diff --git a/.mcp.json b/.mcp.json
new file mode 100644
index 0000000000..32d5a74110
--- /dev/null
+++ b/.mcp.json
@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "trigger": {
+      "command": "bunx",
+      "args": ["trigger.dev@latest", "mcp"]
+    }
+  }
+}
diff --git a/apps/api/caBundleExtension.ts b/apps/api/caBundleExtension.ts
new file mode 100644
index 0000000000..0e602e0b15
--- /dev/null
+++ b/apps/api/caBundleExtension.ts
@@ -0,0 +1,50 @@
+import type { BuildContext, BuildExtension, BuildManifest } from '@trigger.dev/build';
+import { existsSync } from 'node:fs';
+import { cp, mkdir } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+
+// Path relative to the monorepo root (apps/api or apps/app → ../../packages/db/certs/...)
+const BUNDLE_RELATIVE_FROM_APP = '../../packages/db/certs/rds-global-bundle.pem';
+const BUNDLE_DEST_REL = 'certs/rds-global-bundle.pem';
+
+function findBundleSrc(workingDir: string): string | undefined {
+  // Walk up from workingDir to find the cert — handles both normal checkouts and git worktrees
+  // where workspaceDir points to the main worktree root (wrong for us).
+  const candidates = [
+    resolve(workingDir, BUNDLE_RELATIVE_FROM_APP),
+    resolve(workingDir, '../packages/db/certs/rds-global-bundle.pem'),
+    resolve(workingDir, 'packages/db/certs/rds-global-bundle.pem'),
+  ];
+
+  return candidates.find((c) => existsSync(c));
+}
+
+export function caBundleExtension(): BuildExtension {
+  return {
+    name: 'CABundleExtension',
+    onBuildStart: (context) => {
+      // Real OS env var at task spawn time — verified flow:
+      //   addLayer.deploy.env → manifest.deploy.sync.env → syncEnvVarsWithServer →
+      //   taskRunProcessProvider injects into worker env before Node TLS init.
+      context.addLayer({
+        id: 'ca-bundle-env',
+        deploy: {
+          env: { NODE_EXTRA_CA_CERTS: `/app/${BUNDLE_DEST_REL}` },
+          override: true,
+        },
+      });
+    },
+    onBuildComplete: async (context: BuildContext, manifest: BuildManifest) => {
+      const src = findBundleSrc(context.workingDir);
+      if (!src) {
+        throw new Error(
+          `CABundleExtension: rds-global-bundle.pem not found. Searched relative to ${context.workingDir}`,
+        );
+      }
+      const dest = join(manifest.outputPath, BUNDLE_DEST_REL);
+      await mkdir(dirname(dest), { recursive: true });
+      await cp(src, dest);
+      context.logger.log(`Copied RDS CA bundle to ${BUNDLE_DEST_REL}`);
+    },
+  };
+}
diff --git a/apps/api/prisma/client.js b/apps/api/prisma/client.js
index 47ab4f329a..f0ef56f567 100644
--- a/apps/api/prisma/client.js
+++ b/apps/api/prisma/client.js
@@ -2,8 +2,66 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.db = void 0;
 const client_1 = require("@prisma/client");
+const adapter_pg_1 = require("@prisma/adapter-pg");
 const globalForPrisma = global;
-exports.db = globalForPrisma.prisma || new client_1.PrismaClient();
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+function stripSslMode(connectionString) {
+    const url = new URL(connectionString);
+    url.searchParams.delete('sslmode');
+    return url.toString();
+}
+function isLocalhostUrl(connectionString) {
+    try {
+        const { hostname } = new URL(connectionString);
+        // Strip square brackets from IPv6 host form (e.g. [::1] → ::1)
+        const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+        return LOCAL_HOSTNAMES.has(stripped);
+    }
+    catch {
+        // Malformed URL — be conservative and treat as remote so we don't
+        // accidentally disable TLS verification.
+        return false;
+    }
+}
+function createPrismaClient() {
+    const rawUrl = process.env.DATABASE_URL;
+    const isLocalhost = isLocalhostUrl(rawUrl);
+    // Strategy:
+    // - Localhost: TLS off (typical dev Postgres has no cert).
+    // - Remote with NODE_EXTRA_CA_CERTS set: verified TLS using that bundle
+    //   (e.g. Docker with the RDS CA bundle baked in).
+    // - Remote in explicit opt-out mode (PRISMA_ALLOW_INSECURE_TLS=1):
+    //   unverified TLS — used by Trigger.dev / Vercel envs that connect via
+    //   a tunneled proxy whose cert can't be pinned. Must be set deliberately;
+    //   the previous default ("just turn off verification") silently exposed
+    //   prod connections to MITM. (Cubic finding #1 on PR #2671.)
+    // - Remote with neither: throw at boot — surface the misconfig instead of
+    //   silently downgrading.
+    const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+    const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+    let ssl;
+    if (isLocalhost) {
+        ssl = undefined;
+    }
+    else if (hasCABundle) {
+        ssl = true;
+    }
+    else if (allowInsecure) {
+        ssl = { rejectUnauthorized: false };
+    }
+    else {
+        throw new Error('Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.');
+    }
+    // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+    const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
+    const adapter = new adapter_pg_1.PrismaPg({ connectionString: url, ssl });
+    return new client_1.PrismaClient({
+        adapter,
+        transactionOptions: {
+            timeout: 60000,
+        },
+    });
+}
+exports.db = globalForPrisma.prisma || createPrismaClient();
 if (process.env.NODE_ENV !== 'production')
     globalForPrisma.prisma = exports.db;
-//# sourceMappingURL=client.js.map
\ No newline at end of file
diff --git a/apps/api/prisma/client.ts b/apps/api/prisma/client.ts
index 1bd8069f56..5f3c1738d2 100644
--- a/apps/api/prisma/client.ts
+++ b/apps/api/prisma/client.ts
@@ -1,7 +1,9 @@
 import { PrismaClient } from '@prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
 
-const globalForPrisma = global as unknown as { prisma: PrismaClient };
+const globalForPrisma = global as unknown as { prisma?: PrismaClient };
+
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
@@ -9,13 +11,54 @@ function stripSslMode(connectionString: string): string {
   return url.toString();
 }
 
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    // Strip square brackets from IPv6 host form (e.g. [::1] → ::1)
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    // Malformed URL — be conservative and treat as remote so we don't
+    // accidentally disable TLS verification.
+    return false;
+  }
+}
+
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const isLocalhost = isLocalhostUrl(rawUrl);
+  // Strategy:
+  // - Localhost: TLS off (typical dev Postgres has no cert).
+  // - Remote with NODE_EXTRA_CA_CERTS set: verified TLS using that bundle
+  //   (e.g. Docker with the RDS CA bundle baked in).
+  // - Remote in explicit opt-out mode (PRISMA_ALLOW_INSECURE_TLS=1):
+  //   unverified TLS — used by Trigger.dev / Vercel envs that connect via
+  //   a tunneled proxy whose cert can't be pinned. Must be set deliberately;
+  //   the previous default ("just turn off verification") silently exposed
+  //   prod connections to MITM. (Cubic finding #1 on PR #2671.)
+  // - Remote with neither: throw at boot — surface the misconfig instead of
+  //   silently downgrading.
   const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+  let ssl:
+    | undefined
+    | { checkServerIdentity: () => undefined }
+    | { rejectUnauthorized: false };
+  if (isLocalhost) {
+    ssl = undefined;
+  } else if (hasCABundle) {
+    // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
+    // RDS CA to the trust store). Skip hostname check because connections may
+    // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
+    // The chain check still rejects forged or wrong-CA certs.
+    ssl = { checkServerIdentity: () => undefined };
+  } else if (allowInsecure) {
+    ssl = { rejectUnauthorized: false };
+  } else {
+    throw new Error(
+      'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+    );
+  }
   // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
@@ -27,6 +70,21 @@ function createPrismaClient(): PrismaClient {
   });
 }
 
-export const db = globalForPrisma.prisma || createPrismaClient();
+// Lazy initialization. Importing this module does NOT construct a Prisma client
+// — that only happens on first property access on `db`. Critical so that
+// Next.js `next build` (which imports every route handler to analyze it) does
+// not trigger the strict TLS check at build time when no actual queries run.
+function getClient(): PrismaClient {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = createPrismaClient();
+  }
+  return globalForPrisma.prisma;
+}
 
-if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = db;
+export const db = new Proxy({} as PrismaClient, {
+  get(_target, prop, _receiver) {
+    const client = getClient();
+    const value = Reflect.get(client, prop, client);
+    return typeof value === 'function' ? value.bind(client) : value;
+  },
+});
diff --git a/apps/api/prisma/index.js b/apps/api/prisma/index.js
index a818c99668..b6014e58b0 100644
--- a/apps/api/prisma/index.js
+++ b/apps/api/prisma/index.js
@@ -18,4 +18,3 @@ exports.db = void 0;
 __exportStar(require("@prisma/client"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "db", { enumerable: true, get: function () { return client_1.db; } });
-//# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index 318ba6afde..bf6d8b15fb 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -14,6 +14,7 @@ import { awsConfig } from './config/aws.config';
 import { betterAuthConfig } from './config/better-auth.config';
 import { HealthModule } from './health/health.module';
 import { OrganizationModule } from './organization/organization.module';
+import { OrganizationAccessModule } from './organization-access/organization-access.module';
 import { PoliciesModule } from './policies/policies.module';
 import { RisksModule } from './risks/risks.module';
 import { TasksModule } from './tasks/tasks.module';
@@ -74,6 +75,7 @@ import { BillingModule } from './billing/billing.module';
     ]),
     AuthModule,
     OrganizationModule,
+    OrganizationAccessModule,
     PeopleModule,
     RisksModule,
     VendorsModule,
diff --git a/apps/api/src/auth/permission.guard.ts b/apps/api/src/auth/permission.guard.ts
index fee0efac3b..033922d499 100644
--- a/apps/api/src/auth/permission.guard.ts
+++ b/apps/api/src/auth/permission.guard.ts
@@ -187,12 +187,13 @@ export class PermissionGuard implements CanActivate {
     // the schema rejects every request with `[body] Invalid input`, the
     // catch in canActivate turns that into a generic "Unable to verify
     // permissions" 403, and EVERY cookie-authenticated request returns 403.
-    // Reproduced repo-side via `bun run zod-repro.mjs`. Discovered on
-    // ENG-221 and the same fix applies here.
-    const result = await auth.api.hasPermission({
-      headers,
-      body: { permissions, permission: undefined },
-    });
+    //
+    // Spell the body out via a separate variable so TypeScript's excess-
+    // property check (only applied to fresh object literals) doesn't
+    // reject the extra `permission` key — the runtime accepts the wider
+    // shape per the union schema.
+    const body = { permissions, permission: undefined };
+    const result = await auth.api.hasPermission({ headers, body });
 
     return result.success === true;
   }
diff --git a/apps/api/src/billing/billing.service.spec.ts b/apps/api/src/billing/billing.service.spec.ts
index 05084a2b17..d2cc35915d 100644
--- a/apps/api/src/billing/billing.service.spec.ts
+++ b/apps/api/src/billing/billing.service.spec.ts
@@ -208,6 +208,87 @@ describe('BillingService', () => {
     );
   });
 
+  it('aggregates wallet credit balances per product in getStatus', async () => {
+    // The customer-facing /v1/billing/status response is the only
+    // surface the pentest + BG-check UIs read from. If we ever stop
+    // including creditBalances here, both UIs silently regress to
+    // paywalling users whose admin-granted credits would be consumed
+    // by the create endpoint. Lock the contract with this test.
+    const listBalances = jest.fn().mockResolvedValue([
+      {
+        id: 'bcb_1',
+        productKey: 'pentest',
+        skuKey: null,
+        balance: 3,
+        totalGranted: 5,
+        totalConsumed: 2,
+        totalRefunded: 0,
+        lastSource: 'manual',
+        updatedAt: '2026-05-01T00:00:00.000Z',
+      },
+      {
+        id: 'bcb_2',
+        productKey: 'pentest',
+        skuKey: 'pentest_monthly_1',
+        balance: 2,
+        totalGranted: 2,
+        totalConsumed: 0,
+        totalRefunded: 0,
+        lastSource: 'topup',
+        updatedAt: '2026-05-01T00:00:00.000Z',
+      },
+      {
+        id: 'bcb_3',
+        productKey: 'background_check',
+        skuKey: null,
+        balance: 4,
+        totalGranted: 4,
+        totalConsumed: 0,
+        totalRefunded: 0,
+        lastSource: 'manual',
+        updatedAt: '2026-05-01T00:00:00.000Z',
+      },
+    ]);
+    const service = new BillingService(
+      mockStripeService({
+        invoices: { list: jest.fn().mockResolvedValue({ data: [] }) },
+        customers: { retrieve: jest.fn().mockResolvedValue({}) },
+        paymentMethods: { retrieve: jest.fn() },
+      }),
+      { syncSubscriptionItem: jest.fn() } as never,
+      { listBalances } as never,
+    );
+
+    const result = await service.getStatus('org_1');
+
+    expect(listBalances).toHaveBeenCalledWith('org_1');
+    expect(result.creditBalances).toEqual(
+      expect.arrayContaining([
+        { productKey: 'pentest', balance: 5 },
+        { productKey: 'background_check', balance: 4 },
+      ]),
+    );
+    expect(result.creditBalances).toHaveLength(2);
+  });
+
+  it('returns an empty creditBalances array when no credits service is wired in', async () => {
+    // BillingCreditsService is @Optional() so unit tests can keep
+    // hand-constructing BillingService without it. Verify the absent-
+    // dependency branch produces a typesafe empty array, not undefined.
+    const service = new BillingService(
+      mockStripeService({
+        invoices: { list: jest.fn().mockResolvedValue({ data: [] }) },
+        customers: { retrieve: jest.fn().mockResolvedValue({}) },
+        paymentMethods: { retrieve: jest.fn() },
+      }),
+      { syncSubscriptionItem: jest.fn() } as never,
+    );
+
+    const result = await service.getStatus('org_1');
+
+    expect(result.creditBalances).toEqual([]);
+  });
+
   it('marks trial eligibility false after any product subscription history', async () => {
     organizationBillingSubscriptionFindMany.mockResolvedValue([
       {
diff --git a/apps/api/src/billing/billing.service.ts b/apps/api/src/billing/billing.service.ts
index 43fa2d84cb..7fe8792bf4 100644
--- a/apps/api/src/billing/billing.service.ts
+++ b/apps/api/src/billing/billing.service.ts
@@ -2,6 +2,7 @@ import {
   BadRequestException,
   Injectable,
   NotFoundException,
+  Optional,
 } from '@nestjs/common';
 import { db } from '@db';
 import {
@@ -12,6 +13,7 @@ import {
   isSubscriptionBillingSkuKey,
 } from '@trycompai/billing';
 import { StripeService } from '../stripe/stripe.service';
+import { BillingCreditsService } from './billing-credits.service';
 import { findOrCreateBillingCustomer } from './billing-customer';
 import { BillingEntitlementsService } from './billing-entitlements.service';
 import { listBillingInvoices } from './billing-invoices';
@@ -38,6 +40,10 @@ export class BillingService {
   constructor(
     private readonly stripeService: StripeService,
     private readonly entitlements: BillingEntitlementsService,
+    // Optional so existing unit tests that hand-construct BillingService
+    // (without a credits service) keep working. In production the
+    // BillingModule always provides it.
+    @Optional() private readonly credits?: BillingCreditsService,
   ) {}
 
   async getStatus(organizationId: string): Promise<BillingStatus> {
@@ -67,18 +73,31 @@ export class BillingService {
       db.backgroundCheckRequest.count({ where: { organizationId } }),
       db.securityPenetrationTestRun.count({ where: { organizationId } }),
     ]);
-    const [invoices, preferences, usageRows] = await Promise.all([
-      listBillingInvoices({
-        stripeService: this.stripeService,
-        stripeCustomerId: billing?.stripeCustomerId ?? null,
-      }),
-      getBillingPreferences({
-        stripeService: this.stripeService,
-        stripeCustomerId: billing?.stripeCustomerId ?? null,
-        fallbackCompanyName: organization.name,
-      }),
-      listBillingUsageRows({ organizationId, subscriptions }),
-    ]);
+    const [invoices, preferences, usageRows, creditBalances] =
+      await Promise.all([
+        listBillingInvoices({
+          stripeService: this.stripeService,
+          stripeCustomerId: billing?.stripeCustomerId ?? null,
+        }),
+        getBillingPreferences({
+          stripeService: this.stripeService,
+          stripeCustomerId: billing?.stripeCustomerId ?? null,
+          fallbackCompanyName: organization.name,
+        }),
+        listBillingUsageRows({ organizationId, subscriptions }),
+        // Sum wallet balances per product. There can be multiple
+        // BillingCreditBalance rows per (org, product) when grants are
+        // scoped to a specific SKU, so we aggregate before returning.
+        this.credits
+          ? this.credits.listBalances(organizationId)
+          : Promise.resolve([]),
+      ]);
+
+    const creditBalancesByProduct = new Map<BillingProductKey, number>();
+    for (const balance of creditBalances) {
+      const current = creditBalancesByProduct.get(balance.productKey) ?? 0;
+      creditBalancesByProduct.set(balance.productKey, current + balance.balance);
+    }
 
     return {
       hasBilling: !!billing,
@@ -98,6 +117,9 @@ export class BillingService {
         currentPeriodEnd: subscription.currentPeriodEnd?.toISOString() ?? null,
         cancelAtPeriodEnd: subscription.cancelAtPeriodEnd,
       })),
+      creditBalances: Array.from(creditBalancesByProduct.entries()).map(
+        ([productKey, balance]) => ({ productKey, balance }),
+      ),
       invoices,
     };
   }
diff --git a/apps/api/src/billing/billing.types.ts b/apps/api/src/billing/billing.types.ts
index f9db394ae9..fd3b4e13c4 100644
--- a/apps/api/src/billing/billing.types.ts
+++ b/apps/api/src/billing/billing.types.ts
@@ -1,3 +1,4 @@
+import type { BillingProductKey } from '@trycompai/billing';
 import type { BillingInvoice } from './billing-invoices';
 import type { BillingPreferences } from './billing-preferences';
 
@@ -24,6 +25,15 @@ export interface BillingStatus {
     currentPeriodEnd: string | null;
     cancelAtPeriodEnd: boolean;
   }>;
+  // Aggregated wallet balance per product. Mirrors what
+  // `BillingEntitlementsService.tryConsumeIncludedUsageForProduct` falls
+  // back to when a Stripe subscription is missing or exhausted, so the UI
+  // can keep its allowance display in sync with the backend's actual
+  // consumption decision.
+  creditBalances: Array<{
+    productKey: BillingProductKey;
+    balance: number;
+  }>;
   invoices: BillingInvoice[];
 }
 
diff --git a/apps/api/src/evidence-forms/evidence-forms.controller.ts b/apps/api/src/evidence-forms/evidence-forms.controller.ts
index e52d0fbf2f..cec36356d0 100644
--- a/apps/api/src/evidence-forms/evidence-forms.controller.ts
+++ b/apps/api/src/evidence-forms/evidence-forms.controller.ts
@@ -86,7 +86,7 @@ export class EvidenceFormsController {
   }
 
   @Get('my-submissions')
-  @RequirePermission('evidence', 'read')
+  @RequirePermission('portal', 'update')
   @ApiOperation({
     summary: 'Get current user submissions',
     description:
@@ -105,7 +105,7 @@ export class EvidenceFormsController {
   }
 
   @Get('my-submissions/pending-count')
-  @RequirePermission('evidence', 'read')
+  @RequirePermission('portal', 'update')
   @ApiOperation({
     summary: 'Get pending submission count for current user',
     description:
@@ -188,7 +188,7 @@ export class EvidenceFormsController {
   }
 
   @Post(':formType/submissions')
-  @RequirePermission('evidence', 'create')
+  @RequirePermission('portal', 'update')
   @ApiOperation({
     summary: 'Submit evidence form entry',
     description:
@@ -253,7 +253,7 @@ export class EvidenceFormsController {
   }
 
   @Post('uploads')
-  @RequirePermission('evidence', 'create')
+  @RequirePermission('portal', 'update')
   @ApiOperation({
     summary: 'Upload evidence form file',
     description:
diff --git a/apps/api/src/frameworks/frameworks-scores.helper.ts b/apps/api/src/frameworks/frameworks-scores.helper.ts
index 1671598d12..c4cfca9cf1 100644
--- a/apps/api/src/frameworks/frameworks-scores.helper.ts
+++ b/apps/api/src/frameworks/frameworks-scores.helper.ts
@@ -20,7 +20,11 @@ export async function getOverviewScores(organizationId: string) {
       }),
       db.task.findMany({ where: { organizationId, archivedAt: null } }),
       db.member.findMany({
-        where: { organizationId, deactivated: false },
+        where: {
+          organizationId,
+          deactivated: false,
+          isActive: true,
+        },
         include: { user: true },
       }),
       db.onboarding.findUnique({
diff --git a/apps/api/src/organization-access/organization-access.controller.ts b/apps/api/src/organization-access/organization-access.controller.ts
new file mode 100644
index 0000000000..67d38850fa
--- /dev/null
+++ b/apps/api/src/organization-access/organization-access.controller.ts
@@ -0,0 +1,44 @@
+import {
+  Controller,
+  HttpCode,
+  HttpStatus,
+  Post,
+  UseGuards,
+} from '@nestjs/common';
+import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { AuthContext, OrganizationId } from '../auth/auth-context.decorator';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import { PermissionGuard } from '../auth/permission.guard';
+import { RequirePermission } from '../auth/require-permission.decorator';
+import type { AuthContext as AuthContextType } from '../auth/types';
+import {
+  AutoApproveResult,
+  OrganizationAccessService,
+} from './organization-access.service';
+
+@ApiTags('Organization')
+@Controller({ path: 'organization-access', version: '1' })
+@UseGuards(HybridAuthGuard, PermissionGuard)
+export class OrganizationAccessController {
+  constructor(
+    private readonly organizationAccessService: OrganizationAccessService,
+  ) {}
+
+  @Post('auto-approve')
+  @HttpCode(HttpStatus.OK)
+  @RequirePermission('organization', 'update')
+  @ApiOperation({
+    summary: 'Auto-approve organization access via domain or self-hosted check',
+    description:
+      'Grants hasAccess on the active organization if the requesting user is an internal trycomp.ai user, the deployment is self-hosted, or the user email domain matches the organization website domain and is an active Stripe customer.',
+  })
+  async autoApprove(
+    @OrganizationId() organizationId: string,
+    @AuthContext() authContext: AuthContextType,
+  ): Promise<AutoApproveResult> {
+    return this.organizationAccessService.autoApproveAccess({
+      organizationId,
+      userEmail: authContext.userEmail,
+    });
+  }
+}
diff --git a/apps/api/src/organization-access/organization-access.module.ts b/apps/api/src/organization-access/organization-access.module.ts
new file mode 100644
index 0000000000..378b96789e
--- /dev/null
+++ b/apps/api/src/organization-access/organization-access.module.ts
@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { OrganizationAccessController } from './organization-access.controller';
+import { OrganizationAccessService } from './organization-access.service';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [OrganizationAccessController],
+  providers: [OrganizationAccessService],
+})
+export class OrganizationAccessModule {}
diff --git a/apps/api/src/organization-access/organization-access.service.spec.ts b/apps/api/src/organization-access/organization-access.service.spec.ts
new file mode 100644
index 0000000000..211b60779f
--- /dev/null
+++ b/apps/api/src/organization-access/organization-access.service.spec.ts
@@ -0,0 +1,239 @@
+import { NotFoundException } from '@nestjs/common';
+import { db } from '@db';
+import { OrganizationAccessService } from './organization-access.service';
+
+jest.mock('@db', () => ({
+  db: {
+    organization: {
+      findUnique: jest.fn(),
+      update: jest.fn(),
+    },
+  },
+}));
+
+const mockedDb = db as unknown as {
+  organization: {
+    findUnique: jest.Mock;
+    update: jest.Mock;
+  };
+};
+
+const buildService = (
+  overrides: Partial<{ isDomainActiveCustomer: jest.Mock }> = {},
+) => {
+  const isDomainActiveCustomer =
+    overrides.isDomainActiveCustomer ?? jest.fn().mockResolvedValue(false);
+  const stripeService = { isDomainActiveCustomer } as never;
+  return {
+    service: new OrganizationAccessService(stripeService),
+    isDomainActiveCustomer,
+  };
+};
+
+describe('OrganizationAccessService', () => {
+  const ORIGINAL_SELF_HOSTED = process.env.SELF_HOSTED;
+  const ORIGINAL_NEXT_SELF_HOSTED = process.env.NEXT_PUBLIC_SELF_HOSTED;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.SELF_HOSTED;
+    delete process.env.NEXT_PUBLIC_SELF_HOSTED;
+    mockedDb.organization.update.mockResolvedValue({});
+  });
+
+  afterAll(() => {
+    if (ORIGINAL_SELF_HOSTED === undefined) {
+      delete process.env.SELF_HOSTED;
+    } else {
+      process.env.SELF_HOSTED = ORIGINAL_SELF_HOSTED;
+    }
+    if (ORIGINAL_NEXT_SELF_HOSTED === undefined) {
+      delete process.env.NEXT_PUBLIC_SELF_HOSTED;
+    } else {
+      process.env.NEXT_PUBLIC_SELF_HOSTED = ORIGINAL_NEXT_SELF_HOSTED;
+    }
+  });
+
+  it('throws NotFoundException when org does not exist', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue(null);
+    const { service } = buildService();
+
+    await expect(
+      service.autoApproveAccess({
+        organizationId: 'org_x',
+        userEmail: 'a@b.com',
+      }),
+    ).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('returns already-has-access without writing when org has access', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: true,
+      website: 'acme.com',
+    });
+    const { service } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'user@acme.com',
+    });
+
+    expect(result).toEqual({
+      hasAccess: true,
+      autoApproved: false,
+      reason: 'already-has-access',
+    });
+    expect(mockedDb.organization.update).not.toHaveBeenCalled();
+  });
+
+  it('grants on self-hosted via SELF_HOSTED env', async () => {
+    process.env.SELF_HOSTED = 'true';
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: null,
+    });
+    const { service, isDomainActiveCustomer } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'user@gmail.com',
+    });
+
+    expect(result).toEqual({
+      hasAccess: true,
+      autoApproved: true,
+      reason: 'self-hosted',
+    });
+    expect(mockedDb.organization.update).toHaveBeenCalledWith({
+      where: { id: 'org_1' },
+      data: { hasAccess: true },
+    });
+    expect(isDomainActiveCustomer).not.toHaveBeenCalled();
+  });
+
+  it('grants on @trycomp.ai email without consulting Stripe', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'acme.com',
+    });
+    const { service, isDomainActiveCustomer } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'tofik@trycomp.ai',
+    });
+
+    expect(result).toEqual({
+      hasAccess: true,
+      autoApproved: true,
+      reason: 'trycomp-email',
+    });
+    expect(isDomainActiveCustomer).not.toHaveBeenCalled();
+    expect(mockedDb.organization.update).toHaveBeenCalled();
+  });
+
+  it('grants when user email domain matches org website AND is an active Stripe customer', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'https://acme.com',
+    });
+    const { service, isDomainActiveCustomer } = buildService({
+      isDomainActiveCustomer: jest.fn().mockResolvedValue(true),
+    });
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'cfo@acme.com',
+    });
+
+    expect(result).toEqual({
+      hasAccess: true,
+      autoApproved: true,
+      reason: 'stripe-customer',
+    });
+    expect(isDomainActiveCustomer).toHaveBeenCalledWith('acme.com');
+    expect(mockedDb.organization.update).toHaveBeenCalled();
+  });
+
+  it('does not grant when domain matches but Stripe says not an active customer', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'acme.com',
+    });
+    const { service } = buildService({
+      isDomainActiveCustomer: jest.fn().mockResolvedValue(false),
+    });
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'cfo@acme.com',
+    });
+
+    expect(result).toEqual({
+      hasAccess: false,
+      autoApproved: false,
+      reason: 'not-eligible',
+    });
+    expect(mockedDb.organization.update).not.toHaveBeenCalled();
+  });
+
+  it('does not grant when user email domain mismatches org website', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'acme.com',
+    });
+    const { service, isDomainActiveCustomer } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'cfo@example.com',
+    });
+
+    expect(result.autoApproved).toBe(false);
+    expect(result.reason).toBe('not-eligible');
+    expect(isDomainActiveCustomer).not.toHaveBeenCalled();
+  });
+
+  it('does not grant when user domain is a public mailbox provider', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'gmail.com', // pathological — even if website "matches", we refuse
+    });
+    const { service, isDomainActiveCustomer } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: 'someone@gmail.com',
+    });
+
+    expect(result.autoApproved).toBe(false);
+    expect(isDomainActiveCustomer).not.toHaveBeenCalled();
+  });
+
+  it('does not grant when user email is missing', async () => {
+    mockedDb.organization.findUnique.mockResolvedValue({
+      id: 'org_1',
+      hasAccess: false,
+      website: 'acme.com',
+    });
+    const { service } = buildService();
+
+    const result = await service.autoApproveAccess({
+      organizationId: 'org_1',
+      userEmail: undefined,
+    });
+
+    expect(result).toEqual({
+      hasAccess: false,
+      autoApproved: false,
+      reason: 'not-eligible',
+    });
+  });
+});
diff --git a/apps/api/src/organization-access/organization-access.service.ts b/apps/api/src/organization-access/organization-access.service.ts
new file mode 100644
index 0000000000..818acecfc9
--- /dev/null
+++ b/apps/api/src/organization-access/organization-access.service.ts
@@ -0,0 +1,115 @@
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { db } from '@db';
+import { extractDomain, isPublicEmailDomain } from '../stripe/domain.utils';
+import { StripeService } from '../stripe/stripe.service';
+
+export type AutoApproveReason =
+  | 'already-has-access'
+  | 'self-hosted'
+  | 'trycomp-email'
+  | 'stripe-customer'
+  | 'not-eligible';
+
+export interface AutoApproveResult {
+  hasAccess: boolean;
+  autoApproved: boolean;
+  reason: AutoApproveReason;
+}
+
+const isSelfHosted = (): boolean =>
+  process.env.SELF_HOSTED === 'true' ||
+  process.env.NEXT_PUBLIC_SELF_HOSTED === 'true';
+
+@Injectable()
+export class OrganizationAccessService {
+  private readonly logger = new Logger(OrganizationAccessService.name);
+
+  constructor(private readonly stripeService: StripeService) {}
+
+  /**
+   * Decide whether to grant `hasAccess` to the org for the given user, and
+   * persist the flag if so. Membership is enforced upstream by HybridAuthGuard
+   * (the auth guard rejects requests where the user isn't an active member of
+   * the active organization), but we re-fetch the organization here for the
+   * website + current hasAccess values.
+   *
+   * Decision rules (in order):
+   *   1. Org already has access → no-op.
+   *   2. Self-hosted instance → grant.
+   *   3. User email at @trycomp.ai → grant (internal team).
+   *   4. User email domain matches the org website domain AND that domain has
+   *      an active Stripe customer → grant. Public mailbox domains are
+   *      excluded.
+   *   5. Otherwise → not eligible.
+   */
+  async autoApproveAccess(input: {
+    organizationId: string;
+    userEmail: string | undefined;
+  }): Promise<AutoApproveResult> {
+    const { organizationId, userEmail } = input;
+
+    const organization = await db.organization.findUnique({
+      where: { id: organizationId },
+      select: { id: true, hasAccess: true, website: true },
+    });
+
+    if (!organization) {
+      throw new NotFoundException('Organization not found');
+    }
+
+    if (organization.hasAccess) {
+      return {
+        hasAccess: true,
+        autoApproved: false,
+        reason: 'already-has-access',
+      };
+    }
+
+    if (isSelfHosted()) {
+      await this.grantAccess(organizationId);
+      this.logger.log(
+        `Auto-approved org ${organizationId} (reason: self-hosted)`,
+      );
+      return { hasAccess: true, autoApproved: true, reason: 'self-hosted' };
+    }
+
+    const userEmailDomain = extractDomain(userEmail);
+    const orgWebsiteDomain = extractDomain(organization.website);
+
+    if (!userEmailDomain) {
+      return { hasAccess: false, autoApproved: false, reason: 'not-eligible' };
+    }
+
+    const isTrycompEmail = userEmailDomain === 'trycomp.ai';
+
+    const canAutoApproveViaDomain =
+      !isTrycompEmail &&
+      Boolean(orgWebsiteDomain) &&
+      userEmailDomain === orgWebsiteDomain &&
+      !isPublicEmailDomain(userEmailDomain);
+
+    const isStripeCustomer = canAutoApproveViaDomain
+      ? await this.stripeService.isDomainActiveCustomer(userEmailDomain)
+      : false;
+
+    if (isTrycompEmail || isStripeCustomer) {
+      await this.grantAccess(organizationId);
+      const reason: AutoApproveReason = isTrycompEmail
+        ? 'trycomp-email'
+        : 'stripe-customer';
+      this.logger.log(
+        `Auto-approved org ${organizationId} (reason: ${reason}, domain: ${userEmailDomain})`,
+      );
+      return { hasAccess: true, autoApproved: true, reason };
+    }
+
+    return { hasAccess: false, autoApproved: false, reason: 'not-eligible' };
+  }
+
+  private async grantAccess(organizationId: string): Promise<void> {
+    await db.organization.update({
+      where: { id: organizationId },
+      data: { hasAccess: true },
+    });
+  }
+}
diff --git a/apps/api/src/policies/policies.controller.ts b/apps/api/src/policies/policies.controller.ts
index 105260e843..67a4587c40 100644
--- a/apps/api/src/policies/policies.controller.ts
+++ b/apps/api/src/policies/policies.controller.ts
@@ -1319,7 +1319,7 @@ Keep responses helpful and focused on the policy editing task.`;
     ];
 
     const result = streamText({
-      model: openai('gpt-5.1'),
+      model: openai('gpt-5.5'),
       system: systemPrompt,
       messages: convertToModelMessages(messages),
     });
diff --git a/apps/api/src/risks/risks.service.ts b/apps/api/src/risks/risks.service.ts
index 37c920d4ec..e4d29cff92 100644
--- a/apps/api/src/risks/risks.service.ts
+++ b/apps/api/src/risks/risks.service.ts
@@ -8,6 +8,7 @@ import { db, Prisma } from '@db';
 import { CreateRiskDto } from './dto/create-risk.dto';
 import { GetRisksQueryDto } from './dto/get-risks-query.dto';
 import { UpdateRiskDto } from './dto/update-risk.dto';
+import { resolveStrategyDescriptionUpdate } from './strategy-descriptions';
 
 export interface PaginatedRisksResult {
   data: Prisma.RiskGetPayload<{
@@ -94,6 +95,10 @@ export class RisksService {
                 },
               },
             },
+            // Linked task statuses are needed by the table to compute the
+            // current (interpolated) severity score so the badge reflects
+            // treatment progress, not just inherent risk.
+            tasks: { select: { id: true, status: true } },
           },
         }),
         db.risk.count({ where }),
@@ -128,6 +133,14 @@ export class RisksService {
               user: true,
             },
           },
+          tasks: {
+            select: {
+              id: true,
+              title: true,
+              status: true,
+              controls: { select: { id: true, name: true } },
+            },
+          },
         },
       });
 
@@ -182,8 +195,8 @@ export class RisksService {
     updateRiskDto: UpdateRiskDto,
   ) {
     try {
-      // First check if the risk exists in the organization
-      await this.findById(id, organizationId);
+      // Need the existing row to resolve strategy/description swaps below.
+      const existing = await this.findById(id, organizationId);
 
       if (updateRiskDto.assigneeId) {
         await this.validateAssigneeNotPlatformAdmin(
@@ -192,9 +205,18 @@ export class RisksService {
         );
       }
 
+      // Keep per-strategy descriptions independent in the strategyDescriptions
+      // JSON map: a Mitigate plan, an Accept rationale, and a Transfer
+      // rationale all live alongside each other, swapped in/out of the active
+      // `treatmentStrategyDescription` field as the user changes strategy.
+      const resolvedStrategyFields = resolveStrategyDescriptionUpdate(
+        existing,
+        updateRiskDto,
+      );
+
       const updatedRisk = await db.risk.update({
         where: { id },
-        data: updateRiskDto,
+        data: { ...updateRiskDto, ...resolvedStrategyFields },
       });
 
       this.logger.log(`Updated risk: ${updatedRisk.title} (${id})`);
diff --git a/apps/api/src/risks/strategy-descriptions.spec.ts b/apps/api/src/risks/strategy-descriptions.spec.ts
new file mode 100644
index 0000000000..6da074d226
--- /dev/null
+++ b/apps/api/src/risks/strategy-descriptions.spec.ts
@@ -0,0 +1,124 @@
+import { describe, expect, it, jest } from '@jest/globals';
+
+// Mock @db before importing the helper so we don't pull in the real Prisma
+// client (which requires DATABASE_URL at module load).
+jest.mock('@db', () => ({
+  RiskTreatmentType: {
+    accept: 'accept',
+    avoid: 'avoid',
+    mitigate: 'mitigate',
+    transfer: 'transfer',
+  },
+}));
+
+import { RiskTreatmentType } from '@db';
+import { resolveStrategyDescriptionUpdate } from './strategy-descriptions';
+
+const baseExisting = {
+  treatmentStrategy: RiskTreatmentType.mitigate,
+  treatmentStrategyDescription: 'Current mitigate plan',
+  strategyDescriptions: {} as unknown,
+};
+
+describe('resolveStrategyDescriptionUpdate', () => {
+  it('returns empty when neither strategy nor description is changing', () => {
+    expect(resolveStrategyDescriptionUpdate(baseExisting, {})).toEqual({});
+    expect(
+      resolveStrategyDescriptionUpdate(baseExisting, { assigneeId: 'mbr_1' } as never),
+    ).toEqual({});
+  });
+
+  it('on strategy change: saves current description into the OLD slot', () => {
+    const result = resolveStrategyDescriptionUpdate(baseExisting, {
+      treatmentStrategy: RiskTreatmentType.accept,
+    });
+    expect(result.treatmentStrategy).toBe(RiskTreatmentType.accept);
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+    });
+    // Active text becomes empty (no Accept rationale saved yet)
+    expect(result.treatmentStrategyDescription).toBeNull();
+  });
+
+  it('on strategy change: loads NEW strategy slot into active text when present', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: {
+          accept: 'We accept this risk because of cost-benefit analysis.',
+        },
+      },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    expect(result.treatmentStrategyDescription).toBe(
+      'We accept this risk because of cost-benefit analysis.',
+    );
+    // Mitigate plan still preserved in the map
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+      accept: 'We accept this risk because of cost-benefit analysis.',
+    });
+  });
+
+  it('on description change without strategy change: mirrors into active strategy slot', () => {
+    const result = resolveStrategyDescriptionUpdate(baseExisting, {
+      treatmentStrategyDescription: 'Updated mitigate plan',
+    });
+    expect(result.treatmentStrategy).toBeUndefined();
+    expect(result.treatmentStrategyDescription).toBe('Updated mitigate plan');
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Updated mitigate plan',
+    });
+  });
+
+  it('on both change: explicit description wins as the new active text', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: {
+          accept: 'Old accept rationale',
+        },
+      },
+      {
+        treatmentStrategy: RiskTreatmentType.accept,
+        treatmentStrategyDescription: 'Brand-new accept rationale',
+      },
+    );
+    expect(result.treatmentStrategy).toBe(RiskTreatmentType.accept);
+    expect(result.treatmentStrategyDescription).toBe('Brand-new accept rationale');
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+      accept: 'Brand-new accept rationale',
+    });
+  });
+
+  it('clears the slot when description is set to empty', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      {
+        ...baseExisting,
+        strategyDescriptions: { mitigate: 'old text' },
+      },
+      { treatmentStrategyDescription: '' },
+    );
+    expect(result.strategyDescriptions).toEqual({});
+  });
+
+  it('handles malformed strategyDescriptions gracefully', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      { ...baseExisting, strategyDescriptions: 'not an object' as unknown },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    // Falls back to empty map; saves current Mitigate text
+    expect(result.strategyDescriptions).toEqual({
+      mitigate: 'Current mitigate plan',
+    });
+  });
+
+  it('does not save an empty old description into the slot', () => {
+    const result = resolveStrategyDescriptionUpdate(
+      { ...baseExisting, treatmentStrategyDescription: '' },
+      { treatmentStrategy: RiskTreatmentType.accept },
+    );
+    expect(result.strategyDescriptions).toEqual({});
+  });
+});
diff --git a/apps/api/src/risks/strategy-descriptions.ts b/apps/api/src/risks/strategy-descriptions.ts
new file mode 100644
index 0000000000..1511392286
--- /dev/null
+++ b/apps/api/src/risks/strategy-descriptions.ts
@@ -0,0 +1,91 @@
+import { RiskTreatmentType } from '@db';
+
+interface EntityWithStrategy {
+  treatmentStrategy: RiskTreatmentType;
+  treatmentStrategyDescription: string | null;
+  strategyDescriptions: unknown;
+}
+
+interface UpdateInput {
+  treatmentStrategy?: RiskTreatmentType;
+  treatmentStrategyDescription?: string | null;
+}
+
+export interface ResolvedStrategyUpdate {
+  treatmentStrategy?: RiskTreatmentType;
+  treatmentStrategyDescription?: string | null;
+  strategyDescriptions?: Record<string, string>;
+}
+
+/**
+ * Computes the data fields that need to be persisted when an update touches
+ * `treatmentStrategy` and/or `treatmentStrategyDescription`. The logic keeps
+ * each strategy's description independent in the `strategyDescriptions` JSON
+ * column so a Mitigate plan, an Accept rationale, and a Transfer rationale
+ * can coexist on the same risk/vendor.
+ *
+ * Cases:
+ * - Strategy changes → save the current description into the OLD strategy
+ *   slot, then load the NEW strategy's saved text (if any) back into the
+ *   active `treatmentStrategyDescription`.
+ * - Description changes (no strategy change) → mirror it into the active
+ *   strategy's slot in `strategyDescriptions`.
+ * - Both change → strategy swap runs first; explicit description in the
+ *   update wins as the new active text and is mirrored into the new
+ *   strategy's slot.
+ */
+export function resolveStrategyDescriptionUpdate(
+  existing: EntityWithStrategy,
+  update: UpdateInput,
+): ResolvedStrategyUpdate {
+  if (
+    update.treatmentStrategy === undefined &&
+    update.treatmentStrategyDescription === undefined
+  ) {
+    return {};
+  }
+
+  const map = parseStrategyMap(existing.strategyDescriptions);
+  const oldStrategy = existing.treatmentStrategy;
+  const newStrategy = update.treatmentStrategy ?? oldStrategy;
+  const isStrategyChange =
+    update.treatmentStrategy !== undefined && update.treatmentStrategy !== oldStrategy;
+
+  const result: ResolvedStrategyUpdate = {};
+
+  if (isStrategyChange) {
+    if ((existing.treatmentStrategyDescription ?? '').length > 0) {
+      map[oldStrategy] = existing.treatmentStrategyDescription as string;
+    } else {
+      delete map[oldStrategy];
+    }
+    result.treatmentStrategy = newStrategy;
+    if (update.treatmentStrategyDescription === undefined) {
+      result.treatmentStrategyDescription = map[newStrategy] ?? null;
+    }
+  }
+
+  if (update.treatmentStrategyDescription !== undefined) {
+    const next = update.treatmentStrategyDescription ?? '';
+    if (next.length > 0) {
+      map[newStrategy] = next;
+    } else {
+      delete map[newStrategy];
+    }
+    result.treatmentStrategyDescription = update.treatmentStrategyDescription;
+  }
+
+  result.strategyDescriptions = map;
+  return result;
+}
+
+function parseStrategyMap(raw: unknown): Record<string, string> {
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+    const out: Record<string, string> = {};
+    for (const [k, v] of Object.entries(raw as Record<string, unknown>)) {
+      if (typeof v === 'string' && v.length > 0) out[k] = v;
+    }
+    return out;
+  }
+  return {};
+}
diff --git a/apps/api/src/stripe/domain.utils.spec.ts b/apps/api/src/stripe/domain.utils.spec.ts
new file mode 100644
index 0000000000..b9df4964a0
--- /dev/null
+++ b/apps/api/src/stripe/domain.utils.spec.ts
@@ -0,0 +1,46 @@
+import { extractDomain, isPublicEmailDomain } from './domain.utils';
+
+describe('extractDomain', () => {
+  it('returns null for empty input', () => {
+    expect(extractDomain(null)).toBeNull();
+    expect(extractDomain(undefined)).toBeNull();
+    expect(extractDomain('')).toBeNull();
+  });
+
+  it('extracts domain from email', () => {
+    expect(extractDomain('user@acme.com')).toBe('acme.com');
+    expect(extractDomain('USER@ACME.COM')).toBe('acme.com');
+  });
+
+  it('extracts hostname from a URL and strips www.', () => {
+    expect(extractDomain('https://www.acme.com/foo')).toBe('acme.com');
+    expect(extractDomain('http://acme.com')).toBe('acme.com');
+  });
+
+  it('adds protocol when missing', () => {
+    expect(extractDomain('acme.com')).toBe('acme.com');
+    expect(extractDomain('www.acme.com/path')).toBe('acme.com');
+  });
+
+  it('returns null on garbage input', () => {
+    expect(extractDomain('   ')).toBeNull();
+  });
+});
+
+describe('isPublicEmailDomain', () => {
+  it('flags common free providers', () => {
+    expect(isPublicEmailDomain('gmail.com')).toBe(true);
+    expect(isPublicEmailDomain('outlook.com')).toBe(true);
+    expect(isPublicEmailDomain('icloud.com')).toBe(true);
+  });
+
+  it('is case- and trailing-dot-insensitive', () => {
+    expect(isPublicEmailDomain('GMAIL.COM')).toBe(true);
+    expect(isPublicEmailDomain('gmail.com.')).toBe(true);
+  });
+
+  it('returns false for a real company domain', () => {
+    expect(isPublicEmailDomain('acme.com')).toBe(false);
+    expect(isPublicEmailDomain('trycomp.ai')).toBe(false);
+  });
+});
diff --git a/apps/api/src/stripe/domain.utils.ts b/apps/api/src/stripe/domain.utils.ts
new file mode 100644
index 0000000000..954f5646f6
--- /dev/null
+++ b/apps/api/src/stripe/domain.utils.ts
@@ -0,0 +1,57 @@
+// Public/free mailbox providers — domain ownership of these does NOT imply
+// company affiliation, so they must never be used for domain-based auto-approval.
+const PUBLIC_EMAIL_DOMAINS = new Set([
+  // Google
+  'gmail.com',
+  'googlemail.com',
+  // Microsoft
+  'outlook.com',
+  'hotmail.com',
+  'live.com',
+  'msn.com',
+  // Yahoo
+  'yahoo.com',
+  'ymail.com',
+  // Apple
+  'icloud.com',
+  'me.com',
+  'mac.com',
+  // Proton
+  'proton.me',
+  'protonmail.com',
+  'pm.me',
+  // AOL
+  'aol.com',
+]);
+
+export const isPublicEmailDomain = (domain: string): boolean => {
+  const normalized = domain.toLowerCase().trim().replace(/\.$/, '');
+  return PUBLIC_EMAIL_DOMAINS.has(normalized);
+};
+
+/**
+ * Extract a normalized domain from either a website URL or an email address.
+ * Returns null on empty/invalid input.
+ */
+export const extractDomain = (
+  input: string | null | undefined,
+): string | null => {
+  if (!input) return null;
+
+  try {
+    if (input.includes('@') && !input.includes('://')) {
+      const domain = input.split('@')[1]?.toLowerCase().trim();
+      return domain || null;
+    }
+
+    let url = input.trim().toLowerCase();
+    if (!url.startsWith('http://') && !url.startsWith('https://')) {
+      url = `https://${url}`;
+    }
+
+    const parsed = new URL(url);
+    return parsed.hostname.replace(/^www\./, '');
+  } catch {
+    return null;
+  }
+};
diff --git a/apps/api/src/stripe/stripe.service.ts b/apps/api/src/stripe/stripe.service.ts
index 3eac26d69a..274a29ee8e 100644
--- a/apps/api/src/stripe/stripe.service.ts
+++ b/apps/api/src/stripe/stripe.service.ts
@@ -1,5 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';
 import Stripe from 'stripe';
+import { isPublicEmailDomain } from './domain.utils';
 
