Make your control picture clearer.

1. In Overview, choose New workspace.
2. Enter a workspace name and system description, then choose a framework release under Start from. The bundled publisher-verified catalogue is currently ISM 2026.09.4. Restored historical releases may also appear; check the release and provenance label before choosing.
3. Choose Create workspace. Responses start as not determined.
4. Use Active workspace to switch between systems and Edit details to update the name or description.

Each workspace retains its selected release when the app is updated. A workspace may select only one edition of each official framework family; separate workspaces can retain different editions. Official-release transitions, response carry-forward and automatic reassessment are not available. The migration instructions below apply to custom frameworks only.

Records save locally when you submit a form. Closing or cancelling an editor does not save its edits. Before using Delete workspace, download a backup; deletion requires typing DELETE and cannot be undone in the app.

1. Go to Controls. Choose controls, principles, or both using the requirement type selector.
2. Search by identifier, title, or statement; filter by status and applicability, or sort by identifier, title, or implementation status. The list shows at most 100 matches, so narrow your search to find more specific requirements.
3. Choose Edit beside a requirement. Set applicability, implementation status and method; record the responsible entity, owner, rationale and implementation narrative.
4. Choose Save response, then reopen the response to check your saved work.

Applicability records whether a requirement applies to your system. Implementation status records progress; implementation method describes whether the work is self implemented, inherited, shared or hybrid. Assessment outcomes are recorded separately and do not change implementation status.

In the response editor, enter both Add evidence reference title and Reference location, plus relevance to the control, then choose Save response. A location can be an HTTP(S) URL or descriptive path. Evidence files are not uploaded or stored; keep the source material in its existing repository.

Save your response before choosing any of these separate actions, because they replace the response editor:

• Add control mapping: choose a target requirement and relationship, and record rationale and provenance. Mappings are directional, user entered, and do not propagate implementation status.
• Add assessment observation: record an outcome, reviewer and rationale independently of the implementation response.
• Record local attestation: enter a local declaration about the saved response. These declarations do not verify identity and are not digital signatures or an independently verifiable audit trail.

Reopen the response to view Linked records. An attestation marked stale after response change refers to an older response; review the current response and record a new declaration when appropriate.

In Frameworks, choose Custom framework to enter a user supplied framework, or Import framework pack to load a supported Neural-ISM JSON or CSV pack (up to 5 MB). Imported content and rights claims are unverified; review their source before relying on them. Use Export JSON pack or Export CSV pack to share custom framework definitions.

Catalogue labels describe the application’s verification of the stored snapshot. Publisher verified means the release matches a bundled registry record and its complete requirement content. Historical · unverified by this build means the retained official snapshot is readable but is not verified by this application registry. An imported claim of official origin does not grant publisher verification or Annex support.

New revision adds a control to a new release; Revise a control changes a control in a new release. Existing releases remain immutable and workspaces stay pinned to their selected releases.

For a release not yet selected in the active workspace, choose Add blank responses, or Migrate matching responses when a source release from that framework is already selected. Review the migration preview: implementation fields copy only for exact requirement identifiers. Evidence links, mappings, assessments and attestations remain on the source release and require review and re-linking or re-recording.

1. Create or select a workspace pinned to an eligible ISM release, then choose Import SSP Annex in Overview and select a supported ASD September 2026 XLSX workbook. Currently the only supported combination is workspace archive version 1.0.0, ISM 2026.09.4 with its registered source fingerprint, and the September 2026 Annex template.
2. Review the matched requirements and unmapped values, enter the new workspace name, then choose Create imported workspace. Import creates a separate workspace and preserves original imported fields.
3. Review imported responses and assessment observations. Unrecognised values are preserved but may remain not determined or unmapped.
4. In Data tools, choose Download SSP Annex or Download extended XLSX and review the confirmation before downloading.

Annex import and standard Annex export check release-specific adapter eligibility. Having a readable catalogue, or installing a newer catalogue, does not establish Annex support. The app’s “qualified adapter” label refers to its registered release/template combination; it does not establish ASD compatibility, certification or endorsement. Both workbook exports require a saved supported Annex template for that workspace. The standard Annex omits supplementary framework responses, evidence references, mappings, local attestations, narratives and assessment reviewer details. The extended workbook adds sheets for local records across selected frameworks and may contain sensitive workspace content. Review any workbook before sharing and retain a JSON backup.

In Data tools, choose Download backup regularly and before deletion, restoration or changing browser profiles. The JSON archive includes all workspaces, framework definitions and local records, including evidence locations. Keep it somewhere you control. Browser storage is not a backup; private browsing, cleared site data, profile resets or device loss can remove your records. Workspace content is not sent to an application server.

Choose Restore backup to select a supported JSON archive (up to 32 MB), review its workspace and release counts, then choose Restore archive. Restoration replaces all current local archive data, so download the current backup first. The archive replacement and removal of saved templates occur together; if that storage transaction fails, the previous stored archive and templates remain intact. Valid historical snapshots retain their workspace pins, internal identifiers and linked records. A historical release outside the current registry remains visibly unverified. An altered snapshot claiming a registered release fingerprint is rejected. Only archive schema version 1.0.0 is supported; unknown future versions are rejected rather than automatically converted. Annex template files are stored separately and are not included in the backup; re-import a supported Annex after restoration to create a workspace with a saved template for workbook export.

For selected sharing, choose Preview filtered export, set search, status, applicability and assessment filters, and select JSON or Markdown. Evidence locations are excluded by default; enable them only when intended. Review the included and excluded counts and fields, then choose Download package. This analysis package is a subset of records and cannot replace a full restorable backup. Check the export dialog’s filters explicitly; requirement type and sort order from the controls list are not export filters.

• No controls or export matches: select a workspace, check the requirement type, and clear search, status and applicability filters. Check assessment filters in the export dialog too.
• Evidence reference will not save: enter both a title and an HTTP(S) URL or descriptive path, or leave both blank.
• Workbook export asks for an upload: import a supported September 2026 Annex. Import creates a new workspace with its own saved template; select that imported workspace for export.
• No qualified SSP Annex adapter: the selected workspace has no eligible release. Catalogue browsing and JSON backup remain available. For the current adapter, create a separate workspace from the bundled ISM 2026.09.4 release, then import the supported September 2026 workbook; existing historical responses are not automatically carried across.
• Import or restore is rejected: read the error message and check the file format, supported release and size. Arbitrary spreadsheets and framework CSV layouts are not supported. Keep the original file and a backup before retrying.
• Local workspace cannot open: check whether this browser allows site storage and whether you are using the same browser profile and site address. Avoid clearing site data while troubleshooting. If available, use a known-good JSON backup to restore the archive after reviewing the replacement warning.