I'd be very surprised that a drawing tool needs some "qualification" to be used in an assessment. We do security assessments, data protection assessments, architecture assessments - and no process forbids any tools. Sometimes it is necessary/useful to describe explictly modelling methods and languages, which may include types of diagrams and elements used there; but even then, as long as there is an explainable diagramming language, all is fine. Of course,
standardized and well-known and common diagrams are preferable - but whether you
draw them with drawio, Visio, Powerpoint or even pen and paper, should not be of any concern - as only the resulting diagram is the relevant artefact.