 @Injectable()
 export class StripeService {
@@ -28,4 +29,102 @@ export class StripeService {
   isConfigured(): boolean {
     return this.client !== null;
   }
+
+  /**
+   * Look up a Stripe customer by company domain. Prefers an exact match against
+   * the customer's `domain` metadata, then falls back to scanning customers
+   * whose primary email belongs to that domain. Public mailbox domains
+   * (gmail.com, etc.) are never matched — domain ownership of those does not
+   * imply company affiliation.
+   */
+  async findCustomerByDomain(
+    domain: string,
+  ): Promise<{ customerId: string; customerName: string | null } | null> {
+    if (!this.client || !domain) {
+      return null;
+    }
+
+    const normalizedDomain = domain.toLowerCase().trim().replace(/\.$/, '');
+    if (isPublicEmailDomain(normalizedDomain)) {
+      return null;
+    }
+
+    try {
+      const byMetadata = await this.client.customers.search({
+        query: `metadata["domain"]:"${normalizedDomain}"`,
+        limit: 1,
+      });
+
+      if (byMetadata.data.length > 0) {
+        const customer = byMetadata.data[0];
+        return {
+          customerId: customer.id,
+          customerName: customer.name ?? null,
+        };
+      }
+
+      // `email~` is substring matching — re-filter for exact email-domain match.
+      const byEmail = await this.client.customers.search({
+        query: `email~"@${normalizedDomain}"`,
+        limit: 25,
+      });
+
+      const exactMatch = byEmail.data.find((customer) => {
+        const email = customer.email ?? '';
+        const emailDomain = email.split('@')[1]?.toLowerCase().trim() ?? '';
+        return emailDomain === normalizedDomain;
+      });
+
+      if (exactMatch) {
+        return {
+          customerId: exactMatch.id,
+          customerName: exactMatch.name ?? null,
+        };
+      }
+
+      return null;
+    } catch (error) {
+      this.logger.error(
+        `Error searching Stripe customers by domain "${normalizedDomain}"`,
+        error instanceof Error ? error.stack : undefined,
+      );
+      return null;
+    }
+  }
+
+  /**
+   * Returns true when the given domain belongs to a Stripe customer with at
+   * least one active subscription. Used for domain-based auto-approval of
+   * organization access.
+   */
+  async isDomainActiveCustomer(domain: string): Promise<boolean> {
+    if (!this.client) {
+      return false;
+    }
+
+    const normalizedDomain = domain.toLowerCase().trim().replace(/\.$/, '');
+    if (!normalizedDomain || isPublicEmailDomain(normalizedDomain)) {
+      return false;
+    }
+
+    const customer = await this.findCustomerByDomain(normalizedDomain);
+    if (!customer) {
+      return false;
+    }
+
+    try {
+      const subscriptions = await this.client.subscriptions.list({
+        customer: customer.customerId,
+        status: 'active',
+        limit: 1,
+      });
+      return subscriptions.data.length > 0;
+    } catch (error) {
+      this.logger.error(
+        `Error checking active subscriptions for customer "${customer.customerId}"`,
+        error instanceof Error ? error.stack : undefined,
+      );
+      return false;
+    }
+  }
 }
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment-task.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment-task.ts
index 23abf82887..fd664a6e54 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment-task.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment-task.ts
@@ -1,20 +1,17 @@
 import {
   db,
-  Impact,
-  Likelihood,
   TaskItemPriority,
   TaskItemStatus,
   VendorStatus,
   type TaskItemEntityType,
 } from '@db';
-import { openai } from '@ai-sdk/openai';
 import type { Prisma } from '@db';
 import type { Task } from '@trigger.dev/sdk';
 import { logger, metadata, queue, schemaTask, tags } from '@trigger.dev/sdk';
-import { generateObject } from 'ai';
 import { z } from 'zod';
 
 import { resolveTaskCreatorAndAssignee } from './vendor-risk-assessment/assignee';
+import { extractInherentRisk } from './vendor-risk-assessment/assessment-output';
 import { VENDOR_RISK_ASSESSMENT_TASK_ID } from './vendor-risk-assessment/constants';
 import {
   buildRiskAssessmentDescription,
@@ -174,124 +171,6 @@ function parseRiskAssessmentJson(value: string): Prisma.InputJsonValue {
   return parsed;
 }
 
-const riskLevelSchema = z
-  .object({
-    riskLevel: z.string().optional(),
-  })
-  .passthrough();
-
-function extractRiskLevel(value: Prisma.InputJsonValue): string | null {
-  const parsed = riskLevelSchema.safeParse(value);
-  if (!parsed.success) {
-    return null;
-  }
-  return parsed.data.riskLevel ?? null;
-}
-
-/**
- * Risk level categories that map to database enums:
- * - critical → Likelihood.very_likely / Impact.severe (highest)
- * - high → Likelihood.likely / Impact.major
- * - medium → Likelihood.possible / Impact.moderate
- * - low → Likelihood.unlikely / Impact.minor
- * - very_low → Likelihood.very_unlikely / Impact.insignificant (lowest)
- */
-type NormalizedRiskLevel = 'critical' | 'high' | 'medium' | 'low' | 'very_low';
-
-const normalizedRiskLevelSchema = z.object({
-  riskLevel: z
-    .enum(['critical', 'high', 'medium', 'low', 'very_low'])
-    .describe(
-      'The normalized risk level - must be exactly one of these values',
-    ),
-});
-
-/**
- * Use AI to normalize any risk level string to one of our exact enum values.
- * Uses gpt-4o-mini (fast and cheap) with structured output to ensure valid values.
- */
-async function normalizeRiskLevel(
-  rawRiskLevel: string | null | undefined,
-): Promise<NormalizedRiskLevel | null> {
-  if (!rawRiskLevel?.trim()) {
-    return null;
-  }
-
-  try {
-    const result = await generateObject({
-      model: openai('gpt-5.2'),
-      schema: normalizedRiskLevelSchema,
-      prompt: `Classify this vendor security risk level into exactly one of these 5 categories.
-
-Risk level from assessment: "${rawRiskLevel}"
-
-Categories (highest to lowest risk):
-- critical: Highest risk (severe, extreme, very high, critical concerns)
-- high: Significant risk (high, major issues)
-- medium: Moderate risk (medium, moderate, average)
-- low: Low risk (low, minimal, minor)
-- very_low: Minimal risk (very low, negligible, none)
-
-Rules:
-- Return exactly one of: critical, high, medium, low, very_low
-- If ambiguous (e.g., "Low to Moderate"), pick the HIGHER risk to be conservative`,
-    });
-
-    logger.info('Normalized risk level', {
-      rawRiskLevel,
-      normalizedRiskLevel: result.object.riskLevel,
-    });
-
-    return result.object.riskLevel;
-  } catch (error) {
-    logger.warn('Failed to normalize risk level, defaulting to medium', {
-      rawRiskLevel,
-      error: error instanceof Error ? error.message : String(error),
-    });
-    return 'medium';
-  }
-}
-
-function mapRiskLevelToLikelihood(
-  normalizedLevel: NormalizedRiskLevel | null,
-): Likelihood {
-  switch (normalizedLevel) {
-    case 'critical':
-      return Likelihood.very_likely;
-    case 'high':
-      return Likelihood.likely;
-    case 'medium':
-      return Likelihood.possible;
-    case 'low':
-      return Likelihood.unlikely;
-    case 'very_low':
-      return Likelihood.very_unlikely;
-    default:
-      // Default to medium (safer than lowest)
-      return Likelihood.possible;
-  }
-}
-
-function mapRiskLevelToImpact(
-  normalizedLevel: NormalizedRiskLevel | null,
-): Impact {
-  switch (normalizedLevel) {
-    case 'critical':
-      return Impact.severe;
-    case 'high':
-      return Impact.major;
-    case 'medium':
-      return Impact.moderate;
-    case 'low':
-      return Impact.minor;
-    case 'very_low':
-      return Impact.insignificant;
-    default:
-      // Default to medium (safer than lowest)
-      return Impact.moderate;
-  }
-}
-
 /**
  * Valid compliance badge types for trust portal
  */
@@ -857,7 +736,9 @@ export const vendorRiskAssessmentTask: Task<
               verifiedCertifications: verifiedCount,
               links: linkCount,
               hasAssessment: Boolean(result.securityAssessment),
-              riskLevel: result.riskLevel ?? 'none',
+              likelihood: result.likelihood ?? 'none',
+              impact: result.impact ?? 'none',
+              hasRationale: Boolean(result.rationale),
             });
 
             // Report each finding individually with delays so the UI
@@ -1043,22 +924,23 @@ export const vendorRiskAssessmentTask: Task<
         });
 
         // Extract risk level and badges
-        logger.info('🎯 Normalizing risk level', {
+        logger.info('🎯 Extracting inherent risk from assessment payload', {
           vendor: payload.vendorName,
         });
-        const rawRiskLevel = extractRiskLevel(data);
-        const normalizedRiskLvl = await normalizeRiskLevel(rawRiskLevel);
-        const inherentProbability = mapRiskLevelToLikelihood(normalizedRiskLvl);
-        const inherentImpact = mapRiskLevelToImpact(normalizedRiskLvl);
-        const residualProbability = mapRiskLevelToLikelihood(normalizedRiskLvl);
-        const residualImpact = mapRiskLevelToImpact(normalizedRiskLvl);
+        const inherentRisk = extractInherentRisk(data);
+        if (!inherentRisk) {
+          logger.warn(
+            '⚠️ Assessment payload missing likelihood/impact — preserving existing vendor scores',
+            { vendor: payload.vendorName },
+          );
+        }
         const complianceBadges = extractComplianceBadges(data);
         const logoUrl = generateLogoUrl(vendor.website);
 
         logger.info('📊 Risk level and badges extracted', {
           vendor: payload.vendorName,
-          rawRiskLevel,
-          normalizedRiskLevel: normalizedRiskLvl,
+          inherentLikelihood: inherentRisk?.likelihood ?? null,
+          inherentImpact: inherentRisk?.impact ?? null,
           hasBadges: Boolean(complianceBadges),
           badgeCount: Array.isArray(complianceBadges)
             ? complianceBadges.length
@@ -1078,14 +960,23 @@ export const vendorRiskAssessmentTask: Task<
           ),
         });
 
-        // Update vendor with core data (keep status in_progress — news may still be loading)
+        // Update vendor with core data (keep status in_progress — news may still be loading).
+        // Only write risk fields when the assessment payload produced a valid
+        // inherentRisk — otherwise preserve whatever the vendor row already has
+        // (e.g. pre-ENG-221 globalVendors.riskAssessmentData that lacks
+        // likelihood/impact). Residual defaults to inherent until a human
+        // mitigates. Preserved behavior.
         await db.vendor.update({
           where: { id: vendor.id },
           data: {
-            inherentProbability,
-            inherentImpact,
-            residualProbability,
-            residualImpact,
+            ...(inherentRisk
+              ? {
+                  inherentProbability: inherentRisk.likelihood,
+                  inherentImpact: inherentRisk.impact,
+                  residualProbability: inherentRisk.likelihood,
+                  residualImpact: inherentRisk.impact,
+                }
+              : {}),
             ...(complianceBadges ? { complianceBadges } : {}),
             ...(logoUrl ? { logoUrl } : {}),
           },
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-schema.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-schema.ts
index f9f1f9541e..fcf888b62f 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-schema.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-schema.ts
@@ -11,6 +11,26 @@ const dateStringOrEmptySchema = z
   .nullable();
 
 export const vendorRiskAssessmentAgentSchema = z.object({
+  /**
+   * ENG-221: replaces risk_level. Likelihood and impact are scored
+   * independently so vendors can land on any cell of the 5x5 matrix
+   * instead of pooling on the diagonal.
+   */
+  likelihood: z
+    .enum(['very_unlikely', 'unlikely', 'possible', 'likely', 'very_likely'])
+    .optional()
+    .nullable(),
+  impact: z
+    .enum(['insignificant', 'minor', 'moderate', 'major', 'severe'])
+    .optional()
+    .nullable(),
+  rationale: z.string().optional().nullable(),
+  /**
+   * Legacy single-dimension score retained as optional so stored payloads
+   * from before ENG-221 still parse. New assessments should set
+   * `likelihood` + `impact` + `rationale` instead.
+   */
+  // TODO(ENG-221 follow-up): remove once globalVendors.riskAssessmentData backfill ships.
   risk_level: z.string().optional().nullable(),
   security_assessment: z.string().optional().nullable(),
   last_researched_at: dateStringOrEmptySchema,
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-types.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-types.ts
index b934550b98..b95060eeb0 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-types.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/agent-types.ts
@@ -31,11 +31,43 @@ export type VendorRiskAssessmentNewsItem = {
   sentiment?: VendorRiskAssessmentNewsSentiment | null;
 };
 
+/**
+ * Likelihood enum string values — mirrors the Prisma `Likelihood` enum.
+ * Kept as a literal union here so this module stays independent from
+ * `@db` / `@prisma/client`.
+ */
+export type VendorRiskAssessmentLikelihood =
+  | 'very_unlikely'
+  | 'unlikely'
+  | 'possible'
+  | 'likely'
+  | 'very_likely';
+
+/**
+ * Impact enum string values — mirrors the Prisma `Impact` enum.
+ */
+export type VendorRiskAssessmentImpact =
+  | 'insignificant'
+  | 'minor'
+  | 'moderate'
+  | 'major'
+  | 'severe';
+
 export type VendorRiskAssessmentDataV1 = {
   kind: 'vendorRiskAssessmentV1';
   vendorName?: string | null;
   vendorWebsite?: string | null;
   lastResearchedAt?: string | null;
+  /**
+   * ENG-221: two independent dimensions. Preferred over the legacy
+   * single-bucket `riskLevel`. New assessments always set these; legacy
+   * payloads may only have `riskLevel`.
+   */
+  likelihood?: VendorRiskAssessmentLikelihood | null;
+  impact?: VendorRiskAssessmentImpact | null;
+  rationale?: string | null;
+  /** Legacy single-bucket score. Retained for pre-ENG-221 payloads. */
+  // TODO(ENG-221 follow-up): remove once globalVendors.riskAssessmentData backfill ships.
   riskLevel?: string | null;
   securityAssessment?: string | null;
   certifications?: VendorRiskAssessmentCertification[] | null;
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.spec.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.spec.ts
new file mode 100644
index 0000000000..417c49030d
--- /dev/null
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.spec.ts
@@ -0,0 +1,99 @@
+import { Impact, Likelihood } from '@prisma/client';
+
+import {
+  assessmentOutputSchema,
+  extractInherentRisk,
+} from './assessment-output';
+
+describe('assessmentOutputSchema', () => {
+  it('accepts independent likelihood and impact combinations across the full matrix', () => {
+    const offDiagonal = assessmentOutputSchema.safeParse({
+      likelihood: 'very_likely',
+      impact: 'insignificant',
+      rationale: 'Motivated adversary but public-only data.',
+    });
+    expect(offDiagonal.success).toBe(true);
+    if (offDiagonal.success) {
+      expect(offDiagonal.data.likelihood).toBe(Likelihood.very_likely);
+      expect(offDiagonal.data.impact).toBe(Impact.insignificant);
+    }
+  });
+
+  it('accepts every enum value on each dimension', () => {
+    const likelihoods: Likelihood[] = [
+      Likelihood.very_unlikely,
+      Likelihood.unlikely,
+      Likelihood.possible,
+      Likelihood.likely,
+      Likelihood.very_likely,
+    ];
+    const impacts: Impact[] = [
+      Impact.insignificant,
+      Impact.minor,
+      Impact.moderate,
+      Impact.major,
+      Impact.severe,
+    ];
+    for (const likelihood of likelihoods) {
+      for (const impact of impacts) {
+        const result = assessmentOutputSchema.safeParse({
+          likelihood,
+          impact,
+          rationale: 'test rationale long enough.',
+        });
+        expect(result.success).toBe(true);
+      }
+    }
+  });
+
+  it('rejects a missing dimension', () => {
+    const missingImpact = assessmentOutputSchema.safeParse({
+      likelihood: 'possible',
+      rationale: 'missing impact on purpose.',
+    });
+    expect(missingImpact.success).toBe(false);
+  });
+
+  it('rejects out-of-enum values', () => {
+    const result = assessmentOutputSchema.safeParse({
+      likelihood: 'sometimes',
+      impact: 'catastrophic',
+      rationale: 'garbage in.',
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects too-short rationale', () => {
+    const result = assessmentOutputSchema.safeParse({
+      likelihood: 'possible',
+      impact: 'moderate',
+      rationale: 'short',
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe('extractInherentRisk', () => {
+  it('threads likelihood + impact from a clean assessment payload', () => {
+    const payload = {
+      likelihood: 'very_likely',
+      impact: 'minor',
+      rationale: 'High adversary motivation, low blast radius due to scope.',
+    };
+    const extracted = extractInherentRisk(payload);
+    expect(extracted).toEqual({
+      likelihood: Likelihood.very_likely,
+      impact: Impact.minor,
+    });
+  });
+
+  it('returns null when the payload is missing dimensions', () => {
+    const extracted = extractInherentRisk({ riskLevel: 'high' });
+    expect(extracted).toBeNull();
+  });
+
+  it('returns null when the payload is garbage', () => {
+    const extracted = extractInherentRisk({ foo: 'bar' });
+    expect(extracted).toBeNull();
+  });
+});
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.ts
new file mode 100644
index 0000000000..da51a689c6
--- /dev/null
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/assessment-output.ts
@@ -0,0 +1,39 @@
+// Import enums + types from `@prisma/client` directly (not `@db`) so this
+// module has no runtime dependency on the PrismaClient singleton. That lets
+// the spec import it without needing to mock `@db`.
+import { Impact, Likelihood, type Prisma } from '@prisma/client';
+import { z } from 'zod';
+
+/**
+ * Output of the vendor AI risk assessment — two independent dimensions.
+ *
+ * Replaces the previous single-level → diagonal-cell mapping, which pooled
+ * every vendor into 5 of 25 possible cells (5 of 10 score buckets).
+ *
+ * `likelihood` = probability of a security incident originating from or
+ *   involving this vendor (adversary motivation + exposure + data handled).
+ * `impact`     = blast radius if the vendor is compromised (regulatory
+ *   exposure, customer-data sensitivity, operational criticality).
+ */
+export const assessmentOutputSchema = z.object({
+  likelihood: z.nativeEnum(Likelihood),
+  impact: z.nativeEnum(Impact),
+  rationale: z.string().min(20),
+});
+
+export type AssessmentOutput = z.infer<typeof assessmentOutputSchema>;
+
+/**
+ * Extract the inherent likelihood + impact from a vendor risk assessment payload.
+ * Returns null if the payload doesn't conform to `assessmentOutputSchema`
+ * (e.g. old-format payloads from globalVendors created before ENG-221).
+ */
+export function extractInherentRisk(
+  payload: Prisma.InputJsonValue,
+): { likelihood: Likelihood; impact: Impact } | null {
+  const parsed = assessmentOutputSchema.safeParse(payload);
+  if (!parsed.success) {
+    return null;
+  }
+  return { likelihood: parsed.data.likelihood, impact: parsed.data.impact };
+}
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/description.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/description.ts
index d19f6aae86..906f9131d1 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/description.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/description.ts
@@ -18,6 +18,9 @@ export function buildRiskAssessmentDescription(params: {
     vendorName,
     vendorWebsite,
     lastResearchedAt: null,
+    likelihood: null,
+    impact: null,
+    rationale: null,
     riskLevel: null,
     securityAssessment: null,
     certifications: null,
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-core.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-core.ts
index 93683039e3..c48d2e131b 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-core.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-core.ts
@@ -207,7 +207,10 @@ export async function firecrawlResearchCore(params: {
     verifiedAgentCertCount: certifications.filter(
       (c) => c.status === 'verified',
     ).length,
-    agentRiskLevel: parsed.data.risk_level ?? null,
+    agentLikelihood: parsed.data.likelihood ?? null,
+    agentImpact: parsed.data.impact ?? null,
+    agentRationaleLength: parsed.data.rationale?.length ?? 0,
+    agentRiskLevelLegacy: parsed.data.risk_level ?? null,
   });
 
   const deepScrapeSourceUrl = pickDeepScrapeSourceUrl({
@@ -287,6 +290,9 @@ export async function firecrawlResearchCore(params: {
     lastResearchedAt:
       normalizeIso(parsed.data.last_researched_at ?? null) ??
       new Date().toISOString(),
+    likelihood: parsed.data.likelihood ?? null,
+    impact: parsed.data.impact ?? null,
+    rationale: parsed.data.rationale ?? null,
     riskLevel: parsed.data.risk_level ?? null,
     securityAssessment: parsed.data.security_assessment ?? null,
     certifications:
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-prompt.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-prompt.ts
index 4cd4059b50..947298b700 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-prompt.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-prompt.ts
@@ -48,7 +48,9 @@ Only return a certification when the page explicitly names a framework as curren
 - links.privacy_policy_url, links.terms_of_service_url, links.security_page_url, links.soc2_report_url — return only when confirmed; otherwise empty.
 - certifications — may be an empty array. Do NOT pad it.
 - security_assessment — one paragraph summarising what you observed. If the trust portal was SPA-only and you could not read content, say so explicitly ("Trust portal at <url> appears to be a JavaScript SPA; deep-scrape will extract content").
-- risk_level — your best estimate among critical/high/medium/low/very_low based on what you found.
+- likelihood — probability of a security incident originating from or involving this vendor. Score INDEPENDENTLY of impact based on adversary motivation, exposure surface, and the kind of data handled. Choose exactly one of: very_unlikely, unlikely, possible, likely, very_likely.
+- impact — blast radius if this vendor is compromised. Score INDEPENDENTLY of likelihood based on regulatory exposure, customer-data sensitivity, and operational criticality. Choose exactly one of: insignificant, minor, moderate, major, severe.
+- rationale — two to four sentences justifying BOTH scores. Name the data handled and the adversary motivation. Do not merge the two dimensions into a single "risk" verdict.
 
 Focus on ${vendorWebsite} and its trust/security/compliance paths. Only cite URLs on ${vendorDomain}, its subdomains, or a recognised third-party portal hosting this vendor's trust page.`;
 }
diff --git a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-schema-json.ts b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-schema-json.ts
index 310ee19892..3efc452c34 100644
--- a/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-schema-json.ts
+++ b/apps/api/src/trigger/vendor/vendor-risk-assessment/firecrawl-agent-schema-json.ts
@@ -10,10 +10,28 @@
 export const firecrawlAgentJsonSchema = {
   type: 'object',
   properties: {
-    risk_level: {
+    likelihood: {
       type: 'string',
+      enum: [
+        'very_unlikely',
+        'unlikely',
+        'possible',
+        'likely',
+        'very_likely',
+      ],
       description:
-        'Overall vendor risk level: critical, high, medium, low, or very_low',
+        'Probability of an incident originating from or involving this vendor. Score independently of impact.',
+    },
+    impact: {
+      type: 'string',
+      enum: ['insignificant', 'minor', 'moderate', 'major', 'severe'],
+      description:
+        'Blast radius if the vendor is compromised. Score independently of likelihood.',
+    },
+    rationale: {
+      type: 'string',
+      description:
+        'Two to four sentences justifying both scores. Name the data handled and the adversary motivation.',
     },
     security_assessment: {
       type: 'string',
@@ -91,5 +109,5 @@ export const firecrawlAgentJsonSchema = {
       },
     },
   },
-  required: ['security_assessment'],
+  required: ['security_assessment', 'likelihood', 'impact', 'rationale'],
 } as const;
diff --git a/apps/api/src/vendors/dto/update-vendor.dto.spec.ts b/apps/api/src/vendors/dto/update-vendor.dto.spec.ts
index 53641b820f..b0f91c13c0 100644
--- a/apps/api/src/vendors/dto/update-vendor.dto.spec.ts
+++ b/apps/api/src/vendors/dto/update-vendor.dto.spec.ts
@@ -136,6 +136,56 @@ describe('UpdateVendorDto', () => {
     expect(errors[0].property).toBe('status');
   });
 
+  // ── treatment strategy fields (ENG-221) ───────────────────────────
+  it('should accept valid treatmentStrategy enum values', async () => {
+    for (const strategy of ['accept', 'avoid', 'mitigate', 'transfer']) {
+      const dto = toDto({ treatmentStrategy: strategy });
+      const errors = await validate(dto, {
+        whitelist: true,
+        forbidNonWhitelisted: true,
+      });
+      expect(errors).toHaveLength(0);
+    }
+  });
+
+  it('should reject invalid treatmentStrategy enum value', async () => {
+    const dto = toDto({ treatmentStrategy: 'ignore' });
+    const errors = await validate(dto, {
+      whitelist: true,
+      forbidNonWhitelisted: true,
+    });
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors[0].property).toBe('treatmentStrategy');
+  });
+
+  it('should accept treatmentStrategyDescription as a string', async () => {
+    const dto = toDto({
+      treatmentStrategy: 'mitigate',
+      treatmentStrategyDescription:
+        'We isolated the vendor to a dedicated VPC.',
+    });
+    const errors = await validate(dto, {
+      whitelist: true,
+      forbidNonWhitelisted: true,
+    });
+    expect(errors).toHaveLength(0);
+    expect(dto.treatmentStrategyDescription).toBe(
+      'We isolated the vendor to a dedicated VPC.',
+    );
+  });
+
+  it('should reject treatmentStrategyDescription longer than 20,000 chars', async () => {
+    const dto = toDto({
+      treatmentStrategyDescription: 'x'.repeat(20_001),
+    });
+    const errors = await validate(dto, {
+      whitelist: true,
+      forbidNonWhitelisted: true,
+    });
+    expect(errors.length).toBeGreaterThan(0);
+    expect(errors[0].property).toBe('treatmentStrategyDescription');
+  });
+
   // ── forbidNonWhitelisted ──────────────────────────────────────────
   it('should reject unknown properties', async () => {
     const dto = toDto({ name: 'Acronis', unknownField: 'value' });
diff --git a/apps/api/src/vendors/dto/update-vendor.dto.ts b/apps/api/src/vendors/dto/update-vendor.dto.ts
index c7186b3f70..2c4f2efe63 100644
--- a/apps/api/src/vendors/dto/update-vendor.dto.ts
+++ b/apps/api/src/vendors/dto/update-vendor.dto.ts
@@ -6,9 +6,16 @@ import {
   IsEnum,
   IsUrl,
   IsBoolean,
+  MaxLength,
 } from 'class-validator';
 import { Transform } from 'class-transformer';
-import { VendorCategory, VendorStatus, Likelihood, Impact } from '@db';
+import {
+  VendorCategory,
+  VendorStatus,
+  Likelihood,
+  Impact,
+  RiskTreatmentType,
+} from '@db';
 
 /**
  * DTO for PATCH /vendors/:id
@@ -67,6 +74,25 @@ export class UpdateVendorDto {
   @IsEnum(Impact)
   residualImpact?: Impact;
 
+  @ApiPropertyOptional({
+    description: 'Risk treatment strategy',
+    enum: RiskTreatmentType,
+    default: RiskTreatmentType.accept,
+    example: RiskTreatmentType.mitigate,
+  })
+  @IsOptional()
+  @IsEnum(RiskTreatmentType)
+  treatmentStrategy?: RiskTreatmentType;
+
+  @ApiPropertyOptional({
+    description: 'Description of the treatment strategy',
+    example: 'We isolated the vendor to a dedicated VPC.',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(20_000)
+  treatmentStrategyDescription?: string | null;
+
   @ApiPropertyOptional({ description: 'Vendor website URL' })
   @IsOptional()
   @IsUrl()
diff --git a/apps/api/src/vendors/vendors.service.ts b/apps/api/src/vendors/vendors.service.ts
index 47c49b0d17..349a2cff9a 100644
--- a/apps/api/src/vendors/vendors.service.ts
+++ b/apps/api/src/vendors/vendors.service.ts
@@ -11,6 +11,7 @@ import { tasks } from '@trigger.dev/sdk';
 import { Prisma } from '@db';
 import type { TriggerVendorRiskAssessmentVendorDto } from './dto/trigger-vendor-risk-assessment.dto';
 import { resolveTaskCreatorAndAssignee } from '../trigger/vendor/vendor-risk-assessment/assignee';
+import { resolveStrategyDescriptionUpdate } from '../risks/strategy-descriptions';
 
 const normalizeWebsite = (
   website: string | null | undefined,
@@ -106,6 +107,11 @@ export class VendorsService {
               },
             },
           },
+          // Linked task statuses are needed by the vendors table to compute
+          // the current (interpolated) severity score so the residual badge
+          // reflects treatment progress, not just the static residual
+          // probability/impact. Mirrors the risks service.
+          tasks: { select: { id: true, status: true } },
         },
       });
 
@@ -142,6 +148,14 @@ export class VendorsService {
               },
             },
           },
+          tasks: {
+            select: {
+              id: true,
+              title: true,
+              status: true,
+              controls: { select: { id: true, name: true } },
+            },
+          },
         },
       });
 
@@ -626,9 +640,16 @@ export class VendorsService {
         );
       }
 
+      // Keep per-strategy descriptions independent across treatment
+      // strategies — see `apps/api/src/risks/strategy-descriptions.ts`.
+      const resolvedStrategyFields = resolveStrategyDescriptionUpdate(
+        existing,
+        updateVendorDto,
+      );
+
       const updatedVendor = await db.vendor.update({
         where: { id },
-        data: updateVendorDto,
+        data: { ...updateVendorDto, ...resolvedStrategyFields },
       });
 
       this.logger.log(`Updated vendor: ${updatedVendor.name} (${id})`);
diff --git a/apps/api/trigger.config.ts b/apps/api/trigger.config.ts
index 8c6e1b7700..44f4e88364 100644
--- a/apps/api/trigger.config.ts
+++ b/apps/api/trigger.config.ts
@@ -1,4 +1,5 @@
 import { defineConfig } from '@trigger.dev/sdk';
+import { caBundleExtension } from './caBundleExtension';
 import { prismaExtension } from './customPrismaExtension';
 import { emailExtension } from './emailExtension';
 import { integrationPlatformExtension } from './integrationPlatformExtension';
@@ -10,6 +11,7 @@ export default defineConfig({
   maxDuration: 300, // 5 minutes
   build: {
     extensions: [
+      caBundleExtension(),
       prismaExtension({
         version: '7.6.0',
         dbPackageVersion: '^2.0.0',
diff --git a/apps/app/caBundleExtension.ts b/apps/app/caBundleExtension.ts
new file mode 100644
index 0000000000..0e602e0b15
--- /dev/null
+++ b/apps/app/caBundleExtension.ts
@@ -0,0 +1,50 @@
+import type { BuildContext, BuildExtension, BuildManifest } from '@trigger.dev/build';
+import { existsSync } from 'node:fs';
+import { cp, mkdir } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+
+// Path relative to the monorepo root (apps/api or apps/app → ../../packages/db/certs/...)
+const BUNDLE_RELATIVE_FROM_APP = '../../packages/db/certs/rds-global-bundle.pem';
+const BUNDLE_DEST_REL = 'certs/rds-global-bundle.pem';
+
+function findBundleSrc(workingDir: string): string | undefined {
+  // Walk up from workingDir to find the cert — handles both normal checkouts and git worktrees
+  // where workspaceDir points to the main worktree root (wrong for us).
+  const candidates = [
+    resolve(workingDir, BUNDLE_RELATIVE_FROM_APP),
+    resolve(workingDir, '../packages/db/certs/rds-global-bundle.pem'),
+    resolve(workingDir, 'packages/db/certs/rds-global-bundle.pem'),
+  ];
+
+  return candidates.find((c) => existsSync(c));
+}
+
+export function caBundleExtension(): BuildExtension {
+  return {
+    name: 'CABundleExtension',
+    onBuildStart: (context) => {
+      // Real OS env var at task spawn time — verified flow:
+      //   addLayer.deploy.env → manifest.deploy.sync.env → syncEnvVarsWithServer →
+      //   taskRunProcessProvider injects into worker env before Node TLS init.
+      context.addLayer({
+        id: 'ca-bundle-env',
+        deploy: {
+          env: { NODE_EXTRA_CA_CERTS: `/app/${BUNDLE_DEST_REL}` },
+          override: true,
+        },
+      });
+    },
+    onBuildComplete: async (context: BuildContext, manifest: BuildManifest) => {
+      const src = findBundleSrc(context.workingDir);
+      if (!src) {
+        throw new Error(
+          `CABundleExtension: rds-global-bundle.pem not found. Searched relative to ${context.workingDir}`,
+        );
+      }
+      const dest = join(manifest.outputPath, BUNDLE_DEST_REL);
+      await mkdir(dirname(dest), { recursive: true });
+      await cp(src, dest);
+      context.logger.log(`Copied RDS CA bundle to ${BUNDLE_DEST_REL}`);
+    },
+  };
+}
diff --git a/apps/app/next.config.ts b/apps/app/next.config.ts
index c83ff486f7..bcce976cff 100644
--- a/apps/app/next.config.ts
+++ b/apps/app/next.config.ts
@@ -76,6 +76,9 @@ const config: NextConfig = {
     webpackMemoryOptimizations: true,
   },
   outputFileTracingRoot: workspaceRoot,
+  outputFileTracingIncludes: {
+    '/**/*': ['../../packages/db/certs/rds-global-bundle.pem'],
+  },
 
   // Reduce memory usage during production build
   productionBrowserSourceMaps: false,
diff --git a/apps/app/package.json b/apps/app/package.json
index f39fce8fd3..ac2bc13498 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -79,6 +79,7 @@
         "@uiw/react-json-view": "^2.0.0-alpha.40",
         "@uploadthing/react": "^7.3.0",
         "@upstash/ratelimit": "^2.0.5",
+        "@upstash/vector": "^1.2.2",
         "@vercel/analytics": "^1.5.0",
         "@vercel/sandbox": "^0.0.21",
         "@vercel/sdk": "^1.7.1",
diff --git a/apps/app/prisma/client.ts b/apps/app/prisma/client.ts
index 1bd8069f56..d7b33cfb60 100644
--- a/apps/app/prisma/client.ts
+++ b/apps/app/prisma/client.ts
@@ -1,7 +1,9 @@
 import { PrismaClient } from '@prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
 
-const globalForPrisma = global as unknown as { prisma: PrismaClient };
+const globalForPrisma = global as unknown as { prisma?: PrismaClient };
+
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
@@ -9,14 +11,42 @@ function stripSslMode(connectionString: string): string {
   return url.toString();
 }
 
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    return false;
+  }
+}
+
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const isLocalhost = isLocalhostUrl(rawUrl);
   const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
-  // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+  const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+
+  let ssl:
+    | undefined
+    | { checkServerIdentity: () => undefined }
+    | { rejectUnauthorized: false };
+  if (isLocalhost) {
+    ssl = undefined;
+  } else if (hasCABundle) {
+    // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
+    // RDS CA to the trust store). Skip hostname check because connections may
+    // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
+    // The chain check still rejects forged or wrong-CA certs.
+    ssl = { checkServerIdentity: () => undefined };
+  } else if (allowInsecure) {
+    ssl = { rejectUnauthorized: false };
+  } else {
+    throw new Error(
+      'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+    );
+  }
+
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({
@@ -27,6 +57,21 @@ function createPrismaClient(): PrismaClient {
   });
 }
 
-export const db = globalForPrisma.prisma || createPrismaClient();
+// Lazy initialization. Importing this module does NOT construct a Prisma client
+// — that only happens on first property access on `db`. Critical so that
+// Next.js `next build` (which imports every route handler to analyze it) does
+// not trigger the strict TLS check at build time when no actual queries run.
+function getClient(): PrismaClient {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = createPrismaClient();
+  }
+  return globalForPrisma.prisma;
+}
 
-if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = db;
+export const db = new Proxy({} as PrismaClient, {
+  get(_target, prop, _receiver) {
+    const client = getClient();
+    const value = Reflect.get(client, prop, client);
+    return typeof value === 'function' ? value.bind(client) : value;
+  },
+});
diff --git a/apps/app/prisma/index.ts b/apps/app/prisma/index.ts
index b329db54e3..f661a0b1d3 100644
--- a/apps/app/prisma/index.ts
+++ b/apps/app/prisma/index.ts
@@ -1 +1,65 @@
-export * from '@prisma/client';
+// `export *` from `@prisma/client` (CommonJS) makes Turbopack emit a warning
+// on every compile because it can't statically resolve the export list.
+// Listing the runtime values explicitly + `export type *` for types gives the
+// same public surface with a clean compile. Keep enum names alphabetized so
+// additions are obvious in diffs.
+export type * from '@prisma/client';
+export {
+  Prisma,
+  PrismaClient,
+  AttachmentEntityType,
+  AttachmentType,
+  AuditLogEntityType,
+  BrowserAutomationEvaluationStatus,
+  BrowserAutomationRunStatus,
+  CommentEntityType,
+  Departments,
+  DevicePlatform,
+  EvidenceAutomationEvaluationStatus,
+  EvidenceAutomationRunStatus,
+  EvidenceAutomationTrigger,
+  EvidenceFormType,
+  FindingArea,
+  FindingSeverity,
+  FindingStatus,
+  FindingType,
+  FrameworkStatus,
+  FrameworkSyncOperationKind,
+  Frequency,
+  Impact,
+  IntegrationConnectionStatus,
+  IntegrationFindingSeverity,
+  IntegrationFindingStatus,
+  IntegrationRunJobType,
+  IntegrationRunStatus,
+  IntegrationSyncLogStatus,
+  KnowledgeBaseDocumentProcessingStatus,
+  Likelihood,
+  PhaseCompletionType,
+  PolicyDisplayFormat,
+  PolicyStatus,
+  PolicyVisibility,
+  QuestionnaireAnswerStatus,
+  QuestionnaireStatus,
+  RiskCategory,
+  RiskStatus,
+  RiskTreatmentType,
+  Role,
+  SOAAnswerStatus,
+  SOADocumentStatus,
+  TaskAutomationStatus,
+  TaskFrequency,
+  TaskItemEntityType,
+  TaskItemPriority,
+  TaskItemStatus,
+  TaskStatus,
+  TimelinePhaseStatus,
+  TimelineStatus,
+  TrustAccessGrantStatus,
+  TrustAccessRequestStatus,
+  TrustFramework,
+  TrustNDAStatus,
+  TrustStatus,
+  VendorCategory,
+  VendorStatus,
+} from '@prisma/client';
diff --git a/apps/app/prisma/server.ts b/apps/app/prisma/server.ts
index 54d1c4b9c9..b04e8bc13d 100644
--- a/apps/app/prisma/server.ts
+++ b/apps/app/prisma/server.ts
@@ -1,2 +1,65 @@
-export * from '@prisma/client';
+// `export *` from `@prisma/client` (CommonJS) makes Turbopack warn on every
+// compile. Listing runtime values explicitly + `export type *` for types
+// gives the same public surface with a clean compile. Keep enums in sync
+// with `apps/app/prisma/index.ts`.
+export type * from '@prisma/client';
+export {
+  Prisma,
+  PrismaClient,
+  AttachmentEntityType,
+  AttachmentType,
+  AuditLogEntityType,
+  BrowserAutomationEvaluationStatus,
+  BrowserAutomationRunStatus,
+  CommentEntityType,
+  Departments,
+  DevicePlatform,
+  EvidenceAutomationEvaluationStatus,
+  EvidenceAutomationRunStatus,
+  EvidenceAutomationTrigger,
+  EvidenceFormType,
+  FindingArea,
+  FindingSeverity,
+  FindingStatus,
+  FindingType,
+  FrameworkStatus,
+  FrameworkSyncOperationKind,
+  Frequency,
+  Impact,
+  IntegrationConnectionStatus,
+  IntegrationFindingSeverity,
+  IntegrationFindingStatus,
+  IntegrationRunJobType,
+  IntegrationRunStatus,
+  IntegrationSyncLogStatus,
+  KnowledgeBaseDocumentProcessingStatus,
+  Likelihood,
+  PhaseCompletionType,
+  PolicyDisplayFormat,
+  PolicyStatus,
+  PolicyVisibility,
+  QuestionnaireAnswerStatus,
+  QuestionnaireStatus,
+  RiskCategory,
+  RiskStatus,
+  RiskTreatmentType,
+  Role,
+  SOAAnswerStatus,
+  SOADocumentStatus,
+  TaskAutomationStatus,
+  TaskFrequency,
+  TaskItemEntityType,
+  TaskItemPriority,
+  TaskItemStatus,
+  TaskStatus,
+  TimelinePhaseStatus,
+  TimelineStatus,
+  TrustAccessGrantStatus,
+  TrustAccessRequestStatus,
+  TrustFramework,
+  TrustNDAStatus,
+  TrustStatus,
+  VendorCategory,
+  VendorStatus,
+} from '@prisma/client';
 export { db } from './client';
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckTypes.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckTypes.ts
index 44347d001f..448129631b 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckTypes.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/backgroundCheckTypes.ts
@@ -43,6 +43,13 @@ export interface BackgroundCheckBillingStatus {
     currentPeriodEnd: string | null;
     cancelAtPeriodEnd: boolean;
   }>;
+  // Wallet credits per product. Optional because older API responses
+  // and existing test fixtures don't set it; treated as zero balance
+  // when absent.
+  creditBalances?: Array<{
+    productKey: 'pentest' | 'background_check';
+    balance: number;
+  }>;
 }
 
 export function isCompletedBackgroundCheck(status: BackgroundCheckStatus): boolean {
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.test.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.test.ts
new file mode 100644
index 0000000000..b42b63ac34
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, it } from 'vitest';
+import type { BackgroundCheckBillingStatus } from './backgroundCheckTypes';
+import { getBackgroundChecksRemaining } from './useEmployeeBackgroundCheckData';
+
+function status(
+  overrides: Partial<BackgroundCheckBillingStatus> = {},
+): BackgroundCheckBillingStatus {
+  return {
+    hasPaymentMethod: false,
+    setupAt: null,
+    ...overrides,
+  };
+}
+
+describe('getBackgroundChecksRemaining', () => {
+  it('returns null when billing status has not loaded', () => {
+    expect(getBackgroundChecksRemaining({ billingStatus: undefined })).toBeNull();
+  });
+
+  it('returns null when no subscription and no wallet credits exist', () => {
+    expect(getBackgroundChecksRemaining({ billingStatus: status() })).toBeNull();
+  });
+
+  it('returns subscription remainder when an active subscription exists', () => {
+    expect(
+      getBackgroundChecksRemaining({
+        billingStatus: status({
+          subscriptions: [
+            {
+              skuKey: 'background_checks_monthly_3',
+              status: 'active',
+              includedQuantity: 3,
+              usedQuantity: 1,
+              currentPeriodStart: null,
+              currentPeriodEnd: null,
+              cancelAtPeriodEnd: false,
+            },
+          ],
+        }),
+      }),
+    ).toBe(2);
+  });
+
+  it('returns wallet balance when no subscription but wallet credits exist', () => {
+    // Admin grant flow: organization has no subscription, platform
+    // admin granted 5 BG-check credits. Backend would consume from
+    // wallet on POST, so the wizard must allow the request.
+    expect(
+      getBackgroundChecksRemaining({
+        billingStatus: status({
+          creditBalances: [{ productKey: 'background_check', balance: 5 }],
+        }),
+      }),
+    ).toBe(5);
+  });
+
+  it('sums subscription remainder and wallet credits', () => {
+    expect(
+      getBackgroundChecksRemaining({
+        billingStatus: status({
+          subscriptions: [
+            {
+              skuKey: 'background_checks_monthly_3',
+              status: 'trialing',
+              includedQuantity: 3,
+              usedQuantity: 3,
+              currentPeriodStart: null,
+              currentPeriodEnd: null,
+              cancelAtPeriodEnd: false,
+            },
+          ],
+          creditBalances: [{ productKey: 'background_check', balance: 5 }],
+        }),
+      }),
+    ).toBe(5);
+  });
+
+  it('ignores pentest wallet credits when computing background-check allowance', () => {
+    expect(
+      getBackgroundChecksRemaining({
+        billingStatus: status({
+          creditBalances: [{ productKey: 'pentest', balance: 10 }],
+        }),
+      }),
+    ).toBeNull();
+  });
+
+  it('ignores cancelled subscriptions', () => {
+    expect(
+      getBackgroundChecksRemaining({
+        billingStatus: status({
+          subscriptions: [
+            {
+              skuKey: 'background_checks_monthly_3',
+              status: 'canceled',
+              includedQuantity: 3,
+              usedQuantity: 0,
+              currentPeriodStart: null,
+              currentPeriodEnd: null,
+              cancelAtPeriodEnd: false,
+            },
+          ],
+          creditBalances: [{ productKey: 'background_check', balance: 2 }],
+        }),
+      }),
+    ).toBe(2);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.ts
index 348047cdfe..c55edecb6a 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/useEmployeeBackgroundCheckData.ts
@@ -54,11 +54,31 @@ export function getBackgroundChecksRemaining({
 }: {
   billingStatus: BackgroundCheckBillingStatus | undefined;
 }): number | null {
-  const subscription = (billingStatus?.subscriptions ?? []).find(
+  if (!billingStatus) return null;
+  const subscription = (billingStatus.subscriptions ?? []).find(
     (item) =>
       getBillingSkuProductKey(item.skuKey) === 'background_check' &&
       (item.status === 'active' || item.status === 'trialing'),
   );
-  if (!subscription) return null;
-  return Math.max(subscription.includedQuantity - subscription.usedQuantity, 0);
+  // Wallet credits granted by platform admins. The backend's
+  // `BillingEntitlementsService.tryConsumeIncludedUsageForProduct`
+  // falls back to this wallet when no active subscription exists or
+  // the subscription's included usage is exhausted, so we mirror that
+  // logic here — otherwise the wizard paywalls users whose admin-
+  // granted credits would actually be consumed by the create call.
+  const walletBalance =
+    (billingStatus.creditBalances ?? []).find(
+      (entry) => entry.productKey === 'background_check',
+    )?.balance ?? 0;
+  if (!subscription) {
+    // Returning `null` keeps the existing "no allowance — go pick a
+    // plan" wizard path. We only have a positive allowance if there
+    // are wallet credits to consume.
+    return walletBalance > 0 ? walletBalance : null;
+  }
+  const subscriptionRemaining = Math.max(
+    subscription.includedQuantity - subscription.usedQuantity,
+    0,
+  );
+  return subscriptionRemaining + walletBalance;
 }
diff --git a/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.test.tsx b/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.test.tsx
index 22c95d34d2..c8be570601 100644
--- a/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.test.tsx
@@ -70,6 +70,34 @@ vi.mock('@/hooks/use-risks', () => ({
 // Mock @db
 vi.mock('@db', () => ({
   Risk: {},
+  // Enums used by suggested-residual / risk-score helpers. Values mirror
+  // the real Prisma enum string values.
+  Likelihood: {
+    very_unlikely: 'very_unlikely',
+    unlikely: 'unlikely',
+    possible: 'possible',
+    likely: 'likely',
+    very_likely: 'very_likely',
+  },
+  Impact: {
+    insignificant: 'insignificant',
+    minor: 'minor',
+    moderate: 'moderate',
+    major: 'major',
+    severe: 'severe',
+  },
+  RiskTreatmentType: {
+    accept: 'accept',
+    avoid: 'avoid',
+    mitigate: 'mitigate',
+    transfer: 'transfer',
+  },
+  TaskStatus: {
+    todo: 'todo',
+    in_progress: 'in_progress',
+    done: 'done',
+    not_relevant: 'not_relevant',
+  },
 }));
 
