Product Discussions

I scheduled a bunch of future assessment's but now I need to delete them. I do not see a way to do this in bulk. As it stands now I have approximately 99 scheduled assessment's across three vendors. It would be better if we could Bulk Delete Future Vendor Assessments that are scheduled.

I cannot seem to find any documentation explaining what the audit properties fields “class” and “category” are defined as.1.Can someone help define these for me?2.In what specific audit scenarios would you populate these fields?Thank you!

Hello everyone, I have a question about tracking Action Item remediation tasks in my PSA. It seems logical to me for there to be a integration between the ControlMap Action Items and the MSP’s PSA to track and manage remediation tasks. In my mind once a Risk is identified in ControlMap and an associated Action Item created, that action item needs to be handed off to the PSA so that a ticket can be created and managed through completion, just like all the other support tickets? Once the ticket is closed, it can then update the Action Item in ControlMap and serve as the evidence that the Action Item was remediated.  Does this make sense to everyone, or am I missing something. Maybe someone out there can let me know how you track and manage action items in ControlMap. Thank you all.Louis

Is there a REST API or plans for a REST API for ControlMap? A couple things I’m trying to do:Pull all Policies from our clients to do an AI analysis of deviations from the standard as well as provide updates to policies in bulk through automations. Provide a standardized piece of Evidence for certain Evidence types. I would want to search all clients for whether they need a particular evidence type and then upload an Evidence document in bulk via automations. There are a couple more ideas in the future but they are mostly focused around Policies and Evidence. I just want to be able pulls list of Policies and Evidence and make updates.

Check out the ScalePad API docs here: https://developer.scalepad.com/ Have you tried using the ScalePad API yet? It’s a great way to connect ScalePad with your own tools, automate tasks, or build custom workflows. What have you built so far, or what would you like to try building with the API?

Do we have to use the Baseline Controls (and corresponding evidence) in every instance and every tenant? What are situations where we should use the BC and scenarios when we don’t?

Can anyone provide the roadmap/timeline for adding new Controls and Control Families to ControlMap? For example, right now there’s a set of controls for NIST CSF, but not for NIST CSF 2.0. And, as it stands for many Frameworks, the evidence is mapped to the controls, so without the right controls, completing evidence requests doesn’t change the status of the controls or assessment questions in the Framework.

What are all of the conditions by which Evidence Requests and other Documents get auto-created?I was doing some testing and had removed all evidence requests in the system that got pre-populated when I initially loaded CSF framework and some documents. Loaded other frameworks and no other evidence requests were auto-populated or asked if I wanted them re-populated.How can we “re-load” these when desired? Do only certain frameworks provide auto-created evidence requests? If so, which ones?Are Evidence Requests only created when the very first framework is loaded? I can’t find much documentation on this topic and really need some answers please.  

Why is ControlMap showing out of scope requirements in assessment questions? This is causing confusion with clients and our assessors. Is there a way to get the system to correct this as this also shows up in assessment reporting? I have attached a sample screenshot to show you which requirements I specifically set to out of scope in the system and how they are still showing up here in the “Applies to” section. Only one of these requirements is truly in scope.   

I am a Super Admin in our MSP and currently the person who creates most of the client tenants. I noticed that whoever creates a tenant is the person who gets auto assigned to the following:Framework owner Control set owner (when control sets are loaded) Evidence request owner AND assignee (when system auto-creates evidence request) Policies, procedures and governance documents (when created manually or by loading a template)In one of the tenants, I set all of the above to another user and I currently have my notification channels set to “email” and have my notification preferences as follows: Notify me only when I am added as a watcherYou will be notified of changes or updates to a policy, procedure, evidence, control, or risk when you explicitly add yourself as a watcher to that entity.Notify me only when I am an ownerYou will be notified of changes or updates to entities like policy or evidence tha

We’d like to have a feature implemented within Backup Radar to show if backups are encrypted and/or immutable backups are enabled within Microsoft Azure for each client.

I have a tenant who one of my colleagues created, and when they created the frameworks, they didn’t use Quick Start, so none of the related evidence requests were populated in the evidence section. In order to get the mapped evidence to populate can I:Delete all existing frameworks and run the Quick Start again? Import the evidence with the mappings?Cheers

We sent an assessment to a client and they responded to the questions and attached artifacts to support their answers. We noticed in the system that when you click on the question they attached the artifact to, it lands in the Documents tab - and that tab does not exist for questions that the client did NOT attached items to. At the objectives level, the objective attached to that particular question shows the artifacts in the Policies & Procedure tab. How can we attach these artifacts as evidence to satisfy the requirement? Do we have to create a new evidence request and download them, then upload and attach? Seems counter productive. There seems to be no way the system identifies these as evidence or a way to map them. Please advise. Thanks! (screenshots attached)

Currently the Approval Process is pretty limited, you can only assign one person to a single approval policy. We utilize different templates, for example, I want all project work to be approved by our Project Team, for small items, I want that to be approved by a Manager, for MSA, I want that to be approved by someone else.Also, adding in layer approvals. If Margins fall below say 20%, it gets approved by a Manager, if it falls below 10%, it needs to get approved by an Executive. Or even if discounts are applied, it should be approved by specific person.Just having the options creates some flexibility. 

As of 4pm PST, on 10-17-2025, our whole company can not login to quoter.I see scheduled maintenance is scheduled to begin at 8pm eastern time - but I am guessing your team jumped the gun and interrupted with our workday..We get a webpage with the below info: This XML file does not appear to have any style information associated with it. The document tree is shown below.<Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>

Hi,With HPE Aruba switches, Lifecycle Manager is picking up the base warranty which is generally for a 5 month period before it moves to the Limited lifetime warranty that has years on it. Here is an example:Do I have to manually go in an update each of the switches with the correct warranty date or is this something you can fix centrally, or have the system pick up the correct warranty?  Regards

Is there a way to specify which data source is used for the final summary in the ScalePad reporting integration?We’ve noticed that some of our assets receive data from both Datto RMM and HP Inc Lookup, but the final summary currently selects HP Inc Lookup as the source. We would prefer it to use the Datto RMM data instead.Could you please advise if there’s a setting or configuration to control this behavior?

Hi,Is there a way to change the date formatting from US to UK in ControlMap?

I want to understand how the data is calculate, does it include only open tickets ? open and closed within a certain timeframe? How does it deal with Merged or bundled tickets?Is it possible to get to 100% config attached or what is the target for this?