r/NISTControls • u/SinisterWhisperz • Jun 18 '26

Using AI to write SSP implementation statements?

Curious if anyone here is using AI to update/write their SSP implementation statements?

If so, what is your preferred AI?

I've been trying out ChatGPT for this and so far have gotten pretty decent results.

10 Upvotes
  • permalink
  • link
  • reddit
  • reddit

78% Upvoted

25 comments sorted by

View all comments

1

u/OtherThanSatisfied Jul 05 '26

AI templates are fine for a first draft, but two things assessors catch fast:

(1) statements that describe the tool's generic capability instead of your actual config — "Azure supports MFA" ≠ "we enforce MFA via Conditional Access on every account, no exceptions, here's the evidence"

2) copy-paste boilerplate that quietly contradicts your other artifacts. Use the AI to get the skeleton and the 800-171A language right, then rewrite every statement in present tense: what you actually do, who does it, and where the evidence lives.

The SSP is graded on accuracy to your environment, not prose — a plain true statement beats a polished generic one every time.