New vendor risk intake

[CLIENT NAME] wants to use [VENDOR] for [PURPOSE]. Using what you know about the vendor and the client's ControlMap program:
1. Summarize the data and access the vendor would have
2. List the [FRAMEWORK] objectives it affects
3. List questions to ask and documents to request (for example a SOC 2 report or DPA)
4. Propose a risk entry with impact, likelihood, department, category and business impact

Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, create the risk and link it to the affected objectives and assets.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.