Operate & Automate · Prompt
Check that the client's WISP covers every element the FTC Safeguards Rule requires.
Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.
Review [CLIENT NAME]'s ControlMap policies and controls against the required elements of the FTC Safeguards Rule information security program: a Qualified Individual, written risk assessment, safeguards (access controls, data inventory, encryption, MFA, secure disposal, change management, monitoring), staff training, service provider oversight, an incident response plan, and annual reporting to the board. For each element show: covered by which policy or control, evidence status, and the gap if any. Read-only. How to work with the ControlMap API (ScalePad MCP): - Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID. - Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches. - Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large. - Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary. - Use framework-level scores and labels. The overall score_label on client health can be wrong. - Older policy sections may be URL-encoded twice: decode them and use the highest version of each section. - If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.
# Written information security program check
Hook: Check that the client's WISP covers every element the FTC Safeguards Rule requires.
Setting up a Safeguards program, or during the annual review.
A checklist of required elements, with where each is covered and what's missing.
Tested against the ControlMap API on October 16, 2026. Only asks for what the API supports.
