ScalePad ControlMap (Compliance)
Overview
ControlMap is ScalePad's compliance product: per-client risk
registers, control libraries mapped to framework objectives, evidence
collection, policies/procedures/governance documents, assessments,
and action items. Regional: set X-ScalePad-Region to us (default),
eu, ca, or au to match the tenant's data residency. Discover
this domain's tools with scalepad_navigate (domain controlmap).
Search endpoints are
POST with filter bodies upstream — the tools accept normal filter
arguments.
Anti-triggers
- Assessments and action items on a vCIO roadmap — Lifecycle
Manager has identically named objects under
scalepad_lm_*. An LM
assessment scores a client's IT maturity for a QBR; a ControlMap
assessment answers a framework questionnaire. Use
scalepad-lifecycle-manager for the roadmap side.
- A misconfigured tenant setting rather than a control —
"conditional access is off", "MFA is not enforced" is a
configuration baseline, not a framework control. Use
cipp
(cipp-standards), inforcer
(inforcer-baseline-alignment), or m365-security.
- Vendor-agnostic evidence-mapping and questionnaire workflow — the
cross-platform method lives in the
compliance-pack
(evidence-mapping, insurance-questionnaires); this skill is the
ControlMap tool calls behind it.
- Backup evidence — proving backups run is
scalepad-backup-radar
or the backup-pack; attach the result here as evidence afterwards.
API Tools (98 total — 40 read, 58 write; the high-value subset below, full list in references/tool-inventory.md)
Health & Reports
| Tool |
Purpose |
scalepad_cm_health_list / scalepad_cm_health_get |
Compliance health per client |
scalepad_cm_reports_list / scalepad_cm_reports_get_signed_url |
Generated reports and signed download URLs |
Risks
| Tool |
Purpose |
scalepad_cm_risks_search / scalepad_cm_risks_get / scalepad_cm_risks_list_summaries |
Find and inspect risks |
scalepad_cm_risks_create / scalepad_cm_risks_update / scalepad_cm_risks_delete |
Risk CRUD (delete is irreversible) |
scalepad_cm_risks_map / scalepad_cm_risks_unmap |
Map risks to controls/objectives |
scalepad_cm_risks_get_category / scalepad_cm_risks_list_departments |
Risk taxonomy |
Controls & Frameworks
| Tool |
Purpose |
scalepad_cm_controls_search / scalepad_cm_controls_get / scalepad_cm_controls_list_summaries |
Find and inspect controls |
scalepad_cm_controls_create / scalepad_cm_controls_update / scalepad_cm_controls_delete |
Control CRUD |
scalepad_cm_controls_map / scalepad_cm_controls_unmap |
Map controls to framework objectives |
scalepad_cm_controls_list_sets / scalepad_cm_controls_list_families |
Control sets and families |
scalepad_cm_objectives_search / scalepad_cm_objectives_get / scalepad_cm_objectives_list_summaries |
Framework objectives (read-only) |
Evidence & Documents
| Tool |
Purpose |
scalepad_cm_evidence_search / scalepad_cm_evidence_get / scalepad_cm_evidence_list_summaries |
Find evidence |
scalepad_cm_evidence_create / scalepad_cm_evidence_update / scalepad_cm_evidence_delete |
Evidence CRUD |
scalepad_cm_evidence_requests_create / scalepad_cm_evidence_requests_upload_document / scalepad_cm_evidence_requests_create_link |
Evidence requests (multipart up to 10 MB, or signed URLs) |
scalepad_cm_evidence_map / scalepad_cm_evidence_unmap |
Map evidence to controls |
scalepad_cm_documents_get_signed_url / scalepad_cm_documents_delete |
Document access and removal |
Policies, Procedures & Governance
| Tool |
Purpose |
scalepad_cm_policies_search / scalepad_cm_policies_create / scalepad_cm_policies_update / scalepad_cm_policies_delete |
Policy CRUD |
scalepad_cm_policies_upsert_section / scalepad_cm_policies_delete_section |
Policy section editing |
scalepad_cm_procedures_* |
Procedure CRUD + mapping (same verbs as policies) |
scalepad_cm_governance_* |
Governance document CRUD + mapping |
Assessments & Action Items
| Tool |
Purpose |
scalepad_cm_assessments_list_summaries / scalepad_cm_assessments_search_questions |
Assessment surface |
scalepad_cm_assessments_save_answer / scalepad_cm_assessments_clear_answer |
Answer questions |
scalepad_cm_assessments_create_response / scalepad_cm_assessments_update_response / scalepad_cm_assessments_delete_response |
Response CRUD |
scalepad_cm_action_items_search / scalepad_cm_action_items_create / scalepad_cm_action_items_update / scalepad_cm_action_items_delete |
Remediation action items |
scalepad_cm_action_items_upload_document / scalepad_cm_action_items_generate_signed_urls |
Action item attachments |
Common Workflows
- Compliance posture check —
scalepad_cm_health_list, then
scalepad_cm_risks_list_summaries and
scalepad_cm_controls_list_summaries for the weak spots.
