Mapping Cross-Sector Cybersecurity Performance Goals (CPGs) to 5 Critical Controls for ICS/OT Cybersecurity
Summary: CISA and NIST partnered to create Cross-Sector Cybersecurity Performance Goals (CPGs) as part of the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems initiatives released in July 2021, offering voluntary baseline practices for small to medium-sized organizations. The article maps these CPGs, which align to the NIST Cybersecurity Framework but do not fully address each CSF subcategory, against the SANS Institute's five critical controls for ICS/OT cybersecurity.
What you should know: The CPGs are voluntary and explicitly do not cover every NIST CSF subcategory, so a small or medium critical infrastructure owner relying on them as a first step is working from a deliberately partial baseline against adversary TTPs observed by CISA and industry partners.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026