Cybersecurity Performance Goals, often called CPGs, are voluntary security baselines for healthcare organizations. In the U.S. health sector, HHS uses them to translate broad guidance into practical, prioritized controls drawn from CISA CPGs, HICP, and NIST-aligned practices. They are not a compliance regime; they are a roadmap for the defenses that reduce the most risk first.
CPGs matter because healthcare networks are often constrained by legacy systems, limited staff, and constant uptime demands. The goals help teams focus on high-value protections such as patching, multi-factor authentication, endpoint defense, logging, backups, and incident response planning. In real attacks, these controls can slow ransomware, limit account takeover, and improve recovery after disruption. In defense, they provide a common checklist for hospitals, vendors, and security teams to prioritize work and measure progress.