CISA Cybersecurity Performance Goals 2.0

This is a free self-assessment aligned to CISA’s Cross-Sector Cybersecurity Performance Goals (CPG) 2.0. The sections on this page are Account Security, Device Security, Data Security, Governance & Training, Vulnerability Management, Incident Response. The questions ask whether MFA is actually enforced, whether email and privileged access are covered, whether backups can be restored, and whether someone owns incident response. It is an educational gap analysis for operators. It is not a CISA assessment, not a grant score, and not a certification.

CISA publishes the goals so organizations without a large security staff can see a practical baseline. SAINT did not write the CPGs. We mapped the themes we get asked about — account security, devices, data, governance and training, vulnerabilities, and response — into questions a clerk, a superintendent, or a city administrator can answer without a control matrix. Control references such as CPG 3.F show up where the question has one. This is a self-assessment aligned to CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 themes. It is not a CISA assessment, certification, or grant determination.

If the organization is a private business and the pressure is a cyber-insurance form rather than a public-sector baseline, start with NIST CSF 2.0 or, for customer financial information, FTC Safeguards. Healthcare practices that need the Security Rule question set should use HIPAA. All five tracks are listed on the assessment hub.

The track is for municipal and local-government operators and the school, utility, and county environments that sit next to them. In Lincoln that means capital-city and Lancaster County municipal or school work, where Hickman is a short drive and same-day on-site is realistic. In the Omaha metro it means suburban cities and districts — Bellevue, Papillion, La Vista, Gretna, Elkhorn — served from the same team, on a scheduled I-80 trip, without an Omaha office and without a doorway page for each town.

SAINT’s public-sector starting point is the SLED hub, then municipal government and education. We work where CJIS-aware or FERPA-aware handling matters and the environment is still small enough for one accountable team. Large state-agency procurement and federal contract vehicles are a different path. We do not invent a GSA schedule on this page, and we do not claim a CISA relationship that awards grants or closes findings.

A city IT contact who is also the person resetting passwords will recognize the questions: MFA on email and remote access, a backup that has been restored, a vendor list, and a phone number for after hours. That is the point. The consulting version of this work — a person walking the environment — is SAINT security assessments and, when the seam is a plant or utility yard, critical infrastructure assessments.

The form is on this page. Answers stay in the browser session until you download a report. There is no account. Plan on 5–8 minutes. “Not sure” is scored as a gap, because a control nobody can confirm is not evidence you can hand a board or an insurer.

Results show an overall score and a tier — At Risk, Developing, Managed, or Optimized — plus which section is thin. The PDF asks for name, email, and company so the confirmation has somewhere to go. A SAINT review of that result is optional and free for 30 minutes. Book it or call 531-625-2111. The desk line is the same number Lincoln and Omaha already use. Suspected compromise is a different line, on the incident page, not this quiz.

What we will not do with the score: tell you the city is “CISA compliant,” write a grant narrative, or replace your existing MSP without looking. If the gaps are identity, email, and endpoints, the operating answer is usually cybersecurity monitoring and managed IT under one Hickman team. Location context stays on the Lincoln hub and the Omaha hub.