Drafts, not assurance
What Security Assessment Advisor produces, what it does not, and the classification it runs at.
The Advisor produces drafts for a qualified security assessor to review. It is decision support. It is not an accreditation decision, not an authority to operate, and not legal or audit advice. Nothing it produces should go to an accrediting authority, a board or a regulator without a qualified person having read it and taken responsibility for it.
What it does well
- It quotes the standard word for word from the loaded release, and names the release. An assistant with the Advisor cannot invent a control id or paraphrase a requirement from memory.
- It records what you tell it, in the standard's own vocabulary, and keeps the record in a file you hold.
- It does the clerical work of an assessment: scoping, the walk-through, the coverage arithmetic, the workbook.
What it does not do
- It does not verify that a control is in place. It records that you, or a document you gave it, said so. An inferred status is recorded as partial, with the reasoning, so that an assessor can see what was read and what was assumed.
- It does not know your system. It knows the standard.
- It does not replace the assessor's judgement about risk, compensating controls or acceptability.
Classification
The servers run at the OFFICIAL classification and are not an accredited system. Do not put PROTECTED or higher material into them, nor credentials, nor the kind of system detail that would itself be sensitive. If something you are about to paste looks PROTECTED or above, the assistant is instructed to say so and stop rather than quote it in.
A deployment in your own tenancy is stamped with the classification its deployer set, and every generated document carries that marking. The marking describes the environment the document was made in, not an assessment of its contents.
Working exploits
The Advisor explains a weakness and cites the mitigating control. It does not write working exploit code.