Skip to content

Migrate Data from CSAT Pro or CIS-CAT Pro Dashboard to the CIS SecureSuite Platform

Introduction

Users of CSAT Pro, CIS-CAT Pro Dashboard, or both can migrate their test and configuration data to the CIS SecureSuite Platform. The data migration is handled within the CIS SecureSuite Platform and ensures data integrity, prevents duplicates, and maintains relationships between entities.

Access Requirements

Only CIS SecureSuite Platform System Admins can perform data migrations.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact Product Support immediately for next steps.

Upgrading to v1.4.0

When upgrading to v1.4.0, if you are using a fully qualified domain name in conjunction with a self-signed certificate, you need to regenerate the self-signed certificate during upgrade (Windows or Linux) for data migration to run successfully.

This guide explains:

What to Expect During Migration

Migration Formation

Data will be copied from the source system and inserted into the CIS SecureSuite Platform's database using a secure backend process.

Error Handling

If errors occur (e.g., missing foreign keys or invalid references), an error message will be displayed. Errors are logged in detail in securesuite.log which can be found in .../SecureSuite/logs/securesuitelogs/. Please attach the log when submitting a Product Technical Support ticket.

Data Scope

Only supported tables relevant to assessments, systems, results, and Controls will be migrated. Non-essential or deprecated tables are excluded.

Please review the prerequisite sections for both CSAT Pro and the CIS-CAT Pro Dashboard to ensure all necessary tasks are completed prior to migration. While user records will be migrated, passwords will not. Here's what to expect:

  • Active Directory users will be migrated. Once LDAP is configured, existing users will automatically associate with the new LDAP integration.
  • Local users will need to reset their passwords. This can be done via the "Forgot Password" process (once email is configured), or administrators can set temporary passwords directly in the user record.

User Interaction

Users will need to ensure all prerequisites are met and setup steps completed before attempting to migrate data. The data migration itself is handled automatically in the background when initiated.

Go to Data Migration

1. Open the CIS SecureSuite Platform.
2. Go to Support.
3. Select Data Migration.

You will land on the Data Migration page, where you can migrate data from CSAT Pro or from CIS-CAT Pro Dashboard.

Migrate CSAT Pro Data

Migrate data from your CSAT Pro Neo4j database into the CIS SecureSuite Platform relational database.

Prerequisites

Ensure all of the prerequisites are met before attempting the data migration:

  • CIS SecureSuite Platform installed
  • Know CSAT Pro URI
  • Know Neo4j DB credentials
  • On CSAT Pro host machine, configure port 7687 to allow connection from Neo4j to consolidated Maria DB in the CIS SecureSuite Platform
  • Have access to your CSAT Pro host machine and your current admin user
  • Ensure Neo4j is running and accessible (e.g., bolt://localhost:7687)
  • Ensure MariaDB is running and accessible (e.g., jdbc:mariadb://localhost:3306/secure_suite) for your CIS SecureSuite Platform installation
  • Ensure that any open Controls tasks on CSAT Pro are completed. The migration process will not migrate open tasks.
  • Set up evidence file migration if desired.

Forgot Neo4j admin credentials

In case you have forgotten the admin password for your Neo4j account, refer to the Resetting the Neo4j Admin Password article.

Edit CSAT Pro Configuration File

1. On your CSAT Pro host system, open the neo4j.conf file found at C:\Program Files\CSAT_Pro\neo4j\conf.
2. In the "Network connector configuration" section, delete the hashtag (#) at the start of the following line: 

#dbms.connectors.default_listen_address=0.0.0.0

3. Save the file and restart the Neo4j service.
4. Ensure CSAT Pro is up and running and all the prerequisites have been met.

Set Up Evidence File Migration

Additional setup is required if you need to migrate evidence files from the legacy CSAT Pro system to the CIS SecureSuite Platform.

These evidence files include all supporting documentation or attachments uploaded within CSAT Pro. Once the files are in place, the migration tool will automatically organize them into the correct folder structure and link them to their associated records in CIS SecureSuite Platform.

There are two options for setting up the evidence file migration:

Manual File Copy

This method involves manually moving the evidence files from the CSAT host system to the CIS SecureSuite Platform host system.

