CISA Cross-Sector Cybersecurity Performance Goals 2.0: Implications for Financial Institutions

Cybersecurity threats continue to evolve, and regulatory expectations for financial institutions are rising in response. In April 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released Cross-Sector Cybersecurity Performance Goals (CPG) 2.0, an updated set of voluntary, prioritized practices designed to help critical infrastructure sectors, including financial services, strengthen their cyber resilience. This article provides a focused overview of CPG 2.0, highlights changes relevant to financial institutions, and addresses upcoming sector-specific developments, all based strictly on the latest official CISA sources.

NETBankAudit experts have over 25 years of experience in cybersecurity audits and regulatory compliance for financial institutions. If you have any questions after reading this guide, please reach out to our team.

What Are the CISA Cross-Sector Cybersecurity Performance Goals?

The CISA CPGs are a set of voluntary, baseline cybersecurity practices intended to reduce the most significant risks to critical infrastructure. The goals are designed to be actionable, measurable, and adaptable for organizations of varying sizes and maturity levels. CPG 2.0 reflects lessons learned from recent cyber incidents, incorporates stakeholder feedback, and aligns with evolving federal guidance, including the National Cybersecurity Strategy and the NIST Cybersecurity Framework 2.0.

According to CISA, the CPGs are not a replacement for regulatory requirements. Instead, they serve as a practical baseline for risk management and incident response planning, helping organizations prioritize investments and demonstrate due diligence. The CPGs are organized into five key functions: Identify, Protect, Detect, Respond, and Recover, mirroring the NIST Cybersecurity Framework structure. Each function contains specific goals and prioritized actions that address the most common and impactful cyber risks.

Key Enhancements in CPG 2.0

CPG 2.0 introduces several important updates:

• Alignment with the latest NIST Cybersecurity Framework 2.0 and the National Cybersecurity Strategy.
• Expanded coverage of emerging threats, including ransomware and supply chain attacks.
• Clearer implementation guidance and performance measurement criteria for each goal.
• Sector-specific considerations, with a focus on upcoming tailored goals for the financial sector.

These enhancements are designed to help organizations address the most pressing cyber risks and improve their overall security posture.

‍

‍

CPG 2.0: Changes and What’s New for Financial Institutions

The 2.0 release of the CPGs reflects a shift toward more actionable, sector-relevant guidance. For financial institutions, this means a greater emphasis on controls that address the unique risks facing the sector, such as ransomware, business email compromise, and supply chain vulnerabilities. CPG 2.0 also introduces clearer performance measurement criteria, enabling organizations to track progress and demonstrate improvement over time.

Alignment with Federal Strategy and NIST CSF 2.0

One of the most significant changes in CPG 2.0 is its alignment with the NIST Cybersecurity Framework 2.0. This ensures that the CPGs are consistent with widely adopted best practices and can be easily integrated into existing risk management programs. The update also supports the National Cybersecurity Strategy’s emphasis on public-private collaboration and shared responsibility for critical infrastructure protection.

Expanded Focus on Ransomware and Supply Chain Security

CPG 2.0 places greater emphasis on defending against ransomware, business email compromise, and supply chain attacks. The goals now include specific controls for:

• Multi-factor authentication (MFA) for all remote and privileged access.
• Regular backup and recovery testing, with offline storage requirements.
• Vendor risk management and software supply chain integrity.
• Incident response planning and tabletop exercises for ransomware scenarios.

These additions reflect the increasing frequency and impact of these attack vectors on the financial sector and other critical industries.

Performance Measurement and Implementation Guidance

CPG 2.0 introduces clearer performance measurement criteria, enabling organizations to track progress and demonstrate improvement over time. The guidance includes:

• Defined metrics for each goal, such as percentage of systems with MFA enabled or frequency of backup testing.
• Implementation tiers to help organizations prioritize based on risk and resource availability.
• Links to technical resources and templates for policy development and control testing.

This approach supports a more structured and evidence-based compliance program, which is increasingly important for regulatory examinations and third-party risk assessments.

Sector-Specific Developments: Financial Institution Industry Goals

While the CPGs are cross-sector by design, CISA has recognized the need for tailored guidance for high-risk industries. The financial sector, given its critical role and unique regulatory environment, is a priority for upcoming sector-specific CPGs.