 // Mock onboarding hooks
@@ -116,6 +144,11 @@ vi.mock('@trycompai/design-system', () => ({
   InputGroup: ({ children }: any) => <div>{children}</div>,
   InputGroupAddon: ({ children }: any) => <span>{children}</span>,
   InputGroupInput: (props: any) => <input {...props} />,
+  Select: ({ children }: any) => <div data-testid="select">{children}</div>,
+  SelectContent: ({ children }: any) => <div>{children}</div>,
+  SelectItem: ({ children, value }: any) => <button data-value={value}>{children}</button>,
+  SelectTrigger: ({ children }: any) => <div>{children}</div>,
+  SelectValue: ({ placeholder }: any) => <span>{placeholder}</span>,
   Spinner: () => <span data-testid="spinner" />,
   Stack: ({ children }: any) => <div>{children}</div>,
   Table: ({ children, pagination }: any) => <table>{children}</table>,
@@ -202,11 +235,27 @@ describe('RisksTable permission gating', () => {
 
     expect(screen.getByText('RISK')).toBeInTheDocument();
     expect(screen.getByText('SEVERITY')).toBeInTheDocument();
+    expect(screen.getByText('RISK SCORE')).toBeInTheDocument();
     expect(screen.getByText('STATUS')).toBeInTheDocument();
     expect(screen.getByText('OWNER')).toBeInTheDocument();
     expect(screen.getByText('UPDATED')).toBeInTheDocument();
   });
 
+  it('renders SEVERITY label + RISK SCORE number, both from current state', () => {
+    setMockPermissions({});
+
+    render(<RisksTable {...defaultProps} />);
+
+    // Fixture: possible × moderate, mitigate, no linked tasks.
+    //   inherent: 3 × 3 = 9 raw → ceil(9/2.5) = 4
+    //   coverage gate (no tasks) → target = inherent → current = 4
+    // → severity label "Low" (score 4 → low band) + numeric "4/10".
+    // The severity filter dropdown also contains "Low" as an option, so
+    // we expect at least one (row + dropdown option).
+    expect(screen.getAllByText('Low').length).toBeGreaterThanOrEqual(1);
+    expect(screen.getByText('4/10')).toBeInTheDocument();
+  });
+
   it('renders search bar regardless of permissions', () => {
     setMockPermissions({});
 
diff --git a/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.tsx b/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.tsx
index 31f3c5f948..b748b39dc6 100644
--- a/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.tsx
+++ b/apps/app/src/app/(app)/[orgId]/risk/(overview)/RisksTable.tsx
@@ -1,5 +1,6 @@
 'use client';
 
+import { RiskScoreBadge } from '@/components/risks/RiskScoreBadge';
 import { usePermissions } from '@/hooks/use-permissions';
 import {
   useRiskActions,
@@ -9,6 +10,13 @@ import {
   type RisksQueryParams,
 } from '@/hooks/use-risks';
 import { getSortingStateParser } from '@/lib/parsers';
+import { getRiskLevelFromScore, getRiskScore, LEVEL_LABEL } from '@/lib/risk-score';
+import {
+  interpolatedResidualScore,
+  previewResidual,
+  suggestedResidual,
+} from '@/lib/suggested-residual';
+import { TaskStatus } from '@db';
 import type { Member, User } from '@db';
 import { Risk as RiskType } from '@db';
 import {
@@ -34,6 +42,11 @@ import {
   InputGroup,
   InputGroupAddon,
   InputGroupInput,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
   Spinner,
   Stack,
   Table,
@@ -66,33 +79,47 @@ const ACTIVE_STATUSES: Array<'pending' | 'processing' | 'created' | 'assessing'>
   'assessing',
 ];
 
-function getSeverityBadge(likelihood: string, impact: string) {
-  // Calculate severity based on likelihood and impact
-  const likelihoodScore: Record<string, number> = {
-    very_unlikely: 1,
-    unlikely: 2,
-    possible: 3,
-    likely: 4,
-    very_likely: 5,
-  };
-  const impactScore: Record<string, number> = {
-    insignificant: 1,
-    minor: 2,
-    moderate: 3,
-    major: 4,
-    severe: 5,
-  };
+/**
+ * The risk's current severity score (1-10), interpolated by linked-task
+ * completion the same way the Treatment Plan hero does it. Returns the
+ * inherent score when there's no linked work or the strategy doesn't
+ * project a reduction. Falls back to inherent on malformed input.
+ */
+function currentSeverityScore(risk: {
+  likelihood: ApiRisk['likelihood'];
+  impact: ApiRisk['impact'];
+  treatmentStrategy: ApiRisk['treatmentStrategy'];
+  tasks?: Array<{ status: TaskStatus }>;
+}): number {
+  const inherent = getRiskScore(risk.likelihood, risk.impact);
+  const tasks = risk.tasks ?? [];
+  const target = previewResidual({
+    inherentLikelihood: risk.likelihood,
+    inherentImpact: risk.impact,
+    strategy: risk.treatmentStrategy,
+    hasLinkedWork: tasks.length > 0,
+  });
+  const targetScore = getRiskScore(target.likelihood, target.impact).score;
+  const completion = suggestedResidual({
+    likelihood: risk.likelihood,
+    impact: risk.impact,
+    strategy: risk.treatmentStrategy,
+    tasks,
+  }).completion;
+  return interpolatedResidualScore({
+    inherentScore: inherent.score,
+    targetScore,
+    completion,
+  });
+}
 
-  const score = (likelihoodScore[likelihood] || 1) * (impactScore[impact] || 1);
 
-  if (score >= 15) {
-    return <Badge variant="destructive">High</Badge>;
-  }
-  if (score >= 8) {
-    return <Badge variant="secondary">Medium</Badge>;
-  }
-  return <Badge variant="outline">Low</Badge>;
-}
+const STATUS_LABEL: Record<string, string> = {
+  open: 'Open',
+  pending: 'Pending',
+  closed: 'Closed',
+  archived: 'Archived',
+};
 
 function getStatusBadge(status: string) {
   switch (status) {
@@ -146,24 +173,48 @@ export const RisksTable = ({
 
   // Read current search params from URL
   const [title, setTitle] = useQueryState('title', parseAsString.withDefault(''));
+  const [statusFilter, setStatusFilter] = useQueryState(
+    'status',
+    parseAsString.withDefault(''),
+  );
+  const [assigneeFilter, setAssigneeFilter] = useQueryState(
+    'assignee',
+    parseAsString.withDefault(''),
+  );
+  // Severity is computed from the current treatment-aware score, so it's
+  // filtered client-side after fetch (the API can't query a derived value).
+  const [severityFilter, setSeverityFilter] = useQueryState(
+    'severity',
+    parseAsString.withDefault(''),
+  );
   const [sort, setSort] = useQueryState(
     'sort',
     getSortingStateParser<RiskType>().withDefault([{ id: 'title', desc: false }]),
   );
 
-  // Build query params for the API
+  // Build query params for the API. Status and assignee are server-side;
+  // severity is computed from the current treatment-aware score (which the
+  // API can't query directly), so when severity is filtered we fetch
+  // the org's full risk set in one page and paginate after the filter.
+  // Without this, severity filtering would only see whatever happened to
+  // be on the current server page — causing wrong/missing results and an
+  // incorrect total count. (Cubic finding #27 on PR #2671.)
+  const FILTER_ALL_PAGE_SIZE = 1000;
+  const fetchAllForSeverity = Boolean(severityFilter);
   const queryParams = useMemo<RisksQueryParams>(() => {
     const currentSort = sort[0];
     return {
-      page,
-      perPage,
+      page: fetchAllForSeverity ? 1 : page,
+      perPage: fetchAllForSeverity ? FILTER_ALL_PAGE_SIZE : perPage,
       ...(title && { title }),
+      ...(statusFilter && { status: statusFilter }),
+      ...(assigneeFilter && { assigneeId: assigneeFilter }),
       ...(currentSort && {
         sort: currentSort.id,
         sortDirection: currentSort.desc ? 'desc' as const : 'asc' as const,
       }),
     };
-  }, [page, perPage, title, sort]);
+  }, [page, perPage, title, statusFilter, assigneeFilter, sort, fetchAllForSeverity]);
 
   // Use the useRisks hook with query params
   const { data: risksData, mutate: mutateRisks } = useRisks({
@@ -173,12 +224,34 @@ export const RisksTable = ({
     keepPreviousData: true,
   });
 
-  const risks = useMemo(() => {
+  // Full result set from the API — already narrowed by status/assignee/title.
+  const fullList = useMemo(() => {
     const apiData = risksData?.data?.data;
     return Array.isArray(apiData) ? apiData : initialRisks;
   }, [risksData, initialRisks]);
 
-  const pageCount = risksData?.data?.pageCount ?? initialPageCount;
+  // After server filtering, apply the (derived) severity filter and then
+  // re-paginate client-side so totals reflect the filtered result.
+  const filteredList = useMemo(() => {
+    if (!severityFilter) return fullList;
+    return fullList.filter((risk) => {
+      const score = currentSeverityScore(risk);
+      return getRiskLevelFromScore(score) === severityFilter;
+    });
+  }, [fullList, severityFilter]);
+
+  const risks = useMemo(() => {
+    if (!fetchAllForSeverity) return filteredList;
+    const start = (page - 1) * perPage;
+    return filteredList.slice(start, start + perPage);
+  }, [filteredList, fetchAllForSeverity, page, perPage]);
+
+  const pageCount = useMemo(() => {
+    if (fetchAllForSeverity) {
+      return Math.max(1, Math.ceil(filteredList.length / perPage));
+    }
+    return risksData?.data?.pageCount ?? initialPageCount;
+  }, [fetchAllForSeverity, filteredList.length, perPage, risksData, initialPageCount]);
 
   // Check if all risks are done assessing
   const allRisksDoneAssessing = useMemo(() => {
@@ -380,18 +453,107 @@ export const RisksTable = ({
   return (
     <RiskOnboardingProvider statuses={itemStatuses}>
       <Stack gap="4">
-        {/* Search Bar */}
-        <div className="w-full md:max-w-[300px]">
-          <InputGroup>
-            <InputGroupAddon>
-              <Search size={16} />
-            </InputGroupAddon>
-            <InputGroupInput
-              placeholder="Search risks..."
-              value={title}
-              onChange={(e) => setTitle(e.target.value || null)}
-            />
-          </InputGroup>
+        {/* Search + Filters. Severity is client-side (derived score),
+            Status and Owner are server-side via the risks API. Each
+            filter is URL-backed so links are shareable. */}
+        <div className="flex w-full flex-col gap-2 md:flex-row md:flex-wrap md:items-center">
+          <div className="w-full md:max-w-[300px]">
+            <InputGroup>
+              <InputGroupAddon>
+                <Search size={16} />
+              </InputGroupAddon>
+              <InputGroupInput
+                placeholder="Search risks..."
+                value={title}
+                onChange={(e) => setTitle(e.target.value || null)}
+              />
+            </InputGroup>
+          </div>
+          <div className="w-full md:w-[160px]">
+            <Select
+              value={severityFilter || 'all'}
+              onValueChange={(v) => setSeverityFilter(v === 'all' ? null : v)}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder="Severity">
+                  {(value: string) =>
+                    value && value !== 'all'
+                      ? LEVEL_LABEL[value as keyof typeof LEVEL_LABEL] ?? value
+                      : 'All severities'
+                  }
+                </SelectValue>
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="all">All severities</SelectItem>
+                <SelectItem value="very-high">Very high</SelectItem>
+                <SelectItem value="high">High</SelectItem>
+                <SelectItem value="medium">Medium</SelectItem>
+                <SelectItem value="low">Low</SelectItem>
+                <SelectItem value="very-low">Very low</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="w-full md:w-[160px]">
+            <Select
+              value={statusFilter || 'all'}
+              onValueChange={(v) => setStatusFilter(v === 'all' ? null : v)}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder="Status">
+                  {(value: string) =>
+                    value && value !== 'all'
+                      ? STATUS_LABEL[value] ?? value
+                      : 'All statuses'
+                  }
+                </SelectValue>
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="all">All statuses</SelectItem>
+                <SelectItem value="open">Open</SelectItem>
+                <SelectItem value="pending">Pending</SelectItem>
+                <SelectItem value="closed">Closed</SelectItem>
+                <SelectItem value="archived">Archived</SelectItem>
+              </SelectContent>
+            </Select>
+          </div>
+          <div className="w-full md:w-[200px]">
+            <Select
+              value={assigneeFilter || 'all'}
+              onValueChange={(v) => setAssigneeFilter(v === 'all' ? null : v)}
+            >
+              <SelectTrigger>
+                <SelectValue placeholder="Owner">
+                  {(value: string) => {
+                    if (!value || value === 'all') return 'All owners';
+                    const a = assignees.find((m) => m.id === value);
+                    return a?.user?.name || a?.user?.email || 'Unknown';
+                  }}
+                </SelectValue>
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="all">All owners</SelectItem>
+                {assignees.map((a) => (
+                  <SelectItem key={a.id} value={a.id}>
+                    {a.user?.name || a.user?.email || 'Unknown'}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+          {(severityFilter || statusFilter || assigneeFilter || title) && (
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={() => {
+                void setTitle(null);
+                void setSeverityFilter(null);
+                void setStatusFilter(null);
+                void setAssigneeFilter(null);
+              }}
+            >
+              Clear filters
+            </Button>
+          )}
         </div>
 
         {/* Onboarding Progress Banner */}
@@ -463,6 +625,8 @@ export const RisksTable = ({
                     </button>
                   </TableHead>
                   <TableHead>SEVERITY</TableHead>
+                  <TableHead>INHERENT RISK</TableHead>
+                  <TableHead>CURRENT RISK</TableHead>
                   <TableHead>STATUS</TableHead>
                   <TableHead>OWNER</TableHead>
                   <TableHead>
@@ -494,7 +658,36 @@ export const RisksTable = ({
                           <Text>{risk.title}</Text>
                         </HStack>
                       </TableCell>
-                      <TableCell>{getSeverityBadge(risk.likelihood, risk.impact)}</TableCell>
+                      {(() => {
+                        // Three score columns paint the before-vs-now picture:
+                        //   SEVERITY = current treatment-aware level (text).
+                        //   INHERENT = raw score before treatment, fixed.
+                        //   CURRENT  = treatment-aware score interpolated by
+                        //              linked-task completion. Named "Current"
+                        //              (not "Residual") because the canonical
+                        //              residual is the *target* score at 100%
+                        //              completion — what's shown here moves
+                        //              with progress and matches the hero's
+                        //              "Currently X/10" subline.
+                        // SEVERITY is plain text and CURRENT carries the
+                        // colored chip so we don't double-paint the band.
+                        const inherentScore = getRiskScore(risk.likelihood, risk.impact).score;
+                        const score = currentSeverityScore(risk);
+                        const level = getRiskLevelFromScore(score);
+                        return (
+                          <>
+                            <TableCell>
+                              <Text>{LEVEL_LABEL[level]}</Text>
+                            </TableCell>
+                            <TableCell>
+                              <RiskScoreBadge score={inherentScore} />
+                            </TableCell>
+                            <TableCell>
+                              <RiskScoreBadge score={score} />
+                            </TableCell>
+                          </>
+                        );
+                      })()}
                       <TableCell>{getStatusBadge(risk.status)}</TableCell>
                       <TableCell>
                         <Text>{risk.assignee?.user?.name || 'Unassigned'}</Text>
diff --git a/apps/app/src/app/(app)/[orgId]/risk/(overview)/page.tsx b/apps/app/src/app/(app)/[orgId]/risk/(overview)/page.tsx
index 55e499a40c..61a5231678 100644
--- a/apps/app/src/app/(app)/[orgId]/risk/(overview)/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/risk/(overview)/page.tsx
@@ -69,9 +69,30 @@ export default async function RiskRegisterPage(props: {
   const risks = risksResult.data?.data ?? [];
   const pageCount = risksResult.data?.pageCount ?? 0;
 
-  // Transform people response to assignees format expected by CreateRiskSheet
+  // Transform people response to assignees format expected by CreateRiskSheet.
+  // Risk owners need write access to risks (risk:update) and the compliance
+  // app (app:read). The built-in roles that grant both are `owner` and
+  // `admin`; `auditor` is read-only (no update); `employee` and `contractor`
+  // are portal-only. Custom roles can grant any combination of permissions,
+  // so anyone with a non-built-in role is included — we can't resolve
+  // permissions client-side and customers control their own role design.
+  const PORTAL_ONLY_OR_READ_ROLES = new Set([
+    'auditor',
+    'employee',
+    'contractor',
+  ]);
+  const canOwnRisks = (roleField: string): boolean => {
+    const roles = roleField.split(',').map((r) => r.trim()).filter(Boolean);
+    if (roles.length === 0) return false;
+    return roles.some((r) => {
+      if (r === 'owner' || r === 'admin') return true;
+      if (PORTAL_ONLY_OR_READ_ROLES.has(r)) return false;
+      // Custom role — trust the org's role design.
+      return true;
+    });
+  };
   const assignees = (peopleResult.data?.data ?? [])
-    .filter((p) => !p.deactivated && !['employee', 'contractor'].includes(p.role))
+    .filter((p) => !p.deactivated && canOwnRisks(p.role))
     .map((p) => ({
       id: p.id,
       role: p.role,
diff --git a/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.test.tsx b/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.test.tsx
index fbdb7a5f6d..70ab66f3a4 100644
--- a/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.test.tsx
@@ -40,11 +40,48 @@ vi.mock('@/hooks/use-risks', () => ({
   useRisk: () => ({
     risk: mockRisk,
   }),
+  useRiskActions: () => ({
+    updateRisk: vi.fn(),
+    regenerateMitigation: vi.fn().mockResolvedValue({
+      runId: 'run_test',
+      publicAccessToken: 'tok_test',
+    }),
+    suggestRiskLinks: vi.fn(),
+    applyRiskLinks: vi.fn(),
+    fetchActiveRiskAutoLinkRun: vi.fn().mockResolvedValue(null),
+    discardRiskAutoLinkRun: vi.fn(),
+  }),
 }));
 
 // Mock @db
 vi.mock('@db', () => ({
   CommentEntityType: { risk: 'risk' },
+  Likelihood: {
+    very_unlikely: 'very_unlikely',
+    unlikely: 'unlikely',
+    possible: 'possible',
+    likely: 'likely',
+    very_likely: 'very_likely',
+  },
+  Impact: {
+    insignificant: 'insignificant',
+    minor: 'minor',
+    moderate: 'moderate',
+    major: 'major',
+    severe: 'severe',
+  },
+  RiskTreatmentType: {
+    accept: 'accept',
+    avoid: 'avoid',
+    mitigate: 'mitigate',
+    transfer: 'transfer',
+  },
+  TaskStatus: {
+    todo: 'todo',
+    in_progress: 'in_progress',
+    done: 'done',
+    not_relevant: 'not_relevant',
+  },
 }));
 
 // Mock design system
diff --git a/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.tsx b/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.tsx
index a5858b4cec..e58fa9b684 100644
--- a/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/risk/[riskId]/components/RiskPageClient.tsx
@@ -5,16 +5,16 @@ import { RecentAuditLogs } from '@/components/RecentAuditLogs';
 import { InherentRiskChart } from '@/components/risks/charts/InherentRiskChart';
 import { ResidualRiskChart } from '@/components/risks/charts/ResidualRiskChart';
 import { RiskOverview } from '@/components/risks/risk-overview';
+import { TreatmentPlanTab } from '@/components/risks/treatment-plan/TreatmentPlanTab';
 import { TaskItems } from '@/components/task-items/TaskItems';
 import { useAuditLogs } from '@/hooks/use-audit-logs';
-import { useRisk, useRiskActions, type RiskResponse } from '@/hooks/use-risks';
+import { useRisk, useRiskActions, type RiskLinkedTask, type RiskResponse } from '@/hooks/use-risks';
 import { useTaskItems, useTaskItemActions } from '@/hooks/use-task-items';
 import { usePermissions } from '@/hooks/use-permissions';
 import { CommentEntityType } from '@db';
-import type { Member, Risk, User } from '@db';
+import type { Member, Risk, RiskTreatmentType, User } from '@db';
 import {
   Breadcrumb,
-  Button,
   HStack,
   Stack,
   Tabs,
@@ -24,8 +24,8 @@ import {
   Text,
 } from '@trycompai/design-system';
 import Link from 'next/link';
-import { useSearchParams } from 'next/navigation';
-import { useMemo, useState } from 'react';
+import { useQueryState } from 'nuqs';
+import { useCallback, useMemo, useState } from 'react';
 import { toast } from 'sonner';
 
 type RiskWithAssignee = Risk & {
@@ -62,10 +62,25 @@ export function RiskPageClient({
   taskItemId,
 }: RiskPageClientProps) {
   const { risk: swrRisk, mutate: mutateRisk } = useRisk(riskId);
-  const { updateRisk, regenerateMitigation } = useRiskActions();
+  const {
+    updateRisk,
+    regenerateMitigation,
+    suggestRiskLinks,
+    applyRiskLinks,
+    fetchActiveRiskAutoLinkRun,
+    discardRiskAutoLinkRun,
+  } = useRiskActions();
   const { hasPermission } = usePermissions();
-  const searchParams = useSearchParams();
-  const defaultTab = searchParams.get('tab') || 'overview';
+  // URL-backed tab state — bookmarks the active tab in `?tab=...` so a
+  // refresh keeps the same view. Control the value so we can conditionally
+  // render only the active panel below: base-ui's Tabs.Panel keeps the
+  // outgoing panel mounted at full opacity for the duration of the
+  // incoming panel's `fade-in-0 duration-200` animation, which produces
+  // a visible "both panels stacked" flash. Mounting only the active panel
+  // sidesteps the transition window entirely.
+  const [activeTab, setActiveTab] = useQueryState('tab', {
+    defaultValue: 'overview',
+  });
   const isViewingTask = Boolean(taskItemId);
   const canUpdate = hasPermission('risk', 'update');
   const canUpdateTask = hasPermission('task', 'update');
@@ -82,6 +97,10 @@ export function RiskPageClient({
   const [isEditingDescription, setIsEditingDescription] = useState(false);
   const [descriptionValue, setDescriptionValue] = useState('');
   const [isRegenerating, setIsRegenerating] = useState(false);
+  const [regenRun, setRegenRun] = useState<{
+    runId: string;
+    publicAccessToken: string;
+  } | null>(null);
 
   const risk = useMemo(() => {
     if (swrRisk) return normalizeRisk(swrRisk);
@@ -141,20 +160,80 @@ export function RiskPageClient({
     }
   };
 
+  const handleUpdateStrategy = async (strategy: RiskTreatmentType) => {
+    await updateRisk(riskId, { treatmentStrategy: strategy });
+    mutateRisk();
+  };
+
+  const handleUpdateDescription = async (description: string) => {
+    await updateRisk(riskId, { treatmentStrategyDescription: description });
+    mutateRisk();
+  };
+
   const handleRegenerateMitigation = async () => {
     setIsRegenerating(true);
-    toast.info('Regenerating risk mitigation...');
     try {
-      await regenerateMitigation(riskId);
-      toast.success('Regeneration triggered. This may take a moment.');
-      mutateRisk();
+      const handle = await regenerateMitigation(riskId);
+      // Hand control to the realtime subscription in DescriptionEditor.
+      // It calls back via onRegenSettled when the run terminates, at which
+      // point we clear isRegenerating + refetch the risk for the new prose.
+      setRegenRun(handle);
     } catch {
       toast.error('Failed to trigger mitigation regeneration');
-    } finally {
       setIsRegenerating(false);
     }
   };
 
+  const handleRegenSettled = useCallback(
+    (result: { success: boolean; reason?: string }) => {
+      setRegenRun(null);
+      setIsRegenerating(false);
+      if (result.success) {
+        toast.success('Treatment plan regenerated.');
+        void mutateRisk();
+      } else {
+        toast.error(result.reason ?? 'Failed to regenerate the treatment plan.');
+      }
+    },
+    [mutateRisk],
+  );
+
+  const handleSuggest = async () => {
+    return suggestRiskLinks(riskId);
+  };
+
+  const handleApply = async (params: { taskIds: string[]; replace: boolean }) => {
+    await applyRiskLinks(riskId, params);
+    await mutateRisk();
+  };
+
+  const handleUnlinkTask = async (taskId: string) => {
+    try {
+      const res = await fetch(`/api/risks/${riskId}/tasks/${taskId}`, {
+        method: 'DELETE',
+        credentials: 'include',
+      });
+      if (!res.ok) throw new Error('unlink failed');
+      await mutateRisk();
+    } catch {
+      toast.error('Failed to unlink task');
+    }
+  };
+
+  // Memoize so AutoLinkSuggestions' resume effect (which depends on the
+  // callback identity) doesn't re-fire on every parent re-render.
+  const handleResumeAutoLink = useCallback(
+    () => fetchActiveRiskAutoLinkRun(riskId),
+    [fetchActiveRiskAutoLinkRun, riskId],
+  );
+
+  const handleDiscardAutoLinkRun = useCallback(
+    async () => {
+      await discardRiskAutoLinkRun(riskId);
+    },
+    [discardRiskAutoLinkRun, riskId],
+  );
+
   return (
     <>
       <Breadcrumb
@@ -236,10 +315,11 @@ export function RiskPageClient({
       {isViewingTask ? (
         <TaskItems entityId={riskId} entityType="risk"  />
       ) : (
-        <Tabs defaultValue={defaultTab}>
+        <Tabs value={activeTab} onValueChange={(next) => void setActiveTab(String(next))}>
           <Stack gap="lg">
             <TabsList variant="underline">
               <TabsTrigger value="overview">Overview</TabsTrigger>
+              <TabsTrigger value="treatment-plan">Treatment Plan</TabsTrigger>
               <TabsTrigger value="risk-matrix">Risk Matrix</TabsTrigger>
               <TabsTrigger value="tasks">Tasks</TabsTrigger>
               <TabsTrigger value="comments">Comments</TabsTrigger>
@@ -247,52 +327,91 @@ export function RiskPageClient({
               <TabsTrigger value="settings">Settings</TabsTrigger>
             </TabsList>
 
-            <TabsContent value="overview">
-              <RiskOverview risk={risk} assignees={assignees} />
-            </TabsContent>
+            {activeTab === 'overview' && (
+              <TabsContent value="overview">
+                <RiskOverview risk={risk} assignees={assignees} />
+              </TabsContent>
+            )}
+
+            {activeTab === 'treatment-plan' && (
+              <TabsContent value="treatment-plan">
+                <TreatmentPlanTab
+                  orgId={orgId}
+                  entity={{
+                    id: risk.id,
+                    inherentLikelihood: risk.likelihood,
+                    inherentImpact: risk.impact,
+                    residualLikelihood: risk.residualLikelihood,
+                    residualImpact: risk.residualImpact,
+                    treatmentStrategy: risk.treatmentStrategy,
+                    treatmentStrategyDescription: risk.treatmentStrategyDescription,
+                    strategyDescriptions:
+                      (swrRisk as { strategyDescriptions?: unknown } | undefined)
+                        ?.strategyDescriptions as
+                        | Partial<Record<RiskTreatmentType, string>>
+                        | null
+                        | undefined ?? null,
+                    // Fall through to the server-rendered initial risk so the
+                    // Linked Work column doesn't blink empty between SSR and
+                    // the first SWR resolution. (Cubic finding #28.)
+                    tasks:
+                      swrRisk?.tasks ??
+                      (initialRisk as unknown as { tasks?: RiskLinkedTask[] })
+                        .tasks ??
+                      [],
+                  }}
+                  canUpdate={canUpdate}
+                  onUpdateStrategy={handleUpdateStrategy}
+                  onUpdateDescription={handleUpdateDescription}
+                  onRegenerate={handleRegenerateMitigation}
+                  regenerating={isRegenerating}
+                  onSuggest={handleSuggest}
+                  onApply={handleApply}
+                  // Gate the unlink affordance behind risk:update so the trash
+                  // button doesn't render for read-only users. The Next API
+                  // route enforces the same check server-side as defense in
+                  // depth. (Cubic finding on PR #2671.)
+                  onUnlinkTask={canUpdate ? handleUnlinkTask : undefined}
+                  onResumeAutoLink={handleResumeAutoLink}
+                  onDiscardAutoLinkRun={handleDiscardAutoLinkRun}
+                  regenRun={regenRun}
+                  onRegenSettled={handleRegenSettled}
+                />
+              </TabsContent>
+            )}
 
-            <TabsContent value="risk-matrix">
-              <Stack gap="lg">
-                <InherentRiskChart risk={risk} />
-                <ResidualRiskChart risk={risk} />
-              </Stack>
-            </TabsContent>
+            {activeTab === 'risk-matrix' && (
+              <TabsContent value="risk-matrix">
+                <Stack gap="lg">
+                  <InherentRiskChart risk={risk} />
+                  <ResidualRiskChart risk={risk} />
+                </Stack>
+              </TabsContent>
+            )}
 
-            <TabsContent value="tasks">
-              <TaskItems entityId={riskId} entityType="risk"  />
-            </TabsContent>
+            {activeTab === 'tasks' && (
+              <TabsContent value="tasks">
+                <TaskItems entityId={riskId} entityType="risk" />
+              </TabsContent>
+            )}
 
-            <TabsContent value="comments">
-              <Comments entityId={riskId} entityType={CommentEntityType.risk} organizationId={orgId} />
-            </TabsContent>
+            {activeTab === 'comments' && (
+              <TabsContent value="comments">
+                <Comments entityId={riskId} entityType={CommentEntityType.risk} organizationId={orgId} />
+              </TabsContent>
+            )}
 
-            <TabsContent value="activity">
-              <RiskActivitySection riskId={riskId} taskItemIds={taskItemsData?.data?.data?.map((t) => t.id) || []} />
-            </TabsContent>
+            {activeTab === 'activity' && (
+              <TabsContent value="activity">
+                <RiskActivitySection riskId={riskId} taskItemIds={taskItemsData?.data?.data?.map((t) => t.id) || []} />
+              </TabsContent>
+            )}
 
-            <TabsContent value="settings">
-              <Stack gap="lg">
-                {canUpdate && (
-                  <HStack justify="between" align="center">
-                    <Stack gap="none">
-                      <Text size="sm" weight="medium">Regenerate Risk Mitigation</Text>
-                      <Text size="xs" variant="muted">
-                        Generate a fresh mitigation comment for this risk using AI
-                      </Text>
-                    </Stack>
-                    <Button
-                      variant="outline"
-                      size="sm"
-                      onClick={handleRegenerateMitigation}
-                      disabled={isRegenerating}
-                      loading={isRegenerating}
-                    >
-                      {isRegenerating ? 'Regenerating...' : 'Regenerate'}
-                    </Button>
-                  </HStack>
-                )}
-              </Stack>
-            </TabsContent>
+            {activeTab === 'settings' && (
+              <TabsContent value="settings">
+                <Text size="sm" variant="muted">No settings yet.</Text>
+              </TabsContent>
+            )}
           </Stack>
         </Tabs>
       )}
diff --git a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx
index 79147c1014..0846203fff 100644
--- a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx
+++ b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/SplitView.tsx
@@ -6,13 +6,16 @@ import type {
   PentestIssue,
   PentestRun,
 } from '@/lib/security/penetration-tests-client';
-import { getBillingSkuProductKey } from '@trycompai/billing';
 import { cn } from '@trycompai/design-system/cn';
 import { ArrowLeft } from '@trycompai/design-system/icons';
 import { useRouter } from 'next/navigation';
 import { useState } from 'react';
 import { toast } from 'sonner';
 import useSWR from 'swr';
+import {
+  getPentestAllowance,
+  type PentestBillingStatusInput,
+} from './pentest-allowance';
 import {
   useCreatePenetrationTest,
   usePenetrationTest,
@@ -27,15 +30,6 @@ import { OverviewPane } from './OverviewPane';
 import { RunList } from './RunList';
 import './pentest-tokens.css';
 
-interface BillingStatus {
-  subscriptions?: Array<{
-    skuKey: string;
-    status: string;
-    includedQuantity: number;
-    usedQuantity: number;
-  }>;
-}
-
 interface SplitViewProps {
   orgId: string;
   selectedRunId: string | null;
@@ -61,28 +55,20 @@ export function SplitView({ orgId, selectedRunId, mode = 'default' }: SplitViewP
   const { issues } = usePenetrationTestIssues(orgId, selectedRunId ?? '', selectedRun?.status);
   const { events } = usePenetrationTestEvents(orgId, selectedRunId ?? '', selectedRun?.status);
   const { createReport, isCreating } = useCreatePenetrationTest(orgId);
-  const { data: billingStatus } = useSWR<BillingStatus>(
+  const { data: billingStatus } = useSWR<PentestBillingStatusInput>(
     orgId ? (['/v1/billing/status', orgId] as const) : null,
     async ([endpoint, organizationId]: readonly [string, string]) => {
-      const response = await api.get<BillingStatus>(endpoint, organizationId);
+      const response = await api.get<PentestBillingStatusInput>(
+        endpoint,
+        organizationId,
+      );
       if (response.status < 200 || response.status >= 300) {
         throw new Error(response.error ?? 'Failed to load billing status');
       }
       return response.data ?? {};
     },
   );
-  const pentestSubscription = (billingStatus?.subscriptions ?? []).find(
-    (subscription) =>
-      getBillingSkuProductKey(subscription.skuKey) === 'pentest' &&
-      (subscription.status === 'active' || subscription.status === 'trialing'),
-  );
-  const subscriptionBalance = pentestSubscription
-    ? Math.max(pentestSubscription.includedQuantity - pentestSubscription.usedQuantity, 0)
-    : null;
-  // Keep `balance` undefined while billing is loading so the page does not
-  // flash a blocked state before subscription allowance is known.
-  const balance = subscriptionBalance ?? (billingStatus === undefined ? undefined : 0);
-  const planRequired = subscriptionBalance === null && billingStatus !== undefined;
+  const { balance, planRequired } = getPentestAllowance(billingStatus);
   const quotaLabel = 'Plan';
 
   const showEmptyState =
diff --git a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.test.ts b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.test.ts
new file mode 100644
index 0000000000..22e1be6e2c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.test.ts
@@ -0,0 +1,107 @@
+import { describe, expect, it } from 'vitest';
+import { getPentestAllowance } from './pentest-allowance';
+
+describe('getPentestAllowance', () => {
+  it('returns undefined balance while billing status is loading', () => {
+    expect(getPentestAllowance(undefined)).toEqual({
+      balance: undefined,
+      planRequired: false,
+    });
+  });
+
+  it('reports plan required when neither subscription nor wallet credits exist', () => {
+    expect(getPentestAllowance({})).toEqual({
+      balance: 0,
+      planRequired: true,
+    });
+  });
+
+  it('uses subscription remainder when a trial is active', () => {
+    expect(
+      getPentestAllowance({
+        subscriptions: [
+          {
+            skuKey: 'pentest_monthly_1',
+            status: 'trialing',
+            includedQuantity: 1,
+            usedQuantity: 0,
+          },
+        ],
+      }),
+    ).toEqual({ balance: 1, planRequired: false });
+  });
+
+  it('uses wallet credits when no subscription exists', () => {
+    // The "platform admin granted credits to a paywalled org" case —
+    // backend falls back to wallet, so the UI must too.
+    expect(
+      getPentestAllowance({
+        creditBalances: [{ productKey: 'pentest', balance: 5 }],
+      }),
+    ).toEqual({ balance: 5, planRequired: false });
+  });
+
+  it('sums subscription remainder and wallet credits', () => {
+    // Trial used (0 remaining) + 5 wallet credits => 5 total. Without
+    // this fix the UI would compute balance=0 and reroute to billing.
+    expect(
+      getPentestAllowance({
+        subscriptions: [
+          {
+            skuKey: 'pentest_monthly_1',
+            status: 'trialing',
+            includedQuantity: 1,
+            usedQuantity: 1,
+          },
+        ],
+        creditBalances: [{ productKey: 'pentest', balance: 5 }],
+      }),
+    ).toEqual({ balance: 5, planRequired: false });
+  });
+
+  it('clamps negative subscription remainder to zero before adding wallet credits', () => {
+    // Defensive: if Stripe ever reports usedQuantity > includedQuantity
+    // (e.g. proration glitch), the UI should not subtract from wallet.
+    expect(
+      getPentestAllowance({
+        subscriptions: [
+          {
+            skuKey: 'pentest_monthly_1',
+            status: 'active',
+            includedQuantity: 1,
+            usedQuantity: 5,
+          },
+        ],
+        creditBalances: [{ productKey: 'pentest', balance: 3 }],
+      }),
+    ).toEqual({ balance: 3, planRequired: false });
+  });
+
+  it('ignores wallet credits for unrelated products', () => {
+    expect(
+      getPentestAllowance({
+        creditBalances: [
+          { productKey: 'background_check', balance: 10 },
+        ],
+      }),
+    ).toEqual({ balance: 0, planRequired: true });
+  });
+
+  it('ignores cancelled subscriptions', () => {
+    // Match the backend's access-status filter — only active/trialing
+    // subscriptions count toward subscription remainder.
+    expect(
+      getPentestAllowance({
+        subscriptions: [
+          {
+            skuKey: 'pentest_monthly_1',
+            status: 'canceled',
+            includedQuantity: 1,
+            usedQuantity: 0,
+          },
+        ],
+        creditBalances: [{ productKey: 'pentest', balance: 2 }],
+      }),
+    ).toEqual({ balance: 2, planRequired: false });
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.ts b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.ts
new file mode 100644
index 0000000000..a39384ef39
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/_components/pentest-allowance.ts
@@ -0,0 +1,71 @@
+import { getBillingSkuProductKey } from '@trycompai/billing';
+
+/**
+ * Shape of `/v1/billing/status` fields the pentest UI consumes. We only
+ * declare what we read so the type doesn't drift from the broader
+ * BillingStatus contract every time an unrelated billing field
+ * changes.
+ */
+export interface PentestBillingStatusInput {
+  subscriptions?: Array<{
+    skuKey: string;
+    status: string;
+    includedQuantity: number;
+    usedQuantity: number;
+  }>;
+  creditBalances?: Array<{
+    productKey: 'pentest' | 'background_check';
+    balance: number;
+  }>;
+}
+
+export interface PentestAllowance {
+  /**
+   * Total runs the user can start right now: subscription remainder +
+   * admin-granted wallet credits. `undefined` while billing is still
+   * loading so the page does not flash a paywalled state.
+   */
+  balance: number | undefined;
+  /**
+   * True only when neither an active subscription nor a wallet credit
+   * exists. The UI uses this to decide whether to show "+ New Scan" or
+   * "View plans".
+   */
+  planRequired: boolean;
+}
+
+/**
+ * Compute the user-visible pentest allowance from billing status.
+ *
+ * Mirrors `BillingEntitlementsService.tryConsumeIncludedUsageForProduct`:
+ * the backend consumes from the active Stripe subscription first and
+ * falls back to the per-product wallet (BillingCreditBalance). Surfacing
+ * both here keeps the UI's gating in lockstep with what the create
+ * endpoint will actually accept — without this, admin-granted credits
+ * are invisible to the customer and the New Scan button incorrectly
+ * redirects to billing.
+ */
+export function getPentestAllowance(
+  billingStatus: PentestBillingStatusInput | undefined,
+): PentestAllowance {
+  if (billingStatus === undefined) {
+    return { balance: undefined, planRequired: false };
+  }
+  const subscription = (billingStatus.subscriptions ?? []).find(
+    (item) =>
+      getBillingSkuProductKey(item.skuKey) === 'pentest' &&
+      (item.status === 'active' || item.status === 'trialing'),
+  );
+  const subscriptionRemaining = subscription
+    ? Math.max(subscription.includedQuantity - subscription.usedQuantity, 0)
+    : null;
+  const walletBalance =
+    (billingStatus.creditBalances ?? []).find(
+      (entry) => entry.productKey === 'pentest',
+    )?.balance ?? 0;
+
+  return {
+    balance: (subscriptionRemaining ?? 0) + walletBalance,
+    planRequired: subscriptionRemaining === null && walletBalance === 0,
+  };
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/billing/emptyBillingStatus.ts b/apps/app/src/app/(app)/[orgId]/settings/billing/emptyBillingStatus.ts
index 635758166c..defe12071e 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/billing/emptyBillingStatus.ts
+++ b/apps/app/src/app/(app)/[orgId]/settings/billing/emptyBillingStatus.ts
@@ -9,6 +9,7 @@ export const emptyBillingStatus: BackgroundCheckBillingStatus = {
   },
   invoices: [],
   subscriptions: [],
+  creditBalances: [],
   trialEligibility: {
     pentest: false,
     background_check: false,
diff --git a/apps/app/src/app/(app)/[orgId]/settings/billing/types.ts b/apps/app/src/app/(app)/[orgId]/settings/billing/types.ts
index 71f1b1885d..6f8fc66c26 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/billing/types.ts
+++ b/apps/app/src/app/(app)/[orgId]/settings/billing/types.ts
@@ -34,6 +34,14 @@ export interface BackgroundCheckBillingStatus {
     currentPeriodEnd: string | null;
     cancelAtPeriodEnd: boolean;
   }>;
+  // Aggregated wallet credit balance per product. The API guarantees
+  // one entry per product key; an absent product means zero balance.
+  // Optional on the client so older payloads (and existing test
+  // fixtures) keep typechecking.
+  creditBalances?: Array<{
+    productKey: 'pentest' | 'background_check';
+    balance: number;
+  }>;
   invoices?: BillingInvoice[];
 }
 
