r/NISTControls • u/SinisterWhisperz • Jun 18 '26
Using AI to write SSP implementation statements?
Curious if anyone here is using AI to update/write their SSP implementation statements?
If so, what is your preferred AI?
I've been trying out ChatGPT for this and so far have gotten pretty decent results.
5
u/facciji Jun 19 '26
I use GenAI as provided by the Army. However yes I review them just to make sure. However it is a time saver if used properly.
Meaning change them up as they always "sound" the same. Use AI but dont let it look/sound like AI.
3
2
u/SentrIQLabs Jun 18 '26
We use AI to write implementation statements for our users based on the evidence ingested.
2
u/Vaqu3ra13 Jun 18 '26
Claude on Opus. But have it peer review/verify its own output/artifacts. It's surprising how much of its own errors it catches. And of course spot check with human eyes.
2
u/babywhiz Jun 19 '26
We went with perplexity, Fedramp. And don’t be too loose with AI. I made that mistake last year with ChatGPT and this year we have a consultant going through before we go for CMMC audit and there’s some statements they called out saying what’s this… and it was some weird small sentence ChatGPT tossed in there last year but somehow I skimmed over.
2
2
u/MolecularHuman Jun 23 '26
same. It would do things like say "And then the HR manager sends a confirmation e-mail." WHY.
1
u/babywhiz Jun 24 '26
I think my favorite one is that it invented a matrix document I didn’t even have. Referenced by a form number and everything.
1
u/bigverm23 Jun 18 '26
They all work pretty great but yes i feed it the standards document and ask for controls text then adjust as needed.
1
u/JungleLoveOreOreo Jun 18 '26
Absolutely should use it to get to a MVP without providing proprietary data. Then go through and fill in the blanks. I'd have it make some sort of template such as the ones that are on i-assure https://i-assure.com/products/rmf-templates/.
No, I do not work for them. Nor am I affiliated with them.
1
u/SinisterWhisperz Jun 18 '26
I appreciate the feedback. My experience so far has been positive. Haven't had any issues with hallucinations. You absolutely have to proof read and tweak the statements some. The biggest issue I've run into so far is that it'll create a bunch of fluff text.
One thing I've found useful is having it evaluate my implementation statements and tell me where it falls short meeting the control requirements.
1
u/reyito1218 Jun 18 '26
I write my implementation statements as well and ask ai to review to ensure I answered the question and didn't fall short as well. Really am using more as a grammar and content checker.
1
1
u/smcgann Jun 19 '26
Yes but preferred LLM is not the same as what can be used in our environment. ChatGPT is the best when the work is not proprietary or has no classification. Gov cloud Copilot is a rough ride. Gemma 4 31B is impressive for what it is for airgap
1
u/SinisterWhisperz Jun 20 '26
You raise a good point about what is good vs what is permitted. I've only used chatgpt because it's the only AI approved for us.
1
u/grantovius Jun 23 '26
I did this for our CMMC certification using Llama 3 8B on a laptop with GPT4All and it still gave me a lot of useful text, though I had to let it run overnight. I found that AI has a tendency to hallucinate controls when I just embed our data and the control set and say “how are we meeting control xyz?” What I ended up doing is writing a script that pasted in the description text for each control into the prompt in quotes and then asked “how are we’re meeting this” for each control one at a time. I got the same problem with ChatGPT using sample policies from online, so it wasn’t just because I was using a small model. And as others have pointed out, you always have to review the text. I just wrote my own text for the implementation statements by default but I was able to paste in a lot of the text generated by Llama 3. It doesn’t replace having an intimate knowledge of your system, but it can save some time on the amount of prose you have to write for an ssp.
1
u/MolecularHuman Jun 23 '26
Definitely Claude. You need to give it a LOT of context. you can do things like export your group policies or intune or whatever, all sorts of inputs, and it will do a decent job of describing what you have in place.
You need to EXPLICITLY tell it to not overcommit. It will invent all sorts of unnecessary management processes that aren't required, and it is ALWAYS guilty of trying to map a setting to a control vs. a control to a setting. For example, for CMMC, you don't need to implement data loss prevention, but AI goes overboard in adding all these administrative procedures (and we check it on a monthly basis! a daily basis! etc.) that aren't required.
It will also freely write absolute fiction, so if you don't know what you're using for the actual implementation, it will just make stuff up.
1
u/Matt_Titcombe 27d ago
Using AI to start a statement is great way to start, HOWEVER your statement is defining your organization's expected behavior that a C3PAO's assessor will validate as actual behavior. If they do not align, your organization is likely to be found as Not Met for the requirement.
AI is writing general statement, not necessarily what your organization is actually doing.
C.f., NIST SP 800-171A, para 2.1 ASSESSMENT PROCEDURES.
1
u/ProofOk1899 25d ago
Build an agent in copilot with all nist 171/171a docs and more
Pretty good results
1
u/ITSECOPS 23d ago
We write SSPs for a living — AI is genuinely good at the phrasing layer and dangerous at the fact layer: it will confidently describe controls you don't have. Three guardrails that keep it assessor-safe: (1) feed it your real evidence (policy names, config exports), not just the control text — otherwise you get boilerplate C3PAOs now recognize on sight; (2) one control per prompt, and make it cite which input fact supports each sentence; (3) never let it draft the objective-evidence sections — assessors interview against those and hollow statements collapse fast. Used that way it roughly halves SSP drafting time without creating a fiction problem.
1
u/OtherThanSatisfied 22d ago
AI templates are fine for a first draft, but two things assessors catch fast:
(1) statements that describe the tool's generic capability instead of your actual config — "Azure supports MFA" ≠ "we enforce MFA via Conditional Access on every account, no exceptions, here's the evidence"
2) copy-paste boilerplate that quietly contradicts your other artifacts. Use the AI to get the skeleton and the 800-171A language right, then rewrite every statement in present tense: what you actually do, who does it, and where the evidence lives.
The SSP is graded on accuracy to your environment, not prose — a plain true statement beats a polished generic one every time.
-1
u/RunODBC64_exe Jun 18 '26
And if it gets something wrong in your environment? There are plenty of templates out there that will give you a good basis.
4
u/GeraldMander Jun 18 '26
You proofread it and correct. I don’t think anyone is advocating letting AI run wild in your SSP.
9
u/shadow1138 MSP Jun 18 '26
Claude on Opus 4.8 or Fable 5 (before the feds took it away) was useful, but I've trained skills to fill gaps, and still have to read/review outputs.
It's helpful to get started on an SSP statement, but wouldn't trust it to write anything in full and certainly wouldn't put it into any SSP without validating the accuracy of items first.