Define the assessment scope
Create a project from the wizard, an SSP Annex or a CCM import. Set classification, ISM version and system context, then tailor control applicability and responsibilities.
Product
Manage ISM controls, evidence and assessment work.
SecBoost keeps assessment scope, control implementation, evidence, generated documents, registers and assessor records aligned. Work in the workspace or connect your own AI agents and integrations through the API.
Explore the product demo →View product features
Work with the records behind your assessment.
Define the scope, maintain implementation details and keep the evidence available for review.
Generate the documentation suite
Create 20+ ISM-aligned policies, plans, standards, registers and reports from the same system profile and control records.
Track Essential Eight maturity
Record control implementation, maturity progress, blockers, alternate controls, no-visibility gaps and residual risk for Maturity Level 1, 2 or 3.
Attach evidence to controls
Upload screenshots, PDFs, exports and supporting records directly against the control implementation and assessment record.
Bring assessors into the workflow
Standard and Enterprise let assessors work inside SecBoost: review evidence, record assessment outcomes, return controls to editing when more information is needed, and finish with OSCAL and completed CCM outputs.
Get implementation suggestions for your system
Answer questions about your system to get AI implementation suggestions for the relevant ISM control.
Documentation Suite
Generate documents from your control records.
The Documentation Suite uses your system profile, selected ISM version, classification, control applicability and implementation notes to produce assessor-ready material.
Policies
Set expectations for how your organisation protects its systems and information.
- Access Control Policy
- Artificial Intelligence Security Policy
- Asset Management Policy
- Backup and Recovery Policy
- Change Management Policy and Procedure
- Cloud Security Policy
- Cryptographic Controls Policy
- Data Classification and Handling Policy
- Email and Communications Policy
- Endpoint Protection Policy
- Information Security Policy
- Interconnection Security Policy
- Logging and Monitoring Policy
- Physical Security Policy
- Secure Development Policy
- Supplier Security Management Policy
Plans
Document how your team prepares, responds and recovers.
- Business Continuity Plan
- Disaster Recovery Plan
- Incident Response Plan
- Risk Management Plan
- Security Awareness and Training Plan
- Security Review and Audit Plan
- System Security Plan
Registers
Maintain the operational records that support your controls.
- Access Control Register
- Change Management Register
- Cloud Service Inventory
- Crypto Key Inventory and Certificate Register
- Data Retention Schedule
- Evidence Register
- Hardware Asset Register
- Incident Register
- Interconnection Register
- Review and Audit Log
- Software Asset Register
- Supplier Risk Assessment
- Training Register
- Vulnerability Management Register
Matrices, reports and exports
Bring implementation and assessment records together for reporting and handover.
- Cloud Controls Matrix
- SSP Annex: ISM Control Implementation Matrix
- Essential Eight Compliance Progress Report
- Essential Eight Portfolio Executive Report
- Essential Eight Target Progress Report
- OSCAL Assessment Results export
- OSCAL System Security Plan export
Registers and contacts
Keep supporting records with the assessment.
Asset, evidence, training, change, supplier, vulnerability and risk records can be maintained alongside the control implementation and exported when needed.
Automate routine work with your own tools.
Connect your own AI agents, scripts and integrations through the API to maintain implementation records, attach evidence, record assessment work and generate documents. Reduce repeated data entry and requests you would otherwise make by hand.