As part of the Enduring Security Framework (ESF), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) has released Identity and Access Management Recommended Best Practices Guide for Administrators. These recommended best practices provide system administrators with actionable recommendations to better secure their systems from threats to Identity and Access Management (IAM).
IAM—a framework of business processes, policies, and technologies that facilitate the management of digital identities—ensures that users only gain access to data when they have the appropriate credentials. This paper provides recommended best practices and mitigations to counter threats to IAM related to:
identity governance
environmental hardening
identity federation/single sign-on
multifactor authentication
IAM auditing and monitoring
This guidance was developed and published by a CISA- and NSA-led working panel with ESF, a public-private cross-sector partnership that aims to address risks that threaten critical infrastructure and national security systems.
 

CISA released eight Industrial Control Systems (ICS) advisories on March 21, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. 
ICSA-23-080-01 Keysight N6854A Geolocation Server and N6841A RF Sensor
ICSA-23-080-02 Delta Electronics InfraSuite Device Master
ICSA-23-080-03 Siemens RUGGEDCOM APE1808 Product Family 
ICSA-23-080-04 Siemens RADIUS Client of SIPROTEC 5 Devices
ICSA-23-080-05 VISAM VBASE Automation Base
ICSA-23-080-06 Rockwell Automation ThinManager
ICSA-23-080-07 Siemens SCALANCE Third-Party
ICSA-21-343-01 Hitachi Energy GMS600, PWC600, and Relion (Update A)
CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations:  
Please share your thoughts. We recently updated our anonymous Product Feedback Survey and we’d welcome your feedback.

Content: Today, we published stakeholder-based updates to the Cybersecurity Performance Goals (CPGs). Originally released last October, the CPGs are voluntary practices that businesses and critical infrastructure owners can take to protect themselves against cyber threats. The CPGs have been reorganized, reordered and renumbered to align closely with NIST CSF functions (Identify, Protect, Detect, Respond, and Recover) to help organizations more easily use the CPGs to prioritize investments as part of a broader cybersecurity program built around the CSF. 
CISA urges stakeholders to review and learn more by visiting Cross-Sector Cybersecurity Performance Goals.