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/ModernSingleStatusTaskList.test.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/ModernSingleStatusTaskList.test.tsx
index 037bf8306b..403f5c1127 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/ModernSingleStatusTaskList.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/ModernSingleStatusTaskList.test.tsx
@@ -142,6 +142,7 @@ const mockTasks = [
     approvedAt: null,
     approvalComment: null,
     organizationId: 'org_1',
+    embeddingHash: null,
     controls: [],
   },
   {
@@ -168,6 +169,7 @@ const mockTasks = [
     approvedAt: null,
     approvalComment: null,
     organizationId: 'org_1',
+    embeddingHash: null,
     controls: [],
   },
 ];
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.test.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.test.tsx
index 459f1714c7..e3d0c90c25 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.test.tsx
@@ -150,6 +150,7 @@ const baseMockTask = {
   approverId: null,
   approvedAt: null,
   approvalComment: null,
+  embeddingHash: null,
   controls: [] as { id: string; name: string }[],
 };
 
diff --git a/apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/TrustPortalSwitch.tsx b/apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/TrustPortalSwitch.tsx
index 5c6d49369d..40cf35037c 100644
--- a/apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/TrustPortalSwitch.tsx
+++ b/apps/app/src/app/(app)/[orgId]/trust/portal-settings/components/TrustPortalSwitch.tsx
@@ -1,9 +1,8 @@
 'use client';
 
-import { useDebounce } from '@/hooks/useDebounce';
 import { usePermissions } from '@/hooks/use-permissions';
 import { useTrustPortalSettings } from '@/hooks/use-trust-portal-settings';
-import { Form } from '@trycompai/ui/form';
+import { useDebounce } from '@/hooks/useDebounce';
 import { zodResolver } from '@hookform/resolvers/zod';
 import {
   Button,
@@ -25,20 +24,12 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from '@trycompai/design-system';
+import { Form } from '@trycompai/ui/form';
 import { Download, Eye, FileCheck2, Upload } from 'lucide-react';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { toast } from 'sonner';
 import { z } from 'zod';
-import {
-  TrustPortalAdditionalDocumentsSection,
-  type TrustPortalDocument,
-} from './TrustPortalAdditionalDocumentsSection';
-import { TrustPortalCustomLinks } from './TrustPortalCustomLinks';
-import { TrustPortalFaqBuilder } from './TrustPortalFaqBuilder';
-import { TrustPortalOverview } from './TrustPortalOverview';
-import { TrustPortalVendors } from './TrustPortalVendors';
-import { UpdateTrustFavicon } from './UpdateTrustFavicon';
 import { BrandSettings } from './BrandSettings';
 import {
   GDPR,
@@ -62,6 +53,15 @@ import {
   SOC3,
   SOC3InProgress,
 } from './logos';
+import {
+  TrustPortalAdditionalDocumentsSection,
+  type TrustPortalDocument,
+} from './TrustPortalAdditionalDocumentsSection';
+import { TrustPortalCustomLinks } from './TrustPortalCustomLinks';
+import { TrustPortalFaqBuilder } from './TrustPortalFaqBuilder';
+import { TrustPortalOverview } from './TrustPortalOverview';
+import { TrustPortalVendors } from './TrustPortalVendors';
+import { UpdateTrustFavicon } from './UpdateTrustFavicon';
 
 // Client-side form schema (includes all fields for form state)
 const trustPortalSwitchSchema = z.object({
@@ -521,7 +521,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 27001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 27001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 27001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -531,7 +534,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 27001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 27001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 27001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.iso27001}
@@ -554,7 +560,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 42001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 42001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 42001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -564,7 +573,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 42001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 42001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 42001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.iso42001}
@@ -587,7 +599,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('GDPR status updated');
                     } catch (error) {
-                      toast.error('Failed to update GDPR status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update GDPR status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -597,7 +612,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('GDPR status updated');
                     } catch (error) {
-                      toast.error('Failed to update GDPR status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update GDPR status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.gdpr}
@@ -620,7 +638,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('HIPAA status updated');
                     } catch (error) {
-                      toast.error('Failed to update HIPAA status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update HIPAA status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -630,7 +651,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('HIPAA status updated');
                     } catch (error) {
-                      toast.error('Failed to update HIPAA status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update HIPAA status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.hipaa}
@@ -653,7 +677,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('SOC 2 Type 1 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 2 Type 1 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 2 Type 1 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -663,7 +690,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('SOC 2 Type 1 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 2 Type 1 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 2 Type 1 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.soc2type1}
@@ -686,19 +716,23 @@ export function TrustPortalSwitch({
                       });
                       toast.success('SOC 2 Type 2 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 2 Type 2 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 2 Type 2 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
                     try {
                       await updateFrameworkSettings(
-                        checked
-                          ? { soc2type2: true }
-                          : { soc2: false, soc2type2: false },
+                        checked ? { soc2type2: true } : { soc2: false, soc2type2: false },
                       );
                       toast.success('SOC 2 Type 2 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 2 Type 2 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 2 Type 2 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.soc2type2}
@@ -721,7 +755,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('SOC 3 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 3 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 3 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -731,7 +768,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('SOC 3 status updated');
                     } catch (error) {
-                      toast.error('Failed to update SOC 3 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update SOC 3 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.soc3}
@@ -754,7 +794,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('PCI DSS status updated');
                     } catch (error) {
-                      toast.error('Failed to update PCI DSS status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update PCI DSS status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -764,7 +807,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('PCI DSS status updated');
                     } catch (error) {
-                      toast.error('Failed to update PCI DSS status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update PCI DSS status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.pcidss}
@@ -787,7 +833,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('NEN 7510 status updated');
                     } catch (error) {
-                      toast.error('Failed to update NEN 7510 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update NEN 7510 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -797,7 +846,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('NEN 7510 status updated');
                     } catch (error) {
-                      toast.error('Failed to update NEN 7510 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update NEN 7510 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.nen7510}
@@ -820,7 +872,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 9001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 9001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 9001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   onToggle={async (checked) => {
@@ -830,7 +885,10 @@ export function TrustPortalSwitch({
                       });
                       toast.success('ISO 9001 status updated');
                     } catch (error) {
-                      toast.error('Failed to update ISO 9001 status');
+                      console.error('[trust framework update] failed', error);
+                      toast.error('Failed to update ISO 9001 status', {
+                        description: error instanceof Error ? error.message : undefined,
+                      });
                     }
                   }}
                   fileName={certificateFiles.iso9001}
@@ -890,14 +948,21 @@ export function TrustPortalSwitch({
               />
             </div>
           </TabsContent>
-
         </Tabs>
       </form>
     </Form>
   );
 }
 
-function ComplianceFrameworkLogo({ title, status, enabled }: { title: string; status: string; enabled: boolean }) {
+function ComplianceFrameworkLogo({
+  title,
+  status,
+  enabled,
+}: {
+  title: string;
+  status: string;
+  enabled: boolean;
+}) {
   const isInProgress = status === 'in_progress';
   let LogoComponent: React.ElementType | null = null;
 
@@ -1047,9 +1112,7 @@ function ComplianceFramework({
             <div>
               <CardTitle>{title}</CardTitle>
               <div className="line-clamp-3">
-                <CardDescription>
-                  {description}
-                </CardDescription>
+                <CardDescription>{description}</CardDescription>
               </div>
             </div>
           </div>
@@ -1059,20 +1122,31 @@ function ComplianceFramework({
           <div className="flex flex-row items-center justify-between gap-6">
             <div className="min-w-0 flex-1">
               {isEnabled ? (
-                <Select disabled={disabled} defaultValue={status} value={status} onValueChange={async (value) => {
-                  if (!value) return;
-                  const prev = status;
-                  setStatus(value);
-                  try {
-                    await onStatusChange(value);
-                  } catch {
-                    setStatus(prev);
-                  }
-                }}>
+                <Select
+                  disabled={disabled}
+                  defaultValue={status}
+                  value={status}
+                  onValueChange={async (value) => {
+                    if (!value) return;
+                    const prev = status;
+                    setStatus(value);
+                    try {
+                      await onStatusChange(value);
+                    } catch {
+                      setStatus(prev);
+                    }
+                  }}
+                >
                   <SelectTrigger>
                     <span className="flex items-center gap-2">
-                      <span className={`inline-block h-4 w-4 rounded-sm ${status === 'compliant' ? 'bg-primary' : status === 'in_progress' ? 'bg-yellow-400' : 'bg-gray-300'}`} />
-                      {status === 'compliant' ? 'Compliant' : status === 'in_progress' ? 'In Progress' : 'Started'}
+                      <span
+                        className={`inline-block h-4 w-4 rounded-sm ${status === 'compliant' ? 'bg-primary' : status === 'in_progress' ? 'bg-yellow-400' : 'bg-gray-300'}`}
+                      />
+                      {status === 'compliant'
+                        ? 'Compliant'
+                        : status === 'in_progress'
+                          ? 'In Progress'
+                          : 'Started'}
                     </span>
                   </SelectTrigger>
                   <SelectContent>
@@ -1103,14 +1177,18 @@ function ComplianceFramework({
               )}
             </div>
             <div className="shrink-0 pl-2">
-              <Switch disabled={disabled} checked={isEnabled} onCheckedChange={async (checked) => {
-                setIsEnabled(checked);
-                try {
-                  await onToggle(checked);
-                } catch {
-                  setIsEnabled(!checked);
-                }
-              }} />
+              <Switch
+                disabled={disabled}
+                checked={isEnabled}
+                onCheckedChange={async (checked) => {
+                  setIsEnabled(checked);
+                  try {
+                    await onToggle(checked);
+                  } catch {
+                    setIsEnabled(!checked);
+                  }
+                }}
+              />
             </div>
           </div>
 
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.test.tsx b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.test.tsx
index 05baa58be4..f8cd902fee 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.test.tsx
@@ -257,6 +257,43 @@ describe('VendorsTable', () => {
     expect(screen.getByText('4/10')).toBeInTheDocument();
   });
 
+  it('renders the RESIDUAL RISK column immediately after INHERENT RISK', () => {
+    setMockPermissions({});
+
+    render(
+      <VendorsTable
+        vendors={mockVendors}
+        assignees={mockAssignees}
+        orgId="org-1"
+      />,
+    );
+
+    expect(screen.getByText('RESIDUAL RISK')).toBeInTheDocument();
+
+    const headers = screen
+      .getAllByRole('columnheader')
+      .map((h) => (h.textContent || '').toUpperCase());
+    const inherentIdx = headers.findIndex((h) => h.includes('INHERENT RISK'));
+    const residualIdx = headers.findIndex((h) => h.includes('RESIDUAL RISK'));
+    expect(inherentIdx).toBeGreaterThanOrEqual(0);
+    expect(residualIdx).toBe(inherentIdx + 1);
+  });
+
+  it('renders a residual score badge for assessed vendors', () => {
+    setMockPermissions({});
+
+    render(
+      <VendorsTable
+        vendors={mockVendors}
+        assignees={mockAssignees}
+        orgId="org-1"
+      />,
+    );
+
+    // Acme Corp residual (unlikely × minor) → raw 4 → score 2/10
+    expect(screen.getByText('2/10')).toBeInTheDocument();
+  });
+
   it('shows an em-dash for vendors that have not been assessed', () => {
     setMockPermissions({});
 
@@ -275,7 +312,8 @@ describe('VendorsTable', () => {
       />,
     );
 
-    expect(screen.getByText('—')).toBeInTheDocument();
+    // One em-dash per risk column (inherent + residual) for not_assessed vendors.
+    expect(screen.getAllByText('—').length).toBe(2);
     expect(screen.queryByText('1/10')).not.toBeInTheDocument();
   });
 });
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.tsx b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.tsx
index 376b6b731a..806fabd745 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorsTable.tsx
@@ -6,6 +6,12 @@ import { VendorStatus } from '@/components/vendor-status';
 import { usePermissions } from '@/hooks/use-permissions';
 import { useVendors, useVendorActions, type Vendor } from '@/hooks/use-vendors';
 import { getRiskScore } from '@/lib/risk-score';
+import {
+  interpolatedResidualScore,
+  previewResidual,
+  suggestedResidual,
+} from '@/lib/suggested-residual';
+import type { TaskStatus } from '@db';
 import {
   AlertDialog,
   AlertDialogAction,
@@ -54,6 +60,40 @@ export type VendorRow = Vendor & {
   isAssessing?: boolean;
 };
 
+/**
+ * Mirrors `currentSeverityScore` in the risks table — projects the vendor's
+ * inherent + treatment-strategy + linked-task completion into the same
+ * interpolated 1–10 score the Treatment Plan hero shows. Falls back to
+ * inherent when there's no linked work or strategy doesn't reduce.
+ */
+function currentVendorSeverityScore(vendor: {
+  inherentProbability: VendorRow['inherentProbability'];
+  inherentImpact: VendorRow['inherentImpact'];
+  treatmentStrategy: VendorRow['treatmentStrategy'];
+  tasks?: Array<{ status: TaskStatus }>;
+}): number {
+  const inherent = getRiskScore(vendor.inherentProbability, vendor.inherentImpact);
+  const tasks = vendor.tasks ?? [];
+  const target = previewResidual({
+    inherentLikelihood: vendor.inherentProbability,
+    inherentImpact: vendor.inherentImpact,
+    strategy: vendor.treatmentStrategy,
+    hasLinkedWork: tasks.length > 0,
+  });
+  const targetScore = getRiskScore(target.likelihood, target.impact).score;
+  const completion = suggestedResidual({
+    likelihood: vendor.inherentProbability,
+    impact: vendor.inherentImpact,
+    strategy: vendor.treatmentStrategy,
+    tasks,
+  }).completion;
+  return interpolatedResidualScore({
+    inherentScore: inherent.score,
+    targetScore,
+    completion,
+  });
+}
+
 type AssigneeMember = {
   id: string;
   role: string;
@@ -171,7 +211,7 @@ export function VendorsTable({
   // Local state for search, sorting, and pagination
   const [searchQuery, setSearchQuery] = useState('');
   const [sort, setSort] = useState<{
-    id: 'name' | 'updatedAt' | 'inherentRisk';
+    id: 'name' | 'updatedAt' | 'inherentRisk' | 'residualRisk';
     desc: boolean;
   }>({
     id: 'name',
@@ -264,6 +304,8 @@ export function VendorsTable({
         inherentImpact: 'insignificant' as const,
         residualProbability: 'very_unlikely' as const,
         residualImpact: 'insignificant' as const,
+        treatmentStrategy: 'accept' as const,
+        treatmentStrategyDescription: null,
         website: null,
         isSubProcessor: false,
         logoUrl: null,
@@ -290,6 +332,8 @@ export function VendorsTable({
         inherentImpact: 'insignificant' as const,
         residualProbability: 'very_unlikely' as const,
         residualImpact: 'insignificant' as const,
+        treatmentStrategy: 'accept' as const,
+        treatmentStrategyDescription: null,
         website: null,
         isSubProcessor: false,
         logoUrl: null,
@@ -334,6 +378,25 @@ export function VendorsTable({
         const comparison = aScore - bScore;
         return sort.desc ? -comparison : comparison;
       }
+      if (sort.id === 'residualRisk') {
+        // Unassessed vendors carry default residual values (very_unlikely
+        // × insignificant = 1). Without this branch they'd cluster at the
+        // bottom (or top, when desc) of the residual sort even though we
+        // render them as `—` and they have no real residual yet. Force
+        // them to the end of the list regardless of sort direction so
+        // assessed vendors are always grouped together. (Cubic finding
+        // on PR #2671.)
+        const aAssessed = a.status === 'assessed';
+        const bAssessed = b.status === 'assessed';
+        if (aAssessed !== bAssessed) return aAssessed ? -1 : 1;
+        // Sort by the SAME interpolated score the badge renders so the
+        // sort order matches what the user sees (treatment-progress
+        // aware), not the static residual fields.
+        const aScore = currentVendorSeverityScore(a);
+        const bScore = currentVendorSeverityScore(b);
+        const comparison = aScore - bScore;
+        return sort.desc ? -comparison : comparison;
+      }
       const comparison = new Date(a.updatedAt).getTime() - new Date(b.updatedAt).getTime();
       return sort.desc ? -comparison : comparison;
     });
@@ -392,7 +455,7 @@ export function VendorsTable({
     router.push(`/${orgId}/vendors/${vendorId}`);
   };
 
-  const handleSort = (columnId: 'name' | 'updatedAt' | 'inherentRisk') => {
+  const handleSort = (columnId: 'name' | 'updatedAt' | 'inherentRisk' | 'residualRisk') => {
     if (sort.id === columnId) {
       setSort({ id: columnId, desc: !sort.desc });
     } else {
@@ -400,7 +463,7 @@ export function VendorsTable({
     }
   };
 
-  const getSortIcon = (columnId: 'name' | 'updatedAt' | 'inherentRisk') => {
+  const getSortIcon = (columnId: 'name' | 'updatedAt' | 'inherentRisk' | 'residualRisk') => {
     if (sort.id !== columnId) {
       return <ArrowUpDown className="ml-1 h-3 w-3 text-muted-foreground" />;
     }
@@ -545,6 +608,16 @@ export function VendorsTable({
                     {getSortIcon('inherentRisk')}
                   </button>
                 </TableHead>
+                <TableHead>
+                  <button
+                    type="button"
+                    onClick={() => handleSort('residualRisk')}
+                    className="flex items-center hover:text-foreground"
+                  >
+                    CURRENT RISK
+                    {getSortIcon('residualRisk')}
+                  </button>
+                </TableHead>
                 <TableHead>CATEGORY</TableHead>
                 <TableHead>OWNER</TableHead>
                 {hasPermission('vendor', 'delete') && <TableHead>ACTIONS</TableHead>}
@@ -576,6 +649,18 @@ export function VendorsTable({
                         />
                       )}
                     </TableCell>
+                    <TableCell>
+                      {vendor.status === 'not_assessed' ? (
+                        <Text variant="muted" size="sm">—</Text>
+                      ) : (
+                        // Show the current (interpolated) score that
+                        // reflects how far the linked tasks have driven
+                        // the residual down — same logic the risks table
+                        // uses. Static residualProbability / Impact alone
+                        // can't reflect mid-treatment progress.
+                        <RiskScoreBadge score={currentVendorSeverityScore(vendor)} />
+                      )}
+                    </TableCell>
                     <TableCell>
                       <Badge variant="secondary">
                         {CATEGORY_MAP[vendor.category] || vendor.category}
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorDetailTabs.tsx b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorDetailTabs.tsx
index a247af7428..1fc0f69235 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorDetailTabs.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorDetailTabs.tsx
@@ -17,7 +17,8 @@ import { VendorResearchBadges, VendorResearchLinks } from './VendorResearchSecti
 import { VendorResearchFeed } from './VendorResearchFeed';
 import { VendorInherentRiskChart } from './VendorInherentRiskChart';
 import { VendorResidualRiskChart } from './VendorResidualRiskChart';
-import type { Member, User, Vendor } from '@db';
+import { TreatmentPlanTab } from '@/components/risks/treatment-plan/TreatmentPlanTab';
+import type { Member, RiskTreatmentType, User, Vendor } from '@db';
 import { CommentEntityType } from '@db';
 import type { Prisma } from '@db';
 import { useRealtimeRun } from '@trigger.dev/react-hooks';
@@ -35,6 +36,7 @@ import {
 } from '@trycompai/design-system';
 import Link from 'next/link';
 import { useSearchParams } from 'next/navigation';
+import { useQueryState } from 'nuqs';
 import { useCallback, useEffect, useMemo, useState } from 'react';
 import { toast } from 'sonner';
 
@@ -75,11 +77,18 @@ export function VendorDetailTabs({
   isViewingTask,
 }: VendorDetailTabsProps) {
   const searchParams = useSearchParams();
-  const defaultTab = searchParams.get('tab') || 'overview';
   const taskItemId = searchParams.get('taskItemId');
 
   const { vendor: swrVendor, mutate: refreshVendor } = useVendor(vendorId);
-  const { updateVendor, triggerAssessment, regenerateMitigation } = useVendorActions();
+  const {
+    updateVendor,
+    triggerAssessment,
+    regenerateMitigation,
+    suggestVendorLinks,
+    applyVendorLinks,
+    fetchActiveVendorAutoLinkRun,
+    discardVendorAutoLinkRun,
+  } = useVendorActions();
   const { hasPermission } = usePermissions();
   const canUpdate = hasPermission('vendor', 'update');
   const canUpdateTask = hasPermission('task', 'update');
@@ -92,9 +101,20 @@ export function VendorDetailTabs({
   const [isEditingDescription, setIsEditingDescription] = useState(false);
   const [descriptionValue, setDescriptionValue] = useState('');
   const [isMitigationLoading, setIsMitigationLoading] = useState(false);
+  const [regenRun, setRegenRun] = useState<{
+    runId: string;
+    publicAccessToken: string;
+  } | null>(null);
   const [isAssessmentLoading, setIsAssessmentLoading] = useState(false);
   const [isRegenerating, setIsRegenerating] = useState(false);
-  const [activeTab, setActiveTab] = useState(defaultTab);
+  // URL-backed tab state — bookmarks the active tab in `?tab=...` so a
+  // refresh keeps the same view. Conditional rendering below mounts only
+  // the active panel, sidestepping base-ui's transition window where the
+  // outgoing panel stays at full opacity during the incoming fade-in
+  // (visible "both panels stacked" flash on tab switch).
+  const [activeTab, setActiveTab] = useQueryState('tab', {
+    defaultValue: 'overview',
+  });
 
   const { data: taskItemsData, mutate: refreshTaskItems } = useTaskItems(
     vendorId, 'vendor', 1, 50, 'createdAt', 'desc', {},
@@ -248,18 +268,75 @@ export function VendorDetailTabs({
 
   const handleRegenerateMitigation = async () => {
     setIsMitigationLoading(true);
-    toast.info('Regenerating vendor risk mitigation...');
     try {
-      await regenerateMitigation(vendorId);
-      toast.success('Mitigation regeneration triggered.');
-      refreshVendor();
+      const handle = await regenerateMitigation(vendorId);
+      setRegenRun(handle);
     } catch {
       toast.error('Failed to trigger mitigation regeneration');
-    } finally {
       setIsMitigationLoading(false);
     }
   };
 
+  const handleRegenSettled = useCallback(
+    (result: { success: boolean; reason?: string }) => {
+      setRegenRun(null);
+      setIsMitigationLoading(false);
+      if (result.success) {
+        toast.success('Treatment plan regenerated.');
+        void refreshVendor();
+      } else {
+        toast.error(result.reason ?? 'Failed to regenerate the treatment plan.');
+      }
+    },
+    [refreshVendor],
+  );
+
+  const handleUpdateStrategy = async (strategy: RiskTreatmentType) => {
+    await updateVendor(vendorId, { treatmentStrategy: strategy });
+    refreshVendor();
+  };
+
+  const handleSuggest = async () => {
+    return suggestVendorLinks(vendorId);
+  };
+
+  const handleApply = async (params: { taskIds: string[]; replace: boolean }) => {
+    await applyVendorLinks(vendorId, params);
+    await refreshVendor();
+  };
+
+  const handleUnlinkTask = async (taskId: string) => {
+    try {
+      const res = await fetch(`/api/vendors/${vendorId}/tasks/${taskId}`, {
+        method: 'DELETE',
+        credentials: 'include',
+      });
+      if (!res.ok) throw new Error('unlink failed');
+      await refreshVendor();
+    } catch {
+      toast.error('Failed to unlink task');
+    }
+  };
+
+  // Memoize so AutoLinkSuggestions' resume effect (which depends on the
+  // callback identity) doesn't re-fire on every parent re-render.
+  const handleResumeAutoLink = useCallback(
+    () => fetchActiveVendorAutoLinkRun(vendorId),
+    [fetchActiveVendorAutoLinkRun, vendorId],
+  );
+
+  const handleDiscardAutoLinkRun = useCallback(
+    async () => {
+      await discardVendorAutoLinkRun(vendorId);
+    },
+    [discardVendorAutoLinkRun, vendorId],
+  );
+
+  const handleUpdateDescription = async (description: string) => {
+    await updateVendor(vendorId, { treatmentStrategyDescription: description });
+    refreshVendor();
+  };
+
   const handleRegenerateAssessment = async () => {
     setIsAssessmentLoading(true);
     toast.info('Regenerating vendor risk assessment...');
@@ -268,7 +345,7 @@ export function VendorDetailTabs({
       toast.success('Assessment regeneration triggered.');
       if (result.runId && result.publicAccessToken) {
         setIsRegenerating(true);
-        setActiveTab('risk-assessment');
+        void setActiveTab('risk-assessment');
         handleAssessmentTriggered(result.runId, result.publicAccessToken);
       }
       refreshVendor();
@@ -402,10 +479,11 @@ export function VendorDetailTabs({
       {isViewingTask ? (
         <TaskItems entityId={vendorId} entityType="vendor" />
       ) : (
-        <Tabs value={activeTab} onValueChange={setActiveTab}>
+        <Tabs value={activeTab} onValueChange={(next) => void setActiveTab(String(next))}>
           <Stack gap="lg">
             <TabsList variant="underline">
               <TabsTrigger value="overview">Overview</TabsTrigger>
+              <TabsTrigger value="treatment-plan">Treatment Plan</TabsTrigger>
               <TabsTrigger value="risk-matrix">Risk Matrix</TabsTrigger>
               <TabsTrigger value="risk-assessment">Risk Assessment</TabsTrigger>
               <TabsTrigger value="tasks">Tasks</TabsTrigger>
@@ -414,17 +492,61 @@ export function VendorDetailTabs({
               <TabsTrigger value="settings">Settings</TabsTrigger>
             </TabsList>
 
-            <TabsContent value="overview">
-              <SecondaryFields vendor={resolvedVendor} assignees={assignees} onUpdate={refreshVendor} />
+            {activeTab === 'overview' && (
+              <TabsContent value="overview">
+                <SecondaryFields vendor={resolvedVendor} assignees={assignees} onUpdate={refreshVendor} />
+              </TabsContent>
+            )}
+
+            {activeTab === 'treatment-plan' && (
+            <TabsContent value="treatment-plan">
+              <TreatmentPlanTab
+                orgId={orgId}
+                entity={{
+                  id: resolvedVendor.id,
+                  inherentLikelihood: resolvedVendor.inherentProbability,
+                  inherentImpact: resolvedVendor.inherentImpact,
+                  residualLikelihood: resolvedVendor.residualProbability,
+                  residualImpact: resolvedVendor.residualImpact,
+                  treatmentStrategy: resolvedVendor.treatmentStrategy,
+                  treatmentStrategyDescription: resolvedVendor.treatmentStrategyDescription,
+                  strategyDescriptions:
+                    (resolvedVendor as { strategyDescriptions?: unknown })
+                      .strategyDescriptions as
+                      | Partial<Record<RiskTreatmentType, string>>
+                      | null
+                      | undefined ?? null,
+                  tasks: swrVendor?.tasks ?? [],
+                }}
+                canUpdate={canUpdate}
+                onUpdateStrategy={handleUpdateStrategy}
+                onUpdateDescription={handleUpdateDescription}
+                onRegenerate={handleRegenerateMitigation}
+                regenerating={isMitigationLoading}
+                onSuggest={handleSuggest}
+                onApply={handleApply}
+                // Gate the unlink affordance behind vendor:update so it
+                // doesn't render for read-only users. The Next API route
+                // also enforces this check server-side.
+                onUnlinkTask={canUpdate ? handleUnlinkTask : undefined}
+                onResumeAutoLink={handleResumeAutoLink}
+                onDiscardAutoLinkRun={handleDiscardAutoLinkRun}
+                regenRun={regenRun}
+                onRegenSettled={handleRegenSettled}
+              />
             </TabsContent>
+            )}
 
+            {activeTab === 'risk-matrix' && (
             <TabsContent value="risk-matrix">
               <Stack gap="lg">
                 <VendorInherentRiskChart vendor={resolvedVendor} />
                 <VendorResidualRiskChart vendor={resolvedVendor} />
               </Stack>
             </TabsContent>
+            )}
 
+            {activeTab === 'risk-assessment' && (
             <TabsContent value="risk-assessment">
               <Stack gap="md">
                 <AnimatePresence mode="wait">
@@ -472,64 +594,51 @@ export function VendorDetailTabs({
                 </AnimatePresence>
               </Stack>
             </TabsContent>
-
-            <TabsContent value="tasks">
-              <TaskItems entityId={vendorId} entityType="vendor" />
-            </TabsContent>
-
-            <TabsContent value="comments">
-              <Comments entityId={vendorId} entityType={CommentEntityType.vendor} organizationId={orgId} />
-            </TabsContent>
-
-            <TabsContent value="activity">
-              <VendorActivitySection vendorId={vendorId} taskItemIds={taskItemsData?.data?.data?.map((t) => t.id) || []} />
-            </TabsContent>
-
+            )}
+
+            {activeTab === 'tasks' && (
+              <TabsContent value="tasks">
+                <TaskItems entityId={vendorId} entityType="vendor" />
+              </TabsContent>
+            )}
+
+            {activeTab === 'comments' && (
+              <TabsContent value="comments">
+                <Comments entityId={vendorId} entityType={CommentEntityType.vendor} organizationId={orgId} />
+              </TabsContent>
+            )}
+
+            {activeTab === 'activity' && (
+              <TabsContent value="activity">
+                <VendorActivitySection vendorId={vendorId} taskItemIds={taskItemsData?.data?.data?.map((t) => t.id) || []} />
+              </TabsContent>
+            )}
+
+            {activeTab === 'settings' && (
             <TabsContent value="settings">
               <Stack gap="lg">
                 {canUpdate && (
-                  <>
-                    <HStack justify="between" align="center">
-                      <Stack gap="none">
-                        <Text size="sm" weight="medium">Regenerate Risk Assessment</Text>
-                        <Text size="xs" variant="muted">
-                          Generate or regenerate the AI risk assessment for this vendor
-                        </Text>
-                      </Stack>
-                      <Button
-                        variant="outline"
-                        size="sm"
-                        onClick={handleRegenerateAssessment}
-                        disabled={isAssessmentLoading}
-                        loading={isAssessmentLoading}
-                      >
-                        Regenerate Assessment
-                      </Button>
-                    </HStack>
-
-                    <div className="border-t" />
-
-                    <HStack justify="between" align="center">
-                      <Stack gap="none">
-                        <Text size="sm" weight="medium">Regenerate Mitigation</Text>
-                        <Text size="xs" variant="muted">
-                          Generate a fresh risk mitigation comment for this vendor
-                        </Text>
-                      </Stack>
-                      <Button
-                        variant="outline"
-                        size="sm"
-                        onClick={handleRegenerateMitigation}
-                        disabled={isMitigationLoading}
-                        loading={isMitigationLoading}
-                      >
-                        Regenerate Mitigation
-                      </Button>
-                    </HStack>
-                  </>
+                  <HStack justify="between" align="center">
+                    <Stack gap="none">
+                      <Text size="sm" weight="medium">Regenerate Risk Assessment</Text>
+                      <Text size="xs" variant="muted">
+                        Generate or regenerate the AI risk assessment for this vendor
+                      </Text>
+                    </Stack>
+                    <Button
+                      variant="outline"
+                      size="sm"
+                      onClick={handleRegenerateAssessment}
+                      disabled={isAssessmentLoading}
+                      loading={isAssessmentLoading}
+                    >
+                      Regenerate Assessment
+                    </Button>
+                  </HStack>
                 )}
               </Stack>
             </TabsContent>
+            )}
           </Stack>
         </Tabs>
       )}
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorInherentRiskChart.tsx b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorInherentRiskChart.tsx
index 14cbb25fe3..75fadc494b 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorInherentRiskChart.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorInherentRiskChart.tsx
@@ -18,6 +18,7 @@ export function VendorInherentRiskChart({ vendor }: InherentRiskChartProps) {
     <RiskMatrixChart
       title={'Inherent Risk'}
       description={'Select the inherent risk level for this vendor'}
+      titleInfo="Inherent risk = the raw risk before any controls or mitigations. Used as the starting point for residual computation."
       riskId={vendor.id}
       activeLikelihood={vendor.inherentProbability}
       activeImpact={vendor.inherentImpact}
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.test.tsx b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.test.tsx
index fdcdcbd502..f2dd57477a 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.test.tsx
@@ -1,4 +1,4 @@
-import { render } from '@testing-library/react';
+import { render, screen } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   setMockPermissions,
@@ -16,6 +16,7 @@ vi.mock('@/hooks/use-permissions', () => ({
 }));
 
 // Mock useVendor and useVendorActions
+const mockTriggerAssessment = vi.fn();
 vi.mock('@/hooks/use-vendors', () => ({
   useVendor: () => ({
     vendor: null,
@@ -23,9 +24,19 @@ vi.mock('@/hooks/use-vendors', () => ({
   }),
   useVendorActions: () => ({
     updateVendor: vi.fn(),
+    triggerAssessment: mockTriggerAssessment,
   }),
 }));
 
+// Mock toast
+vi.mock('sonner', () => ({
+  toast: {
+    success: vi.fn(),
+    error: vi.fn(),
+    info: vi.fn(),
+  },
+}));
+
 // Capture props passed to RiskMatrixChart
 let capturedProps: any = null;
 vi.mock('@/components/risks/charts/RiskMatrixChart', () => ({
@@ -39,14 +50,20 @@ import { VendorResidualRiskChart } from './VendorResidualRiskChart';
 
 const mockVendor: any = {
   id: 'vendor-1',
+  status: 'assessed',
+  inherentProbability: 'possible',
+  inherentImpact: 'moderate',
   residualProbability: 'unlikely',
   residualImpact: 'minor',
+  treatmentStrategy: 'accept',
+  tasks: [],
 };
 
 describe('VendorResidualRiskChart', () => {
   beforeEach(() => {
     setMockPermissions({});
     capturedProps = null;
+    mockTriggerAssessment.mockReset();
   });
 
   it('passes readOnly=true when user lacks vendor:update permission', () => {
@@ -83,7 +100,7 @@ describe('VendorResidualRiskChart', () => {
 
     expect(capturedProps.title).toBe('Residual Risk');
     expect(capturedProps.description).toBe(
-      'Select the residual risk level for this vendor',
+      'Risk level after the treatment plan is applied. The dashed cell is the suggestion computed from your strategy and linked task completion.',
     );
     expect(capturedProps.riskId).toBe('vendor-1');
     expect(capturedProps.activeLikelihood).toBe('unlikely');
@@ -98,4 +115,37 @@ describe('VendorResidualRiskChart', () => {
     expect(capturedProps).not.toBeNull();
     expect(capturedProps.readOnly).toBe(true);
   });
+
+  describe('status branches', () => {
+    it('renders NotAssessedState when status is not_assessed', () => {
+      setMockPermissions(ADMIN_PERMISSIONS);
+      const vendor = { ...mockVendor, status: 'not_assessed' };
+
+      render(<VendorResidualRiskChart vendor={vendor} />);
+
+      expect(screen.queryByTestId('risk-matrix-chart')).toBeNull();
+      expect(screen.getByRole('button', { name: /Run risk assessment/i })).toBeInTheDocument();
+      expect(capturedProps).toBeNull();
+    });
+
+    it('passes preliminary=true to RiskMatrixChart when status is in_progress', () => {
+      setMockPermissions(ADMIN_PERMISSIONS);
+      const vendor = { ...mockVendor, status: 'in_progress' };
+
+      render(<VendorResidualRiskChart vendor={vendor} />);
+
+      expect(capturedProps).not.toBeNull();
+      expect(capturedProps.preliminary).toBe(true);
+    });
+
+    it('passes preliminary=false to RiskMatrixChart when status is assessed', () => {
+      setMockPermissions(ADMIN_PERMISSIONS);
+      const vendor = { ...mockVendor, status: 'assessed' };
+
+      render(<VendorResidualRiskChart vendor={vendor} />);
+
+      expect(capturedProps).not.toBeNull();
+      expect(capturedProps.preliminary).toBe(false);
+    });
+  });
 });
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.tsx b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.tsx
index ec2062dd83..55cabf9d44 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/[vendorId]/components/VendorResidualRiskChart.tsx
@@ -1,27 +1,70 @@
 'use client';
 
+import { RiskMatrixChart } from '@/components/risks/charts/RiskMatrixChart';
+import { NotAssessedState } from '@/components/risks/treatment-plan/NotAssessedState';
 import { usePermissions } from '@/hooks/use-permissions';
 import { useVendor, useVendorActions } from '@/hooks/use-vendors';
-import { RiskMatrixChart } from '@/components/risks/charts/RiskMatrixChart';
-import type { Vendor } from '@db';
+import { suggestedResidual } from '@/lib/suggested-residual';
+import { VendorStatus, type TaskStatus, type Vendor } from '@db';
+import { toast } from 'sonner';
 
 interface ResidualRiskChartProps {
-  vendor: Vendor;
+  vendor: Vendor & { tasks?: { status: TaskStatus }[] };
 }
 
 export function VendorResidualRiskChart({ vendor }: ResidualRiskChartProps) {
-  const { updateVendor } = useVendorActions();
+  const { updateVendor, triggerAssessment } = useVendorActions();
   const { mutate } = useVendor(vendor.id);
   const { hasPermission } = usePermissions();
 
+  const canUpdate = hasPermission('vendor', 'update');
+
+  if (vendor.status === VendorStatus.not_assessed) {
+    return (
+      <NotAssessedState
+        disabled={!canUpdate}
+        description="Run the AI risk assessment to enable a suggested residual based on the vendor's data handling, exposure, and compliance posture."
+        onAssess={async () => {
+          try {
+            await triggerAssessment(vendor.id);
+            toast.success('Risk assessment started. This may take a moment.');
+            await mutate();
+          } catch {
+            toast.error('Failed to start risk assessment');
+          }
+        }}
+      />
+    );
+  }
+
+  // Only compute a suggestion when tasks are actually loaded — falling back to
+  // [] would render a misleading "0% complete" ghost cell on vendors that
+  // haven't hydrated yet.
+  const suggestion = vendor.tasks
+    ? suggestedResidual({
+        likelihood: vendor.inherentProbability,
+        impact: vendor.inherentImpact,
+        strategy: vendor.treatmentStrategy,
+        tasks: vendor.tasks,
+      })
+    : undefined;
+
+  const preliminary = vendor.status === VendorStatus.in_progress;
+
   return (
     <RiskMatrixChart
       title={'Residual Risk'}
-      description={'Select the residual risk level for this vendor'}
+      description={
+        'Risk level after the treatment plan is applied. The dashed cell is the suggestion computed from your strategy and linked task completion.'
+      }
+      titleInfo="Residual risk = remaining risk after the treatment plan's mitigations are in place. Compare against Inherent to see the impact of your controls."
       riskId={vendor.id}
       activeLikelihood={vendor.residualProbability}
       activeImpact={vendor.residualImpact}
-      readOnly={!hasPermission('vendor', 'update')}
+      suggestedLikelihood={suggestion?.likelihood}
+      suggestedImpact={suggestion?.impact}
+      readOnly={!canUpdate}
+      preliminary={preliminary}
       saveAction={async ({ id, probability, impact }) => {
         await updateVendor(id, {
           residualProbability: probability,
diff --git a/apps/app/src/app/(app)/upgrade/[orgId]/page.tsx b/apps/app/src/app/(app)/upgrade/[orgId]/page.tsx
index d33ae89074..533604bd6f 100644
--- a/apps/app/src/app/(app)/upgrade/[orgId]/page.tsx
+++ b/apps/app/src/app/(app)/upgrade/[orgId]/page.tsx
@@ -1,6 +1,6 @@
-import { extractDomain, isDomainActiveStripeCustomer, isPublicEmailDomain } from '@/lib/stripe';
-import { auth } from '@/utils/auth';
 import { env } from '@/env.mjs';
+import { serverApi } from '@/lib/api-server';
+import { auth } from '@/utils/auth';
 import { db } from '@db/server';
 import { headers } from 'next/headers';
 import { redirect } from 'next/navigation';
@@ -13,6 +13,12 @@ interface PageProps {
   }>;
 }
 
+interface AutoApproveResponse {
+  hasAccess: boolean;
+  autoApproved: boolean;
+  reason: string;
+}
+
 export default async function UpgradePage({ params }: PageProps) {
   const { orgId } = await params;
 
@@ -44,7 +50,9 @@ export default async function UpgradePage({ params }: PageProps) {
     redirect('/');
   }
 
-  // Sync activeOrganizationId only after membership is verified
+  // Sync activeOrganizationId only after membership is verified.
+  // Required so the API's HybridAuthGuard resolves the right org from session
+  // when we call /v1/organization-access/auto-approve below.
   const currentActiveOrgId = authSession.session.activeOrganizationId;
   if (!currentActiveOrgId || currentActiveOrgId !== orgId) {
     try {
@@ -61,44 +69,32 @@ export default async function UpgradePage({ params }: PageProps) {
 
   let hasAccess = member.organization.hasAccess;
 
