EdLaw
CISA Cross-Sector Cybersecurity Performance Goals (CPG)
Voluntary baseline cybersecurity practices published by the US Cybersecurity and Infrastructure Security Agency (cisa.gov/cross-sector-cybersecurity-performance-goals). Per CISA, "a baseline set of cybersecurity practices broadly applicable across critical infrastructure with known risk-reduction value", intended to "help small- and medium-sized organizations kickstart their cybersecurity efforts by prioritizing investment in a limited number of essential actions". The current CPG 2.0 is aligned to the NIST CSF 2.0 functions, including the Govern function; CISA also publishes sector-specific goals. The current version is set out in the CPG 2.0 Report, whose cover reads "Version 2.0" and "December 2025" and whose CISA resource page gives "Revision Date December 11, 2025" (cisa.gov, CPG 2.0 Report, read 2026-10-08).
Applicability to EdTech
Cited in US K-12 cybersecurity guidance (e.g. the CDT K-12 legal-requirements brief) as the practical checklist behind "reasonable security" expectations: MFA, minimum password strength, separating user and privileged accounts, log retention, TLS, incident reporting. Useful as the concrete control vocabulary when answering district security questionnaires that don't name a framework.
Contents
README-level only; the goals checklist can be added as a fact document from CISA's published materials if RFI usage warrants it.
Licence
The corpus reproduces no CISA text: this README describes the Cross-Sector Cybersecurity Performance Goals and links them. The goals are published by the Cybersecurity and Infrastructure Security Agency, so any later extraction would also be a work of the United States Government. 17 U.S.C. § 105(a) (govinfo, United States Code 2024 edition, title 17 § 105, read 2026-10-01) provides: "Copyright protection under this title is not available for any work of the United States Government, but the United States Government is not precluded from receiving and holding copyrights transferred to it by assignment, bequest, or otherwise."
The Government Publishing Office's Public Domain & Copyright Notice (govinfo.gov/about/policies, read 2026-10-01) adds: "By virtue of the foregoing, public documents can generally be reprinted without legal restriction. However, Government publications may contain copyrighted material which was used with permission of the copyright owner." It also says that "whenever a work is published consisting predominantly of work of the U.S. Government, the copyright notice (if any) must identify those parts of the work in which copyright is claimed per 17 U.S.C. § 403."
Conditions: none attach to federal text. The one formal point is § 403: if the public pages ever carry a copyright notice, it must identify the parts in which copyright is claimed (the corpus's own curation) and not cover the reproduced federal text. Nothing is reproduced, so nothing is owed now; the corpus names the source in its Sources section.
Related
- NIST CSF — the framework the CPGs are aligned to