Does CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 cover Kids Online Safety Act (KOSA)?

38% of Kids Online Safety Act (KOSA) you already have

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 already covers about 38% of Kids Online Safety Act (KOSA), leaving 5 of 8 controls as genuinely new work.

Already covered 0 Likely covered 3 New work 5

No control in CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 maps directly to one in Kids Online Safety Act (KOSA). Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 reaches these. This is the list to scope.

KOSA-Age-Verification-Inference-Section2-Knowledge-Standard-Reasonable-Steps-Age-Inference-Methods-Privacy-Preserving

KOSA Age Verification + Inference + Section 2 Knowledge Standard + Reasonable Steps + Age Inference Methods + Privacy-Preserving + Cohort Estimation + Facial Age Estimation + ID-Ba

KOSA-Default-Safeguards-Minors-Section4-Strong-Privacy-Time-Limits-Content-Filters-Restricted-Contact-Geographic-Location

KOSA Default Safeguards for Minors + Section 4 + Strong Privacy Settings + Time Management + Content Filtering + Restricted Contact + Geographic Location Default Off + Personalized

KOSA-Duty-of-Care-Section3-Covered-Platforms-Mental-Health-Substance-Use-Suicide-Eating-Disorders-Sexual-Exploitation

KOSA Duty of Care + Section 3 + Covered Platforms + Mental Health + Substance Use + Suicide + Eating Disorders + Sexual Exploitation + Online Bullying + Physical Violence + Predato

KOSA-Enforcement-FTC-Section10-State-AG-Sole-Civil-Penalty-43792-Per-Violation-No-Private-Right-of-Action

KOSA Enforcement + Section 10 + FTC Sole Federal Authority + State AG Concurrent + NO Private Right of Action + Civil Penalty up to USD 43,792 Per Violation + Injunctive Relief + S

KOSA-Independent-Audit-Section8-Annual-Third-Party-FTC-Approved-Auditor-Compliance-Verification-Public-Summary

KOSA Independent Audit + Section 8 + Annual + Third-Party + FTC-Approved Auditor + Compliance Verification + Public Summary + Multi-Layer Audit + Risk Assessment Verification + Saf

Show the 3 you already have

KOSA-Parental-Tools-Section5-Notification-Control-Account-Privacy-Time-Spending-Limits-Minor-Account-Identification

KOSA Parental Tools + Section 5 + Notification + Control + Account Privacy + Time + Spending Limits + Minor Account Identification + Parental Override + Confirmation + Linked Accou

KOSA-Researcher-Access-Section7-Qualified-Researchers-Public-Interest-Research-Approval-Process-Data-Sharing-Protections

KOSA Researcher Access + Section 7 + Qualified Researchers + Public Interest Research + Approval Process + Data Sharing + Privacy Protections + Methodology Standards + Public Repor

KOSA-Transparency-Reporting-Section6-Annual-Disclosure-Risk-Assessment-Independent-Audit-Researcher-Access-Public-Report

KOSA Transparency Reporting + Section 6 + Annual Public Disclosure + Risk Assessment Findings + Independent Audit Results + Researcher Access Reports + Public Report + Reporting Me

How this is calculated

Already covered means a mapping runs from a control in CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition