Zero-cost Tools and Services for CISA CPG Third-party Validations

The Cybersecurity Performance Goals (CPGs) from the Cybersecurity and Infrastructure Security Agency (CISA) were designed to help establish a common set of fundamental cybersecurity practices for public and private sector critical infrastructure in the United States.

The CPGs are organized into five focus areas (Identify, Protect, Detect, Respond, and Recover) with all CPGs listed as subsections inside one of the five areas.

CISA recommends taking advantage of third-party validation options to help identify cybersecurity gaps. Many of these options are available for no cost through CISA itself or through U.S companies.

Below you’ll find information some zero-cost, third-party validation options mapped to the relevant CPG as numbered by CISA.

See this link for the full list of CPGs from CISA.

 

IDENTIFY: CPG #1.E Mitigating Known Vulnerabilities

• CISA: Cyber Hygiene Services
• Trinsio: Threat Assessment – Active Defense with real-time Threat Intelligence
• RITA: Real Intelligence Threat Analytics open-source framework
• Trinsio: Nessus Vulnerability Scan

 

IDENTIFY: CPG #1.F Third-Party Validation of Cybersecurity Control Effectiveness

• Trinsio: Nessus Vulnerability Scan
• Suricata: open source network analysis and threat detection
• Trinsio: Threat Assessment – Active Defense with real-time Threat Intelligence

 

PROTECT: CPG #2.B Minimum Password Strength & #2.C Unique Credentials

• Secureworks: O365Spray
• OpenWall: John the Ripper

 

PROTECT: CPG #2.P Document Network Topology

• SolarWinds: Network Topology Mapper
• Trinsio: Network Topology Map

 

PROTECT: CPG #2.R System Backups

• Windows Auto-Backup
• Trinsio: Baseline Backup and Disaster Recovery Plans

 

PROTECT: CPG #2.S Incident Response Plans

• CISA: Tabletop Exercise Packages

 

PROTECT: CPG #2.W No Exploitable Services on the Internet

• CISA: Stuff Off Search
• CISA: Cyber Hygiene Services

 

DETECT: CPG #3.A Detecting Relevant Threats and TTPs (Tactics, Techniques, and Procedures)

• CISA: Cyber Hygiene Services
• Trinsio: Nessus Vulnerability Scan
• Trinsio: Threat Assessment – Active Defense with real-time Threat Intelligence
• Suricata: open source network analysis and threat detection
• RITA: Real Intelligence Threat Analytics open-source framework
• BinaryEdge: Attack Surface Monitoring

 

RESPOND: CPG #4.A Incident Reporting

• CISA: Incident Reporting System
• CISA: Tabletop Exercise Packages

 

RESPOND: CPG #4.C Deploy Security.txt Files

• https://securitytxt.org

 

RECOVER: 5.A Incident Planning and Preparedness

• CISA: Tabletop Exercise Packages
• Trinsio: Baseline backup and disaster recovery plans
• MITRE: Caldera
• Rapid7: Metaspolit Framework
• Google: GRR Rapid Response
• Rapid7: Velociraptor

 

Ready to Get Started?

With more than 30 years of real-world experience in network, security, cloud, and data center technologies, Trinsio’s team of best-in-class technologists are here to help.

Trinsio offers many complementary services to help you get started as you strive to meet CISA’s guidance on third-party validations for various cybersecurity protections in the CPGs.