Upcoming Financial Sector CPGs

CISA has announced that it is working with the Department of the Treasury and industry partners to develop financial sector-specific CPGs. These will address:

• Alignment with financial sector regulatory requirements and expectations.
• Integration with existing frameworks and industry best practices.
• Enhanced controls for payment systems, digital banking, and third-party service providers.

The sector-specific goals are expected to be released in the coming months, providing financial institutions with more granular, actionable guidance that reflects both regulatory expectations and emerging threats. Compliance professionals should monitor CISA’s Cross-Sector Cybersecurity Performance Goals page for updates and release timelines.

Why Sector-Specific Goals Matter

Financial institutions face unique risks due to the nature of their operations, regulatory scrutiny, and the criticality of their services. Sector-specific CPGs will help institutions:

• Address threats that are particularly relevant to financial services, such as payment system attacks and third-party risk.
• Demonstrate alignment with both federal and sector-specific regulatory expectations.
• Streamline internal risk assessments and board reporting with clear, measurable goals.

By adopting these goals, financial institutions can strengthen their cyber resilience and better prepare for regulatory examinations and audits.

Practical Steps for Financial Institutions

With the release of CPG 2.0 and the upcoming sector-specific goals, financial institutions should take proactive steps to align their cybersecurity programs with these evolving expectations. The following actions can help compliance teams prepare:

1. Review and Map Existing Controls to CPG 2.0

Start by reviewing your current cybersecurity controls and mapping them to the updated CPGs. Identify any gaps, particularly in areas such as MFA, backup testing, and supply chain risk management. Use the performance measurement criteria in CPG 2.0 to set internal benchmarks and track progress.

2. Prepare for Sector-Specific Guidance

Monitor CISA and Treasury communications for the release of financial sector CPGs. Engage with industry groups and regulatory agencies to understand how the new goals will impact your compliance program. Consider participating in industry working groups or pilot programs to stay ahead of the curve.

3. Enhance Incident Response and Resilience

Given the increased focus on ransomware and operational resilience, review your incident response plans and conduct regular tabletop exercises. Ensure that backup and recovery processes are tested and that critical data is stored offline where possible. Document lessons learned and update policies accordingly.

4. Strengthen Vendor and Supply Chain Risk Management

Assess your third-party risk management program in light of the new CPG requirements. Ensure that vendors are subject to appropriate due diligence, contract requirements, and ongoing monitoring. Pay particular attention to software supply chain risks and require vendors to adhere to recognized security standards.

5. Leverage CISA Resources

Utilize resources such as the CISA CPG 2.0 documentation to benchmark your program and prepare for regulatory reviews. These tools provide practical checklists, templates, and self-assessment guides that can streamline compliance efforts.

How CPG 2.0 Supports Regulatory Compliance

For financial institutions, regulatory compliance is a continuous process that requires alignment with multiple frameworks and standards. CPG 2.0 is designed to complement, not replace, existing requirements. By adopting the CPGs, institutions can:

• Demonstrate proactive risk management to regulators and examiners.
• Streamline internal audits and board reporting with clear, measurable goals.
• Reduce the likelihood and impact of cyber incidents through prioritized controls.

Compliance professionals should document how CPG-aligned controls map to regulatory requirements and be prepared to discuss these efforts during examinations and audits.

Looking Ahead: Preparing for Sector-Specific CPGs

The upcoming release of financial sector-specific CPGs represents a significant opportunity for institutions to further strengthen their cybersecurity posture. These goals will provide more detailed guidance on topics such as payment system security, digital banking risks, and third-party oversight. Early adoption and engagement with these goals can position your institution as a leader in cyber resilience and regulatory compliance.

Stay informed by subscribing to CISA’s updates and participating in industry forums. Consider conducting a gap analysis against the draft sector-specific goals once they are available, and update your risk assessments and control frameworks accordingly.

NETBankAudit: Your Partner in Cybersecurity and Compliance

As the regulatory landscape evolves, financial institutions need a trusted partner to navigate new requirements and implement effective cybersecurity controls. NETBankAudit specializes in IT audits, cybersecurity assessments, and regulatory compliance services tailored to the financial sector. Our team leverages industry frameworks, regulatory guidance, and practical experience to deliver actionable insights and measurable improvements.

If your institution is preparing for CPG 2.0 adoption, sector-specific goal implementation, or a regulatory examination, contact NETBankAudit to discuss how our services can support your compliance and risk management objectives.