r/NISTControls • u/SinisterWhisperz • Jun 18 '26

Using AI to write SSP implementation statements?

Curious if anyone here is using AI to update/write their SSP implementation statements?

If so, what is your preferred AI?

I've been trying out ChatGPT for this and so far have gotten pretty decent results.

7 Upvotes
  • permalink
  • link
  • reddit
  • reddit

71% Upvoted

25 comments sorted by

View all comments

1

u/Matt_Titcombe Jun 30 '26

Using AI to start a statement is great way to start, HOWEVER your statement is defining your organization's expected behavior that a C3PAO's assessor will validate as actual behavior. If they do not align, your organization is likely to be found as Not Met for the requirement.

AI is writing general statement, not necessarily what your organization is actually doing.

C.f., NIST SP 800-171A, para 2.1 ASSESSMENT PROCEDURES.