CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) reflect the federal government’s effort to raise the baseline for basic cybersecurity effectiveness. CPG 2.0 breaks away from the idea of a strict framework, instead establishing a strategic, outcome-driven baseline for cybersecurity performance that cuts across industries, operating environments, and organizational maturity levels.

For CISOs, CIOs, and compliance officers, the value of CPG 2.0 lies in its reframing of cybersecurity as a set of measurable performance expectations anchored in governance and risk management.

Read More

There isn’t a country-wide privacy law in the U.S., much to the chagrin of states and American businesses that thrive on clarity. While frameworks like GovRAMP exist, they aren’t enforced by the government and serve more as a blueprint than a law. Now, however, state-level privacy regulation has begun to fill the gap.

With multiple state privacy laws taking effect or expanding at the start of the year, privacy is now an operational, security, and governance issue that directly affects how organizations collect, store, share, and protect data. For many businesses, 2026 marks the year when privacy compliance becomes just another cost of doing business.

Read More

Open-source software is the cornerstone of most IT platforms and infrastructure. This reliance extends beyond major applications; most software worldwide relies, in part, on even the smallest OSS library that solves a critical problem. 

For businesses subject to FedRAMP, CMMC, and other federal jurisdictions, this is a solid way to plan their compliance. As we’re seeing, however, OSS is just as vulnerable as other software (if not more) due to the nature of decentralized development. This has become such an issue that even members of Congress are starting to pay attention.

Read More