Secure & Govern · Prompt
Draft System Security Plan implementation statements from the client's actual controls and evidence.
Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.
Draft SSP implementation statements for [CLIENT NAME] for each NIST 800-171 requirement in ControlMap. For each requirement: - Describe how it's implemented today, naming the real systems and people from ControlMap - Reference the supporting policies and evidence - Mark it Implemented, Partially implemented or Planned, and for anything not implemented, point to the POA&M item Write in the factual, specific style assessors expect. Don't describe anything we can't evidence. Read-only. How to work with the ControlMap API (ScalePad MCP): - Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID. - Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches. - Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large. - Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary. - Use framework-level scores and labels. The overall score_label on client health can be wrong. - Older policy sections may be URL-encoded twice: decode them and use the highest version of each section. - If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.
# CMMC SSP section drafting
Hook: Draft System Security Plan implementation statements from the client's actual controls and evidence.
Building or updating a client's SSP.
Implementation statements per requirement, with gaps flagged.
Tested against the ControlMap API on October 16, 2026. Only asks for what the API supports.
