Look up a control
Ask what a control, action or requirement says, which ones apply to a topic, what a baseline or level requires, and what changed between releases.
Everything on this page is answered from the release of the standard the server has loaded, never from the model's memory, and the release is named on the answer.
Ask what a control says
Give the id and ask. ISM controls look like ism-1504, Essentials actions like IT.PRO-13.4, ASVS requirements like V6.2.1.
What does ism-1504 say?
The answer quotes the control's text word for word, with its title, the baselines it applies to and the release it came from. If the id does not exist in the loaded release, the assistant says so and offers the nearest ids rather than guessing.
Find what applies to a topic
Ask in plain words and the assistant searches the catalogue for you.
Which ISM controls cover multi-factor authentication at PROTECTED?
Which Essentials actions are in the Protect domain?
Which ASVS Level 2 requirements are about session management?
Search matches a word in a control's id, title or statement. Single words find more than long phrases, so "TLS" or "logging" does better than "configuring transport layer security".
What a baseline, domain or level requires
List the ISM baselines and how many controls are in each.
What are the Essentials domains and principles?
What does ASVS Level 1 cover, chapter by chapter?
Operational technology
The ISM carries an overlay for operational technology: industrial control systems, SCADA and the plant floor. Ask by framework and the assistant maps it back to ISM controls.
Which ISM controls apply at Purdue level 2?
Show me the ISM controls that relate to IEC 62443.
What do the ASD principles of operational technology cyber security say about remote access?
What changed between releases
The ISM is revised several times a year, ASVS 5 differs substantially from ASVS 4, and the Essentials are new.
What changed between the last two ISM releases?
Is there a newer ASVS release than the one you have loaded?
The answer lists controls added, removed and changed. The server checks for a newer release on a schedule and loads it when one appears.
From the Essential Eight to the Essentials
An existing ISM or Essential Eight assessment is evidence for an Essentials assessment, never a rating. Ask for the evidence map and the assistant shows which of your recorded controls bear on each Essentials action, for an assessor to weigh.
Connect it
Add Security Assessment Advisor to Claude Desktop, VS Code, Claude Code, AI Workbench or Microsoft 365 Copilot, and check it answers from the standard.
Run an assessment
Scope an ISM, Essentials or ASVS assessment, be walked through it a few controls at a time, save your progress and pick it up later.