What category of goals this is
The official title is Cross-Sector Cybersecurity Performance Goals (CPGs). These CISA goals are a voluntary subset of cybersecurity practices. CISA states that the goals were selected with industry, government, and expert consultation. The aim is to meaningfully reduce risks to critical infrastructure operations and to the public. The goals are aimed especially at small- and medium-sized organizations. They help those organizations prioritize a limited number of essential, high-impact actions.
The hub states four intended roles for the goals. They are a baseline set of practices with known risk-reduction value. They are a benchmark to measure and improve maturity. They are recommended practices for information technology (IT) and operational technology (OT) owners. They are also practices that consider aggregate national risk, not only risk to a single organization. That is a prioritized set for a first step. It is not a comprehensive control encyclopedia.
Edition covered
The current version is Cross-Sector CPGs version 2.0 (CPG 2.0). The CISA news release is dated 11 December 2025. The CPG 2.0 Report resource page lists Revision Date December 11, 2025. CPG 2.0 builds on the foundation of version 1.0.1. The hub states that the update aligns the goals to NIST Cybersecurity Framework (CSF) 2.0 functions. The update adds emphasis on the GOVERN function.
If a newer version appears, this pin must change. The older claim is then UNKNOWN. The hub also states that a CSET assessment module and an updated checklist were planned for Q1 2026. Whether those tools are live is UNKNOWN.
What voluntary means
The goals are voluntary prioritized practices. They are not a universal legal mandate for public agencies. Adoption of CPGs can be smart risk prioritization. Adoption alone does not prove that a FISMA program is complete. It does not create a certification. It does not replace a sector-specific legal duty.
The CISA news of 11 December 2025 encourages organizations to adopt the voluntary Cross-Sector CPGs. Voluntary is the category. A goal set is not a statute, and it is not an Authorization.
CPG 2.0 themes, not a worksheet
The hub highlights a few themes. Governance and leadership accountability sit under GOVERN. IT and OT goals are consolidated so one shared structure covers both. They are no longer separate silos. Newer goal themes are oversight, managed service provider (MSP) risk, least privilege, and incident communication. The report adds Cost, Impact, and Ease of Implementation ratings to support prioritization.
Sector-specific goals are a different overlay
The hub also describes Sector-Specific Goals that build on the Cross-Sector CPGs. The list of sectors can go stale. Lines that still mark a goal set as not yet released can also go stale. The live inventory is UNKNOWN until the hub is re-opened.
Same-category siblings, other lanes
HHS publishes voluntary healthcare and public-health Cybersecurity Performance Goals. HHS states that they were built off the chassis of the CISA CPGs. They help healthcare organizations prioritize high-impact practices. They are a sibling set. They are not a HIPAA certificate, and they are not the Cross-Sector CPGs.
CISA Protecting Our Future is a set of recommendations for K-12 organizations. The recommendations help them prioritize security investments, recovery, and collaboration. The report encourages near-term progression toward the CISA Cybersecurity Performance Goals. It also encourages longer-term maturity with the NIST Cybersecurity Framework. Use of that report is not a FERPA certificate.
Related tools, different jobs
CSF 2.0 is outcomes language. Alignment to CSF functions, GOVERN among them, does not make CPGs into CSF. It does not make CSF into FISMA. SP 800-53 is a security and privacy control catalog to select and tailor from. SP 800-82 Rev. 3 is OT security guidance. FedRAMP is a federal cloud product Authorization program. None of those is a CPG certificate.
FISMA is the statutory and program backdrop for federal agency information security management. A voluntary goal set is a different category.
Rewrite the one-line claim
The claim "we are CPG and FISMA compliant" mixes two categories. Exact replacement: "We use Cross-Sector CPG 2.0 as voluntary prioritized practices. That use is not the same category as a FISMA program duty."
At work, the team privately asks the risk owner which prioritized goals the organization tracks, if any. It also asks which legal or program lane actually applies.
CPGs are not a mandate, not FISMA, and not a certificate
| Phrase people use | Literacy correction |
|---|---|
| CPGs are federal law, or a FISMA mandate. | CPGs are voluntary CISA goals. FISMA is a different statutory and program lane. Goals are not a universal legal mandate. Explainer: /learn/explainers/fisma/. |
| We follow CPGs, so the plant or agency is certified. | No CPG certificate comes from the PDF alone. A plant Authorization and an agency Authorization to Operate are different objects. |
| CPGs are a FedRAMP Authorization. | FedRAMP is the federal cloud product Authorization program. It is a different object. Explainer: /learn/explainers/fedramp/. |
| CPGs replace CSF, SP 800-53, or SP 800-82. | CSF 2.0 states outcomes. SP 800-53 is a control catalog. SP 800-82 is OT security guidance. They are related tools with different jobs. Cards: /reference/frameworks/nist-csf-2-0/ and /learn/explainers/sp-800-82/. |
| A public agency, hospital, or school is covered because CPGs exist. | Coverage and legal duty questions go to counsel, the privacy officer, or the owner of the Authorization. Goals are not an automatic mandate. HHS healthcare CPGs and Protecting Our Future are sibling guidance, not the Cross-Sector CPGs. |
Common misconceptions
CPGs are a law, or a FISMA substitute.
Cross-Sector CPGs are voluntary CISA goals. FISMA is federal law for agency information security. A goal set is not a mandate.
An organization that follows CPGs is certified or Authorized.
The CPG PDF alone issues no certificate. Following CPGs is not a plant Authorization or an agency Authorization to Operate.
CPGs are only for huge critical infrastructure operators.
CISA frames the goals as a kickstart for small- and medium-sized organizations. CISA also frames them as a baseline for critical infrastructure operators of any size.
HHS healthcare CPGs, or the K-12 Protecting Our Future report, are the Cross-Sector CPGs.
Those are same-category siblings. HHS goals are healthcare prioritized practices built on the CISA chassis. Protecting Our Future is K-12 recommendations. Neither one is Cross-Sector CPG 2.0.
CPG 2.0 keeps separate IT and OT goal lists.
CPG 2.0 consolidates IT and OT goals into one shared structure.
CHECK THE CATEGORY
Which statement describes the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) accurately?
Glossary and nearby pages
- Public sector industry path
- FISMA explainer (statutory program lane, different category)
- SP 800-37 explainer (RMF process, different category)
- SP 800-82 explainer (OT guidance, related)
- FedRAMP explainer (cloud Authorization, different lane)
- NIST CSF 2.0 (outcomes language, related)
- NIST SP 800-53 catalog (related)
- HHS healthcare cybersecurity performance goals (sibling)
- Healthcare industry path (HHS CPG cite)
- CISA Protecting Our Future: cybersecurity for K-12 (sibling)
- Education industry path (Protecting Our Future cite)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.