-  // Auto-approve based on user's email domain or self-hosted instance
   if (!hasAccess) {
-    // Auto-approve for self-hosted/OSS instances
-    const isSelfHosted = env.NEXT_PUBLIC_SELF_HOSTED === 'true';
-
-    if (isSelfHosted) {
+    // Self-hosted instances auto-approve every org. The flag is a Next.js
+    // build-time env var (NEXT_PUBLIC_SELF_HOSTED) that the OSS Docker
+    // deployment sets on the app container only — the API container does NOT
+    // have this env, so the check stays on the page. The DB write here is the
+    // single exception to "all mutations through the API" — it's gated on a
+    // build-time deploy flag, not user input.
+    if (env.NEXT_PUBLIC_SELF_HOSTED === 'true') {
       await db.organization.update({
         where: { id: orgId },
         data: { hasAccess: true },
       });
       hasAccess = true;
     } else {
-      const userEmail = authSession.user.email;
-      const userEmailDomain = extractDomain(userEmail ?? '');
-      const orgWebsiteDomain = extractDomain(member.organization.website ?? '');
-
-      if (userEmailDomain) {
-        // Auto-approve for trycomp.ai emails (internal team)
-        const isTrycompEmail = userEmailDomain === 'trycomp.ai';
-
-        const canAutoApproveViaDomain =
-          !isTrycompEmail &&
-          Boolean(orgWebsiteDomain) &&
-          userEmailDomain === orgWebsiteDomain &&
-          !isPublicEmailDomain(userEmailDomain);
-
-        // Check Stripe for other domains
-        const isStripeCustomer = canAutoApproveViaDomain
-          ? await isDomainActiveStripeCustomer(userEmailDomain)
-          : false;
-
-        if (isTrycompEmail || isStripeCustomer) {
-          await db.organization.update({
-            where: { id: orgId },
-            data: { hasAccess: true },
-          });
-          hasAccess = true;
-        }
+      // Stripe-domain auto-approval (and the @trycomp.ai shortcut) live in the
+      // API so STRIPE_SECRET_KEY only has to exist on the API and the
+      // hasAccess flip is RBAC-checked + audit-logged. Soft-fail so a transient
+      // API error never blocks the booking step from rendering.
+      const response = await serverApi.post<AutoApproveResponse>(
+        '/v1/organization-access/auto-approve',
+      );
+
+      if (response.data?.hasAccess) {
+        hasAccess = true;
+      } else if (response.error) {
+        console.error('[UpgradePage] auto-approve API error:', response.error);
       }
     }
   }
diff --git a/apps/app/src/app/api/risks/[riskId]/auto-link/active/route.ts b/apps/app/src/app/api/risks/[riskId]/auto-link/active/route.ts
new file mode 100644
index 0000000000..f7edbfe67e
--- /dev/null
+++ b/apps/app/src/app/api/risks/[riskId]/auto-link/active/route.ts
@@ -0,0 +1,122 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { auth as triggerAuth } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * Decide whether a `createPublicToken` failure is the "run was purged"
+ * terminal case (drop the stored runId — the run is permanently gone) or
+ * something transient (a network blip, rate limit, auth issue) where we
+ * should keep the runId so the next attempt can recover.
+ *
+ * Trigger.dev surfaces purged/missing runs as 404 with a "not found" body.
+ * Anything else — including unauthorized, timeouts, 5xx — gets treated as
+ * transient and bubbles up as a 502 from the route. See Cubic finding
+ * #4/#5 on PR #2671.
+ */
+function isRunGoneError(err: unknown): boolean {
+  if (!err) return false;
+  const e = err as { status?: number; statusCode?: number; message?: string };
+  const status = e.status ?? e.statusCode;
+  if (status === 404) return true;
+  const msg = (e.message ?? String(err)).toLowerCase();
+  return msg.includes('not found') || msg.includes('purged');
+}
+
+/**
+ * GET /api/risks/[riskId]/auto-link/active
+ *
+ * Resumes an in-flight or completed-but-unreviewed AI suggestion run after a
+ * page reload. The runId is persisted on the Risk row by `/auto-link`; this
+ * endpoint mints a fresh public-access token (the previous one expires after
+ * 15 minutes) so the UI can re-subscribe via `useRealtimeRun`.
+ *
+ * Returns `{ runId: null }` when no active run exists. Also returns null when
+ * the trigger.dev run has been purged (TTL elapsed) — the caller treats both
+ * the same: drop the stale runId and start fresh on the next user action.
+ *
+ * DELETE on the same path discards the active run (user clicked Discard).
+ */
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'read');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId } = await params;
+
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: { id: true, organizationId: true, autoLinkRunId: true },
+    });
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    if (!risk.autoLinkRunId) {
+      return NextResponse.json({ runId: null });
+    }
+
+    try {
+      const publicAccessToken = await triggerAuth.createPublicToken({
+        scopes: { read: { runs: [risk.autoLinkRunId] } },
+        expirationTime: '15m',
+      });
+      return NextResponse.json({ runId: risk.autoLinkRunId, publicAccessToken });
+    } catch (err) {
+      if (isRunGoneError(err)) {
+        // Run was purged by trigger.dev (retention TTL or never existed).
+        // Drop the stale id so the next /auto-link call starts cleanly.
+        console.warn('[auto-link/active] run gone, clearing stored runId', err);
+        await db.risk.update({
+          where: { id: riskId },
+          data: { autoLinkRunId: null, autoLinkRunStartedAt: null },
+        });
+        return NextResponse.json({ runId: null });
+      }
+      // Transient failure (network, 5xx, rate limit). Keep the runId so a
+      // retry can recover; the UI treats 502 as "try again later".
+      console.error('[auto-link/active] transient token mint failure', err);
+      return NextResponse.json(
+        { error: 'Failed to mint access token; try again' },
+        { status: 502 },
+      );
+    }
+  } catch (error) {
+    console.error('Error reading active risk auto-link run:', error);
+    return NextResponse.json({ error: 'Failed to read active run' }, { status: 500 });
+  }
+}
+
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId } = await params;
+
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: { id: true, organizationId: true },
+    });
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    await db.risk.update({
+      where: { id: riskId },
+      data: { autoLinkRunId: null, autoLinkRunStartedAt: null },
+    });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('Error discarding risk auto-link run:', error);
+    return NextResponse.json({ error: 'Failed to discard run' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/risks/[riskId]/auto-link/apply/route.ts b/apps/app/src/app/api/risks/[riskId]/auto-link/apply/route.ts
new file mode 100644
index 0000000000..01e57cf621
--- /dev/null
+++ b/apps/app/src/app/api/risks/[riskId]/auto-link/apply/route.ts
@@ -0,0 +1,101 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+
+const ApplyBodySchema = z.object({
+  taskIds: z.array(z.string()).max(100),
+  replace: z.boolean().optional().default(false),
+});
+
+/**
+ * POST /api/risks/[riskId]/auto-link/apply
+ *
+ * Persists the user-confirmed task selection from the AI-suggestion review UI.
+ *
+ * - `replace: true` → re-assess flow (sync semantics: connect-only-these tasks).
+ * - `replace: false` → fresh suggest flow (additive: connect these to whatever's
+ *   already linked).
+ *
+ * Mutating endpoints elsewhere in the app go through the NestJS API, but the
+ * task↔risk join already lives in this Next.js layer (see `tasks/[taskId]`
+ * DELETE), and the AI scan / suggestion plumbing all lives here too. Keeping
+ * apply alongside avoids a round trip and stays consistent with the existing
+ * unlink endpoint.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId } = await params;
+    if (!riskId) {
+      return NextResponse.json({ error: 'Risk ID is required' }, { status: 400 });
+    }
+
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: { id: true, organizationId: true },
+    });
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const body = await req.json().catch(() => null);
+    const parsed = ApplyBodySchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Invalid body', details: parsed.error.flatten() },
+        { status: 400 },
+      );
+    }
+    const { taskIds, replace } = parsed.data;
+
+    // Validate every taskId belongs to the active organization. Without this,
+    // a malicious caller could connect another org's tasks to this risk by
+    // crafting the request — Prisma's `connect`/`set` doesn't check tenancy.
+    if (taskIds.length > 0) {
+      const ownedTasks = await db.task.findMany({
+        where: { id: { in: taskIds }, organizationId },
+        select: { id: true },
+      });
+      if (ownedTasks.length !== taskIds.length) {
+        return NextResponse.json(
+          { error: 'One or more tasks do not belong to this organization' },
+          { status: 400 },
+        );
+      }
+    }
+
+    if (replace) {
+      await db.risk.update({
+        where: { id: riskId },
+        data: {
+          tasks: { set: taskIds.map((id) => ({ id })) },
+          autoLinkRunId: null,
+          autoLinkRunStartedAt: null,
+        },
+      });
+    } else {
+      await db.risk.update({
+        where: { id: riskId },
+        data: {
+          ...(taskIds.length > 0
+            ? { tasks: { connect: taskIds.map((id) => ({ id })) } }
+            : {}),
+          autoLinkRunId: null,
+          autoLinkRunStartedAt: null,
+        },
+      });
+    }
+
+    return NextResponse.json({ linked: taskIds.length });
+  } catch (error) {
+    console.error('Error applying risk auto-link:', error);
+    return NextResponse.json({ error: 'Failed to apply auto-link' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/risks/[riskId]/auto-link/route.ts b/apps/app/src/app/api/risks/[riskId]/auto-link/route.ts
new file mode 100644
index 0000000000..27cbce1e41
--- /dev/null
+++ b/apps/app/src/app/api/risks/[riskId]/auto-link/route.ts
@@ -0,0 +1,68 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import type { linkRisksAndVendorsToWork } from '@/trigger/tasks/onboarding/link-risks-and-vendors-to-work';
+import { db } from '@db/server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * POST /api/risks/[riskId]/auto-link
+ *
+ * Triggers the linkage task in `suggestionsOnly` mode for one risk and returns
+ * a public-access token so the frontend can subscribe via `useRealtimeRun`,
+ * display live progress, and read `run.output.suggestions` once complete.
+ *
+ * No DB writes happen here — the user reviews the suggestions in the UI and
+ * the apply endpoint (`/auto-link/apply`) persists their final selection.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId } = await params;
+    if (!riskId) {
+      return NextResponse.json(
+        { error: 'Risk ID is required' },
+        { status: 400 },
+      );
+    }
+
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: { id: true, organizationId: true },
+    });
+
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const handle = await tasks.trigger<typeof linkRisksAndVendorsToWork>(
+      'link-risks-and-vendors-to-work',
+      { organizationId, riskId, suggestionsOnly: true },
+    );
+
+    // Persist the runId so the UI can resume an in-flight scan after a page
+    // reload. Cleared by /apply or /discard once the user reviews the result.
+    await db.risk.update({
+      where: { id: riskId },
+      data: {
+        autoLinkRunId: handle.id,
+        autoLinkRunStartedAt: new Date(),
+      },
+    });
+
+    const publicAccessToken = await triggerAuth.createPublicToken({
+      scopes: { read: { runs: [handle.id] } },
+      expirationTime: '15m',
+    });
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
+  } catch (error) {
+    console.error('Error triggering risk auto-link:', error);
+    return NextResponse.json({ error: 'Failed to trigger auto-link' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/risks/[riskId]/regenerate-mitigation/route.ts b/apps/app/src/app/api/risks/[riskId]/regenerate-mitigation/route.ts
index 38ef486948..26d9157312 100644
--- a/apps/app/src/app/api/risks/[riskId]/regenerate-mitigation/route.ts
+++ b/apps/app/src/app/api/risks/[riskId]/regenerate-mitigation/route.ts
@@ -1,8 +1,8 @@
 import { generateRiskMitigation } from '@/trigger/tasks/onboarding/generate-risk-mitigation';
 import type { PolicyContext } from '@/trigger/tasks/onboarding/onboard-organization-helpers';
 import { serverApi } from '@/lib/api-server';
-import { auth } from '@/utils/auth';
-import { tasks } from '@trigger.dev/sdk';
+import { requireApiPermission } from '@/lib/permissions.server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
 import { NextRequest, NextResponse } from 'next/server';
 
 interface PeopleApiResponse {
@@ -27,13 +27,9 @@ export async function POST(
   { params }: { params: Promise<{ riskId: string }> },
 ) {
   try {
-    const session = await auth.api.getSession({
-      headers: req.headers,
-    });
-
-    if (!session?.session?.activeOrganizationId) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-    }
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
 
     const { riskId } = await params;
     if (!riskId) {
@@ -43,8 +39,6 @@ export async function POST(
       );
     }
 
-    const organizationId = session.session.activeOrganizationId;
-
     const [peopleResult, policiesResult] = await Promise.all([
       serverApi.get<PeopleApiResponse>('/v1/people'),
       serverApi.get<PoliciesApiResponse>('/v1/policies'),
@@ -71,7 +65,7 @@ export async function POST(
       description: policy.description,
     }));
 
-    await tasks.trigger<typeof generateRiskMitigation>(
+    const handle = await tasks.trigger<typeof generateRiskMitigation>(
       'generate-risk-mitigation',
       {
         organizationId,
@@ -81,17 +75,27 @@ export async function POST(
       },
     );
 
-    return NextResponse.json({ success: true });
+    // The run is now in flight server-side. Mint a 15-min public token so
+    // the UI can subscribe via useRealtimeRun. If the mint fails, do NOT
+    // throw — that would let a client retry start a duplicate run. Return
+    // the runId with a null token; the UI's `/active` endpoint can mint a
+    // fresh token on the next render. (Cubic finding #29 on PR #2671.)
+    let publicAccessToken: string | null = null;
+    try {
+      publicAccessToken = await triggerAuth.createPublicToken({
+        scopes: { read: { runs: [handle.id] } },
+        expirationTime: '15m',
+      });
+    } catch (mintErr) {
+      console.error(
+        '[regenerate-mitigation] run triggered but token mint failed; client must resume via /active',
+        { runId: handle.id, mintErr },
+      );
+    }
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
   } catch (error) {
     console.error('Error regenerating risk mitigation:', error);
-    return NextResponse.json(
-      {
-        error:
-          error instanceof Error
-            ? error.message
-            : 'Failed to regenerate mitigation',
-      },
-      { status: 500 },
-    );
+    return NextResponse.json({ error: 'Failed to regenerate mitigation' }, { status: 500 });
   }
 }
diff --git a/apps/app/src/app/api/risks/[riskId]/relink/route.ts b/apps/app/src/app/api/risks/[riskId]/relink/route.ts
new file mode 100644
index 0000000000..30aec86054
--- /dev/null
+++ b/apps/app/src/app/api/risks/[riskId]/relink/route.ts
@@ -0,0 +1,57 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import type { linkRisksAndVendorsToWork } from '@/trigger/tasks/onboarding/link-risks-and-vendors-to-work';
+import { db } from '@db/server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * POST /api/risks/[riskId]/relink
+ *
+ * Wipes ALL current task links on the risk and rebuilds linkage from the
+ * top-K embedding-similar tasks. Destructive — clears user's manual unlinks.
+ * Frontend confirms before calling.
+ *
+ * Returns { runId, publicAccessToken } so the UI can subscribe via useRealtimeRun.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId } = await params;
+    if (!riskId) {
+      return NextResponse.json(
+        { error: 'Risk ID is required' },
+        { status: 400 },
+      );
+    }
+
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: { id: true, organizationId: true },
+    });
+
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const handle = await tasks.trigger<typeof linkRisksAndVendorsToWork>(
+      'link-risks-and-vendors-to-work',
+      { organizationId, riskId, replace: true },
+    );
+
+    const publicAccessToken = await triggerAuth.createPublicToken({
+      scopes: { read: { runs: [handle.id] } },
+      expirationTime: '15m',
+    });
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
+  } catch (error) {
+    console.error('Error triggering risk relink:', error);
+    return NextResponse.json({ error: 'Failed to trigger relink' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/risks/[riskId]/tasks/[taskId]/route.ts b/apps/app/src/app/api/risks/[riskId]/tasks/[taskId]/route.ts
new file mode 100644
index 0000000000..008f809f06
--- /dev/null
+++ b/apps/app/src/app/api/risks/[riskId]/tasks/[taskId]/route.ts
@@ -0,0 +1,107 @@
+import { generateRiskMitigation } from '@/trigger/tasks/onboarding/generate-risk-mitigation';
+import type { PolicyContext } from '@/trigger/tasks/onboarding/onboard-organization-helpers';
+import { serverApi } from '@/lib/api-server';
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { tasks as triggerTasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+interface PoliciesApiResponse {
+  data: Array<{
+    id: string;
+    name: string;
+    description: string | null;
+  }>;
+}
+
+/**
+ * Best-effort fan-out: re-trigger the risk mitigation generator so the saved
+ * treatment plan reflects the now-changed task linkage. We deliberately swallow
+ * errors here — the unlink itself already succeeded and refreshing the plan is
+ * not load-bearing for the user-facing operation.
+ */
+async function refreshTreatmentPlan(organizationId: string, riskId: string): Promise<void> {
+  try {
+    const policiesResult = await serverApi.get<PoliciesApiResponse>('/v1/policies');
+    const policyRows = policiesResult.data?.data ?? [];
+    const policies: PolicyContext[] = policyRows.map((policy) => ({
+      name: policy.name,
+      description: policy.description,
+    }));
+
+    await triggerTasks.trigger<typeof generateRiskMitigation>('generate-risk-mitigation', {
+      organizationId,
+      riskId,
+      policies,
+    });
+  } catch (err) {
+    console.warn('Unlink succeeded but plan refresh failed to enqueue', { riskId, err });
+  }
+}
+
+/**
+ * DELETE /api/risks/[riskId]/tasks/[taskId]
+ *
+ * Soft-removes the link between a risk and a task by disconnecting the
+ * many-to-many join row. The task itself is not deleted. Controls remain
+ * derived through the remaining tasks, so removing the last task that
+ * references a given control implicitly removes it from the risk's view.
+ *
+ * After a successful unlink, fire-and-forget a re-generation of the
+ * treatment plan so the persisted citations reflect the new linkage.
+ */
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ riskId: string; taskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'risk', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { riskId, taskId } = await params;
+    if (!riskId || !taskId) {
+      return NextResponse.json(
+        { error: 'Risk ID and Task ID are required' },
+        { status: 400 },
+      );
+    }
+
+    // Verify the risk + the link in one query, scoped to the active org.
+    // Without this, calling DELETE for a non-linked or wrong-tenant task
+    // would let Prisma's `disconnect` no-op or throw a 500 depending on
+    // the case — neither is a useful client signal. (Cubic #22.)
+    const risk = await db.risk.findUnique({
+      where: { id: riskId },
+      select: {
+        id: true,
+        organizationId: true,
+        tasks: { where: { id: taskId }, select: { id: true } },
+      },
+    });
+    if (!risk || risk.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+    if (risk.tasks.length === 0) {
+      return NextResponse.json(
+        { error: 'Task is not linked to this risk' },
+        { status: 404 },
+      );
+    }
+
+    await db.risk.update({
+      where: { id: riskId },
+      data: { tasks: { disconnect: { id: taskId } } },
+    });
+
+    // Fire-and-forget: do NOT await. The unlink itself already succeeded;
+    // we don't want the response to wait on (or fail because of) the
+    // background plan-refresh trigger. (Cubic #30.)
+    void refreshTreatmentPlan(organizationId, riskId);
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('Error unlinking task from risk:', error);
+    return NextResponse.json({ error: 'Failed to unlink task' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/vendors/[vendorId]/auto-link/active/route.ts b/apps/app/src/app/api/vendors/[vendorId]/auto-link/active/route.ts
new file mode 100644
index 0000000000..90d5979a65
--- /dev/null
+++ b/apps/app/src/app/api/vendors/[vendorId]/auto-link/active/route.ts
@@ -0,0 +1,103 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { auth as triggerAuth } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * GET /api/vendors/[vendorId]/auto-link/active — see Risk counterpart.
+ * DELETE clears the active run (Discard).
+ */
+
+/**
+ * Decide whether a `createPublicToken` failure means the run is permanently
+ * gone (drop the runId) or just transient (keep it, surface a 502). See the
+ * risk counterpart and Cubic findings #4/#5 on PR #2671.
+ */
+function isRunGoneError(err: unknown): boolean {
+  if (!err) return false;
+  const e = err as { status?: number; statusCode?: number; message?: string };
+  const status = e.status ?? e.statusCode;
+  if (status === 404) return true;
+  const msg = (e.message ?? String(err)).toLowerCase();
+  return msg.includes('not found') || msg.includes('purged');
+}
+
+export async function GET(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'read');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId } = await params;
+
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, organizationId: true, autoLinkRunId: true },
+    });
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    if (!vendor.autoLinkRunId) {
+      return NextResponse.json({ runId: null });
+    }
+
+    try {
+      const publicAccessToken = await triggerAuth.createPublicToken({
+        scopes: { read: { runs: [vendor.autoLinkRunId] } },
+        expirationTime: '15m',
+      });
+      return NextResponse.json({ runId: vendor.autoLinkRunId, publicAccessToken });
+    } catch (err) {
+      if (isRunGoneError(err)) {
+        console.warn('[auto-link/active] run gone, clearing stored runId', err);
+        await db.vendor.update({
+          where: { id: vendorId },
+          data: { autoLinkRunId: null, autoLinkRunStartedAt: null },
+        });
+        return NextResponse.json({ runId: null });
+      }
+      console.error('[auto-link/active] transient token mint failure', err);
+      return NextResponse.json(
+        { error: 'Failed to mint access token; try again' },
+        { status: 502 },
+      );
+    }
+  } catch (error) {
+    console.error('Error reading active vendor auto-link run:', error);
+    return NextResponse.json({ error: 'Failed to read active run' }, { status: 500 });
+  }
+}
+
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId } = await params;
+
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, organizationId: true },
+    });
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    await db.vendor.update({
+      where: { id: vendorId },
+      data: { autoLinkRunId: null, autoLinkRunStartedAt: null },
+    });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('Error discarding vendor auto-link run:', error);
+    return NextResponse.json({ error: 'Failed to discard run' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/vendors/[vendorId]/auto-link/apply/route.ts b/apps/app/src/app/api/vendors/[vendorId]/auto-link/apply/route.ts
new file mode 100644
index 0000000000..03b93c236e
--- /dev/null
+++ b/apps/app/src/app/api/vendors/[vendorId]/auto-link/apply/route.ts
@@ -0,0 +1,93 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+
+const ApplyBodySchema = z.object({
+  taskIds: z.array(z.string()).max(100),
+  replace: z.boolean().optional().default(false),
+});
+
+/**
+ * POST /api/vendors/[vendorId]/auto-link/apply
+ *
+ * Persists the user-confirmed task selection from the AI-suggestion review UI.
+ *
+ * - `replace: true` → re-assess flow (sync semantics: connect-only-these tasks).
+ * - `replace: false` → fresh suggest flow (additive).
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId } = await params;
+    if (!vendorId) {
+      return NextResponse.json({ error: 'Vendor ID is required' }, { status: 400 });
+    }
+
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, organizationId: true },
+    });
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const body = await req.json().catch(() => null);
+    const parsed = ApplyBodySchema.safeParse(body);
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Invalid body', details: parsed.error.flatten() },
+        { status: 400 },
+      );
+    }
+    const { taskIds, replace } = parsed.data;
+
+    // Validate tenancy of every taskId — see risks/auto-link/apply/route.ts
+    // for the same rationale (Prisma `connect`/`set` doesn't enforce it).
+    if (taskIds.length > 0) {
+      const ownedTasks = await db.task.findMany({
+        where: { id: { in: taskIds }, organizationId },
+        select: { id: true },
+      });
+      if (ownedTasks.length !== taskIds.length) {
+        return NextResponse.json(
+          { error: 'One or more tasks do not belong to this organization' },
+          { status: 400 },
+        );
+      }
+    }
+
+    if (replace) {
+      await db.vendor.update({
+        where: { id: vendorId },
+        data: {
+          tasks: { set: taskIds.map((id) => ({ id })) },
+          autoLinkRunId: null,
+          autoLinkRunStartedAt: null,
+        },
+      });
+    } else {
+      await db.vendor.update({
+        where: { id: vendorId },
+        data: {
+          ...(taskIds.length > 0
+            ? { tasks: { connect: taskIds.map((id) => ({ id })) } }
+            : {}),
+          autoLinkRunId: null,
+          autoLinkRunStartedAt: null,
+        },
+      });
+    }
+
+    return NextResponse.json({ linked: taskIds.length });
+  } catch (error) {
+    console.error('Error applying vendor auto-link:', error);
+    return NextResponse.json({ error: 'Failed to apply auto-link' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/vendors/[vendorId]/auto-link/route.ts b/apps/app/src/app/api/vendors/[vendorId]/auto-link/route.ts
new file mode 100644
index 0000000000..7791a6d062
--- /dev/null
+++ b/apps/app/src/app/api/vendors/[vendorId]/auto-link/route.ts
@@ -0,0 +1,68 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import type { linkRisksAndVendorsToWork } from '@/trigger/tasks/onboarding/link-risks-and-vendors-to-work';
+import { db } from '@db/server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * POST /api/vendors/[vendorId]/auto-link
+ *
+ * Triggers the linkage task in `suggestionsOnly` mode for one vendor and
+ * returns a public-access token so the frontend can subscribe via
+ * `useRealtimeRun` and read `run.output.suggestions` once complete.
+ *
+ * No DB writes happen here — the user reviews the suggestions in the UI and
+ * the apply endpoint (`/auto-link/apply`) persists their final selection.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId } = await params;
+    if (!vendorId) {
+      return NextResponse.json(
+        { error: 'Vendor ID is required' },
+        { status: 400 },
+      );
+    }
+
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, organizationId: true },
+    });
+
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const handle = await tasks.trigger<typeof linkRisksAndVendorsToWork>(
+      'link-risks-and-vendors-to-work',
+      { organizationId, vendorId, suggestionsOnly: true },
+    );
+
+    // Persist the runId so the UI can resume an in-flight scan after a page
+    // reload. Cleared by /apply or /discard once the user reviews the result.
+    await db.vendor.update({
+      where: { id: vendorId },
+      data: {
+        autoLinkRunId: handle.id,
+        autoLinkRunStartedAt: new Date(),
+      },
+    });
+
+    const publicAccessToken = await triggerAuth.createPublicToken({
+      scopes: { read: { runs: [handle.id] } },
+      expirationTime: '15m',
+    });
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
+  } catch (error) {
+    console.error('Error triggering vendor auto-link:', error);
+    return NextResponse.json({ error: 'Failed to trigger auto-link' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/vendors/[vendorId]/regenerate-mitigation/route.ts b/apps/app/src/app/api/vendors/[vendorId]/regenerate-mitigation/route.ts
index 8ea0b7dd54..ac604ba614 100644
--- a/apps/app/src/app/api/vendors/[vendorId]/regenerate-mitigation/route.ts
+++ b/apps/app/src/app/api/vendors/[vendorId]/regenerate-mitigation/route.ts
@@ -1,8 +1,8 @@
 import { generateVendorMitigation } from '@/trigger/tasks/onboarding/generate-vendor-mitigation';
 import type { PolicyContext } from '@/trigger/tasks/onboarding/onboard-organization-helpers';
 import { serverApi } from '@/lib/api-server';
-import { auth } from '@/utils/auth';
-import { tasks } from '@trigger.dev/sdk';
+import { requireApiPermission } from '@/lib/permissions.server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
 import { NextRequest, NextResponse } from 'next/server';
 
 interface PeopleApiResponse {
@@ -27,13 +27,9 @@ export async function POST(
   { params }: { params: Promise<{ vendorId: string }> },
 ) {
   try {
-    const session = await auth.api.getSession({
-      headers: req.headers,
-    });
-
-    if (!session?.session?.activeOrganizationId) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-    }
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
 
     const { vendorId } = await params;
     if (!vendorId) {
@@ -43,8 +39,6 @@ export async function POST(
       );
     }
 
-    const organizationId = session.session.activeOrganizationId;
-
     const [peopleResult, policiesResult] = await Promise.all([
       serverApi.get<PeopleApiResponse>('/v1/people'),
       serverApi.get<PoliciesApiResponse>('/v1/policies'),
@@ -71,7 +65,7 @@ export async function POST(
       description: policy.description,
     }));
 
-    await tasks.trigger<typeof generateVendorMitigation>(
+    const handle = await tasks.trigger<typeof generateVendorMitigation>(
       'generate-vendor-mitigation',
       {
         organizationId,
@@ -81,17 +75,24 @@ export async function POST(
       },
     );
 
-    return NextResponse.json({ success: true });
+    // See risks/regenerate-mitigation: don't fail the request when only the
+    // token mint fails, since the run is already in flight. (Cubic #29.)
+    let publicAccessToken: string | null = null;
+    try {
+      publicAccessToken = await triggerAuth.createPublicToken({
+        scopes: { read: { runs: [handle.id] } },
+        expirationTime: '15m',
+      });
+    } catch (mintErr) {
+      console.error(
+        '[regenerate-mitigation] vendor run triggered but token mint failed; client must resume via /active',
+        { runId: handle.id, mintErr },
+      );
+    }
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
   } catch (error) {
     console.error('Error regenerating vendor mitigation:', error);
-    return NextResponse.json(
-      {
-        error:
-          error instanceof Error
-            ? error.message
-            : 'Failed to regenerate mitigation',
-      },
-      { status: 500 },
-    );
+    return NextResponse.json({ error: 'Failed to regenerate mitigation' }, { status: 500 });
   }
 }
diff --git a/apps/app/src/app/api/vendors/[vendorId]/relink/route.ts b/apps/app/src/app/api/vendors/[vendorId]/relink/route.ts
new file mode 100644
index 0000000000..bed99e4c51
--- /dev/null
+++ b/apps/app/src/app/api/vendors/[vendorId]/relink/route.ts
@@ -0,0 +1,57 @@
+import { requireApiPermission } from '@/lib/permissions.server';
+import type { linkRisksAndVendorsToWork } from '@/trigger/tasks/onboarding/link-risks-and-vendors-to-work';
+import { db } from '@db/server';
+import { auth as triggerAuth, tasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * POST /api/vendors/[vendorId]/relink
+ *
+ * Wipes ALL current task links on the vendor and rebuilds linkage from the
+ * top-K embedding-similar tasks. Destructive — clears user's manual unlinks.
+ * Frontend confirms before calling.
+ *
+ * Returns { runId, publicAccessToken } so the UI can subscribe via useRealtimeRun.
+ */
+export async function POST(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId } = await params;
+    if (!vendorId) {
+      return NextResponse.json(
+        { error: 'Vendor ID is required' },
+        { status: 400 },
+      );
+    }
+
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: { id: true, organizationId: true },
+    });
+
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+
+    const handle = await tasks.trigger<typeof linkRisksAndVendorsToWork>(
+      'link-risks-and-vendors-to-work',
+      { organizationId, vendorId, replace: true },
+    );
+
+    const publicAccessToken = await triggerAuth.createPublicToken({
+      scopes: { read: { runs: [handle.id] } },
+      expirationTime: '15m',
+    });
+
+    return NextResponse.json({ runId: handle.id, publicAccessToken });
+  } catch (error) {
+    console.error('Error triggering vendor relink:', error);
+    return NextResponse.json({ error: 'Failed to trigger relink' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/app/api/vendors/[vendorId]/tasks/[taskId]/route.ts b/apps/app/src/app/api/vendors/[vendorId]/tasks/[taskId]/route.ts
new file mode 100644
index 0000000000..ddd390670a
--- /dev/null
+++ b/apps/app/src/app/api/vendors/[vendorId]/tasks/[taskId]/route.ts
@@ -0,0 +1,104 @@
+import { generateVendorMitigation } from '@/trigger/tasks/onboarding/generate-vendor-mitigation';
+import type { PolicyContext } from '@/trigger/tasks/onboarding/onboard-organization-helpers';
+import { serverApi } from '@/lib/api-server';
+import { requireApiPermission } from '@/lib/permissions.server';
+import { db } from '@db/server';
+import { tasks as triggerTasks } from '@trigger.dev/sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+interface PoliciesApiResponse {
+  data: Array<{
+    id: string;
+    name: string;
+    description: string | null;
+  }>;
+}
+
+/**
+ * Best-effort fan-out: re-trigger the vendor mitigation generator so the saved
+ * treatment plan reflects the now-changed task linkage. We deliberately swallow
+ * errors here — the unlink itself already succeeded.
+ */
+async function refreshVendorTreatmentPlan(
+  organizationId: string,
+  vendorId: string,
+): Promise<void> {
+  try {
+    const policiesResult = await serverApi.get<PoliciesApiResponse>('/v1/policies');
+    const policyRows = policiesResult.data?.data ?? [];
+    const policies: PolicyContext[] = policyRows.map((policy) => ({
+      name: policy.name,
+      description: policy.description,
+    }));
+
+    await triggerTasks.trigger<typeof generateVendorMitigation>('generate-vendor-mitigation', {
+      organizationId,
+      vendorId,
+      policies,
+    });
+  } catch (err) {
+    console.warn('Vendor unlink succeeded but plan refresh failed to enqueue', { vendorId, err });
+  }
+}
+
+/**
+ * DELETE /api/vendors/[vendorId]/tasks/[taskId]
+ *
+ * Soft-removes the link between a vendor and a task by disconnecting the
+ * many-to-many join row. The task itself is not deleted. Controls remain
+ * derived through the remaining tasks.
+ *
+ * After a successful unlink, fire-and-forget a re-generation of the
+ * treatment plan so the persisted citations reflect the new linkage.
+ */
+export async function DELETE(
+  req: NextRequest,
+  { params }: { params: Promise<{ vendorId: string; taskId: string }> },
+) {
+  try {
+    const ctx = await requireApiPermission(req, 'vendor', 'update');
+    if (ctx instanceof NextResponse) return ctx;
+    const { organizationId } = ctx;
+
+    const { vendorId, taskId } = await params;
+    if (!vendorId || !taskId) {
+      return NextResponse.json(
+        { error: 'Vendor ID and Task ID are required' },
+        { status: 400 },
+      );
+    }
+
+    // Verify the vendor + the link in one query, scoped to the active org.
+    // (Cubic #22.)
+    const vendor = await db.vendor.findUnique({
+      where: { id: vendorId },
+      select: {
+        id: true,
+        organizationId: true,
+        tasks: { where: { id: taskId }, select: { id: true } },
+      },
+    });
+    if (!vendor || vendor.organizationId !== organizationId) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 });
+    }
+    if (vendor.tasks.length === 0) {
+      return NextResponse.json(
+        { error: 'Task is not linked to this vendor' },
+        { status: 404 },
+      );
+    }
+
+    await db.vendor.update({
+      where: { id: vendorId },
+      data: { tasks: { disconnect: { id: taskId } } },
+    });
+
+    // Fire-and-forget — see risks counterpart. (Cubic #31.)
+    void refreshVendorTreatmentPlan(organizationId, vendorId);
+
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    console.error('Error unlinking task from vendor:', error);
+    return NextResponse.json({ error: 'Failed to unlink task' }, { status: 500 });
+  }
+}
diff --git a/apps/app/src/components/risks/RiskScoreBadge.tsx b/apps/app/src/components/risks/RiskScoreBadge.tsx
index 5cb0f52811..b0778822c5 100644
--- a/apps/app/src/components/risks/RiskScoreBadge.tsx
+++ b/apps/app/src/components/risks/RiskScoreBadge.tsx
@@ -1,42 +1,59 @@
 import { cn } from '@/lib/utils';
+import {
+  LEVEL_COLOR,
+  LEVEL_LABEL,
+  getRiskLevelFromScore,
+  getRiskScore,
+} from '@/lib/risk-score';
 import type { Impact, Likelihood } from '@db';
-import { getRiskScore, type RiskLevel } from '@/lib/risk-score';
-
-const LEVEL_CLASSES: Record<RiskLevel, string> = {
-  'very-low':
-    'bg-emerald-500/15 border-emerald-500/40 text-emerald-700 dark:text-emerald-300',
-  low: 'bg-green-500/15 border-green-500/40 text-green-700 dark:text-green-300',
-  medium: 'bg-yellow-500/15 border-yellow-600/40 text-yellow-700 dark:text-yellow-300',
-  high: 'bg-orange-500/15 border-orange-500/40 text-orange-700 dark:text-orange-300',
-  'very-high': 'bg-red-500/15 border-red-500/40 text-red-700 dark:text-red-300',
-};
-
-const LEVEL_LABEL: Record<RiskLevel, string> = {
-  'very-low': 'Very low',
-  low: 'Low',
-  medium: 'Medium',
-  high: 'High',
-  'very-high': 'Very high',
-};
 
 export interface RiskScoreBadgeProps {
-  likelihood: Likelihood;
-  impact: Impact;
+  /**
+   * Provide a precomputed 1-10 score directly, or pass `likelihood` + `impact`
+   * to have the badge derive it via `getRiskScore`. The score-derived path is
+   * what callers use when they want a current/interpolated value.
+   */
+  score?: number;
+  likelihood?: Likelihood;
+  impact?: Impact;
+  /**
+   * When true, renders the level label (Low / Medium / High / etc.) instead
+   * of the score numeral. Same color treatment either way. Useful for the
+   * Risks list "Severity" column where a qualitative label scans faster
+   * than a number.
+   */
+  labelOnly?: boolean;
   className?: string;
 }
 
-export function RiskScoreBadge({ likelihood, impact, className }: RiskScoreBadgeProps) {
-  const { score, level } = getRiskScore(likelihood, impact);
+export function RiskScoreBadge({
+  score,
+  likelihood,
+  impact,
+  labelOnly,
+  className,
+}: RiskScoreBadgeProps) {
+  const resolvedScore =
+    score ?? (likelihood && impact ? getRiskScore(likelihood, impact).score : 1);
+  const level = getRiskLevelFromScore(resolvedScore);
   return (
     <span
       className={cn(
-        'inline-flex w-fit items-center rounded-md border px-2 py-0.5 text-xs font-medium tabular-nums',
-        LEVEL_CLASSES[level],
+        'inline-flex w-fit items-center rounded-md border px-2 py-0.5 text-xs font-medium',
+        !labelOnly && 'tabular-nums',
         className,
       )}
+      style={
+        {
+          '--band': LEVEL_COLOR[level],
+          backgroundColor: 'color-mix(in oklab, var(--band) 15%, transparent)',
+          borderColor: 'color-mix(in oklab, var(--band) 40%, transparent)',
+          color: 'var(--band)',
+        } as React.CSSProperties
+      }
       title={`${LEVEL_LABEL[level]} risk`}
     >
-      {score}/10
+      {labelOnly ? LEVEL_LABEL[level] : `${resolvedScore}/10`}
     </span>
   );
 }
diff --git a/apps/app/src/components/risks/charts/AxisTooltip.tsx b/apps/app/src/components/risks/charts/AxisTooltip.tsx
new file mode 100644
index 0000000000..25a4b1943b
--- /dev/null
+++ b/apps/app/src/components/risks/charts/AxisTooltip.tsx
@@ -0,0 +1,29 @@
+'use client';
+
+// TODO(design-system): migrate to @trycompai/design-system when Tooltip ships.
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@trycompai/ui/tooltip';
+import type { ReactNode } from 'react';
+
+interface AxisTooltipProps {
+  label: ReactNode;
+  definition: string;
+}
+
+/**
+ * Wraps an axis tier label (or info icon) with a hover definition,
+ * e.g. "Insignificant: no material impact on operations, customers, or compliance."
+ */
+export function AxisTooltip({ label, definition }: AxisTooltipProps) {
+  return (
+    <TooltipProvider delayDuration={200}>
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <span className="cursor-help underline decoration-dotted underline-offset-2">
+            {label}
+          </span>
+        </TooltipTrigger>
+        <TooltipContent>{definition}</TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+}
diff --git a/apps/app/src/components/risks/charts/InherentRiskChart.tsx b/apps/app/src/components/risks/charts/InherentRiskChart.tsx
index e8cdc9c050..56cec0ae7b 100644
--- a/apps/app/src/components/risks/charts/InherentRiskChart.tsx
+++ b/apps/app/src/components/risks/charts/InherentRiskChart.tsx
@@ -19,6 +19,7 @@ export function InherentRiskChart({ risk }: InherentRiskChartProps) {
     <RiskMatrixChart
       title={'Inherent Risk'}
       description={'Initial risk level before any controls are applied'}
+      titleInfo="Inherent risk = the raw risk before any controls or mitigations. Used as the starting point for residual computation."
       riskId={risk.id}
       activeLikelihood={risk.likelihood}
       activeImpact={risk.impact}
diff --git a/apps/app/src/components/risks/charts/MatrixBody.tsx b/apps/app/src/components/risks/charts/MatrixBody.tsx
new file mode 100644
index 0000000000..4dd885f521
--- /dev/null
+++ b/apps/app/src/components/risks/charts/MatrixBody.tsx
@@ -0,0 +1,188 @@
+'use client';
+
+import { IMPACT_SCORES, LIKELIHOOD_SCORES, getRiskLevel } from '@/lib/risk-score';
+import { Impact, Likelihood } from '@db';
+import { AxisTooltip } from './AxisTooltip';
+
+export const VISUAL_LIKELIHOOD_ORDER: Likelihood[] = [
+  Likelihood.very_likely,
+  Likelihood.likely,
+  Likelihood.possible,
+  Likelihood.unlikely,
+  Likelihood.very_unlikely,
+];
+export const VISUAL_IMPACT_ORDER: Impact[] = [
+  Impact.insignificant,
+  Impact.minor,
+  Impact.moderate,
+  Impact.major,
+  Impact.severe,
+];
+
+export const probabilityLevels = [
+  'Very Likely',
+  'Likely',
+  'Possible',
+  'Unlikely',
+  'Very Unlikely',
+];
+export const probabilityNumbers = ['5', '4', '3', '2', '1'];
+export const impactLevels = ['Insignificant', 'Minor', 'Moderate', 'Major', 'Severe'];
+
+const LIKELIHOOD_DEFINITIONS: Record<string, string> = {
+  'Very Likely': 'Expected to occur multiple times per year without mitigations.',
+  Likely: 'Expected to occur at least once per year without mitigations.',
+  Possible: 'Could occur in the next 1–3 years.',
+  Unlikely: 'Could occur but not expected in the next 3 years.',
+  'Very Unlikely': 'Rare event; theoretical possibility only.',
+};
+
+const IMPACT_DEFINITIONS: Record<string, string> = {
+  Insignificant: 'No material impact on operations, customers, or compliance.',
+  Minor: 'Contained, short-term operational issue; limited customer or compliance exposure.',
+  Moderate: 'Operational disruption, customer complaint, or contained compliance finding.',
+  Major: 'Significant customer impact, regulator scrutiny, or material revenue loss.',
+  Severe: 'Existential or multi-year impact: breach, enforcement action, or loss of trust.',
+};
+
+interface RiskCell {
+  probability: string;
+  impact: string;
+  level: 'very-low' | 'low' | 'medium' | 'high' | 'very-high';
+  value?: number;
+}
+
+const getRiskColor = (level: string, readOnly?: boolean) => {
+  switch (level) {
+    case 'very-low':
+      return `bg-emerald-500/20 border-emerald-500/30${readOnly ? '' : ' hover:bg-emerald-500/30'}`;
+    case 'low':
+      return `bg-green-500/20 border-green-500/30${readOnly ? '' : ' hover:bg-green-500/30'}`;
+    case 'medium':
+      return `bg-yellow-500/20 border-yellow-500/30${readOnly ? '' : ' hover:bg-yellow-500/30'}`;
+    case 'high':
+      return `bg-orange-500/20 border-orange-500/30${readOnly ? '' : ' hover:bg-orange-500/30'}`;
+    case 'very-high':
+      return `bg-red-500/20 border-red-500/30${readOnly ? '' : ' hover:bg-red-500/30'}`;
+    default:
+      return 'bg-slate-500/20 border-slate-500/30';
+  }
+};
+
+export function buildRiskData(
+  activeLikelihood: Likelihood,
+  activeImpact: Impact,
+): RiskCell[] {
+  const activeProbability = probabilityLevels[VISUAL_LIKELIHOOD_ORDER.indexOf(activeLikelihood)];
+  const activeImpactLevel = impactLevels[VISUAL_IMPACT_ORDER.indexOf(activeImpact)];
+
+  return probabilityLevels.flatMap((probability) =>
+    impactLevels.map((impact) => {
+      const likelihoodScore =
+        LIKELIHOOD_SCORES[VISUAL_LIKELIHOOD_ORDER[probabilityLevels.indexOf(probability)]];
+      const impactScore = IMPACT_SCORES[VISUAL_IMPACT_ORDER[impactLevels.indexOf(impact)]];
+      const level = getRiskLevel(likelihoodScore * impactScore);
+
+      return {
+        probability,
+        impact,
+        level,
+        value: probability === activeProbability && impact === activeImpactLevel ? 1 : undefined,
+      };
+    }),
+  );
+}
+
+interface MatrixBodyProps {
+  readOnly?: boolean;
+  riskData: RiskCell[];
+  handleCellClick: (probability: string, impact: string) => void;
+  suggestedLikelihood?: Likelihood;
+  suggestedImpact?: Impact;
+}
+
+export function MatrixBody({
+  readOnly,
+  riskData,
+  handleCellClick,
+  suggestedLikelihood,
+  suggestedImpact,
+}: MatrixBodyProps) {
+  return (
+    <div className="flex gap-0">
+      <div className="flex-1">
+        <div className="mb-2 flex justify-center">
+          <span className="text-xs font-medium text-muted-foreground">Impact</span>
+        </div>
+        <div className="grid rounded-lg" style={{ gridTemplateColumns: '2rem repeat(5, 1fr)' }}>
+          {probabilityLevels.map((probability, rowIdx) => (
+            <div key={probability} className="contents">
+              <div className="flex items-center justify-start">
+                <span className="text-xs text-muted-foreground">
+                  <AxisTooltip
+                    label={probabilityNumbers[rowIdx]}
+                    definition={`${probabilityLevels[rowIdx]}: ${LIKELIHOOD_DEFINITIONS[probabilityLevels[rowIdx]] ?? ''}`}
+                  />
+                </span>
+              </div>
+              {impactLevels.map((impact, colIdx) => {
+                const cell = riskData.find(
+                  (item) => item.probability === probability && item.impact === impact,
+                );
+                let rounding = '';
+                if (rowIdx === 0 && colIdx === 0) rounding = 'rounded-tl-lg';
+                if (rowIdx === 0 && colIdx === impactLevels.length - 1)
+                  rounding = 'rounded-tr-lg';
+                if (rowIdx === probabilityLevels.length - 1 && colIdx === 0)
+                  rounding = 'rounded-bl-lg';
+                if (
+                  rowIdx === probabilityLevels.length - 1 &&
+                  colIdx === impactLevels.length - 1
+                )
+                  rounding = 'rounded-br-lg';
+                const isSuggested =
+                  suggestedLikelihood !== undefined &&
+                  suggestedImpact !== undefined &&
+                  VISUAL_LIKELIHOOD_ORDER[rowIdx] === suggestedLikelihood &&
+                  VISUAL_IMPACT_ORDER[colIdx] === suggestedImpact;
+                return (
+                  <div
+                    key={`${probability}-${impact}`}
+                    className={`relative h-12 ${readOnly ? '' : 'cursor-pointer'} border transition-all duration-200 ${getRiskColor(cell?.level || 'very-low', readOnly)} flex items-center justify-center ${rounding} `}
+                    onClick={() => handleCellClick(probability, impact)}
+                  >
+                    {cell?.value && (
+                      <div className="h-4 w-4 animate-pulse rounded-full bg-white shadow-lg ring-2 ring-slate-900/70 dark:ring-slate-100/80" />
+                    )}
+                    {isSuggested && !cell?.value && (
+                      <div
+                        className="h-8 w-8 animate-pulse rounded-md border-2 border-dashed border-sky-500/80"
+                        title="Suggested by treatment plan"
+                      />
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+          ))}
+        </div>
+        <div className="grid mt-2" style={{ gridTemplateColumns: '2rem repeat(5, 1fr)' }}>
+          <div />
+          {impactLevels.map((impact) => (
+            <div key={impact} className="flex justify-center">
+              <span className="text-center text-xs text-muted-foreground leading-tight">
+                <AxisTooltip label={impact} definition={IMPACT_DEFINITIONS[impact] ?? ''} />
+              </span>
+            </div>
+          ))}
+        </div>
+      </div>
+      <div
+        className="flex items-center justify-center ml-2"
+        style={{ writingMode: 'vertical-rl' }}
+      >
+        <span className="text-xs font-medium text-muted-foreground">Likelihood</span>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/charts/MatrixLegend.tsx b/apps/app/src/components/risks/charts/MatrixLegend.tsx
new file mode 100644
index 0000000000..6bd5995f29
--- /dev/null
+++ b/apps/app/src/components/risks/charts/MatrixLegend.tsx
@@ -0,0 +1,38 @@
+'use client';
+
+import { HStack, Stack, Text } from '@trycompai/design-system';
+
+interface LegendItem {
+  level: 'very-low' | 'low' | 'medium' | 'high' | 'very-high';
+  label: string;
+  range: string;
+  color: string;
+}
+
+const ITEMS: LegendItem[] = [
+  { level: 'very-low', label: 'Very Low', range: 'Raw 1', color: 'bg-emerald-500/30' },
+  { level: 'low', label: 'Low', range: 'Raw 2–4', color: 'bg-green-500/30' },
+  { level: 'medium', label: 'Medium', range: 'Raw 5–9', color: 'bg-yellow-500/30' },
+  { level: 'high', label: 'High', range: 'Raw 10–16', color: 'bg-orange-500/30' },
+  { level: 'very-high', label: 'Very High', range: 'Raw 17–25', color: 'bg-red-500/30' },
+];
+
+export function MatrixLegend() {
+  return (
+    <HStack gap="md" wrap="wrap">
+      {ITEMS.map((item) => (
+        <div key={item.level} className="flex items-center gap-2">
+          <span className={`inline-block h-3 w-3 rounded-sm ${item.color}`} />
+          <Stack gap="none">
+            <Text size="xs" weight="medium">
+              {item.label}
+            </Text>
+            <Text size="xs" variant="muted">
+              {item.range}
+            </Text>
+          </Stack>
+        </div>
+      ))}
+    </HStack>
+  );
+}
diff --git a/apps/app/src/components/risks/charts/ResidualRiskChart.test.tsx b/apps/app/src/components/risks/charts/ResidualRiskChart.test.tsx
index 537a970450..ca8c62ab2c 100644
--- a/apps/app/src/components/risks/charts/ResidualRiskChart.test.tsx
+++ b/apps/app/src/components/risks/charts/ResidualRiskChart.test.tsx
@@ -42,8 +42,12 @@ import { ResidualRiskChart } from './ResidualRiskChart';
 
 const mockRisk: any = {
   id: 'risk-1',
+  likelihood: 'possible',
+  impact: 'moderate',
   residualLikelihood: 'unlikely',
   residualImpact: 'minor',
+  treatmentStrategy: 'accept',
+  tasks: [],
 };
 
 describe('ResidualRiskChart permission gating', () => {
@@ -86,7 +90,7 @@ describe('ResidualRiskChart permission gating', () => {
 
     expect(capturedProps.title).toBe('Residual Risk');
     expect(capturedProps.description).toBe(
-      'Remaining risk level after controls are applied',
+      'Risk level after the treatment plan is applied. The dashed cell is the suggestion computed from your strategy and linked task completion.',
     );
     expect(capturedProps.riskId).toBe('risk-1');
     expect(capturedProps.activeLikelihood).toBe('unlikely');
diff --git a/apps/app/src/components/risks/charts/ResidualRiskChart.tsx b/apps/app/src/components/risks/charts/ResidualRiskChart.tsx
index 14c26290db..00c986aa0d 100644
--- a/apps/app/src/components/risks/charts/ResidualRiskChart.tsx
+++ b/apps/app/src/components/risks/charts/ResidualRiskChart.tsx
@@ -2,12 +2,13 @@
 
 import { usePermissions } from '@/hooks/use-permissions';
 import { useRiskActions } from '@/hooks/use-risks';
-import type { Risk } from '@db';
+import { suggestedResidual } from '@/lib/suggested-residual';
+import type { Risk, TaskStatus } from '@db';
 import { useSWRConfig } from 'swr';
 import { RiskMatrixChart } from './RiskMatrixChart';
 
 interface ResidualRiskChartProps {
-  risk: Risk;
+  risk: Risk & { tasks?: { status: TaskStatus }[] };
 }
 
 export function ResidualRiskChart({ risk }: ResidualRiskChartProps) {
@@ -15,24 +16,39 @@ export function ResidualRiskChart({ risk }: ResidualRiskChartProps) {
   const { mutate: globalMutate } = useSWRConfig();
   const { hasPermission } = usePermissions();
 
