跳到正文
cccskills
免费在 GitHub 公开

cisa-cpg

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

中文简介正在准备中。当前显示原文说明。

查看安装方法

包含的文件(11)

  • SKILL.md5.7 KB
  • chapters/ch01-cpg-purpose-and-2-0-changes.md3.7 KB
  • chapters/ch02-govern-and-identify-goals.md3.6 KB
  • chapters/ch03-protect-goals.md4.3 KB
  • chapters/ch04-detect-respond-recover-goals.md3.0 KB
  • chapters/ch05-it-ot-implementation-and-prioritization.md4.0 KB
  • cheatsheet.md2.1 KB
  • glossary.md2.3 KB
  • LICENSE1.1 KB
  • PACK.yaml1.6 KB
  • patterns.md2.8 KB

SKILL.md(原文)

安装前可以查看交给 AI 代理的指令内容。

<!-- argument-hint: [topic, function, or chapter number] -->

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

Source: CISA CPG 2.0 (US Government work, public domain) | Chapters: 5

When to use

Reach for this pack when selecting or assessing a prioritized baseline of cybersecurity practices for critical infrastructure IT and OT — especially to align investments to CISA’s highest-yield goals, map goals to CSF 2.0 Functions (including GOVERN), brief executives on foundational hygiene, or plan first-mile controls (identity, segmentation, backups, logging, IR readiness) before a full framework build-out.

Prerequisites: none — plain Markdown; no MCP server, API key, or licence tier needed at runtime.

How to Use This Skill

  • Without arguments — load the core frameworks below.
  • With a topic — ask about GOVERN/IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER goals, IT vs OT implementation, prioritization, MFA, segmentation, MSP risk, or 2.0 changes.
  • With a chapter — ask for ch01 through ch05.

Supporting files: glossary.md, patterns.md, cheatsheet.md.

Core Frameworks & Mental Models

What CPGs are

A streamlined, outcome-driven baseline of cybersecurity protections for IT and OT environments across U.S. critical infrastructure. They help organizations pick high-impact practices, prioritize scarce resources, and communicate value to senior leaders.

CSF 2.0 alignment

Goals are grouped under six Functions: GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER. Version 2.0 adds GOVERN and renumbers/consolidates prior goals; former OT-only items fold into universal goals for blended environments.

Goal card pattern

Each goal states an outcome plus recommended actions — usable by practitioners and non-technical stakeholders.

Representative goal map (2.0)

FunctionExample goals
GOVERN1.A responsibilities; 1.C IR plans; 1.D supply-chain reporting; 1.E MSP risk
IDENTIFY2.A/B assets; 2.C/D independent validation; 2.E network topology
PROTECT3.A–3.S identity, MFA, segmentation, training, encryption, backups, logging, edge hardening
DETECT4.A malicious code detection; 4.B adverse events
RESPOND5.A communications; 5.B reporting
RECOVER6.A execute recovery plan

Using CPGs

  • Floor, not ceiling: prioritized subset, not complete assurance.
  • Remap any 1.x trackers before claiming 2.0 coverage.
  • Pair short overview materials with the full report when implementing.
  • Sector-specific goals may extend the cross-sector set.

Chapter Index

#SectionKey content
ch01Purpose and 2.0 ChangesWhy CPGs exist; GOVERN addition; consolidations
ch02GOVERN + IDENTIFYAccountability, IR plans, MSP/supply chain, assets, topology
ch03PROTECTIdentity, MFA, segmentation, backups, logging, edge security
ch04DETECT/RESPOND/RECOVERMalware/events, communications/reporting, recovery execution
ch05IT/OT ImplementationPrioritization, OT constraints, investment framing

Topic Index

  • Adverse event identification → ch04
  • Asset inventory → ch02
  • Backups and restoration → ch03, ch04
  • Board / executive communication → ch01, ch05
  • Change management → ch03
  • CPG 2.0 changes from 1.x → ch01
  • Default passwords / credential hygiene → ch03
  • Encryption → ch03
  • GOVERN function → ch01, ch02
  • Incident communications / reporting → ch04
  • Incident response plans → ch02, ch04
  • Independent control validation → ch02
  • Internet-facing device security → ch03
  • IT vs OT implementation → ch05
  • Logging → ch03
  • Malicious code detection → ch04
  • Managed service provider (MSP) risk → ch02
  • MFA → ch03
  • Network segmentation → ch03, ch05
  • Network topology documentation → ch02
  • Prioritization / where to start → ch01, ch05
  • Privileged vs user accounts → ch03
  • Recovery plan execution → ch04
  • Sector-specific goals (SSGs) → ch05
  • Supply chain incident / vulnerability disclosure → ch02
  • Training → ch03

Supporting Files

  • glossary.md — CPG / CSF terms with chapter references
  • patterns.md — implementation patterns (When/How/Trade-offs)
  • cheatsheet.md — decision rules, goal map, tells & smells

Scope & Limits

This pack covers CISA Cross-Sector Cybersecurity Performance Goals Version 2.0 (report dated December 2025 in the extracted source; aligned to NIST CSF 2.0 including GOVERN) as synthesized reference notes. Combined source_pages = 38 (36-page main report + 2-page slick sheet overview). No separate CPG 2.0 “controls-list” PDF was available at build; the main report holds the full goal inventory. Does not cover: full NIST CSF 2.0 catalog; sector-specific goals in depth; CSET product UI; legal interpretation of NSM-5; or organization-specific compliance scoring. US Government public domain work. No source-material download link is published.

