CISA CPGs for critical-infrastructure operators: the operator's playbook
The 16 critical-infrastructure sectors, the CPG baseline, Shields Up posture, and OT security — a practical guide for operators.
CISA exists for the 16 critical-infrastructure sectors — energy, water, healthcare, transportation, communications, and the rest. The CPGs are your baseline, Shields Up is your posture guidance, and OT security is where most operators are weakest.
The operator's stack
- CPG self-assessment first. It's free, and it tells you where you stand before any consultant does.
- Shields Up posture. CISA's standing guidance for heightened threat periods: MFA everywhere, offline backups, tested incident response.
- OT/ICS security. Separate OT from IT, monitor OT networks passively, and plan for manual operations if systems go down.
- Sector coordination. Your Sector Risk Management Agency and any ISAC/ISAO are force multipliers — join them.
Free help before paid help
CISA's protective security advisors conduct no-cost assessments for critical-infrastructure operators, and Cyber Hygiene scanning is free. Use both, then hire firms — like the critical-infrastructure firms in our directory — for remediation and program build-out.
Take the readiness quiz for a 2-minute read on your posture.
Get quotes from firms that do this work
Matched to your sector and scope — free, 2 minutes.
How it works: tell us once (4 questions, 2 min) → we match licensed auditors to your size and scope → they send scoped quotes directly. Free, no obligation.