CISA CPG 2.0 Formalizes Third-Party Risk for Municipalities

CISA CPG 2.0 makes MSP and other third-party risk an explicit municipal cybersecurity goal, including vendor-renewal verification. CISA's Vulnerability Review and Secure by Design guidance support patch and procurement decisions, while Clarksville's proposed confidentiality rules add unresolved public-records, security-risk classification, and procurement-transparency questions.