Most industries share a common baseline: multifactor authentication, patching exposed systems, backups you have tested, an asset inventory, least privilege and an incident plan. Sector specific rules then sit on top. CISA's Cross-Sector Cybersecurity Performance Goals are a practical starting list for organizations of any size.
Why a shared baseline works
Attackers do not care which industry you are in. They use techniques that work against whoever left them open. CISA describes the Cross-Sector Cybersecurity Performance Goals 2.0 as "a baseline set of cybersecurity practices broadly applicable across critical infrastructure with known risk-reduction value". They are voluntary, and aimed at helping small and medium sized organizations "prioritize investment in a limited number of essential actions".
The goals follow NIST CSF 2.0's functions and now include Govern, with goals on cybersecurity oversight, managed service provider risk, least privilege and incident communication. CISA also says information technology and operational technology goals were merged into shared goals, so an organization with both can use one list.
What is in the baseline?
Expressed as habits rather than control numbers:
- Know your assets. You cannot protect or patch what you cannot list.
- Control access. Multifactor authentication, least privilege and removal of accounts when people leave.
- Patch by exposure. Internet facing systems first, and known exploited issues first.
- Back up and test the restore.
- Log and review the events that matter.
- Manage suppliers, especially those with administrator access.
- Plan for incidents, including who communicates with customers and regulators.
- Give someone ownership, with reporting to leadership.
What changes by sector?
The overlay depends on what you protect and who regulates you.
Healthcare organizations have patient data rules and medical devices that are hard to patch. NIST SP 800-66 Rev. 2 explains how the HIPAA Security Rule's focus on protecting electronic protected health information maps to practical safeguards, and the HHS 405(d) program publishes Health Industry Cybersecurity Practices for the sector.
Financial firms face supervisor rules, payment network requirements and heavy third party reliance. Check your regulator's current text, since details differ by country.
Software companies face customer security questionnaires and supply chain expectations. CISA's Secure by Design guidance addresses software manufacturers directly.
Industrial and utility operators add operational technology, where availability and safety limit patching windows.
The pattern holds: baseline first, then the sector overlay, then your own risk assessment.
What mistakes cross industries?
Buying tools before knowing the asset list. Treating a compliance certificate as a security result. Letting exceptions live forever. Reporting activity counts, such as scans run, rather than outcomes, such as time to fix exploited issues.
A constructed example
A small manufacturer with a back office and a plant network has three people in IT. Using the cross sector goals, it picks eight actions: multifactor authentication for email and remote access, an asset list covering plant equipment, a weekly check of known exploited vulnerabilities against that list, offline backups tested quarterly, vendor remote access through one controlled channel, a one page incident plan, a named executive owner, and a short yearly exercise. Industry rules come second, once the baseline exists.
How to check or apply this
- Read the CISA performance goals and mark each as done, partial or missing.
- Fix the missing items that cover exposed systems and privileged access first.
- Find your sector's guidance and regulator rules, and add them as extra rows.
- Assign each row an owner and a date.
- Report outcomes to leadership every quarter.
Safeguard's compliance automation maps technical evidence to many frameworks, and dependency scanning covers the software inventory.
Quick check
Are CISA's performance goals mandatory?
No. CISA describes them as voluntary. They are a prioritized baseline, not a regulation.
Do small organizations need all of it?
The goals are designed so smaller organizations can start with a limited set of high impact actions and grow from there.
Sources
- CISA Cross-Sector Cybersecurity Performance Goals
- NIST SP 800-66 Rev. 2
- HHS 405(d) program
- CISA Secure by Design
Last reviewed: 18 October 2026.