Prerequisites
  • You have access to the source evidence directory from the legacy CSAT Pro system and the target system where the CIS SecureSuite Platform is installed.
  • The CIS SecureSuite Platform application is installed, running, and accessible via a web browser.
Copy Evidence Files

1. Locate the CSAT Pro evidence directory and files.

Info

The typical directory structure looks like C:\CSAT\evidence\ for Microsoft Windows and /opt/csat/evidence/ for Linux. The directory contains nested folders that represent internal CSAT Pro IDs for organizations, assessments, and Controls.

2. Copy the entire CSAT Pro evidence folder and paste it to the CIS SecureSuite Platform host system (e.g., C:\Migration\CSAT_Evidence_Backup\ for Microsoft Windows or /opt/migration/csat_evidence_backup/ for Linux).

Note

Ensure you copy the entire folder structure, not just the files, so that all subfolders and internal IDs remain intact.

3. Verify the copied files for the following:

  • The total number of files matches the original CSAT Pro evidence folder.
  • The folder hierarchy (nested structure) has been preserved.
  • The new location is readable and accessible by the account under which the CIS SecureSuite Platform runs (Local System for Microsoft Windows; root for Linux).
  • Optionally, run a comparison of the file counts or checksums to confirm integrity:
Get-ChildItem -Recurse "D:\Migration\CSAT_Evidence_Backup" | Measure-Object

find /opt/migration/csat_evidence_backup -type f | wc -l

Evidence file migration should now be ready. When running the CSAT Pro data migration, enter the path to the directory with the copied evidence files in the Evidence File Path field for CSAT Pro data migration.

Establish Share/Mount Drive on CSAT Pro Host Machine

This method involves establishing a shared drive to migrate CSAT Pro evidence files during data migration. You should use this method only if your CSAT Pro and CIS SecureSuite Platform host systems are on the same domain.

Note

The instructions refer to a "migration runner," which is the system running the data migration.

Before migrating:

  • Share the drive where the evidence files are stored.
  • The CIS SecureSuite Platform must be able to access this folder using a single, mounted path:
    • Windows: Use a UNC path via SMB.
    • Linux: Use an NFS or CIFS mount.

Important:

  • You will enter the shared folder path in the SecureSuite data migration form.
  • If this field is left blank, no files will be transferred.
  • You cannot rerun the migration later to include these files.

Follow the instructions below based on the operating system where CSAT Pro is installed:

Microsoft Windows via Network File Share (NFS)

1. Create a network share:
   A. On your CSAT Pro host machine, locate the evidence folder (e.g., C:\Program Files\CSAT_Pro\uploads\evidence).
   B. Right-click the folder, select Properties, go to the Sharing tab, and click Advanced Sharing.
   C. Select Share this folder.
   D. Set a share name, such as CSATEvidence.
   E. Select Permissions.
   F. Add the domain or local account that will run the migration.
   G. Grant Read permission to the added account.

Note

Ensure Read & Execute is allowed via NTFS.

2. Set NTFS permissions:
   A. Return to Properties and go to the Security tab.
   B. Confirm the migration account has read access to the folder and all subfolders and files.

3. Configure firewall:
   A. Enable File and Printer Sharing (SMB).
   B. In Windows Defender Firewall, allow the app or open TCP port 445 inbound.

4. Record the UNC path to the shared folder (e.g.,\\yourCSAT-SERVERname\CSATEvidence).
5. Mount the shared folder on the migration runner:
   A. Use the UNC path directly: \\CSAT-SERVER\CSATEvidence.
   B. (Optional) Map the network drive:

net use Z: \\CSAT-SERVER\CSATEvidence /user:DOMAIN\user Passw0rd!

The shared drive should be set up now. When running the CSAT Pro data migration, enter the share location in the Evidence File Path field for CSAT Pro data migration (e.g., \\yourCSAT-SERVERname\CSATEvidence).

Ubuntu Linux

1. Install and enable NFS: 

sudo apt-get update && sudo apt-get install -y nfs-kernel-server

2. Add the path to evidence folder (e.g., /opt/csat/uploads/evidence) to /etc/exports/ using the following line: 

/opt/csat/uploads/evidence 10.0.0.0/24(ro,fsid=0,insecure,no_subtree_check,async)

Note

Replace 10.0.0.0/24 with the subnet or IP address of the migration runner. Use ro for read-only access.

