Run an assessment
Scope an ISM, Essentials or ASVS assessment, be walked through it a few controls at a time, save your progress and pick it up later.
An assessment is a conversation. You tell the assistant what you are assessing, it puts the controls to you in small batches with the control text in front of you, and it records what you say. Where your client draws forms, the scoping questions and the walk-through appear as forms; where it does not, the same questions come as text. Nothing is missing from the text path.
Scope it
Say what you are assessing and against what.
Start an ISM assessment for the corporate internet gateway at PROTECTED.
Assess our enterprise IT against the Essentials, starting with the Protect domain.
Start an ASVS Level 2 assessment of the customer portal.
The assistant asks a few qualifying questions: the system's name and identifier, the baseline, level or phase, whether the system is internet-facing, whether it includes operational technology, its classification. Set the baseline or level early. Without one, the ISM scopes its entire catalogue and the walk-through is very long.
Be walked through it
Walk me through it.
The assistant puts a handful of controls to you at a time, each with its statement quoted, and asks for a status: implemented, partially implemented, planned, not implemented, not applicable, or an alternative control, with your justification. For the Essentials it asks per domain, with ASD's indicators of good practice as the questions, and derives the effectiveness rating by ASD's rule: any indicator at not effective makes the action not effective; all at fully effective makes it fully effective; anything else is partially effective. You can override the rating with a reason.
If you are vague, the assistant asks again rather than choosing a status for you.
Save your progress
Save my progress.
Your assessment comes back as a file in the Advisor's own format: a download link on the hosted service, a file on disk when the server runs on your machine. An assessment is rarely finished in one sitting, so save whenever a session runs long.
Pick it up later
Attach the saved file and ask to carry on. The walk-through resumes where it stopped. There is no session on the server: the file is the state, which is also why you can move between clients, or between people, by handing the file over.
Which standard
| Use | When |
|---|---|
| ISM | Australian government systems, classification baselines, the Essential Eight maturity levels, and anything operational technology. |
| Essentials for Enterprise IT | An organisation's enterprise IT posture, rated for effectiveness by domain. ASD states that Essential Eight maturity ratings do not translate into Essentials ratings; an existing Essential Eight assessment is evidence, not a result. |
| ASVS | Web applications and APIs, at Levels 1 to 3. |
If it is unclear which applies, the assistant asks, or answers against both and labels each.
Releases
The assistant names the release it assessed against, and the saved file records it. If the standard has moved since you started, the next walk-through says so and tells you which recorded controls changed.
Look up a control
Ask what a control, action or requirement says, which ones apply to a topic, what a baseline or level requires, and what changed between releases.
Start from your documents
Hand over an SSP, a policy, a pen-test report, a risk register or a screenshot and let the assistant map it to controls, with every id checked against the catalogue.