Skip to main content

CISA updates cybersecurity performance goals with governance component

Source Decision Insights Threat Desk Published December 11, 2025 Companies 3
Human View Machine View

3 companies named across 8 categories, one of 495 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues 12 advisories on industrial control systems (Dec 2025).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
How to start
Adoption curve
Early Majority
Industry
Government / Federal / Civilian

Our classification, not the publisher's statement. Best suited for, not only for.

CISA published Cross-Sector Cybersecurity Performance Goals (CPG 2.0), a set of measurable actions intended for critical infrastructure owners and operators and applicable to information technology and Operational technology (OT) environments to establish a foundational level of cybersecurity.

The update incorporates lessons learned and aligns with the most recent National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) (NIST Causal Simulation Framework (CSF)) revisions; it adds a new component focused on governance and identifies governance as essential to managing cybersecurity, emphasizing accountability, risk management, and strategic integration of cybersecurity into day-to-day operations. CPGs are described as streamlined, outcome-driven protections for IT and OT environments.

CPG 2.0 is presented as addressing the most common and impactful threats facing critical infrastructure today, reinforcing the principle that effective governance is the cornerstone of a resilient cyber posture. The guidance also specifies a baseline intended to guide investment, benchmark progress, and reduce risk in measurable ways.

The document is published as an update to the Cross-Sector Cybersecurity Performance Goals and is titled CPG 2.0; for more information, consult CISA's CPG 2.0 and Cross-Sector Cybersecurity Performance Goals pages.

The guidance characterizes the CPGs as providing clear, foundational practices aligned with real-world threats, using straightforward, outcome-oriented language to aid implementation, and supplying criteria to guide investment decisions and measure progress toward reducing risk.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-updates-cybersecurity-performance-goals-with-governance-component/",
        "name": "CISA updates cybersecurity performance goals with governance component",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-updates-cybersecurity-performance-goals-with-governance-component/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
      "name": "Department of Homeland Security"
    },
    "articleSection": [
      "Cybersecurity",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Government / Federal / Civilian"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-27T10:32:16-06:00",
    "datePublished": "2025-12-11T14:25:10-07:00",
    "description": "CISA releases CPG 2.0, aligning goals with NIST CSF revisions and adding a governance component for IT and OT.",
    "headline": "CISA updates cybersecurity performance goals with governance component",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/alerts/2025/12/11/cybersecurity-performance-goals-20-critical-infrastructure"
    },
    "keywords": [
      "Causal Simulation Framework",
      "Critical Infrastructure",
      "Investment",
      "IT Governance",
      "Operational technology",
      "Threats"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-updates-cybersecurity-performance-goals-with-governance-component/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-27",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      {
        "@id": "https://decisioninsights.ai/registry/united-states-department-of-commerce/national-institute-of-standards-and-technology-nist/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/united-states-department-of-commerce/national-institute-of-standards-and-technology-nist/",
        "name": "National Institute of Standards and Technology (NIST)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages