About

Build your own questionnaires (assessments) and your own policies, procedures and governance documents once, then share a copy with each client that needs them. You don't have to rebuild the same content in every client portal.

Where to find each tool:

• Assessments: in the MSP portal top bar, select Assessment. The page is titled "Assessments".
• Documents: in the MSP portal top bar, select Documents. Three tabs sit under the bar: Policies, Procedures and Governance.

Super Admins use both. Compliance Managers see only the Dashboard in the top bar.

Your assessments

Select Assessment to see all of your assessments. When you have none yet, the page shows an "Upload a custom assessment" card with an Upload button. Otherwise it shows a count such as "Showing 4 assessments", a New Assessment button and a table.

The table has these columns:

• Name: select an assessment's name to open its questions.
• # of Questions: for example "21 questions".
• Created On.
• Shared With: reads "Shared 3 times", or stays blank if you have never shared it. Select it to see the clients that hold a copy and the date each was shared.
• Action: a three-dot menu with Edit, Upload Questions, Share with tenants, Clone Assessment and Delete.

Create an assessment

1. Select Assessment › New Assessment, or Upload if your list is empty. The "Create a new assessment" panel opens.
2. Type the Assessment Name.
3. Select Create Assessment to start with an empty assessment, or Create Assessment & Upload Questions to go straight to uploading questions.

Work with the questions in an assessment

Select an assessment's name to open it. A link, All assessments, takes you back to the list, and the buttons Upload Questions and Add Question sit at the top right. An assessment with no questions shows "-- No Questions --".

The questions table has these columns:

• Question: the question code followed by the question text.
• Category.
• Subcategory.
• Applies to: the framework objectives the question is mapped to.
• Actions: a three-dot menu with Change Mappings and Delete.

Long assessments are split into pages. Use the page selector at the bottom to move between them.

Select a question to narrow the list to it and open a detail panel on the right. The panel shows Code, Question, Category, Sub Category, Guidance and Applies to. You edit Code, Question, Category and Sub Category in place, and Guidance has its own editor.

Add a question by hand

1. Open the assessment and select Add Question. The panel "Create question for <assessment name> assessment" opens.
2. Fill in Unique Identifier, Question (required), Guidance, Category and Subcategory. For Category and Subcategory, search for an existing one or add a new one.
3. Select Create question, or Cancel to close the panel without saving.

Upload questions from a spreadsheet

1. Open the assessment and select Upload Questions, or select Assessment, open the three-dot menu on the assessment and choose Upload Questions. The panel "Import questions from a file" opens.
2. On the "Upload File" step, select Choose File and pick a .csv file of up to 10 MB. Choose the delimiter, then select Next. To start from a template, select "Click here to download Sample file".
3. On the "Map Fields" step, match each ControlMap field to a column in your file, then select Validate.
4. Select Import to bring in the validated questions.

The fields you map:

• Question Id: required, must be unique, up to 8 characters.
• Question: required.
• Category: required, up to 250 characters.
• Subcategory: required, up to 250 characters.
• Guidance: optional, up to 1000 characters.
• Mappings: links the question to framework objectives. Write each entry as Framework Name|Requirement Id and separate entries with a semicolon, for example SOC2|CC1.1; NIST CSF|ID.AM-1; CIS V8|3.1.1.

Map a question to framework objectives

1. In the questions table, open the question's three-dot menu and select Change Mappings. The panel "Framework mappings for question <code>" opens.
2. Search for objectives to add, or remove objectives that are already mapped.
3. The Applies to column updates to match.

Delete a question

Open the question's three-dot menu and select Delete. A confirmation asks "Are you sure, you want to delete this question ?" and offers two choices:

• Delete: removes the question from this assessment only.
• Delete (Include Tenants): also removes it from every client copy.

Share an assessment with clients

1. Select Assessment, open the three-dot menu on the assessment and select Share with tenants. The panel "Share Sample Assessment to selected Pro clients" opens.
2. Tick each client you want. Every client shows its name and tenant ID.
3. Select the button at the bottom, which reads "Create questions in a new Custom Assessment in <n> tenants" and counts the clients you ticked.

What happens next:

• A message confirms the share. The copies are made in the background, so the Shared With column updates a little later.
• Each client you chose gets its own new Custom Assessment containing your questions. It is a copy, not a live link.

Update clients' copies after you change an assessment

Changes you make to your assessment don't reach client copies on their own. To bring them in line, reconcile:

1. On the Assessments page, select the "Shared <n> times" link for the assessment. The panel "Assessment shared with following tenants" opens, listing each client and the date it was shared.
2. Select Reconcile Now, then Yes proceed in the confirmation.
3. A "Sync complete." message appears.

Reconcile makes every client copy match your assessment:

• Questions are matched by their question code, so keep your codes stable.
• New questions are added to each client copy and existing ones are updated.
• Any question in a client copy that is not in your assessment is deleted from that copy.

Other assessment actions

From the three-dot menu in the Action column:

• Edit: opens the "Edit name" panel. Change the Assessment Name, then select Save or Cancel.
• Clone Assessment: creates "Cloned <name>" in your MSP portal with all the questions. The clone isn't shared with anyone.
• Delete on an assessment you have never shared: asks "Are you sure, you want to delete this assessment ?" and warns that all of its questions will be deleted. Select Delete Assessment to confirm.
• Delete on an assessment you have shared: choose Delete Master Assessment Only to keep the client copies, or Delete Master & Shared Assessments to delete the client copies too. For the second choice you need at least the Compliance Manager role on every one of those clients.

Your documents

Select Documents, then a tab: Policies, Procedures or Governance. Each tab is a table with a count such as "Showing 33 Policies", a search icon, a filter icon and an Actions menu.

The table has these columns:

• Id.
• Title: select a title to open the document. An icon beside it shows how the document is kept: managed in ControlMap, an uploaded file, or an external link.
• Owner.
• Last Updated: Policies only.
• Objectives: the framework objectives the document is mapped to.
• Shared With: reads "Shared 1 time" or "Shared 3 times". Select it to see each client and the date it was shared.
• Tags.

To narrow a list, use the search box or the filter icon, which filters by tags.

On the Policies and Procedures tabs, the Actions menu offers:

• Policies: Add Policy and Add from template.
• Procedures: Add Procedure and Add from template, plus Add from Confluence and Add from Notion when those integrations are connected.

An empty tab shows a starter card instead of the table. Policies shows "Create your first policy" with Create Policy and Explore Templates. Procedures shows "Create your first procedure" with Create procedure and Choose Templates. Governance shows "Create your first document" with Create document and Choose Templates.

Create a policy

Procedures and governance documents work the same way, on their own tabs.

1. Select Documents › Policies › Actions › Add Policy, or Create Policy on an empty list. The "Create a new Policy" panel opens.
2. Type the Policy Name.
3. Under "How do you want to setup your policy", choose how to keep it: Manage in ControlMap (the default), Upload as a document or Provide a link to an external system. With Manage in ControlMap you can also select a prebuilt policy to import its content.
4. Select Save, or Cancel to close the panel. The policy opens.

If a policy was created without a way chosen, it asks "How do you want to manage the <policy>?" with three cards, each with a Go! button:

• Manage in ControlMap: create it from a ControlMap template and manage its lifecycle there.
• Upload as a document.
• External Link.

On the policy page you can edit the code and the title in place. The page also has an icon to manage cross framework mappings, a Preview & Download button, and arrows to the previous and next policy.

Create documents from templates

1. Select Documents, open the tab you want, then select Actions › Add from template. On an empty list, select Explore Templates or Choose Templates. The "Select policy template" panel opens.
2. Use Search Policy Template to find templates, then tick one or more. Each template has a type menu and, for templates managed in ControlMap, icons to preview and download it.
3. Select Create Policy, or "Create <n> Policies" when you ticked several.

Share documents with clients

1. On the Policies, Procedures or Governance tab, tick the documents you want to share.
2. Select the share button above the table: "Share (<n>) Policies", or the Procedures or Governance equivalent. The share panel opens.
3. Tick the clients and select Share documents.
4. A message says "Successfully shared policy, it will show up in the list later." The copies are made in the background.

What each client gets:

• Its own copy as a new document, with a new document number such as POL-<n>.
• The sharing user's matching account as the owner, and a review date one year ahead.
• The document's text, uploaded file or link, its tags, its mapped controls and its mapped framework objectives.
• Your company name placeholder, wherever it appears in the text, replaced with that client's organization name.

A shared document is a one-time copy. Later edits to your document don't update the client copies.

Other document actions

• Delete: tick one or more documents, select "Delete (<n>) Policies" (or Procedures or Documents) above the table, then confirm with Yes.
• Export: with documents ticked, open the bulk menu and select Export to download the ticked policies or procedures.