Security Assessment Advisor
Ask an AI assistant what the ASD ISM, the ASD Essentials for Enterprise IT and OWASP ASVS actually say, scope and run an assessment, and export the paperwork, with every answer taken from the published standard.
Security Assessment Advisor puts three security standards in front of the AI assistant you already use: the Australian Signals Directorate's Information Security Manual (ISM), with its classification baselines, the Essential Eight and an overlay for operational technology; the ASD Essentials for Enterprise IT, the Essential Eight's replacement; and the OWASP Application Security Verification Standard (ASVS) for web applications and APIs.
It is a set of MCP servers. Connect one to Claude, VS Code Copilot, Microsoft 365 Copilot, Claude Code or AI Workbench, and you can look up a control, scope an assessment, be walked through it question by question, save your progress and pick it up later, and export an SSP annex, a POA&M, a checklist or a report.
Nothing is answered from the model's memory. Every control id, requirement id and quoted sentence comes from the release the server has loaded, and the release is named on the answer.
What it is for
| You want to | What happens |
|---|---|
| Know what a control or requirement says | It is quoted word for word from the loaded release, with the release named. |
| Find what applies to a topic | Search by keyword, narrowed to an ISM baseline, an Essentials domain or principle, or an ASVS level or chapter. |
| Scope an assessment | A short set of qualifying questions: an interactive form where your client can draw one, the same questions in chat where it cannot. |
| Be walked through it | The assistant puts the controls to you a few at a time, with the control text in front of you, and records your answers. |
| Start from what you already have | Attach an SSP, a policy, a pen-test report, a spreadsheet or a screenshot. The assistant reads it and maps it to controls, checking every id against the catalogue. |
| Save and resume | Your progress comes back as a file. Hand it back any time to carry on. |
| See where you stand | Coverage, counts by status and the top gaps, as a dashboard or as text. |
| Produce the paperwork | An SSP annex workbook, an OSCAL POA&M, an ASVS checklist, an Essentials results workbook, and Word, PowerPoint, Markdown or CSV reports. |
| See what changed | Compare two releases of a standard: controls added, removed and changed. |
Drafts, not assurance
Everything the Advisor produces is decision support for a qualified security assessor to review. It is not an accreditation decision and not legal or audit advice. The servers run at the OFFICIAL classification and are not an accredited system: do not put PROTECTED or higher material, credentials or sensitive system detail into them. See Drafts, not assurance.
Security Assessment Advisor is a Mojo Up product. It works in any MCP client, and inside AI Workbench its tools are available to every agent you run.