CISA’s Cybersecurity Performance Goals 2.0: A 2026 Action Plan for Northern Indiana SMBs

Right before the holidays, the Cybersecurity and Infrastructure Security Agency (CISA) quietly released Cybersecurity Performance Goals (CPG) 2.0. The update didn’t grab as many headlines as new ransomware attacks, but it should be on every Northern Indiana business owner’s radar. The CPGs are no longer just for utilities and federal agencies; CISA explicitly says they’re the “practical starting point” for small and medium-sized organizations to achieve a defensible baseline. Translation: if you operate 10 or more systems in South Bend, Elkhart, Mishawaka, Plymouth, or Fort Wayne—and you rely on technology to deliver services—CISA just handed you the yardstick regulators, insurers, and partners will expect you to follow in 2026.

What CISA changed in Version 2.0

The refreshed goals boil down to high-impact actions CISA expects every business to tackle. Highlights include:

• Identity and access maturity: Multifactor authentication (MFA) everywhere, role-based access, and rapid account revocation.
• Asset visibility: Continuous inventories of hardware, software, SaaS, and cloud resources.
• Data and backup protection: Encryption at rest/in transit plus tested, offline-capable backups.
• Secure-by-default infrastructure: Patch management, network segmentation, secure configuration baselines.
• Detection and response: Centralized logging, SIEM/EDR coverage, well-rehearsed incident response plans.
• Resilience and reporting: Clear escalation paths, disaster recovery exercises, and stakeholder notification workflows.

CISA also released a 70-page CPG 2.0 report with maturity tiers, so auditors can benchmark whether you’ve moved beyond “initial” toward “advanced.” That means more third parties will ask, “Show me your CPG score.”

Why Northern Indiana businesses should care

Local manufacturers, professional services firms, and healthcare practices are all part of the cross-sector ecosystem. You may already field questionnaires from customers in Chicago or Detroit about cyber readiness. CPG 2.0 gives those customers an easy checklist to demand from their vendors—including you. We’re already seeing Elkhart RV suppliers and South Bend professional associations ask for proof of MFA, backup testing, and incident playbooks before renewing contracts. Insurers are also aligning premium discounts with CPG-style controls.

A five-step CPG 2.0 game plan for 10+ endpoint SMBs

1. Benchmark where you stand. Map your current tools and policies to the 37 cross-sector goals. Flag red/yellow items: MFA gaps, missing asset inventory, unlabeled data, untested backups.
2. Prioritize high-impact fixes. CISA emphasizes “limited essential actions with outsized security impact.” For most SMBs, that means:
   • Universal MFA (VPN, Microsoft 365, remote support, admin portals)
   • Endpoint detection and response (EDR) with centralized logging
   • Quarterly patch and configuration cadence with proof
   • Immutable/offline backups and failover testing
3. Update governance. Document who owns security (internal champion or vCISO), how incidents escalate, and how you’ll report to regulators/customers. CPG 2.0 stresses leadership accountability.
4. Calibrate vendors. Maintain a living inventory of IT and OT suppliers, enforce least-privilege access, and bake CPG language into contracts (especially for co-managed IT, specialty line-of-business apps, and OT integrators).
5. Measure and repeat. Schedule semiannual CPG reviews, track metrics (MFA coverage, backup success, patch SLA, mean time to detect/respond), and feed improvements into budgets.

Local examples of CPG wins

• Manufacturing (Elkhart/Goshen): Implemented zero-trust remote access for plant floor PLCs, cutting vendor VPN exposure while meeting CPG identity goals.
• Healthcare & behavioral health (South Bend/Plymouth): Consolidated SaaS logins into Entra ID + conditional access, satisfying both HIPAA and CPG authentication requirements.
• Construction/environmental services (Michiana): Adopted immutable backups plus quarterly tabletop exercises, which closed cyber insurance questionnaires referencing CPG data protection goals.

How LecsIT maps CPG 2.0 to real outcomes

LecsIT already embeds the CPG framework into our managed IT and vCISO offerings:

• Rapid assessment: 2-week engagement to score your environment against each CPG category and deliver a prioritized roadmap.
• Implementation sprints: MFA rollout, EDR/XDR deployment, backup hardening, and logging pipelines tuned for manufacturing, healthcare, and professional services networks.
• Continuous monitoring: 24/7 SOC, playbooks aligned with CPG detection/response goals, and executive dashboards that double as evidence for insurers or auditors.
• Quarterly governance: Leadership briefings that document progress, budgets, and exceptions—exactly what regulators expect to see.

Need to prove you’re aligned with CISA’s 2026 expectations? Let’s schedule a CPG 2.0 readiness session and turn the federal checklist into a manageable project plan for your Northern Indiana business.