CMMC readiness summary

For [CLIENT NAME], use ControlMap's CMMC data to build an artifact showing:
- Practice status by domain (met, partially met, not met)
- A calculated SPRS score, using the standard DoD point value for each practice that isn't fully met, with the practices costing the most points
- Open action items flagged as POA&M items, by domain, with owner and target date
- Which unmet practices can't be on a POA&M under CMMC rules
- A realistic timeline to assessment readiness

Use only real ControlMap data and label the SPRS figure as calculated, to be confirmed in a formal self-assessment.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.