- Evidence chase —
scalepad_cm_evidence_search for stale or
missing evidence, then scalepad_cm_evidence_requests_create to
request updates from the client.
- Risk remediation —
scalepad_cm_risks_search for high
severity, scalepad_cm_action_items_create for each remediation,
scalepad_cm_risks_map to link mitigating controls.
Error Handling
402 means no active ControlMap subscription. A 404 on a known-good ID
usually means the wrong region — verify X-ScalePad-Region matches
the tenant. Deletes are irreversible.
Best Practices
- Always confirm the region before a write; ControlMap data is
region-partitioned (us/eu/ca/au).
- Prefer
*_list_summaries tools for dashboards — they are cheaper
than full search + get loops.
- Use signed-URL tools for documents instead of re-uploading.
Related Skills
1---2name: scalepad-controlmap3description: ScalePad ControlMap per-client compliance management: risk registers, control libraries, evidence collection, policies and procedures, framework objectives, assessments, and remediation action items across regions us, eu, ca, and au.4---56# ScalePad ControlMap (Compliance)78## Overview910ControlMap is ScalePad's compliance product: per-client risk11registers, control libraries mapped to framework objectives, evidence12collection, policies/procedures/governance documents, assessments,13and action items. Regional: set `X-ScalePad-Region` to `us` (default),14`eu`, `ca`, or `au` to match the tenant's data residency. Discover15this domain's tools with `scalepad_navigate` (domain `controlmap`).16Search endpoints are17POST with filter bodies upstream — the tools accept normal filter18arguments.1920## Anti-triggers2122- **Assessments and action items on a vCIO roadmap** — Lifecycle23 Manager has identically named objects under `scalepad_lm_*`. An LM24 assessment scores a client's IT maturity for a QBR; a ControlMap25 assessment answers a framework questionnaire. Use26 `scalepad-lifecycle-manager` for the roadmap side.27- **A misconfigured tenant setting rather than a control** —28 "conditional access is off", "MFA is not enforced" is a29 configuration baseline, not a framework control. Use `cipp`30 (`cipp-standards`), `inforcer`31 (`inforcer-baseline-alignment`), or `m365-security`.32- **Vendor-agnostic evidence-mapping and questionnaire workflow** — the33 cross-platform method lives in the `compliance-pack`34 (`evidence-mapping`, `insurance-questionnaires`); this skill is the35 ControlMap tool calls behind it.36- **Backup evidence** — proving backups run is `scalepad-backup-radar`37 or the `backup-pack`; attach the result here as evidence afterwards.3839## API Tools (98 total — 40 read, 58 write; the high-value subset below, full list in [references/tool-inventory.md](../../references/tool-inventory.md))4041### Health & Reports4243| Tool | Purpose |44|------|---------|45| `scalepad_cm_health_list` / `scalepad_cm_health_get` | Compliance health per client |46| `scalepad_cm_reports_list` / `scalepad_cm_reports_get_signed_url` | Generated reports and signed download URLs |4748### Risks4950| Tool | Purpose |51|------|---------|52| `scalepad_cm_risks_search` / `scalepad_cm_risks_get` / `scalepad_cm_risks_list_summaries` | Find and inspect risks |53| `scalepad_cm_risks_create` / `scalepad_cm_risks_update` / `scalepad_cm_risks_delete` | Risk CRUD (delete is irreversible) |54| `scalepad_cm_risks_map` / `scalepad_cm_risks_unmap` | Map risks to controls/objectives |55| `scalepad_cm_risks_get_category` / `scalepad_cm_risks_list_departments` | Risk taxonomy |5657### Controls & Frameworks5859| Tool | Purpose |60|------|---------|61| `scalepad_cm_controls_search` / `scalepad_cm_controls_get` / `scalepad_cm_controls_list_summaries` | Find