My organization is dipping our toes in developing SSPs for our systems. We have run across a few tools that promise to help automate some of the sections: Qmulos, GitHub - CivicActions/ssp-toolkit: Automate the creation of a System Security Plan (SSP) , and OSCAL.

Do any of you have any experience with beginning the process? Were there any tools that really help out or are they still mostly manual configuration under the hood at the end of the day? Any tips and tricks you would like to share for the community?

In a previous life I had to manage the SSP creation and lifecycle process for multiple enclaves but it is an new process and documentation now. We had to do a lot of manual review and verification for every system and it was very time consuming and tedious, hoping it got a little better! lol.

Thank you for your time and help!