New U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGs
This is the second of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.
In part one of this series, we discussed the new priorities included in the FY 2023 State and Local Cybersecurity Grant Program (SLCGP) Notice of Funding Opportunity (NOFO). We reviewed the program objectives and provided an in-depth look at Objective 2, which calls for SLTT agencies to understand their current cybersecurity posture and identify areas for improvement based on continuous testing, evaluation and structured assessments.
Here, in part two, we explore the requirement that applicants adopt key cybersecurity best practices and consult the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is a statutory requirement for receiving grant funding.
As applicants develop their cybersecurity projects for FY 2023 to meet the new objectives, they should also be aware of the enhanced emphasis the 2023 NOFO places on IT and operational technology (OT) convergence.
How do CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) affect SLCGP applicants?
SLCGP applicants are required to adopt key cybersecurity best practices and consult the CISA CPGs throughout their development of plans and projects within the program.
CPGs were introduced as part of the National Security Memorandum (NSM)-5: Improving Cybersecurity for Critical Infrastructure Control Systems. This memorandum calls for a “whole-of-nation” effort to secure critical infrastructure. It requires CISA, in coordination with the National Institute of Standards and Technology’s (NIST) and the interagency community, to develop baseline cybersecurity goals that are consistent across all critical infrastructure sectors.
The CPGs provide a common set of IT and OT fundamental cybersecurity best practices to help SLTT agencies address some of the most common and impactful cyber risks. According to NIST, CPGs are:
- A prioritized subset of cybersecurity best practices
- For IT and OT
- Prioritized for risk reduction
- Informed by threats observed by CISA and its government and industry partners
- Applicable across all critical infrastructure sectors
- Intended to meaningfully reduce risks to both critical infrastructure operations and the American people.
CISA’s CPGs align to the NIST Cybersecurity Framework (CSF) functions: identify; protect; detect; respond; recover
Source: Public Draft: The NIST Cybersecurity Framework 2.0
How Tenable can help SLTT agencies meet CISA CPGs
Tenable is uniquely positioned to help SLTT agencies meet the new requirement to consult CPGs to adopt cybersecurity best practices. Specifically, Tenable can help agencies meet the following CPGs.
-
- Identify: Goals within the identify function help agencies manage cybersecurity risk to systems, people, assets, data and capabilities. Core to this function is identifying and managing IT and OT assets, their vulnerabilities, and associated risks, as well as ensuring alignment between IT and OT leadership and security practices so that agencies can focus mitigation efforts and prioritize high-risk vulnerabilities.
- Protect: Goals within the protect function outline safeguards to protect the agency and ensure the delivery of services. Core to this function is understanding how the network can be breached and using that knowledge to limit or contain the impact of a potential cybersecurity event.
- Detect: The detect function builds awareness of the tactics, techniques and procedures employed by adversaries to infiltrate the network. Core to this function is the ability to develop and implement the appropriate activities to identify the occurrence of a cybersecurity event so that swift action can be taken to respond and remediate.
-
The Tenable One Exposure Management Platform helps SLTT agencies understand their attack surface and manage the assets, users, systems and vulnerabilities residing on it. Agencies get extensive context into potential security threats, clear metrics to measure cyber risk, the ability to anticipate cyberattacks and comprehensive analytics to prioritize actions and communicate cyber risk.
For detailed information on how Tenable helps SLTT agencies adopt CPGs, review Meeting CISA’s Cybersecurity Performance Goals with Tenable.
Learn more
Related Articles
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
November 22, 2024Don’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against cyberattacks.
Active Directory Under Attack: Five Eyes Guidance Targets Crucial Security Gaps
November 21, 2024A landmark global report from cybersecurity agencies emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the first of our two-part series, we offer five steps you can take today to shore up your AD defenses.
Five Cyber Agencies Sound Alarm About Active Directory Attacks: Beyond the Basics
November 21, 2024A landmark global report emphasizes 17 attack techniques against Microsoft Active Directory and cautions organizations to step up protections. In the second of our two-part series, we take you beyond the basics to highlight three key areas to focus on.
- Exposure Management
- Exposure Management
- Government