New U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGs
2023-10-4 20:50:0 Author: www.tenable.com(查看原文) 阅读量:12 收藏

Adopt Cybersecurity Best Practices Using CISA's CPGs

This is the second of a two-part series exploring how Tenable One can help state, local, tribal and territorial (SLTT) agencies meet the goals and objectives of the SLCGP.

In part one of this series, we discussed the new priorities included in the FY 2023 State and Local Cybersecurity Grant Program (SLCGP) Notice of Funding Opportunity (NOFO). We reviewed the program objectives and provided an in-depth look at Objective 2, which calls for SLTT agencies to understand their current cybersecurity posture and identify areas for improvement based on continuous testing, evaluation and structured assessments.

Here, in part two, we explore the requirement that applicants adopt key cybersecurity best practices and consult the Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is a statutory requirement for receiving grant funding.

As applicants develop their cybersecurity projects for FY 2023 to meet the new objectives, they should also be aware of the enhanced emphasis the 2023 NOFO places on IT and operational technology (OT) convergence.

How do CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) affect SLCGP applicants?

SLCGP applicants are required to adopt key cybersecurity best practices and consult the CISA CPGs throughout their development of plans and projects within the program.

CPGs were introduced as part of the National Security Memorandum (NSM)-5: Improving Cybersecurity for Critical Infrastructure Control Systems. This memorandum calls for a “whole-of-nation” effort to secure critical infrastructure. It requires CISA, in coordination with the National Institute of Standards and Technology’s (NIST) and the interagency community, to develop baseline cybersecurity goals that are consistent across all critical infrastructure sectors.

The CPGs provide a common set of IT and OT fundamental cybersecurity best practices to help SLTT agencies address some of the most common and impactful cyber risks. According to NIST, CPGs are:

  • A prioritized subset of cybersecurity best practices
  • For IT and OT
  • Prioritized for risk reduction
  • Informed by threats observed by CISA and its government and industry partners
  • Applicable across all critical infrastructure sectors
  • Intended to meaningfully reduce risks to both critical infrastructure operations and the American people.

CISA’s CPGs align to the NIST Cybersecurity Framework (CSF) functions: identify; protect; detect; respond; recover

Source: Public Draft: The NIST Cybersecurity Framework 2.0

How Tenable can help SLTT agencies meet CISA CPGs

Tenable is uniquely positioned to help SLTT agencies meet the new requirement to consult CPGs to adopt cybersecurity best practices. Specifically, Tenable can help agencies meet the following CPGs.

    • Identify: Goals within the identify function help agencies manage cybersecurity risk to systems, people, assets, data and capabilities. Core to this function is identifying and managing IT and OT assets, their vulnerabilities, and associated risks, as well as ensuring alignment between IT and OT leadership and security practices so that agencies can focus mitigation efforts and prioritize high-risk vulnerabilities.

Isaac Miguel

Isaac Miguel

In his role as a Sales Engineer with Tenable, Isaac Miguel supports customers throughout the U.S. public sector. Prior to joining Tenable, Isaac worked as a Security Analyst for the State of Washington, helping build and establish vulnerability management programs using Tenable products. Isaac’s role at Tenable allows him to use his firsthand experience working in the public sector to help U.S. government organizations with exposure management.

Gerson Matos

Gerson Matos

Gerson Matos is a Security Engineer specializing in supporting Tenable customers in U.S. state and local governments and higher education. With over 18 years of experience, Gerson is a seasoned cybersecurity professional skilled in architecting and assessing IT and operational technology (OT) infrastructures. Gerson helps Tenable customers gain a deeper understanding of their modern attack surface through the implementation of exposure management

Related Articles

  • Exposure Management
  • Government

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Formerly Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Thank You

Thank you for your interest in Tenable.io. A representative will be in touch soon.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable.io

BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Thank You

Thank you for your interest in Tenable.io. A representative will be in touch soon.

Try Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Formerly Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Thank You

Thank you for your interest in Tenable Lumin. A representative will be in touch soon.

Request a demo of Tenable Security Center

Formerly Tenable.sc

Please fill out this form with your contact information.

A sales representative will contact you shortly to schedule a demo.

* Field is required

Request a demo of Tenable OT Security

Formerly Tenable.ot

Get the Operational Technology Security You Need.

Reduce the Risk You Don’t.

Request a demo of Tenable Identity Exposure

Formerly Tenable.ad

Continuously detect and respond to Active Directory attacks. No agents. No privileges.

On-prem and in the cloud.

Request a Demo of Tenable Cloud Security

Exceptional unified cloud security awaits you!

We’ll show you exactly how Tenable Cloud Security helps you deliver multi-cloud asset discovery, prioritized risk assessments and automated compliance/audit reports.

Thank You

Thank you for your interest in Tenable Cloud Security. A representative will be in touch soon.

See
Tenable One
In Action

Exposure management for the modern attack surface.

See Tenable Attack Surface Management In Action

Formerly Tenable.asm

Know the exposure of every asset on any platform.

Thank You

Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.


文章来源: https://www.tenable.com/blog/new-u-s-slcgp-cybersecurity-plan-requirement-adopt-cybersecurity-best-practices-using-cisas
如有侵权请联系:admin#unsafe.sh