New U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGs

This is the second of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.

In part one of this series, we discussed the new priorities included in the FY 2023 State and Local Cybersecurity Grant Program (SLCGP) Notice of Funding Opportunity (NOFO). We reviewed the program objectives and provided an in-depth look at Objective 2, which calls for SLTT agencies to understand their current cybersecurity posture and identify areas for improvement based on continuous testing, evaluation and structured assessments.

Here, in part two, we explore the requirement that applicants adopt key cybersecurity best practices and consult the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is a statutory requirement for receiving grant funding.

As applicants develop their cybersecurity projects for FY 2023 to meet the new objectives, they should also be aware of the enhanced emphasis the 2023 NOFO places on IT and operational technology (OT) convergence.

How do CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) affect SLCGP applicants?

SLCGP applicants are required to adopt key cybersecurity best practices and consult the CISA CPGs throughout their development of plans and projects within the program.

CPGs were introduced as part of the National Security Memorandum (NSM)-5: Improving Cybersecurity for Critical Infrastructure Control Systems. This memorandum calls for a “whole-of-nation” effort to secure critical infrastructure. It requires CISA, in coordination with the National Institute of Standards and Technology’s (NIST) and the interagency community, to develop baseline cybersecurity goals that are consistent across all critical infrastructure sectors.

The CPGs provide a common set of IT and OT fundamental cybersecurity best practices to help SLTT agencies address some of the most common and impactful cyber risks. According to NIST, CPGs are:

• A prioritized subset of cybersecurity best practices
• For IT and OT
• Prioritized for risk reduction
• Informed by threats observed by CISA and its government and industry partners
• Applicable across all critical infrastructure sectors
• Intended to meaningfully reduce risks to both critical infrastructure operations and the American people.

CISA’s CPGs align to the NIST Cybersecurity Framework (CSF) functions: identify; protect; detect; respond; recover

Source: Public Draft: The NIST Cybersecurity Framework 2.0

How Tenable can help SLTT agencies meet CISA CPGs

Tenable is uniquely positioned to help SLTT agencies meet the new requirement to consult CPGs to adopt cybersecurity best practices. Specifically, Tenable can help agencies meet the following CPGs.

• • Identify: Goals within the identify function help agencies manage cybersecurity risk to systems, people, assets, data and capabilities. Core to this function is identifying and managing IT and OT assets, their vulnerabilities, and associated risks, as well as ensuring alignment between IT and OT leadership and security practices so that agencies can focus mitigation efforts and prioritize high-risk vulnerabilities.

• Protect: Goals within the protect function outline safeguards to protect the agency and ensure the delivery of services. Core to this function is understanding how the network can be breached and using that knowledge to limit or contain the impact of a potential cybersecurity event.
• Detect: The detect function builds awareness of the tactics, techniques and procedures employed by adversaries to infiltrate the network. Core to this function is the ability to develop and implement the appropriate activities to identify the occurrence of a cybersecurity event so that swift action can be taken to respond and remediate.

• The Tenable One Exposure Management Platform helps SLTT agencies understand their attack surface and manage the assets, users, systems and vulnerabilities residing on it. Agencies get extensive context into potential security threats, clear metrics to measure cyber risk, the ability to anticipate cyberattacks and comprehensive analytics to prioritize actions and communicate cyber risk.

  For detailed information on how Tenable helps SLTT agencies adopt CPGs, review Meeting CISA’s Cybersecurity Performance Goals with Tenable.

  Learn more

  • Download the white paper: Meeting CISA Cybersecurity Performance Goals
  • Cross-Sector Cybersecurity Performance Goals, March 2023 Update
  • Notice of Funding Opportunity Fiscal Year 2023 State and Local Cybersecurity Grant Program
  • Meeting SLCGP Cybersecurity Plan Requirements with Tenable Technologies