Evidence intake and mapping

I'm setting up evidence for [CLIENT NAME]. I'll describe each item or paste a link to where it's stored (SharePoint, Google Drive). For each item:
1. Say what it proves and which system it comes from
2. Name it consistently: System - What it proves - Period
3. List the [FRAMEWORK] objectives it satisfies, plus matching objectives in the client's other ControlMap frameworks
4. Suggest a refresh interval and an owner
5. Rate it as strong, partial or weak proof, and say what would make it stronger

Check ControlMap first so you don't duplicate existing evidence.

Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, create each evidence record with its mappings (scoped by program_name), owner and refresh schedule, write your summary to the evidence request notes, and attach the link if I gave one.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.