Assessment Tools

Walk through all seven Risk Management Framework steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) with guided checklists, FIPS 199 impact categorization, SP 800-53 control baseline selection, and structured documentation fields aligned to ATO package requirements.

Guided SP 800-18 authoring with full SP 800-53 Rev 5 control narrative support. Work through system description, roles and responsibilities, FIPS 199 impact categorization, baseline selection and tailoring, and structured implementation narrative fields for every applicable control in your selected baseline.

Document the results of a security control assessment the way SP 800-53A prescribes: assessment methods (Examine, Interview, Test), a Satisfied / Other Than Satisfied determination, and assessor findings per control. Pull the in-scope controls straight from your SSP, record your determinations, and produce the Security Assessment Report that anchors the authorization package, with Other Than Satisfied findings exporting directly into the POA&M.

Track plans of action and milestones for findings and weaknesses. Log corrective actions with responsible parties, scheduled completion dates, milestone progress, and priority/status badges, with overdue tracking, plus Pro import and CSV export aligned to FISMA and FedRAMP POA&M reporting.

Score your organization across all six CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) down to all 106 subcategories. Built-in gap analysis highlights your lowest-scoring areas, maturity gauges show tier-by-tier progress, and Pro trend tracking compares snapshots across time to measure improvement.

Assess your AI program across the four AI RMF functions (Govern, Map, Measure, Manage) and all 72 subcategories, plus the 12-category Generative AI Profile from NIST AI 600-1. Every subcategory carries tier-by-tier examples, Playbook actions, and a crosswalk to regulations like the EU AI Act and ISO/IEC 42001. Pro pushes gaps to the POA&M and AI risks to the Risk Register.

Self-assess against all 110 NIST SP 800-171 Rev 2 requirements and compute your DoD SPRS score using the official Assessment Methodology weights, with per-family progress, full requirement text and discussion, implementation notes, and an exportable POA&M of every gap for CMMC Level 2 readiness.

Maintain an organizational risk register over time. Each risk carries inherent and residual ratings on the SP 800-30 likelihood/impact scale, a NIST risk response (mitigate, accept, avoid, transfer, share), an SP 800-30 threat-source category, owner, status, and next-review date. Sort, filter, configure columns, and export a board-ready register.

SP 800-30 structured threat identification, vulnerability analysis, and risk quantification. Work through threat source taxonomy, threat events, vulnerability identification, and likelihood/impact scoring using SP 800-30 Appendix D/E/G/H scales, with risk response planning and a clear likelihood × impact risk rating to communicate findings.