OneClickComply
    Book a demo
    CISA Cross-Sector Cybersecurity Performance GoalsSupported in OneClickComply

    Put the CISA CPGs into practice and prove your security baseline

    1 in March 2023. The 38 goals cover IT and operational technology, are grouped by the NIST Cybersecurity Framework functions, and each describes the outcome, the threat it reduces and a recommended action.

    See the CISA CPGs requirements
    CISA CPGs mapped
    Automated evidence
    Continuous monitoring
    Who needs CISA CPGs

    Is CISA CPGs right for your organisation?

    The CPGs are written for owners and operators of US critical infrastructure, especially small and medium organisations that need a prioritised starting point. They are not mandatory, but sector regulators, customers and insurers use them as a benchmark, and they are a sensible baseline for any supplier selling into US critical infrastructure.

    Adopting it is voluntary, though customers and auditors often expect it.

    How we help

    How OneClickComply helps with CISA CPGs

    The CISA CPGs are supported in OneClickComply today, and each goal links to controls you may already meet for ISO 27001, SOC 2 or NIST CSF. Automated evidence collection and continuous monitoring then show progress on goals such as MFA, log collection, backups and default passwords, with OneClickFix correcting supported misconfigurations.

    Requirements covered

    38 goals (1.A to 5.A) grouped under five NIST CSF functions: Identify (9 goals), Protect (24), Detect (1), Respond (3) and Recover (1).

    Why automate

    Manual CISA CPGs compliance vs OneClickComply

    Doing it manually

    • Working through 38 goals in a spreadsheet with no link to your systems
    • Screenshotting admin consoles to show MFA and logging are in place
    • Re-assessing the same controls separately for CPGs, ISO 27001 and SOC 2
    • Finding out about a disabled control only at the next self-assessment
    • Chasing suppliers by email for incident and vulnerability disclosure terms

    With OneClickComply

    • Each goal tracked against live controls in one dashboard
    • Evidence pulled automatically from cloud, identity and device tools
    • Evidence collected once counts towards every mapped framework
    • Alerts as soon as a control drifts, with one-click fixes where supported
    • Supplier security requirements tracked in vendor risk management
    Capabilities

    Everything you need for CISA CPGs

    • Every CPG goal mapped to controls you already run for other frameworks

    • Automated evidence for MFA, password, logging and backup goals

    • OneClickFix for supported misconfigurations such as missing MFA

    • Continuous monitoring with alerts when a goal's controls drift

    • AutoComplete policies for incident response, asset and access management

    • Vendor risk management for the CPG supply chain goals

    How it works

    Three steps to CISA CPGs compliance

    1. Connect and scan

      Connect your cloud, identity and SaaS tools. OneClickComply checks them against CISA CPGs and shows which controls pass and which fail.

    2. Fix and generate

      OneClickFix fixes supported misconfigurations automatically, and AutoComplete drafts CISA CPGs policies from your real environment.

    3. Monitor and evidence

      Continuous monitoring flags drift as it happens, and our in-house audit team is on hand when you need expert guidance.

    See how far your current setup is from CISA CPGs.

    Requirements

    CISA Cross-Sector Cybersecurity Performance Goals requirements

    All 38 goals of the 2022 CPGs (version 1.0.1), numbered by NIST CSF function: 1 Identify, 2 Protect, 3 Detect, 4 Respond, 5 Recover.

    ReferenceRequirement
    1.AAsset Inventory
    1.BOrganizational Cybersecurity Leadership
    1.COT Cybersecurity Leadership
    1.DImproving IT and OT Cybersecurity Relationships
    1.EMitigating Known Vulnerabilities
    1.FThird-Party Validation of Cybersecurity Control Effectiveness
    1.GSupply Chain Incident Reporting
    1.HSupply Chain Vulnerability Disclosure
    1.IVendor/Supplier Cybersecurity Requirements
    2.AChanging Default Passwords
    2.BMinimum Password Strength
    2.CUnique Credentials
    2.DRevoking Credentials of Departing Employees
    2.ESeparating User and Privileged Accounts
    2.FNetwork Segmentation
    2.GDetection of Unsuccessful (Automated) Login Attempts
    2.HPhishing-Resistant Multifactor Authentication (MFA)
    2.IBasic Cybersecurity Training
    2.JOT Cybersecurity Training
    2.KStrong and Agile Encryption

    Always check the official text of CISA CPGs for the exact wording.

    FAQs

    CISA CPGs questions, answered

    Can't find what you need? Our in-house auditors can talk you through CISA CPGs on a 30-minute call.

    What are the CISA CPGs?

    The CISA Cross-Sector Cybersecurity Performance Goals are a voluntary baseline of cyber security practices for critical infrastructure, published by the US Cybersecurity and Infrastructure Security Agency in October 2022. The 2022 edition, updated to version 1.0.1 in March 2023, contains 38 goals covering IT and operational technology, each with a recommended action, the risk it addresses and an indication of cost, impact and complexity.

    Are the CISA CPGs mandatory?

    No. The CPGs are voluntary guidance, not a law or regulation, and there are no penalties for not following them. CISA intends them as a common baseline that organisations, sector regulators and customers can use to prioritise investment. Some sector agencies and contracts reference them, so check whether your regulator or customers expect you to report against them.

    Who should adopt the CISA CPGs?

    The CPGs are aimed at owners and operators of US critical infrastructure, such as energy, water, healthcare, communications and manufacturing, and they are designed to be achievable for small and medium organisations. Suppliers and managed service providers to those sectors also adopt them, because several goals cover vendor security requirements, incident reporting and vulnerability disclosure in the supply chain.

    How are the CPGs structured?

    The 2022 CPGs contain 38 goals numbered 1.A to 5.A and grouped under five NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond and Recover. Each goal states the security outcome, the threat actor techniques it mitigates, a recommended action and its relative cost, impact and complexity. CISA also publishes a checklist for organisations to self-assess progress.

    Is there a newer version of the CISA CPGs?

    Yes. CISA released CPG 2.0 in December 2025, aligned with NIST Cybersecurity Framework 2.0 and adding a governance function with goals on leadership oversight. The numbering changed, so mappings to the 2022 goals do not carry over directly. This page covers the 2022 edition (version 1.0.1); organisations starting now should check CISA's site for the current version.

    How do the CPGs relate to NIST CSF and ISO 27001?

    The CPGs are a prioritised subset of practices drawn largely from the NIST Cybersecurity Framework and organised by its functions. They are far narrower than ISO 27001, which requires a full information security management system and offers certification. Most CPG goals, such as MFA, backups, logging and asset inventory, overlap with ISO 27001 Annex A controls, so work done for one supports the other.

    How do you comply with the CISA CPGs?

    Start by self-assessing each of the 38 goals using CISA's CPG checklist, then prioritise gaps by the cost, impact and complexity ratings CISA provides. Implement the recommended actions, keep evidence that each control is working, and reassess regularly. There is no certification or audit body for the CPGs, so the outcome is an evidenced self-assessment you can share with regulators or customers.

    Does OneClickComply support the CISA CPGs?

    Yes. The CISA CPGs are supported in OneClickComply today. Each goal links to controls shared with frameworks such as ISO 27001, SOC 2 and NIST CSF, so automated evidence and continuous monitoring count towards the CPGs as well. OneClickFix corrects supported misconfigurations, and our in-house audit team can help you prioritise the goals that matter most for your organisation.

    Start working towards CISA CPGs

    Automate controls, gather evidence continuously and stay audit-ready, all on one platform.