and inspect controls |62| `scalepad_cm_controls_create` / `scalepad_cm_controls_update` / `scalepad_cm_controls_delete` | Control CRUD |63| `scalepad_cm_controls_map` / `scalepad_cm_controls_unmap` | Map controls to framework objectives |64| `scalepad_cm_controls_list_sets` / `scalepad_cm_controls_list_families` | Control sets and families |65| `scalepad_cm_objectives_search` / `scalepad_cm_objectives_get` / `scalepad_cm_objectives_list_summaries` | Framework objectives (read-only) |6667### Evidence & Documents6869| Tool | Purpose |70|------|---------|71| `scalepad_cm_evidence_search` / `scalepad_cm_evidence_get` / `scalepad_cm_evidence_list_summaries` | Find evidence |72| `scalepad_cm_evidence_create` / `scalepad_cm_evidence_update` / `scalepad_cm_evidence_delete` | Evidence CRUD |73| `scalepad_cm_evidence_requests_create` / `scalepad_cm_evidence_requests_upload_document` / `scalepad_cm_evidence_requests_create_link` | Evidence requests (multipart up to 10 MB, or signed URLs) |74| `scalepad_cm_evidence_map` / `scalepad_cm_evidence_unmap` | Map evidence to controls |75| `scalepad_cm_documents_get_signed_url` / `scalepad_cm_documents_delete` | Document access and removal |7677### Policies, Procedures & Governance7879| Tool | Purpose |80|------|---------|81| `scalepad_cm_policies_search` / `scalepad_cm_policies_create` / `scalepad_cm_policies_update` / `scalepad_cm_policies_delete` | Policy CRUD |82| `scalepad_cm_policies_upsert_section` / `scalepad_cm_policies_delete_section` | Policy section editing |83| `scalepad_cm_procedures_*` | Procedure CRUD + mapping (same verbs as policies) |84| `scalepad_cm_governance_*` | Governance document CRUD + mapping |8586### Assessments & Action Items8788| Tool | Purpose |89|------|---------|90| `scalepad_cm_assessments_list_summaries` / `scalepad_cm_assessments_search_questions` | Assessment surface |91| `scalepad_cm_assessments_save_answer` / `scalepad_cm_assessments_clear_answer` | Answer questions |92| `scalepad_cm_assessments_create_response` / `scalepad_cm_assessments_update_response` / `scalepad_cm_assessments_delete_response` | Response CRUD |93| `scalepad_cm_action_items_search` / `scalepad_cm_action_items_create` / `scalepad_cm_action_items_update` / `scalepad_cm_action_items_delete` | Remediation action items |94| `scalepad_cm_action_items_upload_document` / `scalepad_cm_action_items_generate_signed_urls` | Action item attachments |9596## Common Workflows97981. **Compliance posture check** — `scalepad_cm_health_list`, then99 `scalepad_cm_risks_list_summaries` and100 `scalepad_cm_controls_list_summaries` for the weak spots.1012. **Evidence chase** — `scalepad_cm_evidence_search` for stale or102 missing evidence, then `scalepad_cm_evidence_requests_create` to103 request updates from the client.1043. **Risk remediation** — `scalepad_cm_risks_search` for high105 severity, `scalepad_cm_action_items_create` for each remediation,106 `scalepad_cm_risks_map` to link mitigating controls.107108## Error Handling109110402 means no active ControlMap subscription. A 404 on a known-good ID111usually means the wrong region — verify `X-ScalePad-Region` matches112the tenant. Deletes are irreversible.113114## Best Practices115116- Always confirm the region before a write; ControlMap data is117 region-partitioned (us/eu/ca/au).118- Prefer `*_list_summaries` tools for dashboards — they are cheaper119 than full search + get loops.120- Use signed-URL tools for documents instead of re-uploading.121122## Related Skills123124- [api-patterns](../api-patterns/SKILL.md) - auth, regions, errors125- [lifecycle-manager](../lifecycle-manager/SKILL.md) - roadmap the remediation work
WYRE-AI