Nzism

It handles gap analyses across classification levels (Unclassified through Top Secret), generates System Security Plans with proper control references, and maps out the full Certification and Accreditation pathway that agencies are required to follow for Restricted and above. The control guidance is structured around what auditors will look for, not just theory. Honestly most useful if you're a CISO or security manager dealing with GCSB requirements and need to produce documentation that maps cleanly to the manual's control IDs.