---
title: "Australian ISM Compliance Software | SecBoost"
source: "https://secboost.com/product/"
---

Product

# Manage ISM controls, evidence and assessment work.

SecBoost keeps assessment scope, control implementation, evidence, generated documents, registers and assessor records aligned. Work in the workspace or connect your own AI agents and integrations through the API.

 [Explore the product demo →](<https://secboost.com/demo/>) 

## Work with the records behind your assessment.

Define the scope, maintain implementation details and keep the evidence available for review.

### Define the assessment scope

Create a project from the wizard, an SSP Annex or a CCM import. Set classification, ISM version and system context, then tailor control applicability and responsibilities.

### Generate the documentation suite

Create 20+ ISM-aligned policies, plans, standards, registers and reports from the same system profile and control records.

### Track Essential Eight maturity

Record control implementation, maturity progress, blockers, alternate controls, no-visibility gaps and residual risk for Maturity Level 1, 2 or 3.

### Attach evidence to controls

Upload screenshots, PDFs, exports and supporting records directly against the control implementation and assessment record.

### Bring assessors into the workflow

Standard and Enterprise let assessors work inside SecBoost: review evidence, record assessment outcomes, return controls to editing when more information is needed, and finish with OSCAL and completed CCM outputs.

### Get implementation suggestions for your system

Answer questions about your system to get AI implementation suggestions for the relevant ISM control.

Documentation Suite

## Generate documents from your control records.

The Documentation Suite uses your system profile, selected ISM version, classification, control applicability and implementation notes to produce assessor-ready material.

### Policies

Set expectations for how your organisation protects its systems and information.

-   Access Control Policy
-   Artificial Intelligence Security Policy
-   Asset Management Policy
-   Backup and Recovery Policy
-   Change Management Policy and Procedure
-   Cloud Security Policy
-   Cryptographic Controls Policy
-   Data Classification and Handling Policy
-   Email and Communications Policy
-   Endpoint Protection Policy
-   Information Security Policy
-   Interconnection Security Policy
-   Logging and Monitoring Policy
-   Physical Security Policy
-   Secure Development Policy
-   Supplier Security Management Policy

### Plans

Document how your team prepares, responds and recovers.

-   Business Continuity Plan
-   Disaster Recovery Plan
-   Incident Response Plan
-   Risk Management Plan
-   Security Awareness and Training Plan
-   Security Review and Audit Plan
-   System Security Plan

### Registers

Maintain the operational records that support your controls.

-   Access Control Register
-   Change Management Register
-   Cloud Service Inventory
-   Crypto Key Inventory and Certificate Register
-   Data Retention Schedule
-   Evidence Register
-   Hardware Asset Register
-   Incident Register
-   Interconnection Register
-   Review and Audit Log
-   Software Asset Register
-   Supplier Risk Assessment
-   Training Register
-   Vulnerability Management Register

### Matrices, reports and exports

Bring implementation and assessment records together for reporting and handover.

-   Cloud Controls Matrix
-   SSP Annex: ISM Control Implementation Matrix
-   Essential Eight Compliance Progress Report
-   Essential Eight Portfolio Executive Report
-   Essential Eight Target Progress Report
-   OSCAL Assessment Results export
-   OSCAL System Security Plan export

Registers and contacts

## Keep supporting records with the assessment.

Asset, evidence, training, change, supplier, vulnerability and risk records can be maintained alongside the control implementation and exported when needed.

## Automate routine work with your own tools.

Connect your own AI agents, scripts and integrations through the API to maintain implementation records, attach evidence, record assessment work and generate documents. Reduce repeated data entry and requests you would otherwise make by hand.

 [Explore the API and integrations](<https://secboost.com/api/>)