CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
Device Security

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 CPG-2.B: Prohibit Connection of Unauthorized Devices

Prevent unauthorized devices from connecting to the network using NAC, 802.1X, port security, or equivalent.

What else in your programme already covers this

This control maps to 50 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27043 · 3 controls

ISO/SAE 21434 · 3 controls

NIST SP 800-61 · 3 controls

  • NISTSP61-1 Incident Response Policy, Plan, and Procedures
  • NISTSP61-3 Preparation: Communications, Toolkits, Training, Exercises, Threat Intelligence
  • NISTSP61-4 Detection and Analysis: Sources, Triage, Categorisation, Prioritisation

MITRE ATT&CK · 2 controls

MITRE D3FEND · 2 controls

NIST SP 800-88 · 2 controls

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework
  • NISTSP88-5 Media Inventory, Tracking, Chain of Custody, and Sanitization Records

NIST SP 800-92 · 2 controls

  • NISTSP92-2 Log Generation: OS, Application, Security Tools, Network, Cloud, Required Event Content
  • NISTSP92-7 Privacy in Logs, Sensitive Content Handling, Cloud and SaaS Log Considerations

OWASP SAMM · 2 controls

  • OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture
  • OWASPSAMM-5 Operations: Incident Management, Environment Management, Operational Management

SIG (Shared Assessments) · 2 controls

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems · 1 control

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 38500:2024 - Governance of IT · 1 control

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-6 Access Control, Asset Management, and Physical Security

NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) · 1 control

  • NISTSP115-8 Operational Considerations - Tools, Reporting Templates, ISMS Integration, Annex Material

NIST SP 800-123 · 1 control

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-137 · 1 control

  • NISTSP137-1 ISCM Strategy, Governance, and Volatility Assessment

NIST SP 800-63-4 · 1 control

  • NISTSP63R4-7 Privacy, Records Retention, and User-Controlled Wallets

NSA Guidance for Transition to Quantum-Resistant Cryptography · 1 control

OWASP MASVS · 1 control

OpenSSF Scorecard · 1 control

  • OSSFSC-2 Dependency Management, Pinning, Updates, Vulnerability Tracking

PTES · 1 control

SLSA · 1 control

  • SUPCHAIN-1 Build Integrity - Source, Build, Provenance

Sigstore - Software Artifact Signing and Verification · 1 control

  • SIGSTORE-2 Transparency Log (Rekor) and Verification

TISAX - Trusted Information Security Assessment Exchange · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Device Security

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 controls