Topic starter
26/08/2026 11:51 am
TL;DR: CISA’s updated Cross-Sector Cybersecurity Performance Goals push critical infrastructure toward phishing-resistant authentication, unique credentials, and stronger third-party access controls, with Yubico framing hardware-backed passkeys and FIDO/WebAuthn as the highest-assurance option. For identity teams, the practical shift is from password-centric assurance to verifiable, device-bound credential governance that reduces credential reuse, phishing exposure, and MSP-driven blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “Raising the security bar for critical infrastructure: Breaking down CISA’s new Cybersecurity Performance Goals 2.0”.
Key questions
Q: What breaks when organisations rely on password vaults for every privileged identity?
A: Password vaults still help, but they break down when the real risk is persistent authorisation rather than secret storage.
Q: Why do unique credentials matter if MFA is already in place?
A: MFA does not solve the accountability problem created by shared, reused, or default credentials.
Q: How should organisations govern third-party identity access more tightly?
A: Treat third-party access as a lifecycle problem, not a procurement checkbox.
Practitioner guidance
- Mandate phishing-resistant MFA for privileged access Apply FIDO/WebAuthn or PKI-based authentication to administrator and remote access paths first, then expand to other high-risk user groups where phishing is a credible entry method.
- Eliminate default and shared credentials Disable default accounts where feasible and assign unique credentials for each user, administrator, and vendor context so accountability and revocation remain specific.
- Extend authentication policy to third parties Require MSPs and other privileged suppliers to use the same authentication strength as internal admins, including device-bound factors for sensitive environments.
Bottom line: CISA CPG 2.0 pushes identity teams toward stronger authentication because phishing-resistant MFA is becoming the practical baseline for high-risk access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishing resistance is now a governance baseline, not an advanced option: CISA’s updated goals make authentication strength part of operational resilience rather than a niche IAM preference. The article is right to centre phishing-resistant MFA because password and OTP workflows leave too much room for relays, replay, and helpdesk-assisted compromise. For practitioners, the governance question is whether the strongest available factor is actually required on the paths that matter most.
A question worth separating out:
Q: What is the difference between synced passkeys and device-bound passkeys?
A: Synced passkeys can move across a user’s devices through a cloud or ecosystem service, which improves convenience and recovery. Device-bound passkeys stay on the original device and usually provide tighter locality and stronger containment. The right choice depends on whether the business values portability more than device isolation and operational control.
👉 Read our full editorial: CISA CPG 2.0 raises the bar for phishing-resistant identity