评价

还没有评价。欢迎分享你的使用感受。

评论

无需登录即可发表。欢迎分享使用感受、提问,或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

提交后会立即公开。请勿填写邮箱、电话等个人信息。URL 最多 2 个。

0 / 1000 字

此表单受 reCAPTCHA 保护,适用 Google 的隐私权政策和服务条款。

同一仓库的技能

Signpost (not a knowledge pack) for the automotive standards landscape: ISO 26262, ASPICE, SAE J3016, UNECE R155, UNECE R156, and the NHTSA vehicle set. Contains NO source content: designation, edition, owner, status, and an official catalogue URL only. Use when you need to identify or locate an automotive standard. Most are paywalled or carry no redistribution grant and cannot be packaged; the one open path is the nhtsa-vehicle pack.

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

Signpost (not a knowledge pack) for the avionics development assurance standards landscape: RTCA DO-178C / EUROCAE ED-12C and its supplements (DO-330/ED-215, DO-331/ED-218, DO-332/ED-217, DO-333/ED-216); RTCA DO-254 / EUROCAE ED-80; SAE ARP4754B and ARP4761A; and the free regulator documents that recognise them (FAA AC 20-115D, AC 20-152A, Order 8110.49A; EASA AMC 20-115D and AMC 20-152A). Contains no source content: each row carries only the designation, title, edition, owner, redistributability status, and the owner's URL. Use when you need to identify, cite, or locate an avionics standard; paywalled rows point to the owner, free rows point to the regulator text, and the FAA rows also name the in-repo faa-8110-49 pack.

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

Knowledge base from DAFMAN 63-119 (15 April 2021), Mission-Oriented Test Readiness Certification. Use for continuous MOTRC replacing single-point OTRR thinking: framework/applicability, Certification Official vs PM roles, review cycle and exit criteria, certification memo/decertify gates, DT&E/contractor evidence, ITT integration and cyber resiliency, and the 31-template matrix. DAF T&E readiness process only—does not replace DoDI 5000.89, AFI 99-103, or multi-service lead policies.

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to ISO/IEC/IEEE 15288, the event-driven technical reviews and audits across the Major Capability Acquisition life cycle (ASR, SRR, SFR, PDR, CDR, SVR/FCA, PRR, PCA), the Systems Engineering Plan (SEP), risk/issue/opportunity management, TPMs and leading indicators, system-of-systems and digital engineering, and the 24 design considerations (RAM, system safety, HSI, system security engineering, MOSA, supportability, etc.). Acquisition-program oriented: thin on detailed cost estimating, contracting law, and non-DoD or commercial life cycles.

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

Knowledge pack from 'Towards Digital Engineering: The Advent of Digital Systems Engineering' (Huang et al., Old Dominion University, arXiv:2002.11672, 2020). Use when reasoning about digital engineering, the DoD Digital Engineering Strategy and its five goals, the Authoritative Source of Truth, digitalization vs. digitization, digital augmentation, digitalized models, provenance, unique identification, and the four-level (vision/strategy/action/foundation) DSE research framework. Covers the conceptual/vision layer of the field. SCOPE LIMITS: this is a single ~28-page vision paper, not a methods handbook — it is thin on step-by-step procedures, tooling, case studies, and quantitative evaluation, and it predates 2020 so it does not cover later digital-engineering standards or recent AI/LLM advances. Use the sebok pack for established SE canon and MBSE depth.

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

Knowledge base from the DoD Digital Engineering Strategy (2018, OUSD/ODASD(SE)). Use for the Department of Defense's five digital engineering goals — (1) formalize the development, integration, and use of models; (2) provide an enduring authoritative source of truth; (3) incorporate technological innovation; (4) establish supporting infrastructure and environments; (5) transform the culture and workforce — plus their focus areas, the document-to-model and design-build-test→model-analyze-build shifts, model formalisms/provenance, governance and access control of the authoritative source of truth, and the coordinate→plan→pilot→sustain rollout. A vision-and-policy strategy, deliberately non-prescriptive. Does NOT provide a how-to method, tool tutorials, MBSE/SysML mechanics, or implementation-plan content; thin on metrics, acquisition-policy detail, and step-by-step procedure. Excludes the CAC-gated Digital Engineering Body of Knowledge (DEBoK).

中文简介正在准备中。当前显示原文说明。

jgsystemsconsulting/jgs-se-knowledge-packs82026年10月15日 更新

查看 jgsystemsconsulting 的全部技能

报告此技能的问题