Start from your documents
Hand over an SSP, a policy, a pen-test report, a risk register or a screenshot and let the assistant map it to controls, with every id checked against the catalogue.
Most organisations already have evidence: a system security plan, policies, a penetration test report, a risk register, a spreadsheet from the last audit. You do not have to retype any of it.
Hand it over
Attach whatever you have and say what it is for.
Here is our SSP for the payments gateway. Record what it evidences against the ISM at PROTECTED.
This is last quarter's pen-test report for the customer portal. Map the findings to ASVS Level 2.
The assistant reads the document, works out which controls it evidences, confirms every id against the loaded release before recording it, and records the result as answers in the assessment. It never asks you for JSON or a particular layout.
What you get back
A summary of what was recorded, in three parts:
- Mapped: controls the document evidences, with the status recorded and the passage it came from.
- Inferred: controls the document suggests but does not state. These are recorded as partially implemented with the reasoning, never as implemented.
- Not mapped: what could not be placed, for you to answer in the walk-through.
Read the summary and correct it. The assistant records your corrections the same way.
In Microsoft 365 Copilot
The Advisor's agent can find and read documents in your OneDrive and SharePoint, so "assess the gateway design document" works without downloading and attaching it.
A design document describes intent, not reality. Controls taken from one are recorded as planned or partially implemented unless the document states something is already in place. An SSP annex generated from a design is a plan, and a qualified assessor still has to confirm it against the built system.
Then carry on
Once the document is recorded, run the walk-through for what is left, or go straight to where you stand.
Run an assessment
Scope an ISM, Essentials or ASVS assessment, be walked through it a few controls at a time, save your progress and pick it up later.
See where you stand
Coverage, the top gaps and the exports your assessor asked for: SSP annex, OSCAL POA&M, ASVS checklist, Essentials workbook, and Word, PowerPoint, Markdown and CSV reports.