CSET scores an assessment against standards, and the database is the part you load first

What the tool actually measures

CSET is developed by the Cybersecurity Infrastructure Security Agency and Idaho National Laboratory for asset owners, and its stated objective is reducing risk to critical infrastructure. The audience is an organization that owns physical processes controlled by electronics, not a penetration tester.

The workflow is questionnaire-first. The tool guides a user through collecting facility-specific information about hardware, software, administrative policies and user obligations, compares that against relevant security standards and regulations, assesses compliance, and produces recommendations drawn from a collection of cybersecurity standards, guidelines and practices. Where it makes sense, a recommendation links to a set of actions.

The four deliverables the README lists describe what you get out of a session: a framework for analysing vulnerabilities across both the ICS and the IT architecture, a consistent methodology for identifying and communicating vulnerabilities to security professionals, a documented process for identifying those vulnerabilities, and suggested methods for evaluating improvement options against existing standards.

That last item is why the tool is framed as a process rather than a product. It records how you assessed, which is what an auditor later asks for.

Two deployment shapes with different constraints

Windows is the native platform. CSET Enterprise only runs on Windows, with Windows 10 or higher for local installations and Windows Server 2016 or higher for enterprise deployments. Local standalone installers are published alongside binaries for creating enterprise installations.

For everyone else, Docker is the recommended approach, and that includes Windows users who prefer it. The repository ships compose files and a taskfile.yml, and Task is described as recommended rather than required.

The enterprise hardware and software list is specific: a Pentium dual core 2.2 GHz processor as the floor, 8 GB of free disk space, 4 GB of RAM, Windows Server 2016 Edition or higher, Microsoft .NET 10 Runtime, Microsoft ASP.NET Core 7 Runtime, Microsoft SQL Server 2022 or higher, and either Internet Information Server or Kestrel. The README also asks users to install the latest service pack and critical updates.

Note the version pairing there. A .NET 10 runtime alongside an ASP.NET Core 7 runtime is an unusual combination to have to provision, and it is the sort of detail that decides whether the enterprise install fits your build pipeline.

The Docker path ends with loading the database

The Mac and Linux route is a documented sequence: clone the repository, install Task if you want it, install Docker Desktop, allocate at least 5 GB of memory to Docker Desktop, copy the environment file, then bring the stack up.

cp .env.example .env

docker compose up -d

Then the step people miss. The container comes up, but there is no data in it yet, so you load the database from the backup files in the repository.

task load-bak

Ports are all overridable through .env or the environment. WEB_PORT defaults to 4200 for the Angular UI, WEB_TLS_PORT to 443 for HTTPS on the UI container and API_PORT to 5000 for the ASP.NET API, and the README shows overriding two at once on the compose command line.

WEB_PORT=4300 API_PORT=5100 docker compose up -d

For development there is compose.dev.yml with live reload of both the API and the Angular UI, started either with docker compose -f compose.dev.yml up or with task up:dev.

compose.yml publishes SQL Server and a default password

The compose file is short enough to read in full, and two of its lines matter for anything beyond a laptop.

  sqlserver:
    container_name: cset-mssql
    hostname: mssql
    image: "mcr.microsoft.com/mssql/server:2022-CU13-ubuntu-22.04"
    platform: linux/amd64

The SQL Server container is published on host port 1433, and .env.example ships a working connection string and password.

ConnectionStrings__CSET_DB="data source=mssql,1433;initial catalog=CSET;User Id=sa;Password=Password123;Encrypt=False;TrustServerCertificate=True;"

MSSQL_SA_PASSWORD=Password123
ACCEPT_EULA=Y

That file is an example and it says so in spirit, but the value is a literal Password123 with Encrypt=False and TrustServerCertificate=True. Anyone who copies .env.example without editing it is running a database with a known administrator password. The same file documents an optional CA_CERT_URL for corporate proxies and VPNs, which is the hook you use when TLS interception breaks the container's certificate trust.

The web container also takes CA_CERT_URL as a build argument, so a custom CA has to be supplied at build time, not only at runtime.

Where CSET is the wrong instrument

CSET does not scan. It has no vulnerability scanner, no port scanner and no exploit logic, and the repository layout reflects that: CSETWebApi and CSETWebNg are the API and the Angular UI, DatabaseScripts and backup/ hold the schema and the data, and install-and-troubleshooting-guides plus userguides/ hold the documentation. There is no scanner component in that list.

So the quality of a CSET assessment is the quality of the answers. A facility that answers optimistically gets an optimistic score, and the tool has no way to detect that. If you need evidence that a control is actually implemented rather than asserted, you need tooling that inspects the estate, and CSET will not substitute for it.

Three more boundaries follow from the packaging. There is no documented headless or scheduled mode, so assessments are driven through the UI. There is no documented API for automating question sets across many sites, even though a Web API exists, which is the obvious thing an enterprise rollout would want. And a vulnerability report goes to the issues tracker or to the project management mailbox rather than to a maintained security process, which is a reasonable choice for a government tool but worth knowing.

Ownership, releases and dual licensing

The project is not archived and the last push was on 2026-10-09, on the develop branch rather than main. Release v13.0.0.0 was tagged on 2026-10-06, after v12.4.0.4 from 2025-07-18 and v12.4.0.3 from 2025-05-15, so the project moved from the v12.4.x line to v13.0.0.0.

Licensing is unusual and worth reading precisely. The README states MIT License, Apache License 2.0, copyright 2018 Battelle Energy Alliance, LLC, with License.txt and NOTICE.txt in the repository. It then adds that the software includes components licensed under LGPL, that LGPL dependencies are required to build CSET, and that you must acquire them through nuGet because they are not distributed with the source.

That last sentence decides your build plan. You cannot clone and build offline from this repository alone; the LGPL pieces have to come from a package feed, and any redistribution you do has to account for those terms as well as the MIT and Apache portions. This is not legal advice, but it is the difference between a build that works and one that fails on a clean machine.

There is also a real support boundary: questions go to [email protected], and the README routes installation options to a separate install-and-troubleshooting-guides repository.

Editorial conclusion

Adopt CSET if you assess industrial control or critical infrastructure and need a repeatable questionnaire whose answers map to named standards, because that mapping is the product and nothing else in the market gives it to you for free. Do not adopt it as a scanner: it collects what you tell it and compares that to control sets, so it will not find a flaw on your network by itself. Verify first the deployment route, since CSET Enterprise only runs on Windows with Server 2016 or higher and a .NET 10 runtime, while the Docker path publishes SQL Server 2022 on port 1433 with an example sa password you must replace in .env before exposing anything. Version 13.0.0.0 shipped on 2026-10-06 and the last push was on 2026-10-09, so check the release notes for breaking changes in the question sets you already use.

Frequently asked questions

Official sources

1. cisagov/cset on GitHub
2. Issues
3. License: MIT
4. README
5. Releases