Tailor template policies to the client

I'm tailoring ControlMap policy templates for [CLIENT NAME]. First, ask me for their legal name, key roles (IT, security, HR owners), main systems (identity, email, endpoint, backup) and preferred review cycle.

Then for each template policy under [FRAMEWORK]:
1. Replace generic placeholders with the client's details
2. Remove statements that don't apply and tell me what you removed
3. Keep the same requirement mappings
4. List any question still open before the policy is final

Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, update the policies in ControlMap as drafts.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.