See where you stand
Coverage, the top gaps and the exports your assessor asked for: SSP annex, OSCAL POA&M, ASVS checklist, Essentials workbook, and Word, PowerPoint, Markdown and CSV reports.
Gap analysis
Run a gap analysis.
The answer leads with coverage, then counts by status, then the top gaps. Where your client draws views it is a dashboard; elsewhere it is the same numbers as text.
| Standard | What the analysis shows |
|---|---|
| ISM | Coverage of the scoped baseline, counts by status, the controls not implemented or only planned, and the operational technology overlay where the system includes it. |
| Essentials | Effectiveness by domain, principle ratings by the weakest link, and the summary view by priority phase. |
| ASVS | Coverage of the target level by chapter, with the requirements not yet verified. |
The analysis is always complete, including on a trial licence.
Exports
Ask for the document your assessor wants.
| Ask for | You get |
|---|---|
| The SSP annex | An .xlsx workbook, one row per control, with status, justification and the operational technology overlay if it applies. |
| The POA&M | An OSCAL 1.1 plan of action and milestones, as JSON, for your GRC tooling. |
| The ASVS checklist | An .xlsx workbook of the target level's requirements and their verification status. |
| The Essentials results | An .xlsx workbook of actions, indicators, ratings and justifications by domain. |
| A report | A narrative report as Markdown, a Word document, an executive summary as a PowerPoint deck, or a flat CSV for Power BI or Excel. |
Every document carries the classification marking the server was deployed with and the release of the standard it was built from.
Where the file goes
On the hosted service, or any server that is not on your own machine, a document comes back as a short-lived download link, or as the file itself attached to the answer. The link lasts about thirty minutes, comes from a private container, and the file is deleted after a day. Nothing is left in storage for an administrator to browse.
When the server runs on your own computer, ask for the file to be written to a path and it is saved there.
On a trial
Gap analysis, the walk-through, search and lookups are complete on a trial. Exports are capped: the summary and coverage figures are complete, and the itemised rows stop at twenty, with a row saying what was withheld. The figures are never altered, so a trial never misleads you about your posture. A licence from the Mojo Up customer portal removes the cap.
Start from your documents
Hand over an SSP, a policy, a pen-test report, a risk register or a screenshot and let the assistant map it to controls, with every id checked against the catalogue.
With AI Workbench
Use Security Assessment Advisor from the chat in AI Workbench, and let the agents in a team use it while they work.