Choose the right starting framework

I'm onboarding [CLIENT NAME] into ControlMap. Interview me one question at a time about their industry, region, size, the data they handle, contract or insurance requirements, and any audits they expect.

Then recommend:
1. A primary framework, and why
2. Up to two secondary frameworks, with how much they overlap the primary
3. The order to roll them out in, with a realistic timeline

Check which frameworks are already in use across my ControlMap clients and prefer those. The API doesn't list the full ControlMap library, so mark any other framework as "confirm it's available in ControlMap". If they need something ControlMap likely doesn't have, flag it as a candidate for a custom framework.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.