+  // Only compute a suggestion when tasks are actually loaded — falling back to
+  // [] would render a misleading "0% complete" ghost cell on orgs that haven't
+  // hydrated yet.
+  const suggestion = risk.tasks
+    ? suggestedResidual({
+        likelihood: risk.likelihood,
+        impact: risk.impact,
+        strategy: risk.treatmentStrategy,
+        tasks: risk.tasks,
+      })
+    : undefined;
+
   return (
     <RiskMatrixChart
       title={'Residual Risk'}
-      description={'Remaining risk level after controls are applied'}
+      description={
+        'Risk level after the treatment plan is applied. The dashed cell is the suggestion computed from your strategy and linked task completion.'
+      }
+      titleInfo="Residual risk = remaining risk after the treatment plan's mitigations are in place. Compare against Inherent to see the impact of your controls."
       riskId={risk.id}
       activeLikelihood={risk.residualLikelihood}
       activeImpact={risk.residualImpact}
+      suggestedLikelihood={suggestion?.likelihood}
+      suggestedImpact={suggestion?.impact}
       readOnly={!hasPermission('risk', 'update')}
       saveAction={async ({ id, probability, impact }) => {
         await updateRisk(id, {
           residualLikelihood: probability,
           residualImpact: impact,
         });
-        globalMutate(
-          (key) => Array.isArray(key) && key[0]?.includes('/v1/risks'),
-          undefined,
-          { revalidate: true },
-        );
+        globalMutate((key) => Array.isArray(key) && key[0]?.includes('/v1/risks'), undefined, {
+          revalidate: true,
+        });
       }}
     />
   );
diff --git a/apps/app/src/components/risks/charts/RiskMatrixChart.spec.tsx b/apps/app/src/components/risks/charts/RiskMatrixChart.spec.tsx
new file mode 100644
index 0000000000..82c6a49d58
--- /dev/null
+++ b/apps/app/src/components/risks/charts/RiskMatrixChart.spec.tsx
@@ -0,0 +1,117 @@
+import { Impact, Likelihood } from '@db';
+import { fireEvent, render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { RiskMatrixChart } from './RiskMatrixChart';
+
+describe('RiskMatrixChart', () => {
+  it('renders the legend', () => {
+    render(
+      <RiskMatrixChart
+        title="Residual Risk"
+        description="x"
+        riskId="rsk_1"
+        activeLikelihood={Likelihood.possible}
+        activeImpact={Impact.moderate}
+        saveAction={vi.fn()}
+      />,
+    );
+    expect(screen.getByText('Very Low')).toBeInTheDocument();
+    expect(screen.getByText('Very High')).toBeInTheDocument();
+  });
+
+  it('renders the Accept-suggested button only when a suggestion differs from active', () => {
+    const saveAction = vi.fn();
+    const { rerender } = render(
+      <RiskMatrixChart
+        title="Residual Risk"
+        description="x"
+        riskId="rsk_1"
+        activeLikelihood={Likelihood.likely}
+        activeImpact={Impact.major}
+        suggestedLikelihood={Likelihood.possible}
+        suggestedImpact={Impact.moderate}
+        saveAction={saveAction}
+      />,
+    );
+    expect(screen.getByRole('button', { name: /Accept suggested residual/i })).toBeInTheDocument();
+
+    rerender(
+      <RiskMatrixChart
+        title="Residual Risk"
+        description="x"
+        riskId="rsk_1"
+        activeLikelihood={Likelihood.possible}
+        activeImpact={Impact.moderate}
+        suggestedLikelihood={Likelihood.possible}
+        suggestedImpact={Impact.moderate}
+        saveAction={saveAction}
+      />,
+    );
+    expect(screen.queryByRole('button', { name: /Accept suggested residual/i })).toBeNull();
+  });
+
+  it('Accept-suggested snaps the active cell to the suggested coords', () => {
+    const saveAction = vi.fn();
+    render(
+      <RiskMatrixChart
+        title="Residual Risk"
+        description="x"
+        riskId="rsk_1"
+        activeLikelihood={Likelihood.likely}
+        activeImpact={Impact.major}
+        suggestedLikelihood={Likelihood.possible}
+        suggestedImpact={Impact.moderate}
+        saveAction={saveAction}
+      />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: /Accept suggested residual/i }));
+    expect(screen.getByRole('button', { name: 'Save' })).toBeInTheDocument();
+  });
+
+  it('renders no ghost marker when suggestion matches active cell', () => {
+    render(
+      <RiskMatrixChart
+        title="Residual Risk"
+        description="x"
+        riskId="rsk_1"
+        activeLikelihood={Likelihood.possible}
+        activeImpact={Impact.moderate}
+        suggestedLikelihood={Likelihood.possible}
+        suggestedImpact={Impact.moderate}
+        saveAction={vi.fn()}
+      />,
+    );
+    expect(document.querySelectorAll('.border-dashed').length).toBe(0);
+  });
+
+  describe('preliminary subtitle', () => {
+    it('does not render the preliminary subtitle by default', () => {
+      render(
+        <RiskMatrixChart
+          title="Residual Risk"
+          description="x"
+          riskId="rsk_1"
+          activeLikelihood={Likelihood.possible}
+          activeImpact={Impact.moderate}
+          saveAction={vi.fn()}
+        />,
+      );
+      expect(screen.queryByText(/Preliminary/i)).toBeNull();
+    });
+
+    it('renders the preliminary subtitle when preliminary=true', () => {
+      render(
+        <RiskMatrixChart
+          title="Residual Risk"
+          description="x"
+          riskId="rsk_1"
+          activeLikelihood={Likelihood.possible}
+          activeImpact={Impact.moderate}
+          saveAction={vi.fn()}
+          preliminary
+        />,
+      );
+      expect(screen.getByText(/Preliminary — assessment still running/i)).toBeInTheDocument();
+    });
+  });
+});
diff --git a/apps/app/src/components/risks/charts/RiskMatrixChart.tsx b/apps/app/src/components/risks/charts/RiskMatrixChart.tsx
index 7853115fd3..7f48b2cc15 100644
--- a/apps/app/src/components/risks/charts/RiskMatrixChart.tsx
+++ b/apps/app/src/components/risks/charts/RiskMatrixChart.tsx
@@ -1,60 +1,19 @@
 'use client';
 
-import { IMPACT_SCORES, LIKELIHOOD_SCORES, getRiskLevel } from '@/lib/risk-score';
 import { Impact, Likelihood } from '@db';
-import { Button, HStack, Section } from '@trycompai/design-system';
+import { Button, HStack, Section, Text } from '@trycompai/design-system';
+import { Information } from '@trycompai/design-system/icons';
 import { useEffect, useState } from 'react';
-
-const VISUAL_LIKELIHOOD_ORDER: Likelihood[] = [
-  Likelihood.very_likely,
-  Likelihood.likely,
-  Likelihood.possible,
-  Likelihood.unlikely,
-  Likelihood.very_unlikely,
-];
-const VISUAL_IMPACT_ORDER: Impact[] = [
-  Impact.insignificant,
-  Impact.minor,
-  Impact.moderate,
-  Impact.major,
-  Impact.severe,
-];
-
-interface RiskCell {
-  probability: string;
-  impact: string;
-  level: 'very-low' | 'low' | 'medium' | 'high' | 'very-high';
-  value?: number;
-}
-
-const getRiskColor = (level: string, readOnly?: boolean) => {
-  switch (level) {
-    case 'very-low':
-      return `bg-emerald-500/20 border-emerald-500/30${readOnly ? '' : ' hover:bg-emerald-500/30'}`;
-    case 'low':
-      return `bg-green-500/20 border-green-500/30${readOnly ? '' : ' hover:bg-green-500/30'}`;
-    case 'medium':
-      return `bg-yellow-500/20 border-yellow-500/30${readOnly ? '' : ' hover:bg-yellow-500/30'}`;
-    case 'high':
-      return `bg-orange-500/20 border-orange-500/30${readOnly ? '' : ' hover:bg-orange-500/30'}`;
-    case 'very-high':
-      return `bg-red-500/20 border-red-500/30${readOnly ? '' : ' hover:bg-red-500/30'}`;
-    default:
-      return 'bg-slate-500/20 border-slate-500/30';
-  }
-};
-
-const probabilityLevels = ['Very Likely', 'Likely', 'Possible', 'Unlikely', 'Very Unlikely'];
-const probabilityNumbers = ['5', '4', '3', '2', '1'];
-const probabilityLabels = [
-  'Very Likely (5)',
-  'Likely (4)',
-  'Possible (3)',
-  'Unlikely (2)',
-  'Very Unlikely (1)',
-];
-const impactLevels = ['Insignificant', 'Minor', 'Moderate', 'Major', 'Severe'];
-const impactNumbers = ['1', '2', '3', '4', '5'];
+import { AxisTooltip } from './AxisTooltip';
+import {
+  MatrixBody,
+  VISUAL_IMPACT_ORDER,
+  VISUAL_LIKELIHOOD_ORDER,
+  buildRiskData,
+  impactLevels,
+  probabilityLevels,
+} from './MatrixBody';
+import { MatrixLegend } from './MatrixLegend';
 
 interface RiskMatrixChartProps {
   title: string;
@@ -62,8 +21,16 @@ interface RiskMatrixChartProps {
   riskId: string;
   activeLikelihood: Likelihood;
   activeImpact: Impact;
-  saveAction: (data: { id: string; probability: Likelihood; impact: Impact }) => Promise<any>;
+  saveAction: (data: { id: string; probability: Likelihood; impact: Impact }) => Promise<unknown>;
   readOnly?: boolean;
+  /** If set, renders a pulsing dashed-outline cell as the "suggested" residual. */
+  suggestedLikelihood?: Likelihood;
+  /** If set, renders a pulsing dashed-outline cell as the "suggested" residual. */
+  suggestedImpact?: Impact;
+  /** Tooltip body shown on the title info icon. */
+  titleInfo?: string;
+  /** When true, render a small "Preliminary — assessment still running" subtitle below the matrix. */
+  preliminary?: boolean;
 }
 
 export function RiskMatrixChart({
@@ -74,6 +41,10 @@ export function RiskMatrixChart({
   activeImpact: initialImpactProp,
   saveAction,
   readOnly,
+  suggestedLikelihood,
+  suggestedImpact,
+  titleInfo,
+  preliminary,
 }: RiskMatrixChartProps) {
   const [initialLikelihood, setInitialLikelihood] = useState<Likelihood>(initialLikelihoodProp);
   const [initialImpact, setInitialImpact] = useState<Impact>(initialImpactProp);
@@ -90,34 +61,14 @@ export function RiskMatrixChart({
     setActiveImpact(initialImpactProp);
   }, [initialImpactProp]);
 
-  const activeProbability = probabilityLevels[VISUAL_LIKELIHOOD_ORDER.indexOf(activeLikelihood)];
-  const activeImpactLevel = impactLevels[VISUAL_IMPACT_ORDER.indexOf(activeImpact)];
-
-  // Create risk data
-  const riskData: RiskCell[] = probabilityLevels.flatMap((probability) =>
-    impactLevels.map((impact) => {
-      const likelihoodScore =
-        LIKELIHOOD_SCORES[VISUAL_LIKELIHOOD_ORDER[probabilityLevels.indexOf(probability)]];
-      const impactScore = IMPACT_SCORES[VISUAL_IMPACT_ORDER[impactLevels.indexOf(impact)]];
-      const level = getRiskLevel(likelihoodScore * impactScore);
-
-      return {
-        probability,
-        impact,
-        level,
-        value: probability === activeProbability && impact === activeImpactLevel ? 1 : undefined,
-      };
-    }),
-  );
+  const riskData = buildRiskData(activeLikelihood, activeImpact);
 
   const handleCellClick = (probability: string, impact: string) => {
     if (readOnly) return;
     const likelihoodIdx = probabilityLevels.indexOf(probability);
     const impactIdx = impactLevels.indexOf(impact);
-    const newLikelihood = VISUAL_LIKELIHOOD_ORDER[likelihoodIdx];
-    const newImpact = VISUAL_IMPACT_ORDER[impactIdx];
-    setActiveLikelihood(newLikelihood);
-    setActiveImpact(newImpact);
+    setActiveLikelihood(VISUAL_LIKELIHOOD_ORDER[likelihoodIdx]);
+    setActiveImpact(VISUAL_IMPACT_ORDER[impactIdx]);
   };
 
   const hasChanges = activeLikelihood !== initialLikelihood || activeImpact !== initialImpact;
@@ -132,81 +83,90 @@ export function RiskMatrixChart({
       });
       setInitialLikelihood(activeLikelihood);
       setInitialImpact(activeImpact);
-    } catch (e) {
+    } catch (_e) {
     } finally {
       setLoading(false);
     }
   };
 
