CSET (Cybersecurity Evaluation Tool) is a free, MIT-licensed tool from the Cybersecurity Infrastructure Security Agency (CISA) and the Idaho National Laboratory (INL) that walks asset owners step by step through collecting facility-specific hardware, software, policy and user-obligation information, compares it against relevant security standards and regulations, and recommends improvements — it is built for critical-infrastructure and industrial control system owners, and for the security professionals who assess them.

What it is

CSET is a free software tool for evaluating the cybersecurity of control systems, meaning the electronic devices that control physical processes and are a crucial element in protecting national infrastructure. CISA and INL develop it with the primary objective of reducing risk to the nation's critical infrastructure. It guides a user step by step through collecting facility-specific information on hardware, software, administrative policies and user obligations, compares that information to relevant security standards and regulations, assesses overall compliance, and provides recommendations for improving cybersecurity posture. Those recommendations are pulled from a collection of the best available cybersecurity standards, guidelines and practices, and where appropriate are linked to a set of actions that enhance cybersecurity controls.

The problem it solves is the lack of a consistent, defensible and documented way to assess an industrial control system (ICS) or IT architecture against the standards that apply to it. CSET supplies a framework for analysing vulnerabilities across an organisation's overall ICS and IT architecture, a consistent and technically sound methodology for identifying, analysing and communicating vulnerabilities and their consequences to security professionals, and the means for a user to document the process by which vulnerabilities were identified. It also suggests methods for evaluating options for improvement based on existing standards and recommended practices. It belongs to the security-audit tooling ecosystem, and it replaces the hand-assembled assessment in which standards are reconciled manually and conclusions are recorded in scattered documents.

Key capabilities

• A guided, step-by-step process that collects facility-specific information on hardware, software, administrative policies and user obligations.
• Comparison of that information against relevant security standards and regulations, with an overall compliance assessment and follow-on recommendations.
• A framework for analysing cybersecurity vulnerabilities across an organisation's overall industrial control system (ICS) and information technology (IT) architecture.
• Recommendations drawn from a collection of cybersecurity standards, guidelines and practices and linked, where appropriate, to actions that enhance controls.
• Standalone local installers and enterprise installation binaries: Windows 10 or higher for local installations, Windows Server 2016 or higher for enterprise.
• A Docker path using "docker compose up -d" for Mac, Linux and Windows, an editable "compose.dev.yml" or "task up:dev" environment, database loading with "task load-bak", and configurable "WEB_PORT", "WEB_TLS_PORT" and "API_PORT" values for the Angular UI, HTTPS and the ASP.NET API.

Who uses it and how

• Asset owners run assessments on Windows laptops or desktop computers, working through the guided collection of facility-specific information.
• Organisations that need multi-user assessment deploy the client-server enterprise configuration on Windows Server 2016 or higher.
• Mac and Linux users run it through Docker Desktop with a minimum of 5 GB of memory allocated.
• Security professionals use the results to identify, analyse and communicate vulnerabilities and their consequences, and to document the process behind each finding.

Getting started

Windows users install from the standalone installers or the enterprise binaries; Mac and Linux users clone the repository, copy ".env.example" to ".env" and run "docker compose up -d", optionally installing Task and loading the database with "task load-bak". Installation options are documented in "install-and-troubleshooting-guides/README.md".

How it compares

CSET stands alone in this registry: no comparable tool is named in the facts provided, and the only organisations identified are the Cybersecurity Infrastructure Security Agency (CISA) and the Idaho National Laboratory (INL), which develop it jointly. Rather than positioning itself against a set of paid products, it is offered as a free software tool whose recommendations are assembled from the best available cybersecurity standards, guidelines and practices.

When to use it — and when not to

A self-hoster must run Docker Desktop with at least 5 GB of memory allocated, manage environment variables and port overrides for the UI, HTTPS and the API, and load the database from ".bak" files, while enterprise installations require Windows Server 2016 or higher. Teams wanting a native Mac or Linux install, or a hosted service, should look elsewhere: CSET Enterprise only runs on Windows, the standalone installer also requires Windows 10 or higher, and no hosted option is documented. The README is also thin in places and is truncated mid-sentence in its system requirements, and the declared language is TSQL, so expect to rely on the installation guides rather than the README alone.