What are the CS2SAT’s limitations?
The reports generated by the tool are only as useful as the care that went into answering the requirement questions. CS2SAT does not independently determine the security level of the control system network. The CS2SAT identifies areas of concern based on the answers provide to the questions; it is up to the organization to analyze these areas and take appropriate action based upon their business model. The CS2SAT does not provide an architectural analysis of the network or a detailed network hardware/software configuration review. CS2SAT is not intended as a substitute for in-depth analysis of control system vulnerabilities as performed by trained cyber security control systems professionals. Periodic onsite reviews and inspections must still be conducted using a holistic approach including scanning, penetration testing, facility walk-downs, and other security exercises. The CS2SAT has a component focus rather than a system focus. Therefore, network hardware and software configuration