-  return (
-    <Section
-      title={title}
-      description={description}
-      actions={
-        !readOnly && hasChanges ? (
-          <Button onClick={handleSave} disabled={loading} loading={loading} size="sm">
-            Save
+  const hasSuggestion = suggestedLikelihood !== undefined && suggestedImpact !== undefined;
+  const suggestionDiffers =
+    hasSuggestion &&
+    (suggestedLikelihood !== activeLikelihood || suggestedImpact !== activeImpact);
+
+  const handleAcceptSuggestion = () => {
+    if (!hasSuggestion) return;
+    setActiveLikelihood(suggestedLikelihood);
+    setActiveImpact(suggestedImpact);
+  };
+
+  const sectionActions =
+    !readOnly && hasChanges ? (
+      <Button onClick={handleSave} disabled={loading} loading={loading} size="sm">
+        Save
+      </Button>
+    ) : undefined;
+
+  const body = (
+    <>
+      <MatrixBody
+        readOnly={readOnly}
+        riskData={riskData}
+        handleCellClick={handleCellClick}
+        suggestedLikelihood={suggestedLikelihood}
+        suggestedImpact={suggestedImpact}
+      />
+      {suggestionDiffers && !readOnly && (
+        <div className="mt-3 flex items-center gap-2">
+          <Button size="sm" variant="outline" onClick={handleAcceptSuggestion}>
+            Accept suggested residual
           </Button>
-        ) : undefined
-      }
-    >
-        <div className="flex gap-0">
-          <div className="flex-1">
-            <div className="mb-2 flex justify-center">
-              <span className="text-xs font-medium text-muted-foreground">Impact</span>
-            </div>
-            <div className="grid rounded-lg" style={{ gridTemplateColumns: '2rem repeat(5, 1fr)' }}>
-              {probabilityLevels.map((probability, rowIdx) => (
-                <div key={probability} className="contents">
-                  <div
-                    className="flex items-center justify-start"
-                    title={probabilityLabels[rowIdx]}
-                  >
-                    <span className="text-xs text-muted-foreground">{probabilityNumbers[rowIdx]}</span>
-                  </div>
-                  {impactLevels.map((impact, colIdx) => {
-                    const cell = riskData.find(
-                      (item) => item.probability === probability && item.impact === impact,
-                    );
-                    let rounding = '';
-                    if (rowIdx === 0 && colIdx === 0) rounding = 'rounded-tl-lg';
-                    if (rowIdx === 0 && colIdx === impactLevels.length - 1)
-                      rounding = 'rounded-tr-lg';
-                    if (rowIdx === probabilityLevels.length - 1 && colIdx === 0)
-                      rounding = 'rounded-bl-lg';
-                    if (
-                      rowIdx === probabilityLevels.length - 1 &&
-                      colIdx === impactLevels.length - 1
-                    )
-                      rounding = 'rounded-br-lg';
-                    return (
-                      <div
-                        key={`${probability}-${impact}`}
-                        className={`relative h-12 ${readOnly ? '' : 'cursor-pointer'} border transition-all duration-200 ${getRiskColor(cell?.level || 'very-low', readOnly)} flex items-center justify-center ${rounding} `}
-                        onClick={() => handleCellClick(probability, impact)}
-                      >
-                        {cell?.value && (
-                          <div className="h-4 w-4 animate-pulse rounded-full bg-white shadow-lg ring-2 ring-slate-900/70 dark:ring-slate-100/80" />
-                        )}
-                      </div>
-                    );
-                  })}
-                </div>
-              ))}
-            </div>
-            <div className="grid mt-2" style={{ gridTemplateColumns: '2rem repeat(5, 1fr)' }}>
-              <div />
-              {impactLevels.map((impact) => (
-                <div key={impact} className="flex justify-center">
-                  <span className="text-center text-xs text-muted-foreground leading-tight">{impact}</span>
-                </div>
-              ))}
-            </div>
-          </div>
-          <div className="flex items-center justify-center ml-2" style={{ writingMode: 'vertical-rl' }}>
-            <span className="text-xs font-medium text-muted-foreground">Likelihood</span>
-          </div>
+          <Text size="xs" variant="muted">
+            Ghost cell shows the residual suggested by this entity&apos;s treatment plan.
+          </Text>
+        </div>
+      )}
+      {preliminary && (
+        <div className="mt-2">
+          <Text size="xs" variant="muted">
+            Preliminary — assessment still running
+          </Text>
+        </div>
+      )}
+      <div className="mt-3">
+        <MatrixLegend />
+      </div>
+    </>
+  );
+
+  // When titleInfo is present, we render the title manually so we can inject an info icon.
+  // The DS Section's `title` prop only accepts `string`, so when titleInfo is set we omit
+  // `title` and render our own heading row. When no titleInfo, fall back to the normal prop.
+  if (titleInfo) {
+    return (
+      <Section description={description} actions={sectionActions}>
+        <div className="flex items-start justify-between gap-4 -mt-2 mb-2">
+          <HStack gap="xs" align="center">
+            <h3 className="text-base font-semibold leading-none tracking-tight">{title}</h3>
+            <AxisTooltip
+              label={
+                <Information
+                  aria-label="About this chart"
+                  className="h-4 w-4 text-muted-foreground"
+                />
+              }
+              definition={titleInfo}
+            />
+          </HStack>
         </div>
+        {body}
+      </Section>
+    );
+  }
+
+  return (
+    <Section title={title} description={description} actions={sectionActions}>
+      {body}
     </Section>
   );
 }
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkButton.spec.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkButton.spec.tsx
new file mode 100644
index 0000000000..6e8c49aee8
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkButton.spec.tsx
@@ -0,0 +1,97 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AutoLinkButton } from './AutoLinkButton';
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }));
+
+const realtimeRunMock = vi.fn();
+vi.mock('@trigger.dev/react-hooks', () => ({
+  useRealtimeRun: (runId: string, opts: { accessToken?: string; enabled?: boolean }) =>
+    realtimeRunMock(runId, opts),
+}));
+
+afterEach(() => {
+  realtimeRunMock.mockReset();
+});
+
+describe('AutoLinkButton', () => {
+  it('shows "generate plan" label when description is empty', () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    render(
+      <AutoLinkButton
+        hasDescription={false}
+        onAutoLink={vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' })}
+      />,
+    );
+    expect(
+      screen.getByRole('button', { name: /Auto-link tasks & generate plan/i }),
+    ).toBeInTheDocument();
+  });
+
+  it('shows "refresh plan" label when description is non-empty', () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    render(
+      <AutoLinkButton
+        hasDescription
+        onAutoLink={vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' })}
+      />,
+    );
+    expect(
+      screen.getByRole('button', { name: /Auto-link tasks & refresh plan/i }),
+    ).toBeInTheDocument();
+  });
+
+  it('replaces the button with a progress card after click', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: { status: 'EXECUTING', metadata: { phase: 'embedding-tasks', current: 5, total: 10 } },
+    });
+    const onAutoLink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    render(<AutoLinkButton hasDescription onAutoLink={onAutoLink} />);
+    fireEvent.click(screen.getByRole('button'));
+    await waitFor(() => {
+      expect(screen.getByRole('status')).toBeInTheDocument();
+    });
+    expect(screen.getByText(/Embedding tasks/i)).toBeInTheDocument();
+    expect(screen.getByText(/\(5\/10\)/i)).toBeInTheDocument();
+  });
+
+  it('chains onAfterLink and toasts when run completes with links', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: { status: 'COMPLETED', metadata: { phase: 'done', riskLinks: 3, vendorLinks: 0 } },
+    });
+    const onAutoLink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    const onAfterLink = vi.fn().mockResolvedValue(undefined);
+    render(<AutoLinkButton hasDescription onAutoLink={onAutoLink} onAfterLink={onAfterLink} />);
+    fireEvent.click(screen.getByRole('button'));
+    await waitFor(() => {
+      expect(onAfterLink).toHaveBeenCalled();
+    });
+  });
+
+  it('skips onAfterLink and toasts info when run completes with zero links', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: { status: 'COMPLETED', metadata: { phase: 'done', riskLinks: 0, vendorLinks: 0 } },
+    });
+    const onAutoLink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    const onAfterLink = vi.fn();
+    render(<AutoLinkButton hasDescription onAutoLink={onAutoLink} onAfterLink={onAfterLink} />);
+    fireEvent.click(screen.getByRole('button'));
+    await waitFor(() => {
+      // Component returns to idle (button visible again).
+      expect(screen.getByRole('button')).toBeInTheDocument();
+    });
+    expect(onAfterLink).not.toHaveBeenCalled();
+  });
+
+  it('toasts error and returns to idle when run fails', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: { status: 'FAILED', metadata: {} },
+    });
+    const onAutoLink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    render(<AutoLinkButton hasDescription onAutoLink={onAutoLink} />);
+    fireEvent.click(screen.getByRole('button'));
+    await waitFor(() => {
+      expect(screen.getByRole('button')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkButton.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkButton.tsx
new file mode 100644
index 0000000000..1fef7b3f42
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkButton.tsx
@@ -0,0 +1,177 @@
+'use client';
+
+import { Button, Stack, Text } from '@trycompai/design-system';
+import { Link as LinkIcon } from '@trycompai/design-system/icons';
+import { useRealtimeRun } from '@trigger.dev/react-hooks';
+import { useEffect, useState } from 'react';
+import { toast } from 'sonner';
+
+interface AutoLinkButtonProps {
+  /** Whether the entity already has a saved treatment-plan description. */
+  hasDescription: boolean;
+  disabled?: boolean;
+  onAutoLink: () => Promise<{ runId: string; publicAccessToken: string }>;
+  onAfterLink?: () => Promise<void>;
+}
+
+type RunState =
+  | { kind: 'idle' }
+  | { kind: 'running'; runId: string; publicAccessToken: string };
+
+const PHASE_LABEL: Record<string, string> = {
+  starting: 'Starting…',
+  'embedding-tasks': 'Embedding tasks',
+  'embedding-risks': 'Embedding risks',
+  'embedding-vendors': 'Embedding vendors',
+  'waiting-for-index': 'Waiting for the index',
+  'matching-risks': 'Matching tasks to risks',
+  'matching-vendors': 'Matching tasks to vendors',
+  done: 'Finishing up…',
+};
+
+export function AutoLinkButton({
+  hasDescription,
+  disabled,
+  onAutoLink,
+  onAfterLink,
+}: AutoLinkButtonProps) {
+  const [state, setState] = useState<RunState>({ kind: 'idle' });
+  const [submitting, setSubmitting] = useState(false);
+
+  const handleClick = async () => {
+    setSubmitting(true);
+    try {
+      const { runId, publicAccessToken } = await onAutoLink();
+      setState({ kind: 'running', runId, publicAccessToken });
+    } catch {
+      toast.error('Auto-link failed. Try again or link manually.');
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  if (state.kind === 'running') {
+    return (
+      <RunProgress
+        runId={state.runId}
+        accessToken={state.publicAccessToken}
+        hasDescription={hasDescription}
+        onComplete={async (linked) => {
+          if (linked === 0) {
+            toast.info('No matching tasks found. Link manually from the Tasks tab.');
+          } else {
+            toast.success(
+              `Linked ${linked} task${linked === 1 ? '' : 's'}${
+                hasDescription ? ' · refreshing treatment plan' : ' · generating treatment plan'
+              }`,
+            );
+            // Post-link refresh (mitigation regen, swr revalidation) is
+            // separate from the link itself succeeding. If it fails we
+            // surface a distinct toast so the user knows the link landed
+            // but the plan refresh did not. Without this branch a
+            // refresh failure could either be silent or — worse — get
+            // mistaken for a link failure. (Cubic finding #23.)
+            if (onAfterLink) {
+              try {
+                await onAfterLink();
+              } catch (err) {
+                console.error('[AutoLinkButton] post-link refresh failed', err);
+                toast.warning(
+                  'Linked the tasks, but refreshing the treatment plan failed. Try regenerating manually.',
+                );
+              }
+            }
+          }
+          setState({ kind: 'idle' });
+        }}
+        onFailed={() => {
+          toast.error('Auto-link failed. Try again or link manually.');
+          setState({ kind: 'idle' });
+        }}
+      />
+    );
+  }
+
+  return (
+    <Button
+      variant="outline"
+      size="sm"
+      onClick={handleClick}
+      disabled={disabled || submitting}
+      loading={submitting}
+      iconLeft={<LinkIcon aria-hidden="true" />}
+    >
+      {hasDescription ? 'Auto-link tasks & refresh plan' : 'Auto-link tasks & generate plan'}
+    </Button>
+  );
+}
+
+interface RunProgressProps {
+  runId: string;
+  accessToken: string;
+  hasDescription: boolean;
+  onComplete: (linked: number) => void;
+  onFailed: () => void;
+}
+
+function RunProgress({ runId, accessToken, onComplete, onFailed }: RunProgressProps) {
+  const { run } = useRealtimeRun(runId, { accessToken, enabled: true });
+
+  const meta = (run?.metadata ?? {}) as Record<string, unknown>;
+  const phase = typeof meta.phase === 'string' ? meta.phase : 'starting';
+  const current = typeof meta.current === 'number' ? meta.current : null;
+  const total = typeof meta.total === 'number' ? meta.total : null;
+
+  const status = run?.status;
+  useEffect(() => {
+    if (!status) return;
+    if (status === 'COMPLETED') {
+      const riskLinks = typeof meta.riskLinks === 'number' ? meta.riskLinks : 0;
+      const vendorLinks = typeof meta.vendorLinks === 'number' ? meta.vendorLinks : 0;
+      onComplete(riskLinks + vendorLinks);
+      return;
+    }
+    if (
+      status === 'FAILED' ||
+      status === 'CANCELED' ||
+      status === 'CRASHED' ||
+      status === 'SYSTEM_FAILURE' ||
+      status === 'EXPIRED' ||
+      status === 'TIMED_OUT'
+    ) {
+      onFailed();
+    }
+  }, [status]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  // Show progress phases (skip 'done' — onComplete handles transition).
+  const showProgress = phase !== 'done' && phase in PHASE_LABEL;
+  const label = showProgress ? PHASE_LABEL[phase] : PHASE_LABEL.starting;
+  const countSuffix =
+    current !== null && total !== null && total > 0 && phase !== 'starting' && phase !== 'done'
+      ? ` (${current}/${total})`
+      : '';
+
+  return (
+    <div
+      className="rounded-md border border-border bg-muted/30 p-3"
+      role="status"
+      aria-live="polite"
+    >
+      <Stack gap="xs">
+        <div className="flex items-center gap-2">
+          <span
+            className="inline-block h-2 w-2 animate-pulse rounded-full bg-primary"
+            aria-hidden="true"
+          />
+          <Text size="xs" weight="medium">
+            Auto-linking tasks
+          </Text>
+        </div>
+        <Text size="xs" variant="muted">
+          {label}
+          {countSuffix}
+        </Text>
+      </Stack>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.parts.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.parts.tsx
new file mode 100644
index 0000000000..fd5e730a67
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.parts.tsx
@@ -0,0 +1,459 @@
+'use client';
+
+import { Button } from '@trycompai/design-system';
+import { MagicWandFilled } from '@trycompai/design-system/icons';
+import { useRealtimeRun } from '@trigger.dev/react-hooks';
+import { useEffect, useMemo, useRef } from 'react';
+import { ControlsSection, TasksSection } from './AutoLinkSuggestions.sections';
+import {
+  isControlDerived,
+  type SuggestedControl,
+  type SuggestedTask,
+} from './AutoLinkSuggestions.types';
+
+export function EmptyState({
+  canUpdate,
+  submitting,
+  onSuggest,
+  onStartFromScratch,
+  variant = 'default',
+}: {
+  canUpdate: boolean;
+  submitting: boolean;
+  onSuggest: () => void;
+  /** Required when variant === 'kickoff' — dismisses the kickoff so the user
+   *  can write the plan manually. Ignored for other variants. */
+  onStartFromScratch?: () => void;
+  /**
+   * `'kickoff'` — the wide centered panel ("Let AI kick this off") shown when
+   *   plan and tasks are both empty. Has a primary "Draft plan & suggest
+   *   links" button plus a "Start from scratch" escape hatch.
+   * `'kickoff-with-plan'` — same wide panel, copy adapted for the case where
+   *   a plan already exists ("AI will only suggest tasks/controls; your plan
+   *   stays as-is unless you regenerate").
+   * `'default'` — the smaller per-column empty CTA shown when the user has a
+   *   plan but no linked tasks yet.
+   */
+  variant?: 'default' | 'kickoff' | 'kickoff-with-plan';
+}) {
+  // Adapt kickoff copy based on whether a plan already exists. The same
+  // wide-panel layout applies in both cases.
+  const isKickoff = variant === 'kickoff' || variant === 'kickoff-with-plan';
+  if (isKickoff) {
+    const hasPlan = variant === 'kickoff-with-plan';
+    const title = hasPlan ? 'Let AI suggest tasks and controls' : 'Let AI kick this off';
+    const description = hasPlan
+      ? "Based on your treatment plan, AI can scan your library and suggest the tasks and controls most likely to drive this risk down. You'll review everything before anything is linked."
+      : "Based on the strategy above, AI can draft a treatment plan and suggest the tasks and controls most likely to drive this risk down. You'll review everything before anything is saved or linked.";
+    const primaryLabel = hasPlan ? 'Suggest tasks & controls' : 'Draft plan & suggest links';
+    const escapeLabel = hasPlan ? 'Edit plan manually' : 'Start from scratch';
+
+    return (
+      <div className="flex flex-col items-center rounded-md bg-primary/[0.05] px-6 py-10 text-center">
+        <div className="flex h-14 w-14 items-center justify-center rounded-full bg-primary/[0.12] text-primary">
+          <MagicWandFilled size={24} aria-hidden="true" />
+        </div>
+        <h3 className="mt-4 text-xl font-normal tracking-[-0.01em]">{title}</h3>
+        <p className="mt-3 max-w-[520px] text-sm leading-[1.55] text-muted-foreground">
+          {description}
+        </p>
+        <div className="mt-6 flex flex-wrap items-center justify-center gap-3">
+          <Button
+            iconLeft={<MagicWandFilled aria-hidden="true" />}
+            onClick={onSuggest}
+            loading={submitting}
+            disabled={!canUpdate}
+          >
+            {primaryLabel}
+          </Button>
+          <Button variant="ghost" onClick={onStartFromScratch} disabled={!canUpdate}>
+            {escapeLabel}
+          </Button>
+        </div>
+        <div className="mt-8 grid w-full max-w-[640px] grid-cols-1 gap-6 border-t border-border pt-5 text-left sm:grid-cols-2">
+          <div>
+            <div className="font-mono text-[10px] uppercase tracking-[0.1em] text-muted-foreground">
+              02 · Plan
+            </div>
+            <div className="mt-1.5 text-xs text-muted-foreground">
+              {hasPlan
+                ? 'Your existing plan stays as-is unless you regenerate.'
+                : 'A concrete plan grounded in the selected tasks and controls.'}
+            </div>
+          </div>
+          <div>
+            <div className="font-mono text-[10px] uppercase tracking-[0.1em] text-muted-foreground">
+              03 · Links
+            </div>
+            <div className="mt-1.5 text-xs text-muted-foreground">
+              Tasks and framework controls AI ranks for this risk.
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="mt-4 flex flex-col items-center rounded-md border border-dashed border-border bg-primary/[0.02] px-4 py-7 text-center">
+      <div className="flex h-9 w-9 items-center justify-center rounded-full bg-primary/[0.12] text-primary">
+        <MagicWandFilled size={20} aria-hidden="true" />
+      </div>
+      <div className="mt-3 text-sm font-normal">No tasks or controls linked yet</div>
+      <div className="mt-1 max-w-[320px] text-xs leading-[1.5] text-muted-foreground">
+        Have AI scan your library and suggest the tasks and controls most likely to drive this risk
+        down.
+      </div>
+      <div className="mt-4">
+        <Button
+          size="sm"
+          iconLeft={<MagicWandFilled aria-hidden="true" />}
+          onClick={onSuggest}
+          loading={submitting}
+          disabled={!canUpdate}
+        >
+          Suggest with AI
+        </Button>
+      </div>
+      <div className="mt-2.5 text-[11px] text-muted-foreground">
+        You'll review before anything is linked.
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Statuses we treat as "in flight, render the loading UI". Anything outside
+ * this set is either terminal-success (COMPLETED) or terminal-failure (which
+ * we surface via FailedState).
+ */
+const IN_FLIGHT_STATUSES = new Set([
+  'WAITING_FOR_DEPLOY',
+  'DELAYED',
+  'QUEUED',
+  'EXECUTING',
+  'INTERRUPTED',
+  'WAITING_TO_RESUME',
+]);
+
+/**
+ * Terminal failures we route to FailedState. EXPIRED happens when a run sits
+ * in the queue past its TTL; TIMED_OUT when execution exceeds maxDuration.
+ */
+const TERMINAL_FAILURE_STATUSES = new Set([
+  'FAILED',
+  'CANCELED',
+  'CRASHED',
+  'SYSTEM_FAILURE',
+  'EXPIRED',
+  'TIMED_OUT',
+]);
+
+/**
+ * Phases written to `metadata.phase` by the trigger task wrapper. Mirrored
+ * from `LinkagePhase` in `lib/embedding/run-linkage.ts`.
+ */
+type PhaseName =
+  | 'starting'
+  | 'embedding-tasks'
+  | 'embedding-risks'
+  | 'embedding-vendors'
+  | 'waiting-for-index'
+  | 'matching-risks'
+  | 'matching-vendors'
+  | 'done';
+
+function describeStatus(
+  status: string | undefined,
+  phase: PhaseName | undefined,
+  current: number | undefined,
+  total: number | undefined,
+): { headline: string; sub: string } {
+  if (!status || status === 'WAITING_FOR_DEPLOY') {
+    return {
+      headline: 'Waiting for a worker…',
+      sub: 'Allocating compute capacity.',
+    };
+  }
+  if (status === 'QUEUED' || status === 'DELAYED') {
+    return {
+      headline: 'Queued — waiting to start…',
+      sub: 'Your scan will pick up momentarily.',
+    };
+  }
+  if (status === 'INTERRUPTED' || status === 'WAITING_TO_RESUME') {
+    return {
+      headline: 'Resuming…',
+      sub: 'Picking up where the run left off.',
+    };
+  }
+  // EXECUTING from here down — describe by phase metadata.
+  if (!phase || phase === 'starting') {
+    return {
+      headline: 'Starting AI scan…',
+      sub: 'Initializing the suggestion run.',
+    };
+  }
+  if (phase === 'embedding-tasks') {
+    const progress = total ? ` (${current ?? 0} / ${total})` : '';
+    return {
+      headline: 'Embedding your task library…',
+      sub: `Indexing tasks for semantic search${progress}.`,
+    };
+  }
+  if (phase === 'embedding-risks' || phase === 'embedding-vendors') {
+    return {
+      headline: 'Embedding the subject…',
+      sub: 'Preparing the query vector.',
+    };
+  }
+  if (phase === 'waiting-for-index') {
+    return {
+      headline: 'Waiting for the index…',
+      sub: 'Letting the vector store finish ingesting before we query it.',
+    };
+  }
+  if (phase === 'matching-risks' || phase === 'matching-vendors') {
+    return {
+      headline: 'Scanning your library…',
+      sub: 'Matching candidates and reranking with AI.',
+    };
+  }
+  // 'done' — the status itself will flip to COMPLETED imminently.
+  return {
+    headline: 'Wrapping up…',
+    sub: 'Compiling the final suggestions.',
+  };
+}
+
+export function LoadingState({
+  runId,
+  accessToken,
+  onReady,
+  onFailed,
+}: {
+  runId: string;
+  accessToken: string;
+  onReady: (s: { tasks: SuggestedTask[]; controls: SuggestedControl[] }) => void;
+  onFailed: (reason: string) => void;
+}) {
+  const { run } = useRealtimeRun(runId, { accessToken, enabled: true });
+  const status = run?.status;
+  const output = run?.output as
+    | { suggestions?: { tasks?: SuggestedTask[]; controls?: SuggestedControl[] } }
+    | undefined;
+  const meta = (run?.metadata ?? {}) as {
+    phase?: PhaseName;
+    current?: number;
+    total?: number;
+  };
+
+  // Stash callbacks in refs so the effect can fire only on `status` changes
+  // (we never want to re-fire on every parent render that changes callback
+  // identity), but always read the freshest `output` and handlers — avoids
+  // the stale-closure race Cubic flagged (#32 on PR #2671).
+  const outputRef = useRef(output);
+  outputRef.current = output;
+  const onReadyRef = useRef(onReady);
+  onReadyRef.current = onReady;
+  const onFailedRef = useRef(onFailed);
+  onFailedRef.current = onFailed;
+
+  useEffect(() => {
+    if (!status) return;
+    if (status === 'COMPLETED') {
+      const sugg = outputRef.current?.suggestions;
+      onReadyRef.current({
+        tasks: Array.isArray(sugg?.tasks) ? sugg.tasks : [],
+        controls: Array.isArray(sugg?.controls) ? sugg.controls : [],
+      });
+      return;
+    }
+    if (TERMINAL_FAILURE_STATUSES.has(status)) {
+      const reasons: Record<string, string> = {
+        FAILED: 'The AI scan hit an error.',
+        CANCELED: 'The AI scan was canceled.',
+        CRASHED: 'The worker crashed mid-scan.',
+        SYSTEM_FAILURE: 'A system error stopped the scan.',
+        EXPIRED: 'The scan expired before it could start.',
+        TIMED_OUT: 'The scan took too long and timed out.',
+      };
+      onFailedRef.current(reasons[status] ?? 'The AI scan failed.');
+    }
+  }, [status]);
+
+  // Treat unknown / pre-subscribe state as in-flight so the spinner stays up
+  // until the realtime stream catches up.
+  const inFlight = !status || IN_FLIGHT_STATUSES.has(status);
+  if (!inFlight) {
+    // Either COMPLETED (the effect above will transition state) or terminal
+    // failure (same). Render a quiet placeholder for the brief gap.
+    return (
+      <div className="mt-4 border-t border-border pt-4" role="status" aria-live="polite">
+        <div className="text-[13px] text-muted-foreground">Finishing up…</div>
+      </div>
+    );
+  }
+
+  const { headline, sub } = describeStatus(status, meta.phase, meta.current, meta.total);
+  const showProgress = meta.phase === 'embedding-tasks' && typeof meta.total === 'number' && meta.total > 0;
+  const pct = showProgress
+    ? Math.min(100, Math.round(((meta.current ?? 0) / (meta.total ?? 1)) * 100))
+    : null;
+
+  return (
+    <div className="mt-4 border-t border-border pt-4" role="status" aria-live="polite">
+      <div className="mb-3.5 flex items-center gap-2">
+        <span
+          className="inline-block h-3.5 w-3.5 animate-spin rounded-full border-2 border-border border-t-primary"
+          aria-hidden="true"
+        />
+        <span className="text-[13px]">{headline}</span>
+      </div>
+      <div className="mb-4 font-mono text-[11px] uppercase tracking-[0.05em] text-muted-foreground">
+        {sub}
+      </div>
+      {pct !== null && (
+        <div className="mb-4 h-1 overflow-hidden rounded-full bg-muted">
+          <div
+            className="h-full rounded-full bg-primary transition-[width] duration-300 ease-out"
+            style={{ width: `${pct}%` }}
+            aria-hidden="true"
+          />
+        </div>
+      )}
+      {[0, 1, 2, 3].map((i) => (
+        <div
+          key={i}
+          className="flex animate-pulse items-center gap-2.5 border-b border-border py-2"
+          style={{ animationDelay: `${i * 120}ms` }}
+        >
+          <div className="h-3.5 w-3.5 rounded-[3px] bg-muted" />
+          <div className="h-2 rounded bg-muted" style={{ width: `${60 + ((i * 7) % 30)}%` }} />
+        </div>
+      ))}
+    </div>
+  );
+}
+
+export function FailedState({
+  reason,
+  retrying,
+  onRetry,
+  onDiscard,
+}: {
+  reason: string;
+  retrying: boolean;
+  onRetry: () => void;
+  onDiscard: () => void;
+}) {
+  return (
+    <div
+      role="alert"
+      className="mt-4 flex flex-col items-start gap-3 rounded-md border border-destructive/40 bg-destructive/[0.06] px-4 py-4"
+    >
+      <div>
+        <div className="text-sm font-normal text-destructive">Auto-link failed</div>
+        <div className="mt-1 text-xs leading-[1.5] text-muted-foreground">{reason}</div>
+      </div>
+      <div className="flex items-center gap-2">
+        <Button
+          size="sm"
+          iconLeft={<MagicWandFilled aria-hidden="true" />}
+          onClick={onRetry}
+          loading={retrying}
+        >
+          Retry
+        </Button>
+        <Button variant="ghost" size="sm" onClick={onDiscard} disabled={retrying}>
+          Discard
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export function SuggestionsState({
+  tasks,
+  controls,
+  checkedTaskIds,
+  applying,
+  submitting,
+  onToggle,
+  onDiscard,
+  onApply,
+  onRerun,
+}: {
+  tasks: SuggestedTask[];
+  controls: SuggestedControl[];
+  checkedTaskIds: Set<string>;
+  applying: boolean;
+  submitting: boolean;
+  onToggle: (id: string) => void;
+  onDiscard: () => void;
+  onApply: () => void;
+  onRerun: () => void;
+}) {
+  const derivedControlsCount = useMemo(
+    () => controls.filter((c) => isControlDerived(c, checkedTaskIds)).length,
+    [controls, checkedTaskIds],
+  );
+  const taskCount = tasks.length;
+  const controlCount = controls.length;
+
+  return (
+    <div className="mt-4 border-t border-border pt-4">
+      <div
+        className="mb-4 flex items-center gap-2 rounded-md border bg-primary/[0.06] px-2.5 py-2"
+        style={{ borderColor: 'color-mix(in oklab, var(--primary) 25%, var(--border))' }}
+      >
+        <MagicWandFilled size={14} className="shrink-0 text-primary" aria-hidden="true" />
+        <span className="text-xs">
+          AI found{' '}
+          <strong>
+            {taskCount} task{taskCount === 1 ? '' : 's'}
+          </strong>{' '}
+          and{' '}
+          <strong>
+            {controlCount} control{controlCount === 1 ? '' : 's'}
+          </strong>
+          . Review below.
+        </span>
+      </div>
+
+      <TasksSection tasks={tasks} checkedTaskIds={checkedTaskIds} onToggle={onToggle} />
+
+      {controls.length > 0 && (
+        <ControlsSection
+          controls={controls}
+          checkedTaskIds={checkedTaskIds}
+          derivedControlsCount={derivedControlsCount}
+        />
+      )}
+
+      <div className="mt-4 flex items-center gap-2 border-t border-border pt-3.5">
+        <Button
+          variant="ghost"
+          size="sm"
+          iconLeft={<MagicWandFilled aria-hidden="true" />}
+          onClick={onRerun}
+          disabled={submitting}
+        >
+          Re-run
+        </Button>
+        <span className="flex-1" />
+        <Button variant="ghost" size="sm" onClick={onDiscard}>
+          Discard
+        </Button>
+        <Button
+          size="sm"
+          onClick={onApply}
+          disabled={checkedTaskIds.size === 0 || applying}
+          loading={applying}
+        >
+          Link {checkedTaskIds.size || 'none'}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.sections.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.sections.tsx
new file mode 100644
index 0000000000..83b0b37508
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.sections.tsx
@@ -0,0 +1,229 @@
+'use client';
+
+import { cn } from '@/lib/utils';
+import { Text } from '@trycompai/design-system';
+import { ChevronLeft, ChevronRight, Checkmark } from '@trycompai/design-system/icons';
+import { useEffect, useState } from 'react';
+import {
+  isControlDerived,
+  type SuggestedControl,
+  type SuggestedTask,
+} from './AutoLinkSuggestions.types';
+
+// Match the LinkedWork list pagination so the selection UI feels consistent
+// with the post-apply view (also 4 per page).
+const PAGE_SIZE = 4;
+
+function Pagination({
+  page,
+  pageCount,
+  onPageChange,
+  total,
+}: {
+  page: number;
+  pageCount: number;
+  onPageChange: (next: number) => void;
+  total: number;
+}) {
+  if (pageCount <= 1) return null;
+  const start = (page - 1) * PAGE_SIZE + 1;
+  const end = Math.min(page * PAGE_SIZE, total);
+  return (
+    <div className="mt-2 flex items-center justify-between gap-2 px-1 text-[11px] text-muted-foreground">
+      <span className="font-mono tabular-nums">
+        {start}–{end} of {total}
+      </span>
+      <div className="flex items-center gap-1">
+        <button
+          type="button"
+          onClick={() => onPageChange(Math.max(1, page - 1))}
+          disabled={page === 1}
+          className="inline-flex h-6 w-6 items-center justify-center rounded border border-border bg-transparent text-foreground transition-colors hover:bg-muted disabled:cursor-not-allowed disabled:opacity-40"
+          aria-label="Previous page"
+        >
+          <ChevronLeft size={12} aria-hidden="true" />
+        </button>
+        <span className="font-mono tabular-nums">
+          {page} / {pageCount}
+        </span>
+        <button
+          type="button"
+          onClick={() => onPageChange(Math.min(pageCount, page + 1))}
+          disabled={page === pageCount}
+          className="inline-flex h-6 w-6 items-center justify-center rounded border border-border bg-transparent text-foreground transition-colors hover:bg-muted disabled:cursor-not-allowed disabled:opacity-40"
+          aria-label="Next page"
+        >
+          <ChevronRight size={12} aria-hidden="true" />
+        </button>
+      </div>
+    </div>
+  );
+}
+
+export function ConfidencePill({ score }: { score: number }) {
+  if (score <= 0) {
+    return (
+      <span className="mt-0.5 shrink-0 font-mono text-[11px] tabular-nums tracking-[-0.02em] text-muted-foreground">
+        —
+      </span>
+    );
+  }
+  // Cap at 100%; raw similarity + boost can exceed 1 in theory.
+  const pct = Math.min(100, Math.round(score * 100));
+  const tier = pct >= 85 ? 'high' : pct >= 70 ? 'med' : 'low';
+  const colorClass =
+    tier === 'high'
+      ? 'text-green-600 dark:text-green-400'
+      : tier === 'med'
+        ? 'text-amber-600 dark:text-amber-400'
+        : 'text-muted-foreground';
+  return (
+    <span
+      className={cn(
+        'mt-0.5 shrink-0 font-mono text-[11px] tabular-nums tracking-[-0.02em]',
+        colorClass,
+      )}
+    >
+      {pct}%
+    </span>
+  );
+}
+
+export function TasksSection({
+  tasks,
+  checkedTaskIds,
+  onToggle,
+}: {
+  tasks: SuggestedTask[];
+  checkedTaskIds: Set<string>;
+  onToggle: (id: string) => void;
+}) {
+  const pageCount = Math.max(1, Math.ceil(tasks.length / PAGE_SIZE));
+  const [page, setPage] = useState(1);
+  // Re-clamp the page when the list shrinks (e.g. after a re-run returns
+  // fewer tasks). Keeps the user on a valid page rather than rendering
+  // empty space.
+  useEffect(() => {
+    if (page > pageCount) setPage(pageCount);
+  }, [page, pageCount]);
+  const start = (page - 1) * PAGE_SIZE;
+  const visible = tasks.slice(start, start + PAGE_SIZE);
+
+  return (
+    <div>
+      <div className="mb-1 flex items-center justify-between text-xs font-normal">
+        <span>Tasks</span>
+        <span className="font-mono text-[11px] text-muted-foreground">
+          {checkedTaskIds.size} / {tasks.length} selected
+        </span>
+      </div>
+      {tasks.length === 0 ? (
+        <p className="py-2 text-[12px] text-muted-foreground">
+          No tasks suggested. Try rerunning or link manually.
+        </p>
+      ) : (
+        <>
+          {visible.map((t) => {
+            const checked = checkedTaskIds.has(t.id);
+            return (
+              <button
+                key={t.id}
+                type="button"
+                onClick={() => onToggle(t.id)}
+                aria-pressed={checked}
+                aria-label={`${checked ? 'Uncheck' : 'Check'} task ${t.title}`}
+                className="flex w-full items-start gap-2.5 border-b border-border bg-transparent px-1 py-2.5 text-left transition-colors hover:bg-muted"
+              >
+                <span
+                  className={cn(
+                    'mt-0.5 flex h-4 w-4 shrink-0 items-center justify-center rounded-[3px] border transition-colors',
+                    checked ? 'border-primary bg-primary' : 'border-border bg-background',
+                  )}
+                >
+                  {checked && (
+                    <Checkmark size={11} className="text-primary-foreground" aria-hidden="true" />
+                  )}
+                </span>
+                <div className={cn('min-w-0 flex-1', !checked && 'opacity-55')}>
+                  <div className="text-[13px] leading-[1.4]">{t.title}</div>
+                </div>
+                <ConfidencePill score={t.score} />
+              </button>
+            );
+          })}
+          <Pagination
+            page={page}
+            pageCount={pageCount}
+            onPageChange={setPage}
+            total={tasks.length}
+          />
+        </>
+      )}
+    </div>
+  );
+}
+
+export function ControlsSection({
+  controls,
+  checkedTaskIds,
+  derivedControlsCount,
+}: {
+  controls: SuggestedControl[];
+  checkedTaskIds: Set<string>;
+  derivedControlsCount: number;
+}) {
+  const pageCount = Math.max(1, Math.ceil(controls.length / PAGE_SIZE));
+  const [page, setPage] = useState(1);
+  useEffect(() => {
+    if (page > pageCount) setPage(pageCount);
+  }, [page, pageCount]);
+  const start = (page - 1) * PAGE_SIZE;
+  const visible = controls.slice(start, start + PAGE_SIZE);
+
+  return (
+    <div className="mt-4 border-t border-border pt-4">
+      <div className="mb-1 flex items-center justify-between text-xs font-normal">
+        <span>Controls</span>
+        <span className="font-mono text-[11px] text-muted-foreground">
+          {derivedControlsCount} {derivedControlsCount === 1 ? 'control' : 'controls'} via tasks
+        </span>
+      </div>
+      <Text size="xs" variant="muted" as="p">
+        These controls will be linked through the selected tasks.
+      </Text>
+      <div className="mt-2">
+        {visible.map((c) => {
+          const isDerived = isControlDerived(c, checkedTaskIds);
+          // Show "code · name" when the framework provides a code
+          // (e.g. "1.2.7 · Credential Management"); fall back to just
+          // the name when code is empty so we don't render a leading
+          // "· " orphan separator.
+          const heading = c.code ? `${c.code} · ${c.name}` : c.name;
+          return (
+            <div
+              key={c.id}
+              className={cn(
+                'flex items-start gap-2.5 border-b border-border px-1 py-2.5',
+                !isDerived && 'opacity-55',
+              )}
+            >
+              <div className="min-w-0 flex-1">
+                <div className="text-[13px] leading-[1.4]">{heading}</div>
+                <div className="mt-0.5 text-[11px] leading-[1.4] text-muted-foreground">
+                  {c.framework}
+                </div>
+              </div>
+              <ConfidencePill score={c.score} />
+            </div>
+          );
+        })}
+        <Pagination
+          page={page}
+          pageCount={pageCount}
+          onPageChange={setPage}
+          total={controls.length}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.spec.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.spec.tsx
new file mode 100644
index 0000000000..04c8cf3c9d
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.spec.tsx
@@ -0,0 +1,238 @@
+import { TaskStatus } from '@db';
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AutoLinkSuggestions, type LinkedTask } from './AutoLinkSuggestions';
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }));
+
+const realtimeRunMock = vi.fn();
+vi.mock('@trigger.dev/react-hooks', () => ({
+  useRealtimeRun: (runId: string, opts: { accessToken?: string; enabled?: boolean }) =>
+    realtimeRunMock(runId, opts),
+}));
+
+afterEach(() => {
+  realtimeRunMock.mockReset();
+});
+
+const linkedTask: LinkedTask = {
+  id: 'tsk_existing',
+  title: 'Existing task',
+  status: TaskStatus.todo,
+  controls: [{ id: 'ctl_existing', name: 'Existing control' }],
+};
+
+function defaultProps() {
+  return {
+    orgId: 'org_1',
+    canUpdate: true,
+    tasks: [] as LinkedTask[],
+    onSuggest: vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' }),
+    onApply: vi.fn().mockResolvedValue(undefined),
+    onAfterApply: vi.fn().mockResolvedValue(undefined),
+    onUnlinkTask: vi.fn().mockResolvedValue(undefined),
+  };
+}
+
+describe('AutoLinkSuggestions', () => {
+  it('renders the empty state when no tasks are linked', () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    render(<AutoLinkSuggestions {...defaultProps()} />);
+    expect(screen.getByRole('button', { name: /Suggest with AI/i })).toBeInTheDocument();
+    expect(screen.getByText(/No tasks or controls linked yet/i)).toBeInTheDocument();
+  });
+
+  it('renders the linked state with Re-assess affordance when tasks exist', () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    render(<AutoLinkSuggestions {...defaultProps()} tasks={[linkedTask]} />);
+    expect(screen.getByText('Existing task')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /Re-assess/i })).toBeInTheDocument();
+  });
+
+  it('calls onSuggest when "Suggest with AI" is clicked', async () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+    await waitFor(() => {
+      expect(props.onSuggest).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it('transitions to suggestions when the run completes with output', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [
+              { id: 'tsk_a', title: 'Suggested A', status: 'todo', score: 0.9 },
+              { id: 'tsk_b', title: 'Suggested B', status: 'todo', score: 0.7 },
+            ],
+            controls: [],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+
+    await waitFor(() => {
+      expect(screen.getByText(/AI found/i)).toBeInTheDocument();
+    });
+    expect(screen.getByText('Suggested A')).toBeInTheDocument();
+    expect(screen.getByText('Suggested B')).toBeInTheDocument();
+    // Both default-checked → Link 2.
+    expect(screen.getByRole('button', { name: /^Link 2$/i })).toBeInTheDocument();
+  });
+
+  it('updates the Link N count when a task is unchecked', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [
+              { id: 'tsk_a', title: 'Suggested A', status: 'todo', score: 0.9 },
+              { id: 'tsk_b', title: 'Suggested B', status: 'todo', score: 0.7 },
+            ],
+            controls: [],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: /^Link 2$/i })).toBeInTheDocument();
+    });
+
+    // Click the row for "Suggested A" — the row itself is the toggle.
+    fireEvent.click(screen.getByRole('button', { name: /Uncheck task Suggested A/i }));
+    expect(screen.getByRole('button', { name: /^Link 1$/i })).toBeInTheDocument();
+  });
+
+  it('calls onApply with selected ids and replace=false in fresh mode', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [
+              { id: 'tsk_a', title: 'Suggested A', status: 'todo', score: 0.9 },
+            ],
+            controls: [],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: /^Link 1$/i })).toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /^Link 1$/i }));
+    await waitFor(() => {
+      expect(props.onApply).toHaveBeenCalledWith({ taskIds: ['tsk_a'], replace: false });
+    });
+  });
+
+  it('calls onApply with replace=true when launched from the Re-assess button', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [{ id: 'tsk_a', title: 'A', status: 'todo', score: 0.9 }],
+            controls: [],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} tasks={[linkedTask]} />);
+
+    fireEvent.click(screen.getByRole('button', { name: /Re-assess/i }));
+    await waitFor(() => {
+      expect(props.onSuggest).toHaveBeenCalled();
+    });
+    // After the realtime "completed" event, suggestions render with mode=reassess.
+    await waitFor(() => {
+      expect(screen.getByText(/AI found/i)).toBeInTheDocument();
+    });
+
+    // 1 AI-suggested + 1 currently-linked (merged) → 2 checked.
+    fireEvent.click(screen.getByRole('button', { name: /^Link 2$/i }));
+    await waitFor(() => {
+      expect(props.onApply).toHaveBeenCalledWith({
+        taskIds: expect.arrayContaining(['tsk_a', 'tsk_existing']),
+        replace: true,
+      });
+    });
+  });
+
+  it('renders read-only controls section with derived dimming', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [{ id: 'tsk_a', title: 'A', status: 'todo', score: 0.9 }],
+            controls: [
+              {
+                id: 'ctl_1',
+                code: 'CC1.1',
+                name: 'Awareness',
+                framework: 'SOC 2',
+                score: 0.9,
+                viaTaskIds: ['tsk_a'],
+              },
+            ],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+
+    await waitFor(() => {
+      expect(
+        screen.getByText(/These controls will be linked through the selected tasks/i),
+      ).toBeInTheDocument();
+    });
+    expect(screen.getByText(/CC1.1 · Awareness/i)).toBeInTheDocument();
+  });
+
+  it('returns to the prior state when Discard is clicked', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        output: {
+          suggestions: {
+            tasks: [{ id: 'tsk_a', title: 'A', status: 'todo', score: 0.9 }],
+            controls: [],
+          },
+        },
+      },
+    });
+    const props = defaultProps();
+    render(<AutoLinkSuggestions {...props} />);
+    fireEvent.click(screen.getByRole('button', { name: /Suggest with AI/i }));
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: /^Link 1$/i })).toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /^Discard$/i }));
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: /Suggest with AI/i })).toBeInTheDocument();
+    });
+  });
+});
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.tsx b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.tsx
new file mode 100644
index 0000000000..30fd232d8d
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.tsx
@@ -0,0 +1,295 @@
+'use client';
+
+import { MagicWandFilled } from '@trycompai/design-system/icons';
+import { useEffect, useState } from 'react';
+import { toast } from 'sonner';
+import { LinkedWork } from './LinkedWork';
+import {
+  EmptyState,
+  FailedState,
+  LoadingState,
+  SuggestionsState,
+} from './AutoLinkSuggestions.parts';
+import type {
+  LinkedTask,
+  Mode,
+  State,
+  SuggestedControl,
+  SuggestedTask,
+} from './AutoLinkSuggestions.types';
+
+export type {
+  SuggestedTask,
+  SuggestedControl,
+  LinkedTask,
+} from './AutoLinkSuggestions.types';
+
+export interface AutoLinkSuggestionsProps {
+  orgId: string;
+  /** Existing linked tasks (rendered in `linked` state via <LinkedWork>). */
+  tasks: LinkedTask[];
+  canUpdate: boolean;
+  /** Triggers the AI scan; returns a runId + token for realtime subscription. */
+  onSuggest: () => Promise<{ runId: string; publicAccessToken: string }>;
+  /** Persists the user-confirmed selection. `replace` is true for re-assess. */
+  onApply: (params: { taskIds: string[]; replace: boolean }) => Promise<void>;
+  /** Called after apply succeeds — typically the parent's onRegenerate. */
+  onAfterApply?: () => Promise<void>;
+  /** Per-task unlink, plumbed through to <LinkedWork> in linked state. */
+  onUnlinkTask?: (taskId: string) => Promise<void>;
+  /**
+   * `'kickoff'` — wide panel for the truly-fresh case.
+   * `'kickoff-with-plan'` — wide panel with copy adapted to "AI will only
+   *   suggest tasks/controls; your plan stays".
+   * `'default'` — small per-column CTA (currently unused).
+   */
+  emptyVariant?: 'default' | 'kickoff' | 'kickoff-with-plan';
+  /** Called when the user clicks "Start from scratch" in the kickoff panel.
+   *  Parent should dismiss the kickoff state so the editor renders. */
+  onStartFromScratch?: () => void;
+  /**
+   * Resumes an in-flight or completed-but-unreviewed AI scan after a page
+   * reload. Parent fetches `GET /auto-link/active`. When this returns a run,
+   * the component jumps straight into the loading state and re-subscribes to
+   * the trigger.dev run via `useRealtimeRun`.
+   */
+  onResume?: () => Promise<{ runId: string; publicAccessToken: string } | null>;
+  /**
+   * Clears the persisted runId server-side. Called when the user clicks
+   * Discard so the next reload doesn't re-resume a discarded run.
+   */
+  onDiscardRun?: () => Promise<void>;
+}
+
+export function AutoLinkSuggestions({
+  orgId,
+  tasks,
+  canUpdate,
+  onSuggest,
+  onApply,
+  onAfterApply,
+  onUnlinkTask,
+  emptyVariant = 'default',
+  onStartFromScratch,
+  onResume,
+  onDiscardRun,
+}: AutoLinkSuggestionsProps) {
+  const [state, setState] = useState<State>(() =>
+    tasks.length > 0 ? { kind: 'linked' } : { kind: 'empty' },
+  );
+  const [submitting, setSubmitting] = useState(false);
+  const [applying, setApplying] = useState(false);
+
+  // Keep linked/empty state in sync with parent task list. Don't override
+  // mid-flow loading/suggestions/failed states.
+  useEffect(() => {
+    setState((prev) => {
+      if (prev.kind === 'linked' || prev.kind === 'empty') {
+        return tasks.length > 0 ? { kind: 'linked' } : { kind: 'empty' };
+      }
+      return prev;
+    });
+  }, [tasks.length]);
+
+  // On mount, if a run is already in flight (or completed-but-unreviewed) on
+  // the server, jump straight to the loading state and re-subscribe. Mode is
+  // unknown after a reload; default 'fresh' so apply stays additive (no
+  // accidental destructive replace on user side).
+  //
+  // Guard against overwriting a newer transition: the user might click
+  // "Suggest" before /active resolves, in which case `state` will already
+  // be `loading` (with their own runId) and we must NOT clobber it with
+  // the server-side resume payload. Same goes for `review` / `confirming`
+  // — only apply the resume when we're still in the initial render state.
+  // (Cubic finding #33 on PR #2671.)
+  useEffect(() => {
+    if (!onResume) return;
+    let cancelled = false;
+    void onResume().then((active) => {
+      if (cancelled || !active) return;
+      setState((prev) => {
+        if (prev.kind !== 'empty' && prev.kind !== 'linked') return prev;
+        return {
+          kind: 'loading',
+          runId: active.runId,
+          publicAccessToken: active.publicAccessToken,
+          mode: 'fresh',
+        };
+      });
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [onResume]);
+
+  const handleSuggest = async (mode: Mode) => {
+    setSubmitting(true);
+    try {
+      const { runId, publicAccessToken } = await onSuggest();
+      setState({ kind: 'loading', runId, publicAccessToken, mode });
+    } catch {
+      toast.error('Suggest failed. Try again.');
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  const handleSuggestionsReady = (suggestions: {
+    tasks: SuggestedTask[];
+    controls: SuggestedControl[];
+  }) => {
+    setState((prev) => {
+      const mode: Mode = prev.kind === 'loading' ? prev.mode : 'fresh';
+      const checked = new Set<string>(suggestions.tasks.map((t) => t.id));
+      const merged: SuggestedTask[] = [...suggestions.tasks];
+      if (mode === 'reassess') {
+        for (const t of tasks) checked.add(t.id);
+        const seen = new Set(suggestions.tasks.map((t) => t.id));
+        for (const t of tasks) {
+          if (seen.has(t.id)) continue;
+          merged.push({ id: t.id, title: t.title, status: t.status, score: 0 });
+        }
+      }
+      return {
+        kind: 'suggestions',
+        mode,
+        tasks: merged,
+        controls: suggestions.controls,
+        checkedTaskIds: checked,
+      };
+    });
+  };
+
+  const handleSuggestionsFailed = (reason: string) => {
+    setState((prev) => ({
+      kind: 'failed',
+      reason,
+      mode: prev.kind === 'loading' ? prev.mode : 'fresh',
+    }));
+  };
+
+  const handleToggleTask = (id: string) => {
+    setState((prev) => {
+      if (prev.kind !== 'suggestions') return prev;
+      const next = new Set(prev.checkedTaskIds);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return { ...prev, checkedTaskIds: next };
+    });
+  };
+
+  const handleDiscard = () => {
+    if (onDiscardRun) {
+      void onDiscardRun();
+    }
+    setState(tasks.length > 0 ? { kind: 'linked' } : { kind: 'empty' });
+  };
+
+  const handleApply = async () => {
+    if (state.kind !== 'suggestions') return;
+    setApplying(true);
+    try {
+      const taskIds = [...state.checkedTaskIds];
+      const isReassess = state.mode === 'reassess';
+      await onApply({ taskIds, replace: isReassess });
+      if (onAfterApply) {
+        try {
+          await onAfterApply();
+        } catch {
+          /* parent surfaces its own errors */
+        }
+      }
+      toast.success(`Linked ${taskIds.length} task${taskIds.length === 1 ? '' : 's'}`);
+      // Reassess (replace=true) wipes the existing set, so the post-apply
+      // state is exactly taskIds. Additive (replace=false) keeps existing
+      // linked tasks, so we should land in `linked` if EITHER the existing
+      // set has any rows OR we just added any. Without this, applying 0
+      // new tasks in additive mode wrongly swaps the linked-state UI back
+      // to the kickoff "empty" state. (Cubic finding on PR #2671.)
+      const willHaveLinked = isReassess
+        ? taskIds.length > 0
+        : tasks.length > 0 || taskIds.length > 0;
+      setState(willHaveLinked ? { kind: 'linked' } : { kind: 'empty' });
+    } catch {
+      toast.error('Failed to apply suggestions.');
+    } finally {
+      setApplying(false);
+    }
+  };
+
+  const handleRerun = () => {
+    if (state.kind !== 'suggestions') return;
+    void handleSuggest(state.mode);
+  };
+
+  if (state.kind === 'empty') {
+    return (
+      <EmptyState
+        canUpdate={canUpdate}
+        submitting={submitting}
+        onSuggest={() => void handleSuggest('fresh')}
+        onStartFromScratch={onStartFromScratch}
+        variant={emptyVariant}
+      />
+    );
+  }
+
+  if (state.kind === 'loading') {
+    return (
+      <LoadingState
+        runId={state.runId}
+        accessToken={state.publicAccessToken}
+        onReady={handleSuggestionsReady}
+        onFailed={handleSuggestionsFailed}
+      />
+    );
+  }
+
+  if (state.kind === 'suggestions') {
+    return (
+      <SuggestionsState
+        tasks={state.tasks}
+        controls={state.controls}
+        checkedTaskIds={state.checkedTaskIds}
+        applying={applying}
+        submitting={submitting}
+        onToggle={handleToggleTask}
+        onDiscard={handleDiscard}
+        onApply={() => void handleApply()}
+        onRerun={handleRerun}
+      />
+    );
+  }
+
+  if (state.kind === 'failed') {
+    return (
+      <FailedState
+        reason={state.reason}
+        retrying={submitting}
+        onRetry={() => void handleSuggest(state.mode)}
+        onDiscard={handleDiscard}
+      />
+    );
+  }
+
+  // linked
+  return (
+    <div>
+      {canUpdate && (
+        <div className="mt-2 flex justify-end">
+          <button
+            type="button"
+            onClick={() => void handleSuggest('reassess')}
+            disabled={submitting}
+            title="Re-assess all linked tasks and controls with AI"
+            className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[11px] text-muted-foreground transition-colors hover:bg-primary/[0.08] hover:text-primary disabled:cursor-not-allowed disabled:opacity-50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50"
+          >
+            <MagicWandFilled size={11} aria-hidden="true" />
+            <span>Re-assess</span>
+          </button>
+        </div>
+      )}
+      <LinkedWork orgId={orgId} tasks={tasks} onUnlinkTask={onUnlinkTask} />
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.types.ts b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.types.ts
new file mode 100644
index 0000000000..d67c10c825
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/AutoLinkSuggestions.types.ts
@@ -0,0 +1,46 @@
+import type { TaskStatus } from '@db';
+
+export interface SuggestedTask {
+  id: string;
+  title: string;
+  status: string;
+  score: number;
+}
+
+export interface SuggestedControl {
+  id: string;
+  code: string;
+  name: string;
+  framework: string;
+  score: number;
+  viaTaskIds: string[];
+}
+
+export interface LinkedTask {
+  id: string;
+  title: string;
+  status: TaskStatus;
+  controls: { id: string; name: string }[];
+}
+
+export type Mode = 'fresh' | 'reassess';
+
+export type State =
+  | { kind: 'linked' }
+  | { kind: 'empty' }
+  | { kind: 'loading'; runId: string; publicAccessToken: string; mode: Mode }
+  | {
+      kind: 'suggestions';
+      mode: Mode;
+      tasks: SuggestedTask[];
+      controls: SuggestedControl[];
+      checkedTaskIds: Set<string>;
+    }
+  | { kind: 'failed'; reason: string; mode: Mode };
+
+export function isControlDerived(
+  c: SuggestedControl,
+  checkedTaskIds: Set<string>,
+): boolean {
+  return c.viaTaskIds.some((id) => checkedTaskIds.has(id));
+}
diff --git a/apps/app/src/components/risks/treatment-plan/DescriptionEditor.tsx b/apps/app/src/components/risks/treatment-plan/DescriptionEditor.tsx
new file mode 100644
index 0000000000..becb4fd583
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/DescriptionEditor.tsx
@@ -0,0 +1,406 @@
+'use client';
+
+import { Button } from '@trycompai/design-system';
+import { Edit, Renew } from '@trycompai/design-system/icons';
+import { useRealtimeRun } from '@trigger.dev/react-hooks';
+import { useEffect, useLayoutEffect, useRef, useState } from 'react';
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+import { cn } from '@/lib/utils';
+
+interface DescriptionEditorProps {
+  value: string;
+  onSave: (next: string) => Promise<void>;
+  onRegenerate: () => Promise<void>;
+  regenerating: boolean;
+  disabled?: boolean;
+  /**
+   * The trigger.dev run handle for an in-flight regeneration. When set, the
+   * editor subscribes via `useRealtimeRun`, renders status-specific progress
+   * copy, and notifies the parent via `onRegenSettled` when the run reaches
+   * a terminal state. Null/undefined while no regen is active.
+   */
+  regenRun?: { runId: string; publicAccessToken: string } | null;
+  /** Called once the regeneration run terminates (success or failure). */
+  onRegenSettled?: (result: { success: boolean; reason?: string }) => void;
+}
+
+const TERMINAL_FAILURE_STATUSES = new Set([
+  'FAILED',
+  'CANCELED',
+  'CRASHED',
+  'SYSTEM_FAILURE',
+  'EXPIRED',
+  'TIMED_OUT',
+]);
+
+/**
+ * Cap (in px) for both the markdown preview and the auto-growing textarea.
+ * Past this height, the body scrolls internally so the Treatment plan column
+ * stays roughly aligned with the Strategy and Linked Work columns instead
+ * of pushing the whole row downward when AI emits a long plan.
+ */
+const TEXTAREA_MAX_PX = 480;
+
+function regenStatusCopy(status: string | undefined): { headline: string; sub: string } {
+  if (!status || status === 'WAITING_FOR_DEPLOY') {
+    return {
+      headline: 'Starting AI scan…',
+      sub: 'Allocating compute capacity.',
+    };
+  }
+  if (status === 'QUEUED' || status === 'DELAYED') {
+    return {
+      headline: 'Queued — waiting to start…',
+      sub: 'Your regeneration will begin in a moment.',
+    };
+  }
+  if (status === 'INTERRUPTED' || status === 'WAITING_TO_RESUME') {
+    return {
+      headline: 'Resuming…',
+      sub: 'Picking up where the run left off.',
+    };
+  }
+  return {
+    headline: 'AI is drafting your treatment plan…',
+    sub: 'Reading linked controls and tasks, then writing each citation.',
+  };
+}
+
+function countWords(text: string): number {
+  const trimmed = text.trim();
+  if (trimmed === '') return 0;
+  return trimmed.split(/\s+/).length;
+}
+
+export function DescriptionEditor({
+  value,
+  onSave,
+  onRegenerate,
+  regenerating,
+  disabled,
+  regenRun,
+  onRegenSettled,
+}: DescriptionEditorProps) {
+  const [draft, setDraft] = useState(value);
+  const [saving, setSaving] = useState(false);
+  // Mode: 'preview' renders markdown, 'edit' shows the auto-growing textarea.
+  // We default to 'edit' when the value is empty (nothing to preview yet) and