3. Apply the export:

sudo exportfs -ra

4. Open NFS-related ports or allow access from the runner IP. If using firewall, run the following:

sudo firewall-cmd --permanent --add-service=nfs
sudo firewall-cmd --permanent --add-service=mountd
sudo firewall-cmd --permanent --add-service=rpc-bind
sudo firewall-cmd --reload

The shared drive should be set up now. When running the CSAT Pro data migration, enter the share location in the Evidence File Path field for CSAT Pro data migration (e.g., \\yourCSAT-SERVERname\CSATEvidence).

Run CSAT Pro Data Migration

1. Go to Admin > Email & Login Settings and change the Session Lock When Idle value to 360.
2. On the Data Migration page, enter the database connection information:

3. Select Begin migration.

Once started, the tool will:

  • Extract data from CSAT’s graph database including assessments, rules, rule controls, and related metadata.
  • Map and transform this data into the SecureSuite schema.
  • Ensure relationships like rule-to-Control and Control-to-Sub-Control are preserved during import.
  • Show a real-time progress indicator and a success message once the migration completes. Errors (if any) will be shown in a summary at the end of the process.
  • Read evidence metadata from the migrated MariaDB data.
  • Move each file form the manually copied source directory into its correct folder structure in the CIS SecureSuite Platform.
  • Automatically match and validate file associations based on organization, assessment, Control, and Sub-Control mappings.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact Product Support immediately for next steps.

4. (If evidence files migrated) Verify that the evidence files now appear in the CIS SecureSuite Platform evidence directory and check a few records within the application to confirm that evidence files are linked properly to their assessments or Controls.
5. Change the Session Lock When Idle value back to what is was originally (or to a value aligned with your organization's security policy).

Organization logos

Organization logos are not included in the data migration. You can add a logo while creating or editing an organization in Admin.

Migrate CIS-CAT Pro Dashboard Data

Migrate data from your CIS-CAT Pro Dashboard MariaDB to your CIS SecureSuite Platform database.

Prerequisites

Ensure all of the prerequisites are met before attempting the data migration:

  • CIS SecureSuite Platform installed
  • Know CIS-CAT Pro URI
  • Know Maria DB credentials for CIS SecureSuite Platform and CIS-CAT Pro
  • On CIS-CAT Pro host machine, configure port 3306 to allow connection from CIS-CAT Pro Dashboard Maria DB to the consolidated Maria DB in the CIS SecureSuite Platform
  • Have access to your CIS-CAT Pro host machine and your current admin user
  • Disconnect automated configuration assessment imports via the centralized workflow or other automated processes
  • Stop the CCPD service before beginning the migration.
  • Ensure that there is no data in the CIS SecureSuite Platform before migration, otherwise errors will occur when viewing the migrated data.
  • Ensure that any open tasks on CIS-CAT Pro Dashboard are completed. The migration process will not migrate your Inbox data.
  • Ensure CIS-CAT Pro MariaDB is running and accessible
  • Ensure MariaDB is running and accessible (e.g., jdbc:mariadb://localhost:3306/secure_suite) for the CIS SecureSuite Platform

Set Up CIS-CAT Pro Dashboard Host Machine

1. Copy ciscat-remote-enable.jar from the dataMigration folder in the destination directory you defined during the CIS SecureSuite Platform installation.
2. Place the ciscat-remote-enable.jar on your CIS-CAT Pro Dashboard host machine.
3. In Windows Search, enter Environment Variables and select Edit the system environment variables.
4. Select Environment Variables....

5. Under System variables, select the Path variable and then Edit.
6. Select New, enter %JAVA_HOME%\bin, and exit out of the windows.

Run Remote Enabler JAR

Running ciscat-remote-enabler.jar establishes a user specifically for data migration that has the correct permissions to insert data into the CIS SecureSuite Platform. This user will be disabled at the end of a successful migration.

1. Open Command Prompt (Windows) or Terminal (Linux).
2. Navigate to the directory containing ciscat-remote-enable.jar. 

cd <path\to\jar\directory>\bin

Locating ciscat-remote-enable.jar

If you do not know the directory containing the JAR file, run this command to find it: echo %JAVA_HOME%.

3. Run the JAR file using the java -jar command: 

java -jar ciscat-remote-enable.jar

Note

Store the password of the migration user created by ciscat-remote-enable.jar in a secure but discoverable location. You will need it when running the data migration or if you need to rerun the script.

