What's New
New and Updated Assessments
- Cross-Sector Cybersecurity Performance Goals (CPG) v2.0. CPG 2.0 adds a Technology Domain setting of IT, OT or OT+IT. When OT+IT is selected, each question can be answered separately for IT and OT. The CPG report now includes answer heatmaps. As in CPG 1.0.1, sector-specific goals are included for the Chemical and Information Technology sectors.
- EVCI assessment. The new EV Charging Infrastructure Assessment & Evaluation (EVCI) is now available.
- Updated NIST SP 800-53 to Revision 5.2.0
- Updated NIST SP 800-171 to Revision 3
- Updated NIST SP 800-161 to Revision 1
- Updated American Water Works Association (AWWA) to version 4.0
- Updated Payment Card Industry Data Security Standard (PCIDSS) to version 4.0.1
Other Features
- Deprecated assessments retired. A number of CISA-sponsored assessment types are no longer offered and have been removed from the New Assessment gallery. See details below.
- Redesigned assessment gallery. Sideways scrolling through rows of cards is gone. Each category's cards are now laid out in a grid, making the full selection visible. Often-used assessments can be favorited for easy access.
- Improved My Assessments grid. The assessment list resizes, allows paging, filtering, and sorting. Assessments can be favorited for easy retrieval.
- Persistent header and completion tracking. The assessment header stays in place while working through an assessment and shows how much of it is complete.
- Light and dark mode. Light and dark themes are now available.
Retired Assessments
CISA no longer supports the following assessments. New assessments of these types can no longer be created in CSET v13.0:
- Cyber Resilience Review (CRR)
- External Dependencies Management (EDM)
- Incident Management Review (IMR)
- Ransomware Readiness Assessment (RRA)
- Cyber Infrastructure Survey (CIS)
- Cross-Sector Cybersecurity Performance Goals (CPG) v1.0.1
Note: Upgrading to CSET v13.0 does not delete existing assessments of the retired types. Those assessments stay available in v13.0 and can still be opened, edited and finished. However, once CSET is upgraded to v13.0, new assessments of these types cannot be created.
Organizations that plan to start a new assessment of a retired type should create it before upgrading, or wait to upgrade until it is no longer needed.
Algorithm: SHA256
Hash: 8CBE762A616E085A3178ECC86E4952D317202EABA1AD66D1DA1E7CDC5A8D9F4F
Path: CSETStandAloneV13999.exe