CISA Releases Cybersecurity Performance Goals 2.0 for Critical Infrastructure

According to Inside Privacy, on 11 December 2025 the U.S. Cybersecurity and Infrastructure Security Agency released Cybersecurity Performance Goals 2.0 (CPG 2.0), updating its core, voluntary cybersecurity practices for critical infrastructure owners and operators. The CPGs, which apply to both IT and OT environments, are designed to reduce risk from known high‑impact cyber threats and adversarial tactics, techniques, and procedures.

CPG 2.0 aligns with the latest NIST CSF 2.0 revisions and covers the core cyber Functions—Identify, Protect, Detect, Respond, Recover—with the newest Function added in CSF 2.0, Govern. The updates reflect operational data, threat‑landscape research, and collaboration with government, industry groups, and private sector experts, and incorporate lessons learned from the prior version. The framework is intended to help organisations build out a broader cybersecurity programme based on CSF or other similar frameworks and standards.