Run CIS-CAT Pro Dashboard Data Migration

1. Ensure CIS-CAT Pro Dashboard is up and running and all the prerequisites have been met.
2. On your CIS SecureSuite Platform host machine, go to Admin > Email & Login Settings and change the Session Lock When Idle value to 600.
3. Go to the Data Migration page and enter the database connection information:

  • Maria Database URI: URL of your CIS-CAT Pro Dashboard MariaDB instance.
  • Password: Password of the migration user.

4. Select Begin migration.

Once started, the tool will:

  • Transfer all relevant CIS-CAT data including system characteristics, rules, collected objects, and item data.
  • Normalize values such as control versions to ensure compatibility.
  • Maintain referential integrity across related tables using built-in business key logic and special handlers.
  • Show a progress bar displaying migration status. A final summary will indicate success or highlight any rows that were skipped or errored during the import.
  • Check that the username for the migration user is not root and revokes all privileges from the migration user after data migration is finished.

How long will the data migration take?

How long the data migration takes is contingent on how many configuration assessment reports you are migrating. For example, one Member's migration of 7,000 configuration reports took about 3 hours. Another Member's migration of 21,000 configuration reports took 16 hours. Your experience may be different and dependent on your network.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact Product Support immediately for next steps.

Note

The process sometimes gets stuck for a while even after data migration is completed. Verify your data in the CIS SecureSuite Platform and securesuite.log for completeness. If necessary, contact Product Support for additional information or help.

5. Change the Session Lock When Idle value back to what is was originally (or to a value aligned with your organization's security policy).

Troubleshooting

If data migration fails, do not add more data until the root cause of the failure has been determined.

Restart Services and Task

Data migration may be failing due to a service or task being unavailable. Restart the services and tasks to ensure they are available.

Windows

1. Open Services.
2. Right-click SecureSuite_Windows and select Restart.

3. Repeat step 2 for the MariaDB and Apache HTTPD services.
4. Open Task Scheduler.
5. Select Task Scheduler Library, right-click Keycloak, and select Run.

Linux

1. Open Terminal.
2. Run the following commands: 

sudo systemctl restart securesuite 
sudo systemctl restart mariadb
sudo systemctl restart apache2
sudo systemctl restart keycloak

Data Migrations Over 10 Hours (Only CIS-CAT Pro Dashboard)

If your data migration exceeds 10 hours, you may receive a failure message even though the data transfer is still running successfully.

To verify that the data migration has completed:

1. Go to SecureSuite/logs/securesuitelogs/ and open the securesuite.log.

Note

If you want CIS to double-check the status of the migration, submit the log to Product Support.

2. Check that the log shows the “special mappings” as the last data to be migrated. If the data migration was successful, it will say that (e.g., "successfully migrated special mappings") and will be followed by the connections closing (e.g., "Neo4j connection closed").

19/09/2025 00:14:39.024 INFO org.cisecurity.migration.MariadbMigrationService - successfully migrated special mappings
19/09/2025 00:14:56.710 INFO org.cisecurity.migration.MariadbMigrationService - successfully restricted migration user privileges after completion
19/09/2025 00:14:56.741 INFO org.neo4j.driver.internal.InternalDriver - Closing driver instance 1938718587
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - Neo4j connection closed.
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - source MariaDB connection closed.
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - target MariaDB connection closed.

Evidence File Migration Issues (only for CSAT Pro)

Migration skipped all evidence files

Likely Cause: Evidence File field was left empty
Resolution: Enter the correct path and rerun migration .

“File not found” warnings

Likely Cause: Some files missing in manually copied folder. Resolution: Verify again that all CSAT Pro evidence files were transferred.

Evidence folder structure created but empty

Likely Cause: Source path incorrect or contains nested folders. Resolution: Verify that the top-level folder matches the expected evidence hierarchy.

Contact Product Support

Follow the instructions below to receive troubleshooting assistance:

1. Start a Product Technical Support ticket.
2. Fill out the ticket with as much details as possible and attach the securesuite log to the ticket.

Log Location

Go to your designated CIS SecureSuite Platform destination directory and then logs\securesuitelogs (e.g., C:\Program Files\SecureSuite\logs\securesuitelogs).