+  // stay in 'edit' when an AI regeneration completes with new content so the
+  // user immediately sees what was drafted.
+  const [mode, setMode] = useState<'preview' | 'edit'>(
+    value.trim().length > 0 ? 'preview' : 'edit',
+  );
+  const textareaRef = useRef<HTMLTextAreaElement | null>(null);
+
+  // Resync the draft from upstream `value` ONLY when the user isn't
+  // actively editing. Without the `mode === 'edit'` guard, a background
+  // SWR revalidation, AI regeneration, or any other prop change would
+  // wipe whatever the user was typing. (Cubic finding on PR #2671.)
+  useEffect(() => {
+    if (saving) return;
+    if (mode === 'edit') return;
+    setDraft(value);
+  }, [value, saving, mode]);
+
+  // When a fresh value arrives from upstream (regenerate, server update) and
+  // we're not actively editing, drop back to preview.
+  useEffect(() => {
+    if (mode === 'edit' || saving) return;
+    if (value.trim().length === 0) setMode('edit');
+  }, [value, mode, saving]);
+
+  // Regenerate-with-AI bypasses the in-edit guard above. When a regen run
+  // terminates (`regenRun` flips from set → null), the user explicitly
+  // asked to overwrite whatever they had — keeping the stale draft and
+  // requiring a refresh to see the new prose was confusing.
+  //
+  // The new prose may already be in `value` at the moment regenRun
+  // clears (sync write before the parent flips the run handle), or it
+  // may arrive in a later render after SWR refetches. Both paths are
+  // handled:
+  //
+  // 1. Sync arrival: when regenRun flips set→null, immediately apply
+  //    the current value and force preview.
+  // 2. Async arrival: capture the value-at-clear-time. The next render
+  //    where `value` differs from the captured snapshot is the AI prose
+  //    landing — apply it, force preview, and clear the latch.
+  //
+  // Without (2), a regen that completes BEFORE the SWR refetch would
+  // sync-apply the OLD value, and the new prose arriving moments later
+  // would be ignored because the in-edit guard skips resync while
+  // mode === 'edit'.
+  const prevRegenRunRef = useRef(regenRun);
+  const valueAtRegenClearRef = useRef<string | null>(null);
+  useEffect(() => {
+    const wasRunning = prevRegenRunRef.current != null;
+    const isRunning = regenRun != null;
+    prevRegenRunRef.current = regenRun;
+    if (wasRunning && !isRunning) {
+      // Path 1: sync arrival — value has already updated.
+      valueAtRegenClearRef.current = value;
+      setDraft(value);
+      if (value.trim().length > 0) setMode('preview');
+    }
+  }, [regenRun, value]);
+
+  useEffect(() => {
+    const captured = valueAtRegenClearRef.current;
+    if (captured === null) return;
+    if (value === captured) return;
+    // Path 2: async arrival — value just changed since regen cleared,
+    // so this is the AI prose landing. Overwrite even if user is in
+    // edit mode (they explicitly opted into the overwrite by clicking
+    // Regenerate).
+    valueAtRegenClearRef.current = null;
+    setDraft(value);
+    if (value.trim().length > 0) setMode('preview');
+  }, [value]);
+
+  // Auto-grow the textarea to fit content, but cap at TEXTAREA_MAX_PX so a
+  // long draft doesn't stretch the Treatment plan column past the Strategy
+  // / Linked Work columns. Internal scroll kicks in past the cap.
+  useLayoutEffect(() => {
+    if (mode !== 'edit') return;
+    const el = textareaRef.current;
+    if (!el) return;
+    el.style.height = 'auto';
+    const next = Math.max(Math.min(el.scrollHeight, TEXTAREA_MAX_PX), 200);
+    el.style.height = `${next}px`;
+    el.style.overflowY = el.scrollHeight > TEXTAREA_MAX_PX ? 'auto' : 'hidden';
+  }, [draft, mode]);
+
+  const isDirty = draft.trim() !== (value ?? '').trim();
+  const wordCount = countWords(draft);
+  const charCount = draft.length;
+  const hasValue = value.trim().length > 0;
+
+  const handleSave = async () => {
+    if (!isDirty) {
+      setMode('preview');
+      return;
+    }
+    setSaving(true);
+    try {
+      await onSave(draft.trim());
+      setMode('preview');
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  const handleCancelEdit = () => {
+    setDraft(value);
+    setMode('preview');
+  };
+
+  return (
+    <div className="flex flex-col">
+      {mode === 'preview' && hasValue ? (
+        <div
+          className="mt-4 overflow-y-auto border-t border-border pt-4"
+          style={{ maxHeight: TEXTAREA_MAX_PX }}
+        >
+          <MarkdownPreview content={value} />
+        </div>
+      ) : (
+        <textarea
+          ref={textareaRef}
+          value={draft}
+          onChange={(e) => setDraft(e.target.value)}
+          disabled={disabled || saving}
+          placeholder="Describe how this risk is being treated — concrete controls, owners, timelines. Markdown supported."
+          className="mt-4 block w-full overflow-hidden border-0 border-t border-border bg-transparent py-3.5 text-sm leading-[1.55] text-foreground outline-none disabled:opacity-60"
+          style={{ resize: 'none', minHeight: 200 }}
+        />
+      )}
+      <div className={cn('flex items-center gap-2 border-t border-border pt-2.5', !hasValue && mode === 'preview' && 'mt-4')}>
+        <span className="font-mono text-[11px] tabular-nums text-muted-foreground">
+          {wordCount} {wordCount === 1 ? 'word' : 'words'} · {charCount}{' '}
+          {charCount === 1 ? 'char' : 'chars'}
+        </span>
+        <span className="flex-1" />
+        <Button
+          variant="ghost"
+          size="sm"
+          onClick={onRegenerate}
+          disabled={disabled || regenerating}
+          loading={regenerating}
+          iconLeft={<Renew aria-hidden="true" />}
+        >
+          {hasValue ? 'Regenerate with AI' : 'Generate treatment plan'}
+        </Button>
+        {mode === 'preview' ? (
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => setMode('edit')}
+            disabled={disabled}
+            iconLeft={<Edit aria-hidden="true" />}
+          >
+            Edit
+          </Button>
+        ) : (
+          <>
+            {hasValue && (
+              <Button
+                variant="ghost"
+                size="sm"
+                onClick={handleCancelEdit}
+                disabled={disabled || saving}
+              >
+                Cancel
+              </Button>
+            )}
+            <Button
+              size="sm"
+              onClick={handleSave}
+              disabled={disabled || (!isDirty && !hasValue) || saving}
+              loading={saving}
+            >
+              Save
+            </Button>
+          </>
+        )}
+      </div>
+      {(regenerating || regenRun) && (
+        <RegenProgress
+          regenRun={regenRun ?? null}
+          onSettled={onRegenSettled}
+          /* While `regenerating` is true but no run handle yet, the POST
+             that triggers the task is in flight — show a generic starter
+             until the runId arrives. */
+          fallbackHeadline="Starting AI scan…"
+        />
+      )}
+    </div>
+  );
+}
+
+function RegenProgress({
+  regenRun,
+  onSettled,
+  fallbackHeadline,
+}: {
+  regenRun: { runId: string; publicAccessToken: string } | null;
+  onSettled?: (result: { success: boolean; reason?: string }) => void;
+  fallbackHeadline: string;
+}) {
+  const { run } = useRealtimeRun(regenRun?.runId ?? '', {
+    accessToken: regenRun?.publicAccessToken ?? '',
+    enabled: !!regenRun,
+  });
+  const status = run?.status;
+
+  useEffect(() => {
+    if (!status) return;
+    if (status === 'COMPLETED') {
+      onSettled?.({ success: true });
+      return;
+    }
+    if (TERMINAL_FAILURE_STATUSES.has(status)) {
+      const reasons: Record<string, string> = {
+        FAILED: 'The AI run hit an error.',
+        CANCELED: 'The AI run was canceled.',
+        CRASHED: 'The worker crashed mid-run.',
+        SYSTEM_FAILURE: 'A system error stopped the run.',
+        EXPIRED: 'The run expired before it could start.',
+        TIMED_OUT: 'The run took too long and timed out.',
+      };
+      onSettled?.({ success: false, reason: reasons[status] ?? 'The AI run failed.' });
+    }
+  }, [status]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const { headline, sub } = regenRun
+    ? regenStatusCopy(status)
+    : { headline: fallbackHeadline, sub: 'This may take up to a minute.' };
+
+  return (
+    <div
+      className="mt-3 flex items-start gap-2 rounded-md border border-border bg-primary/[0.04] px-3 py-2.5"
+      role="status"
+      aria-live="polite"
+    >
+      <span
+        className="mt-0.5 inline-block h-3.5 w-3.5 shrink-0 animate-spin rounded-full border-2 border-border border-t-primary"
+        aria-hidden="true"
+      />
+      <div className="min-w-0">
+        <div className="text-[13px] text-foreground">{headline}</div>
+        <div className="mt-0.5 text-[11px] leading-[1.5] text-muted-foreground">{sub}</div>
+        <div className="mt-1 text-[11px] leading-[1.5] text-muted-foreground">
+          You can keep editing; your edits will win if they save before the AI finishes.
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Lightweight markdown preview tuned for treatment-plan prose. Headings,
+ * bullets, ordered lists, links, bold/italic, code spans. No raw HTML or
+ * complex blocks — the AI prompts already shape output to this.
+ */
+function MarkdownPreview({ content }: { content: string }) {
+  return (
+    <div className="prose-sm max-w-none text-sm leading-[1.65] text-foreground">
+      <ReactMarkdown
+        remarkPlugins={[remarkGfm]}
+        components={{
+          p: ({ children }) => (
+            <p className="my-2 first:mt-0 last:mb-0">{children}</p>
+          ),
+          ul: ({ children }) => (
+            <ul className="my-2 list-disc space-y-1 pl-5">{children}</ul>
+          ),
+          ol: ({ children }) => (
+            <ol className="my-2 list-decimal space-y-1 pl-5">{children}</ol>
+          ),
+          li: ({ children }) => <li className="pl-0.5">{children}</li>,
+          h1: ({ children }) => (
+            <h3 className="mt-4 mb-2 text-base font-semibold first:mt-0">
+              {children}
+            </h3>
+          ),
+          h2: ({ children }) => (
+            <h4 className="mt-3 mb-1.5 text-sm font-semibold first:mt-0">
+              {children}
+            </h4>
+          ),
+          h3: ({ children }) => (
+            <h5 className="mt-3 mb-1 text-sm font-semibold first:mt-0">
+              {children}
+            </h5>
+          ),
+          strong: ({ children }) => (
+            <strong className="font-semibold text-foreground">{children}</strong>
+          ),
+          em: ({ children }) => <em className="italic">{children}</em>,
+          a: ({ children, href }) => (
+            <a
+              href={href}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="text-primary underline-offset-2 hover:underline"
+            >
+              {children}
+            </a>
+          ),
+          code: ({ children }) => (
+            <code className="rounded bg-muted px-1 py-0.5 font-mono text-[0.85em]">
+              {children}
+            </code>
+          ),
+          blockquote: ({ children }) => (
+            <blockquote className="my-2 border-l-2 border-border pl-3 text-muted-foreground">
+              {children}
+            </blockquote>
+          ),
+          hr: () => <hr className="my-3 border-border" />,
+        }}
+      >
+        {content}
+      </ReactMarkdown>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/LinkedWork.spec.tsx b/apps/app/src/components/risks/treatment-plan/LinkedWork.spec.tsx
new file mode 100644
index 0000000000..cc0c27cd9e
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/LinkedWork.spec.tsx
@@ -0,0 +1,50 @@
+import { TaskStatus } from '@db';
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import { LinkedWork } from './LinkedWork';
+
+const tasks = [
+  { id: 'tsk_a', title: 'Awareness training', status: TaskStatus.done, controls: [] },
+  { id: 'tsk_b', title: 'Phishing simulation', status: TaskStatus.todo, controls: [] },
+];
+
+describe('LinkedWork', () => {
+  it('renders task titles as links that open in a new tab', () => {
+    render(<LinkedWork orgId="org_1" tasks={tasks} />);
+    const a = screen.getByRole('link', { name: /Awareness training/i });
+    expect(a).toHaveAttribute('href', '/org_1/tasks/tsk_a');
+    expect(a).toHaveAttribute('target', '_blank');
+    const b = screen.getByRole('link', { name: /Phishing simulation/i });
+    expect(b).toHaveAttribute('target', '_blank');
+  });
+
+  it('marks incomplete tasks visually distinct from done tasks', () => {
+    render(<LinkedWork orgId="org_1" tasks={tasks} />);
+    // Done task gets line-through styling on its title.
+    const done = screen.getByRole('link', { name: /Awareness training/i });
+    expect(done.className).toMatch(/line-through/);
+    const incomplete = screen.getByRole('link', { name: /Phishing simulation/i });
+    expect(incomplete.className).not.toMatch(/line-through/);
+  });
+
+  it('derives controls completeness from parent tasks', () => {
+    const linkedTasks = [
+      {
+        id: 'tsk_a',
+        title: 'A',
+        status: TaskStatus.done,
+        controls: [{ id: 'c1', name: 'Awareness Training' }],
+      },
+      {
+        id: 'tsk_b',
+        title: 'B',
+        status: TaskStatus.todo,
+        controls: [{ id: 'c1', name: 'Awareness Training' }],
+      },
+    ];
+    render(<LinkedWork orgId="org_1" tasks={linkedTasks} />);
+    // Control c1 has one done + one todo parent → not complete.
+    const control = screen.getByRole('link', { name: /Awareness Training/i });
+    expect(control.className).not.toMatch(/line-through/);
+  });
+});
diff --git a/apps/app/src/components/risks/treatment-plan/LinkedWork.tsx b/apps/app/src/components/risks/treatment-plan/LinkedWork.tsx
new file mode 100644
index 0000000000..21f5b60281
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/LinkedWork.tsx
@@ -0,0 +1,295 @@
+'use client';
+
+import { cn } from '@/lib/utils';
+import { TaskStatus } from '@db';
+import {
+  Checkmark,
+  ChevronLeft,
+  ChevronRight,
+  Close,
+  TrashCan,
+} from '@trycompai/design-system/icons';
+import Link from 'next/link';
+import { useEffect, useState } from 'react';
+
+// Show 4 items per page in each list (Tasks + Controls). Long lists used
+// to stretch the column past the Strategy / Treatment-plan columns and
+// force the page to scroll just to see the bottom controls.
+const PAGE_SIZE = 4;
+
+interface LinkedTask {
+  id: string;
+  title: string;
+  status: TaskStatus;
+  controls: { id: string; name: string }[];
+}
+
+interface LinkedWorkProps {
+  orgId: string;
+  tasks: LinkedTask[];
+  /**
+   * Per-task unlink. When provided, a trash-can icon button appears on
+   * hover next to each task title. When omitted (e.g. read-only views),
+   * no unlink affordance is rendered.
+   */
+  onUnlinkTask?: (taskId: string) => Promise<void>;
+}
+
+function isTaskDone(status: TaskStatus): boolean {
+  return status === TaskStatus.done || status === TaskStatus.not_relevant;
+}
+
+interface DerivedControl {
+  id: string;
+  name: string;
+  /** True only when every linked task that brings in this control is done. */
+  isComplete: boolean;
+}
+
+function deriveControls(tasks: LinkedTask[]): DerivedControl[] {
+  const map = new Map<string, { name: string; parentDone: boolean[] }>();
+  for (const t of tasks) {
+    for (const c of t.controls) {
+      const entry = map.get(c.id) ?? { name: c.name, parentDone: [] };
+      entry.parentDone.push(isTaskDone(t.status));
+      map.set(c.id, entry);
+    }
+  }
+  return [...map.entries()].map(([id, { name, parentDone }]) => ({
+    id,
+    name,
+    isComplete: parentDone.length > 0 && parentDone.every(Boolean),
+  }));
+}
+
+function Pagination({
+  page,
+  pageCount,
+  onPageChange,
+  total,
+}: {
+  page: number;
+  pageCount: number;
+  onPageChange: (next: number) => void;
+  total: number;
+}) {
+  if (pageCount <= 1) return null;
+  const start = (page - 1) * PAGE_SIZE + 1;
+  const end = Math.min(page * PAGE_SIZE, total);
+  return (
+    <div className="mt-2 flex items-center justify-between gap-2 px-1 text-[11px] text-muted-foreground">
+      <span className="font-mono tabular-nums">
+        {start}–{end} of {total}
+      </span>
+      <div className="flex items-center gap-1">
+        <button
+          type="button"
+          onClick={() => onPageChange(Math.max(1, page - 1))}
+          disabled={page === 1}
+          className="inline-flex h-6 w-6 items-center justify-center rounded border border-border bg-transparent text-foreground transition-colors hover:bg-muted disabled:cursor-not-allowed disabled:opacity-40"
+          aria-label="Previous page"
+        >
+          <ChevronLeft size={12} aria-hidden="true" />
+        </button>
+        <span className="font-mono tabular-nums">
+          {page} / {pageCount}
+        </span>
+        <button
+          type="button"
+          onClick={() => onPageChange(Math.min(pageCount, page + 1))}
+          disabled={page === pageCount}
+          className="inline-flex h-6 w-6 items-center justify-center rounded border border-border bg-transparent text-foreground transition-colors hover:bg-muted disabled:cursor-not-allowed disabled:opacity-40"
+          aria-label="Next page"
+        >
+          <ChevronRight size={12} aria-hidden="true" />
+        </button>
+      </div>
+    </div>
+  );
+}
+
+function StatusIcon({ done }: { done: boolean }) {
+  if (done) {
+    return (
+      <Checkmark
+        size={11}
+        className="shrink-0 text-green-600 dark:text-green-400"
+        aria-hidden="true"
+      />
+    );
+  }
+  return (
+    <Close
+      size={11}
+      className="shrink-0 text-red-600 dark:text-red-400"
+      aria-hidden="true"
+    />
+  );
+}
+
+export function LinkedWork({ orgId, tasks, onUnlinkTask }: LinkedWorkProps) {
+  const total = tasks.length;
+  const done = tasks.filter((t) => isTaskDone(t.status)).length;
+  const taskPct = total === 0 ? 0 : Math.round((done / total) * 100);
+  const controls = deriveControls(tasks);
+  const controlsDone = controls.filter((c) => c.isComplete).length;
+  const [unlinking, setUnlinking] = useState<string | null>(null);
+  const handleUnlink = async (taskId: string) => {
+    if (!onUnlinkTask) return;
+    setUnlinking(taskId);
+    try {
+      await onUnlinkTask(taskId);
+    } finally {
+      setUnlinking((current) => (current === taskId ? null : current));
+    }
+  };
+
+  // Per-list pagination (Tasks + Controls). Reset to page 1 when the
+  // underlying list shrinks past the current page (e.g. after an unlink
+  // that drops the last task on the visible page).
+  const [taskPage, setTaskPage] = useState(1);
+  const [controlPage, setControlPage] = useState(1);
+  const taskPageCount = Math.max(1, Math.ceil(tasks.length / PAGE_SIZE));
+  const controlPageCount = Math.max(1, Math.ceil(controls.length / PAGE_SIZE));
+  useEffect(() => {
+    if (taskPage > taskPageCount) setTaskPage(taskPageCount);
+  }, [taskPage, taskPageCount]);
+  useEffect(() => {
+    if (controlPage > controlPageCount) setControlPage(controlPageCount);
+  }, [controlPage, controlPageCount]);
+  const visibleTasks = tasks.slice(
+    (taskPage - 1) * PAGE_SIZE,
+    (taskPage - 1) * PAGE_SIZE + PAGE_SIZE,
+  );
+  const visibleControls = controls.slice(
+    (controlPage - 1) * PAGE_SIZE,
+    (controlPage - 1) * PAGE_SIZE + PAGE_SIZE,
+  );
+
+  return (
+    <div className="mt-4 flex flex-col gap-4 border-t border-border pt-4">
+      {/* Tasks group */}
+      <div>
+        <div className="mb-2 flex items-center gap-2">
+          <span className="text-[13px] font-normal">Tasks</span>
+          <span className="flex-1" />
+          <span className="font-mono text-[11px] tabular-nums text-muted-foreground">
+            {done} / {total}
+          </span>
+        </div>
+        <div className="bg-muted mb-1.5 h-[3px] w-full overflow-hidden rounded-full">
+          <span
+            className="block h-full rounded-full"
+            style={{ width: `${taskPct}%`, background: 'var(--warning)' }}
+          />
+        </div>
+        {tasks.length === 0 ? (
+          <p className="text-[12px] text-muted-foreground">
+            No tasks linked. Link tasks from the Tasks tab to track mitigation progress.
+          </p>
+        ) : (
+          <>
+            <ul className="flex list-none flex-col pl-0">
+              {visibleTasks.map((t, i) => {
+                const taskDone = isTaskDone(t.status);
+                const isUnlinking = unlinking === t.id;
+                return (
+                  <li
+                    key={t.id}
+                    className={cn(
+                      'group flex items-center gap-2',
+                      i > 0 && 'border-t border-border',
+                    )}
+                  >
+                    <Link
+                      href={`/${orgId}/tasks/${t.id}`}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      className={cn(
+                        'flex flex-1 items-center gap-2 py-1.5 text-[12px] transition-colors hover:bg-muted',
+                        taskDone
+                          ? 'text-muted-foreground line-through decoration-muted-foreground'
+                          : 'text-foreground',
+                      )}
+                    >
+                      <StatusIcon done={taskDone} />
+                      <span className="min-w-0 flex-1 truncate">{t.title}</span>
+                    </Link>
+                    {onUnlinkTask && (
+                      <button
+                        type="button"
+                        onClick={() => void handleUnlink(t.id)}
+                        disabled={isUnlinking}
+                        title="Unlink task from this risk"
+                        aria-label={`Unlink ${t.title}`}
+                        className="rounded px-1.5 py-1 text-muted-foreground opacity-0 transition-opacity hover:text-destructive focus-visible:opacity-100 group-hover:opacity-100 disabled:cursor-not-allowed disabled:opacity-50"
+                      >
+                        <TrashCan size={12} aria-hidden="true" />
+                      </button>
+                    )}
+                  </li>
+                );
+              })}
+            </ul>
+            <Pagination
+              page={taskPage}
+              pageCount={taskPageCount}
+              onPageChange={setTaskPage}
+              total={tasks.length}
+            />
+          </>
+        )}
+      </div>
+
+      <div className="h-px bg-border" aria-hidden="true" />
+
+      {/* Controls group */}
+      <div>
+        <div className="mb-2 flex items-center gap-2">
+          <span className="text-[13px] font-normal">Controls</span>
+          <span className="flex-1" />
+          <span className="font-mono text-[11px] tabular-nums text-muted-foreground">
+            {controlsDone} / {controls.length}
+          </span>
+        </div>
+        {controls.length === 0 ? (
+          <p className="text-[12px] text-muted-foreground">
+            No controls linked (derived from tasks).
+          </p>
+        ) : (
+          <>
+            <ul className="flex list-none flex-col pl-0">
+              {visibleControls.map((c, i) => (
+                <li
+                  key={c.id}
+                  className={cn(i > 0 && 'border-t border-border')}
+                >
+                  <Link
+                    href={`/${orgId}/controls/${c.id}`}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className={cn(
+                      'flex items-center gap-2 py-1.5 text-[12px] transition-colors hover:bg-muted',
+                      c.isComplete
+                        ? 'text-muted-foreground line-through decoration-muted-foreground'
+                        : 'text-foreground',
+                    )}
+                  >
+                    <StatusIcon done={c.isComplete} />
+                    <span className="min-w-0 flex-1 truncate">{c.name}</span>
+                  </Link>
+                </li>
+              ))}
+            </ul>
+            <Pagination
+              page={controlPage}
+              pageCount={controlPageCount}
+              onPageChange={setControlPage}
+              total={controls.length}
+            />
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/NotAssessedState.tsx b/apps/app/src/components/risks/treatment-plan/NotAssessedState.tsx
new file mode 100644
index 0000000000..fbb700398f
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/NotAssessedState.tsx
@@ -0,0 +1,52 @@
+'use client';
+
+import { Button, Card, CardContent, Stack, Text } from '@trycompai/design-system';
+import { Information } from '@trycompai/design-system/icons';
+
+interface NotAssessedStateProps {
+  onAssess: () => Promise<void> | void;
+  disabled?: boolean;
+  /**
+   * Override the empty-state body. Default copy is intentionally neutral
+   * ("the entity's...") so the component is safe to reuse on both the
+   * vendor and risk surfaces. Callers should supply subject-specific
+   * copy when context allows it. (Cubic finding on PR #2671 — the prior
+   * default leaked vendor-only language onto the risk page if reused.)
+   */
+  description?: string;
+  /** Override the headline. Defaults to "No risk assessment yet". */
+  headline?: string;
+  /** Override the CTA label. Defaults to "Run risk assessment". */
+  ctaLabel?: string;
+}
+
+export function NotAssessedState({
+  onAssess,
+  disabled,
+  description = "Run the AI risk assessment to enable a suggested residual based on the entity's data handling, exposure, and compliance posture.",
+  headline = 'No risk assessment yet',
+  ctaLabel = 'Run risk assessment',
+}: NotAssessedStateProps) {
+  return (
+    <Card>
+      <CardContent>
+        <Stack gap="sm" align="center">
+          <Information size={20} aria-hidden="true" className="text-muted-foreground" />
+          <Text size="sm" weight="medium">
+            {headline}
+          </Text>
+          <div className="max-w-md text-center">
+            <Text size="xs" variant="muted">
+              {description}
+            </Text>
+          </div>
+          <div>
+            <Button size="sm" onClick={() => void onAssess()} disabled={disabled}>
+              {ctaLabel}
+            </Button>
+          </div>
+        </Stack>
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/RelinkButton.spec.tsx b/apps/app/src/components/risks/treatment-plan/RelinkButton.spec.tsx
new file mode 100644
index 0000000000..b4777b1397
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/RelinkButton.spec.tsx
@@ -0,0 +1,58 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { RelinkButton } from './RelinkButton';
+
+vi.mock('sonner', () => ({ toast: { info: vi.fn(), success: vi.fn(), error: vi.fn() } }));
+
+const realtimeRunMock = vi.fn();
+vi.mock('@trigger.dev/react-hooks', () => ({
+  useRealtimeRun: (runId: string, opts: { accessToken?: string; enabled?: boolean }) =>
+    realtimeRunMock(runId, opts),
+}));
+
+afterEach(() => {
+  realtimeRunMock.mockReset();
+});
+
+describe('RelinkButton', () => {
+  it('renders with the "Re-assess" label by default', () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    render(<RelinkButton onRelink={vi.fn()} />);
+    expect(
+      screen.getByRole('button', { name: /Re-assess/i }),
+    ).toBeInTheDocument();
+  });
+
+  it('opens a confirm dialog before triggering', async () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    const onRelink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    render(<RelinkButton onRelink={onRelink} />);
+    fireEvent.click(screen.getByRole('button', { name: /Re-assess/i }));
+    expect(await screen.findByText(/Re-assess linked tasks/i)).toBeInTheDocument();
+    expect(onRelink).not.toHaveBeenCalled();
+  });
+
+  it('triggers when the user confirms', async () => {
+    realtimeRunMock.mockReturnValue({ run: null });
+    const onRelink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    render(<RelinkButton onRelink={onRelink} />);
+    fireEvent.click(screen.getByRole('button', { name: /Re-assess/i }));
+    fireEvent.click(await screen.findByRole('button', { name: /Yes, re-assess/i }));
+    await waitFor(() => expect(onRelink).toHaveBeenCalled());
+  });
+
+  it('chains onAfterLink when re-link completes with links', async () => {
+    realtimeRunMock.mockReturnValue({
+      run: {
+        status: 'COMPLETED',
+        metadata: { phase: 'done', riskLinks: 2, vendorLinks: 0 },
+      },
+    });
+    const onRelink = vi.fn().mockResolvedValue({ runId: 'r1', publicAccessToken: 't1' });
+    const onAfterLink = vi.fn().mockResolvedValue(undefined);
+    render(<RelinkButton onRelink={onRelink} onAfterLink={onAfterLink} />);
+    fireEvent.click(screen.getByRole('button', { name: /Re-assess/i }));
+    fireEvent.click(await screen.findByRole('button', { name: /Yes, re-assess/i }));
+    await waitFor(() => expect(onAfterLink).toHaveBeenCalled());
+  });
+});
diff --git a/apps/app/src/components/risks/treatment-plan/RelinkButton.tsx b/apps/app/src/components/risks/treatment-plan/RelinkButton.tsx
new file mode 100644
index 0000000000..69354d0911
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/RelinkButton.tsx
@@ -0,0 +1,198 @@
+'use client';
+
+import type { linkRisksAndVendorsToWork } from '@/trigger/tasks/onboarding/link-risks-and-vendors-to-work';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+  AlertDialogTrigger,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { MagicWandFilled } from '@trycompai/design-system/icons';
+import { useRealtimeRun } from '@trigger.dev/react-hooks';
+import { useEffect, useState } from 'react';
+import { toast } from 'sonner';
+
+interface RelinkButtonProps {
+  disabled?: boolean;
+  /** Triggers the relink and returns realtime handle. */
+  onRelink: () => Promise<{ runId: string; publicAccessToken: string }>;
+  /** Called after the run completes with non-zero links — typically chains regen. */
+  onAfterLink?: () => Promise<void>;
+}
+
+type RunState =
+  | { kind: 'idle' }
+  | { kind: 'running'; runId: string; publicAccessToken: string };
+
+// Duplicated from AutoLinkButton (~50 lines) — small enough to keep inline.
+const PHASE_LABEL: Record<string, string> = {
+  starting: 'Starting…',
+  'embedding-tasks': 'Embedding tasks',
+  'embedding-risks': 'Embedding risks',
+  'embedding-vendors': 'Embedding vendors',
+  'waiting-for-index': 'Waiting for the index',
+  'matching-risks': 'Matching tasks to risks',
+  'matching-vendors': 'Matching tasks to vendors',
+  done: 'Finishing up…',
+};
+
+export function RelinkButton({ disabled, onRelink, onAfterLink }: RelinkButtonProps) {
+  const [state, setState] = useState<RunState>({ kind: 'idle' });
+  const [submitting, setSubmitting] = useState(false);
+
+  const handleConfirm = async () => {
+    setSubmitting(true);
+    try {
+      const { runId, publicAccessToken } = await onRelink();
+      setState({ kind: 'running', runId, publicAccessToken });
+    } catch {
+      toast.error('Re-assess failed. Try again.');
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  if (state.kind === 'running') {
+    return (
+      <RunProgress
+        runId={state.runId}
+        accessToken={state.publicAccessToken}
+        onComplete={async (linked) => {
+          if (linked === 0) {
+            toast.info('No matching tasks found after re-assess.');
+          } else {
+            toast.success(
+              `Re-assessed and linked ${linked} task${linked === 1 ? '' : 's'} · refreshing treatment plan`,
+            );
+            if (onAfterLink) {
+              try {
+                await onAfterLink();
+              } catch {
+                // outer handler surfaces errors; we just reset state.
+              }
+            }
+          }
+          setState({ kind: 'idle' });
+        }}
+        onFailed={() => {
+          toast.error('Re-assess failed. Try again.');
+          setState({ kind: 'idle' });
+        }}
+      />
+    );
+  }
+
+  return (
+    <AlertDialog>
+      <AlertDialogTrigger
+        disabled={disabled || submitting}
+        render={
+          <button
+            type="button"
+            title="Re-assess all linked tasks and controls with AI"
+            className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[11px] text-muted-foreground transition-colors hover:bg-primary/[0.08] hover:text-primary disabled:cursor-not-allowed disabled:opacity-50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50"
+          >
+            <MagicWandFilled size={11} aria-hidden="true" />
+            <span>Re-assess</span>
+          </button>
+        }
+      />
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Re-assess linked tasks?</AlertDialogTitle>
+          <AlertDialogDescription>
+            This removes every currently linked task and re-runs the matching to find
+            the most relevant tasks. Any manual unlinks you've made will be reverted.
+            The treatment plan will refresh after.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel>Cancel</AlertDialogCancel>
+          <AlertDialogAction onClick={handleConfirm}>Yes, re-assess</AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
+
+interface RunProgressProps {
+  runId: string;
+  accessToken: string;
+  onComplete: (linked: number) => void;
+  onFailed: () => void;
+}
+
+function RunProgress({ runId, accessToken, onComplete, onFailed }: RunProgressProps) {
+  const { run } = useRealtimeRun<typeof linkRisksAndVendorsToWork>(runId, {
+    accessToken,
+    enabled: true,
+  });
+
+  const meta = (run?.metadata ?? {}) as Record<string, unknown>;
+  const phase = typeof meta.phase === 'string' ? meta.phase : 'starting';
+  const current = typeof meta.current === 'number' ? meta.current : null;
+  const total = typeof meta.total === 'number' ? meta.total : null;
+
+  const status = run?.status;
+  // Pull link counts from the typed `run.output` (canonical result of the
+  // task) instead of metadata. Metadata is mirror-only progress state and
+  // can lag behind the status transition by a tick — reading from output
+  // here avoids the stale-closure race Cubic flagged (#6 on PR #2671).
+  const riskLinks = typeof run?.output?.riskLinks === 'number' ? run.output.riskLinks : 0;
+  const vendorLinks = typeof run?.output?.vendorLinks === 'number' ? run.output.vendorLinks : 0;
+  useEffect(() => {
+    if (!status) return;
+    if (status === 'COMPLETED') {
+      onComplete(riskLinks + vendorLinks);
+      return;
+    }
+    if (
+      status === 'FAILED' ||
+      status === 'CANCELED' ||
+      status === 'CRASHED' ||
+      status === 'SYSTEM_FAILURE' ||
+      status === 'EXPIRED' ||
+      status === 'TIMED_OUT'
+    ) {
+      onFailed();
+    }
+  }, [status, riskLinks, vendorLinks, onComplete, onFailed]);
+
+  const showProgress = phase !== 'done' && phase in PHASE_LABEL;
+  const label = showProgress ? PHASE_LABEL[phase] : PHASE_LABEL.starting;
+  const countSuffix =
+    current !== null && total !== null && total > 0 && phase !== 'starting' && phase !== 'done'
+      ? ` (${current}/${total})`
+      : '';
+
+  return (
+    <div
+      className="rounded-md border border-border bg-muted/30 p-3"
+      role="status"
+      aria-live="polite"
+    >
+      <Stack gap="xs">
+        <div className="flex items-center gap-2">
+          <span
+            className="inline-block h-2 w-2 animate-pulse rounded-full bg-primary"
+            aria-hidden="true"
+          />
+          <Text size="xs" weight="medium">
+            Re-assessing tasks
+          </Text>
+        </div>
+        <Text size="xs" variant="muted">
+          {label}
+          {countSuffix}
+        </Text>
+      </Stack>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/RiskMatrix5x5.tsx b/apps/app/src/components/risks/treatment-plan/RiskMatrix5x5.tsx
new file mode 100644
index 0000000000..8243f24321
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/RiskMatrix5x5.tsx
@@ -0,0 +1,244 @@
+'use client';
+
+import { Impact, Likelihood } from '@db';
+import { Text } from '@trycompai/design-system';
+import { Checkmark } from '@trycompai/design-system/icons';
+
+const LIKELIHOOD_ORDER: Likelihood[] = [
+  Likelihood.very_unlikely,
+  Likelihood.unlikely,
+  Likelihood.possible,
+  Likelihood.likely,
+  Likelihood.very_likely,
+];
+
+const IMPACT_ORDER: Impact[] = [
+  Impact.insignificant,
+  Impact.minor,
+  Impact.moderate,
+  Impact.major,
+  Impact.severe,
+];
+
+const CELL_SIZE = 44;
+
+// Cell colors mirror the 5 score-band segments used by RiskScale at the
+// bottom of the hero, so the matrix, the headline numeral color, and the
+// bottom scale all agree on what counts as Low / Medium / High / etc.
+//
+// Score for cell (L_idx, I_idx) = ceil((L_idx+1)(I_idx+1) / 2.5), then bucket
+// by the same thresholds as `getRiskLevelFromScore`:
+//   1-2 → very-low,  3-4 → low,  5-6 → medium,  7-8 → high,  9-10 → very-high
+const CELL_BACKGROUND_BY_SCORE_BAND: Record<
+  'very-low' | 'low' | 'medium' | 'high' | 'very-high',
+  string
+> = {
+  'very-low': 'color-mix(in oklab, var(--success) 35%, transparent)',
+  low: 'color-mix(in oklab, var(--success) 25%, var(--warning) 35%)',
+  medium: 'color-mix(in oklab, var(--warning) 35%, transparent)',
+  high: 'color-mix(in oklab, var(--warning) 25%, var(--destructive) 35%)',
+  'very-high': 'color-mix(in oklab, var(--destructive) 35%, transparent)',
+};
+
+function cellBackground(likelihoodIdx: number, impactIdx: number): string {
+  const raw = (likelihoodIdx + 1) * (impactIdx + 1);
+  const score = Math.max(1, Math.ceil(raw / 2.5));
+  if (score >= 9) return CELL_BACKGROUND_BY_SCORE_BAND['very-high'];
+  if (score >= 7) return CELL_BACKGROUND_BY_SCORE_BAND.high;
+  if (score >= 5) return CELL_BACKGROUND_BY_SCORE_BAND.medium;
+  if (score >= 3) return CELL_BACKGROUND_BY_SCORE_BAND.low;
+  return CELL_BACKGROUND_BY_SCORE_BAND['very-low'];
+}
+
+interface RiskMatrix5x5Props {
+  inherentLikelihood: Likelihood;
+  inherentImpact: Impact;
+  residualLikelihood: Likelihood;
+  residualImpact: Impact;
+  /**
+   * 0..1 — completion of the linked treatment work. The "Now" marker is
+   * rendered at a position interpolated between the inherent cell and the
+   * residual (target) cell by this fraction. Default 0 means the Now
+   * marker sits on the inherent cell (no progress yet).
+   */
+  completion?: number;
+  /** When true, render a small "Preliminary — assessment still running" subtitle below the matrix. */
+  preliminary?: boolean;
+}
+
+const GAP = 2;
+
+export function RiskMatrix5x5({
+  inherentLikelihood,
+  inherentImpact,
+  residualLikelihood,
+  residualImpact,
+  completion,
+  preliminary,
+}: RiskMatrix5x5Props) {
+  const inherentL = LIKELIHOOD_ORDER.indexOf(inherentLikelihood);
+  const inherentI = IMPACT_ORDER.indexOf(inherentImpact);
+  const residualL = LIKELIHOOD_ORDER.indexOf(residualLikelihood);
+  const residualI = IMPACT_ORDER.indexOf(residualImpact);
+  const c = Math.min(1, Math.max(0, completion ?? 0));
+  // Fractional "Now" position — interpolated between inherent and target by
+  // task completion. Snaps to inherent when completion=0 and to target when
+  // completion=1; lands somewhere in-between for partial progress.
+  const nowLFloat = inherentL + (residualL - inherentL) * c;
+  const nowIFloat = inherentI + (residualI - inherentI) * c;
+  // "Goal reached" — Now interpolated all the way to Target AND the strategy
+  // actually projects a reduction (so target ≠ inherent). When true we show
+  // a single celebratory marker instead of two stacked dots that hide each
+  // other. Accept (target === inherent) is excluded so an Accept-from-day-
+  // one risk doesn't claim a "completed" reduction.
+  const isAtTarget =
+    c >= 1 && (inherentL !== residualL || inherentI !== residualI);
+  // Pixel offset within the grid (top-left = (0,0)). Rows render top-to-
+  // bottom in descending likelihood order, so the y-axis is flipped (4 - L).
+  const stepPx = CELL_SIZE + GAP;
+  const nowOffsetX = nowIFloat * stepPx + CELL_SIZE / 2;
+  const nowOffsetY = (4 - nowLFloat) * stepPx + CELL_SIZE / 2;
+
+  const cells: React.ReactNode[] = [];
+  // Render rows top-to-bottom: highest likelihood first (row 4 → 0)
+  for (let row = 4; row >= 0; row--) {
+    for (let col = 0; col < 5; col++) {
+      const isResidual = row === residualL && col === residualI;
+      cells.push(
+        <div
+          key={`${row}-${col}`}
+          className="rounded-sm border border-border/50 grid place-items-center relative"
+          style={{
+            width: CELL_SIZE,
+            height: CELL_SIZE,
+            background: cellBackground(row, col),
+          }}
+        >
+          {isResidual && !isAtTarget && (
+            <span
+              aria-label="Target risk"
+              className="rounded-full"
+              style={{
+                width: CELL_SIZE * 0.55,
+                height: CELL_SIZE * 0.55,
+                background: 'var(--primary)',
+                border: '2px solid var(--background)',
+                position: 'absolute',
+              }}
+            />
+          )}
+        </div>
+      );
+    }
+  }
+
+  return (
+    <div className="bg-muted rounded-md p-4">
+      <div className="flex items-center justify-between mb-3">
+        <span className="text-[10px] font-bold uppercase tracking-[0.08em] text-muted-foreground">
+          5×5 Risk Matrix
+        </span>
+        <div className="flex items-center gap-3 text-[11px]">
+          <span className="inline-flex items-center gap-1.5">
+            <span
+              aria-hidden
+              className="rounded-full"
+              style={{ width: 9, height: 9, background: 'var(--destructive)' }}
+            />
+            <Text as="span" size="xs" variant="muted">
+              Now
+            </Text>
+          </span>
+          <span className="inline-flex items-center gap-1.5">
+            <span
+              aria-hidden
+              className="rounded-full"
+              style={{ width: 9, height: 9, background: 'var(--primary)' }}
+            />
+            <Text as="span" size="xs" variant="muted">
+              Target
+            </Text>
+          </span>
+        </div>
+      </div>
+      <div className="flex justify-center">
+        <div
+          className="grid items-stretch gap-1.5"
+          style={{ gridTemplateColumns: 'auto auto' }}
+        >
+          <div
+            className="text-[9px] font-bold uppercase tracking-[0.08em] text-muted-foreground flex items-center justify-center"
+            style={{ writingMode: 'vertical-rl', transform: 'rotate(180deg)' }}
+          >
+            Likelihood →
+          </div>
+          <div
+            className="inline-grid relative"
+            style={{
+              gridTemplateColumns: `repeat(5, ${CELL_SIZE}px)`,
+              gap: GAP,
+            }}
+          >
+            {cells}
+            {/* "Now" marker — rendered as an absolute overlay so it can sit
+                between cells when partial completion lands its position
+                off-grid. When the user reaches 100% completion (Now lands
+                on Target), we swap to a single primary-colored marker with
+                a checkmark — otherwise the red Now would just hide the
+                green Target and the user wouldn't see the win. */}
+            {isAtTarget ? (
+              <span
+                aria-label="Risk reduced to target — plan complete"
+                className="pointer-events-none flex items-center justify-center rounded-full"
+                style={{
+                  position: 'absolute',
+                  width: CELL_SIZE * 0.65,
+                  height: CELL_SIZE * 0.65,
+                  background: 'var(--primary)',
+                  outline: '2px solid var(--background)',
+                  boxShadow: '0 0 0 4px color-mix(in oklab, var(--primary) 25%, transparent)',
+                  left: nowOffsetX,
+                  top: nowOffsetY,
+                  transform: 'translate(-50%, -50%)',
+                  transition: 'left 200ms ease-out, top 200ms ease-out',
+                }}
+              >
+                <Checkmark
+                  size={Math.round(CELL_SIZE * 0.4)}
+                  style={{ color: 'var(--background)' }}
+                  aria-hidden="true"
+                />
+              </span>
+            ) : (
+              <span
+                aria-label="Current risk"
+                className="rounded-full pointer-events-none"
+                style={{
+                  position: 'absolute',
+                  width: CELL_SIZE * 0.55,
+                  height: CELL_SIZE * 0.55,
+                  background: 'var(--destructive)',
+                  outline: '2px solid var(--background)',
+                  left: nowOffsetX,
+                  top: nowOffsetY,
+                  transform: 'translate(-50%, -50%)',
+                  transition: 'left 200ms ease-out, top 200ms ease-out',
+                }}
+              />
+            )}
+          </div>
+        </div>
+      </div>
+      <div className="text-[9px] font-bold uppercase tracking-[0.08em] text-muted-foreground text-center mt-2">
+        ← Impact →
+      </div>
+      {preliminary && (
+        <div className="mt-2">
+          <Text size="xs" variant="muted">
+            Preliminary — assessment still running
+          </Text>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/RiskScale.tsx b/apps/app/src/components/risks/treatment-plan/RiskScale.tsx
new file mode 100644
index 0000000000..84a9716bdd
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/RiskScale.tsx
@@ -0,0 +1,91 @@
+'use client';
+
+const SEGMENT_BACKGROUNDS = [
+  'color-mix(in oklab, var(--success) 35%, transparent)',
+  'color-mix(in oklab, var(--success) 25%, var(--warning) 35%)',
+  'color-mix(in oklab, var(--warning) 35%, transparent)',
+  'color-mix(in oklab, var(--warning) 25%, var(--destructive) 35%)',
+  'color-mix(in oklab, var(--destructive) 35%, transparent)',
+];
+
+const LABELS = ['Negligible', 'Low', 'Medium', 'High', 'Critical'];
+
+function pctFor(score: number): number {
+  return ((score - 0.5) / 10) * 100;
+}
+
+interface RiskScaleProps {
+  inherentScore: number;
+  residualScore: number;
+  /** Color for the inherent marker line + label. Defaults to destructive. */
+  inherentColor?: string;
+  /** Color for the residual marker line + label. Defaults to primary. */
+  residualColor?: string;
+}
+
+export function RiskScale({
+  inherentScore,
+  residualScore,
+  inherentColor = 'var(--destructive)',
+  residualColor = 'var(--primary)',
+}: RiskScaleProps) {
+  return (
+    <div className="relative pt-3 pb-6">
+      <div
+        className="grid h-2.5 overflow-hidden rounded-full border border-border"
+        style={{ gridTemplateColumns: 'repeat(5, 1fr)' }}
+      >
+        {SEGMENT_BACKGROUNDS.map((bg, i) => (
+          <div key={i} style={{ background: bg }} />
+        ))}
+      </div>
+
+      {/* Inherent marker */}
+      <div
+        className="absolute"
+        style={{
+          left: `${pctFor(inherentScore)}%`,
+          top: 6,
+          transform: 'translateX(-50%)',
+        }}
+      >
+        <div className="mx-auto" style={{ width: 2, height: 18, background: inherentColor }} />
+        <div
+          className="mt-0.5 text-center font-mono text-[10px] font-bold tabular-nums"
+          style={{ color: inherentColor, letterSpacing: '0.05em' }}
+        >
+          {inherentScore}
+        </div>
+      </div>
+
+      {/* Residual marker */}
+      <div
+        className="absolute"
+        style={{
+          left: `${pctFor(residualScore)}%`,
+          top: 6,
+          transform: 'translateX(-50%)',
+        }}
+      >
+        <div className="mx-auto" style={{ width: 2, height: 18, background: residualColor }} />
+        <div
+          className="mt-0.5 text-center font-mono text-[10px] font-bold tabular-nums"
+          style={{ color: residualColor, letterSpacing: '0.05em' }}
+        >
+          {residualScore}
+        </div>
+      </div>
+
+      <div
+        className="mt-3 grid font-mono text-[10px] uppercase tracking-[0.1em] text-muted-foreground"
+        style={{ gridTemplateColumns: 'repeat(5, 1fr)' }}
+      >
+        {LABELS.map((l) => (
+          <span key={l} className="text-center">
+            {l}
+          </span>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/ScoreExplainer.tsx b/apps/app/src/components/risks/treatment-plan/ScoreExplainer.tsx
new file mode 100644
index 0000000000..53ca6df77b
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/ScoreExplainer.tsx
@@ -0,0 +1,135 @@
+'use client';
+
+/**
+ * Concise but specific explanation of how the treatment-impact score is
+ * computed. Uses real GRC vocabulary and shows the actual formulas a CISO
+ * would expect to see (5x5 matrix, ceil(raw/2.5) normalization, linear
+ * interpolation by task completion).
+ *
+ * Does NOT publish the exact step-down counts per strategy — those live in
+ * `lib/suggested-residual.ts` and may evolve as we calibrate against
+ * customer feedback. Strategy effects are described qualitatively (which
+ * axes move, why) without naming the step magnitudes.
+ */
+export function ScoreExplainer() {
+  return (
+    <div className="flex max-h-[70vh] flex-col gap-3 overflow-y-auto pr-1 text-[13px] leading-[1.55] text-foreground">
+      <div className="text-sm font-medium">How this score is calculated</div>
+
+      <Section title="1 · Inherent score (1–10)">
+        We rate likelihood (Very Unlikely → Very Likely) and impact
+        (Insignificant → Severe) on a standard 5×5 matrix, each axis indexed
+        1 to 5.
+        <Formula
+          lines={[
+            'raw = likelihood × impact   →   1..25',
+            'score = ⌈raw ÷ 2.5⌉          →   1..10',
+          ]}
+        />
+        Risk levels (Negligible · Low · Medium · High · Critical) map from
+        bands of the raw score.
+      </Section>
+
+      <Section title="2 · Treatment target">
+        Each strategy projects a residual along defined axes:
+        <ul className="mt-1 list-disc pl-4 text-muted-foreground">
+          <li>
+            <span className="font-medium text-foreground">Mitigate</span> —
+            linked controls and tasks reduce <em>both</em> likelihood and
+            impact. The target re-runs the matrix math on the reduced inputs
+            and re-normalizes to 1–10.
+          </li>
+          <li>
+            <span className="font-medium text-foreground">Transfer</span> —
+            insurance or contractual indemnity shifts financial impact but
+            doesn't change the probability of an event. The target reduces
+            impact only; likelihood stays at inherent.
+          </li>
+          <li>
+            <span className="font-medium text-foreground">Accept</span> —
+            residual equals inherent. No reduction; rationale is documented
+            on the plan.
+          </li>
+        </ul>
+      </Section>
+
+      <Section title="3 · Coverage gate">
+        Strategies that require operational evidence (Mitigate, Transfer)
+        only project a target reduction when at least one task is linked
+        to the risk. Without linked work, the target collapses back to
+        inherent — the strategy alone isn't audit evidence. Accept is
+        unaffected (its target is inherent by definition).
+      </Section>
+
+      <Section title="4 · Current vs. target">
+        For Mitigate, the displayed score interpolates linearly between
+        inherent and target by task completion:
+        <Formula
+          lines={[
+            'completion = (tasks done OR not_relevant) ÷ total linked tasks',
+            'current = inherent − (inherent − target) × completion',
+          ]}
+        />
+        At 0% complete the score equals inherent; at 100% it equals the
+        target. Non-Mitigate strategies are treated as fully executed by
+        definition (the strategy itself <em>is</em> the action), so their
+        current and target are the same.
+      </Section>
+
+      <div className="border-t border-border pt-2 text-[11px] text-muted-foreground">
+        <div className="font-bold uppercase tracking-[0.06em]">References</div>
+        <ul className="mt-1 list-disc space-y-1 pl-4">
+          <li>
+            <a
+              href="https://csrc.nist.gov/pubs/sp/800/30/r1/final"
+              target="_blank"
+              rel="noopener noreferrer"
+              className="text-foreground underline-offset-2 hover:underline focus-visible:underline"
+            >
+              NIST SP 800-30 Rev. 1
+            </a>{' '}
+            — recognizes 5×5 matrices as a valid semi-quantitative risk
+            assessment approach (Appendix I).
+          </li>
+          <li>
+            <a
+              href="https://www.iso.org/standard/80585.html"
+              target="_blank"
+              rel="noopener noreferrer"
+              className="text-foreground underline-offset-2 hover:underline focus-visible:underline"
+            >
+              ISO/IEC 27005:2022
+            </a>{' '}
+            — defines our treatment categories: <em>risk modification</em>{' '}
+            (Mitigate), <em>risk sharing</em> (Transfer), <em>risk
+            retention</em> (Accept).
+          </li>
+        </ul>
+        <div className="mt-1.5 italic">
+          The matrix structure and treatment categories align with these
+          standards; the specific 1–10 normalization and step-down magnitudes
+          are Comp AI's calibration.
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function Section({ title, children }: { title: string; children: React.ReactNode }) {
+  return (
+    <div>
+      <div className="text-[11px] font-bold uppercase tracking-[0.06em] text-muted-foreground">
+        {title}
+      </div>
+      <div className="mt-1">{children}</div>
+    </div>
+  );
+}
+
+function Formula({ lines }: { lines: string[] }) {
+  return (
+    <pre className="mt-1.5 mb-1 overflow-x-auto rounded border border-border bg-muted/40 px-2 py-1.5 font-mono text-[11px] leading-[1.55] text-foreground/80">
+      {lines.join('\n')}
+    </pre>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/StrategyPicker.tsx b/apps/app/src/components/risks/treatment-plan/StrategyPicker.tsx
new file mode 100644
index 0000000000..454d2c2c0e
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/StrategyPicker.tsx
@@ -0,0 +1,113 @@
+'use client';
+
+import { cn } from '@/lib/utils';
+import { RiskTreatmentType } from '@db';
+import type { CarbonIconType } from '@carbon/icons-react';
+import {
+  ArrowsHorizontal,
+  Checkmark,
+  CheckmarkOutline,
+  CloseOutline,
+  Security,
+} from '@trycompai/design-system/icons';
+
+interface StrategyOption {
+  value: RiskTreatmentType;
+  label: string;
+  blurb: string;
+  Icon: CarbonIconType;
+}
+
+// Mitigate first (default + the workhorse). Accept and Transfer follow.
+// Avoid is intentionally not offered as a new selection — too rarely used in
+// SaaS GRC programs to be worth the cognitive load. Existing risks already
+// set to `avoid` still render the option (see `LEGACY_AVOID_OPTION` below)
+// so users aren't surprised by missing state.
+const PRIMARY_OPTIONS: StrategyOption[] = [
+  {
+    value: RiskTreatmentType.mitigate,
+    label: 'Mitigate',
+    blurb: 'Apply controls to reduce likelihood and impact.',
+    Icon: Security,
+  },
+  {
+    value: RiskTreatmentType.accept,
+    label: 'Accept',
+    blurb: 'Live with the risk; document the rationale. Residual equals inherent.',
+    Icon: CheckmarkOutline,
+  },
+  {
+    value: RiskTreatmentType.transfer,
+    label: 'Transfer',
+    blurb: 'Shift the impact (e.g. cyber insurance, contractual indemnity).',
+    Icon: ArrowsHorizontal,
+  },
+];
+
+const LEGACY_AVOID_OPTION: StrategyOption = {
+  value: RiskTreatmentType.avoid,
+  label: 'Avoid',
+  blurb: 'Eliminate the activity that causes the risk. Residual pins to the minimum.',
+  Icon: CloseOutline,
+};
+
+interface StrategyPickerProps {
+  value: RiskTreatmentType;
+  onChange: (next: RiskTreatmentType) => void;
+  disabled?: boolean;
+}
+
+export function StrategyPicker({ value, onChange, disabled }: StrategyPickerProps) {
+  const options =
+    value === RiskTreatmentType.avoid
+      ? [...PRIMARY_OPTIONS, LEGACY_AVOID_OPTION]
+      : PRIMARY_OPTIONS;
+
+  return (
+    <div
+      role="radiogroup"
+      aria-label="Treatment strategy"
+      className="mt-3 border-t border-border"
+    >
+      {options.map((opt) => {
+        const isActive = value === opt.value;
+        const Icon = opt.Icon;
+        return (
+          <button
+            key={opt.value}
+            type="button"
+            role="radio"
+            aria-checked={isActive}
+            aria-label={opt.label}
+            disabled={disabled}
+            onClick={() => onChange(opt.value)}
+            className={cn(
+              'flex w-full items-start gap-3 border-b border-l-2 border-border border-l-transparent bg-transparent px-3 py-3.5 text-left text-foreground transition-colors',
+              !disabled && 'cursor-pointer hover:bg-muted',
+              isActive && 'border-l-primary bg-primary/[0.05]',
+              disabled && 'cursor-not-allowed opacity-60',
+            )}
+          >
+            <Icon
+              size={18}
+              className={cn(
+                'mt-0.5 shrink-0',
+                isActive ? 'text-primary' : 'text-muted-foreground',
+              )}
+              aria-hidden="true"
+            />
+            <div className="min-w-0 flex-1">
+              <div className="text-sm font-normal">{opt.label}</div>
+              <div className="mt-0.5 text-xs leading-[1.4] text-muted-foreground">
+                {opt.blurb}
+              </div>
+            </div>
+            {isActive && (
+              <Checkmark size={14} className="mt-1 shrink-0 text-primary" aria-hidden="true" />
+            )}
+          </button>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/TreatmentHero.tsx b/apps/app/src/components/risks/treatment-plan/TreatmentHero.tsx
new file mode 100644
index 0000000000..11d5c50321
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/TreatmentHero.tsx
@@ -0,0 +1,341 @@
+'use client';
+
+import { getRiskLevelFromScore, getRiskScore, type RiskLevel } from '@/lib/risk-score';
+import {
+  interpolatedResidualScore,
+  previewResidual,
+  suggestedResidual,
+} from '@/lib/suggested-residual';
+import { Impact, Likelihood, RiskTreatmentType, TaskStatus } from '@db';
+import { Popover as BasePopover } from '@base-ui/react/popover';
+import { Card, CardContent } from '@trycompai/design-system';
+import { ArrowRight, Information } from '@trycompai/design-system/icons';
+import { RiskMatrix5x5 } from './RiskMatrix5x5';
+import { RiskScale } from './RiskScale';
+import { ScoreExplainer } from './ScoreExplainer';
+
+const LEVEL_LABEL: Record<RiskLevel, string> = {
+  'very-low': 'LOW',
+  low: 'LOW',
+  medium: 'MEDIUM',
+  high: 'HIGH',
+  'very-high': 'CRITICAL',
+};
+
+// Solid (full-opacity) versions of the RiskScale bar's segment hues — so the
+// big numeral, the strong tag in the narrative, and the matching segment
+// below the hero all read as the same color band. The bar mixes these tokens
+// with `transparent` to look soft; the numeral wants the opaque mix at the
+// same hue ratio.
+const LEVEL_COLOR: Record<RiskLevel, string> = {
+  'very-low': 'var(--success)',
+  low: 'color-mix(in oklab, var(--success) 50%, var(--warning))',
+  medium: 'var(--warning)',
+  high: 'color-mix(in oklab, var(--warning) 50%, var(--destructive))',
+  'very-high': 'var(--destructive)',
+};
+
+const LIKELIHOOD_DISPLAY: Record<Likelihood, string> = {
+  very_unlikely: 'Very Unlikely',
+  unlikely: 'Unlikely',
+  possible: 'Possible',
+  likely: 'Likely',
+  very_likely: 'Very Likely',
+};
+
+const IMPACT_DISPLAY: Record<Impact, string> = {
+  insignificant: 'Insignificant',
+  minor: 'Minor',
+  moderate: 'Moderate',
+  major: 'Major',
+  severe: 'Severe',
+};
+
+interface TreatmentHeroProps {
+  inherentLikelihood: Likelihood;
+  inherentImpact: Impact;
+  /**
+   * @deprecated The hero now derives residual from `strategy` + `tasks` via
+   * `previewResidual`, so the math reflects the user's current strategy
+   * selection live. These props are retained for callers that haven't
+   * migrated yet but are unused.
+   */
+  residualLikelihood?: Likelihood;
+  residualImpact?: Impact;
+  strategy: RiskTreatmentType;
+  tasks: { status: TaskStatus }[];
+  /**
+   * When true, the narrative reflects "no plan in place yet" instead of the
+   * standard strategy-specific copy. Used for the Mitigate-fully-empty case
+   * where columns 02 and 03 are merged into a single empty-state CTA.
+   */
+  isEmpty?: boolean;
+}
+
+const STRATEGY_NARRATIVE: Record<RiskTreatmentType, string> = {
+  mitigate: 'assuming linked tasks complete on schedule.',
+  accept: 'because we are accepting this risk as-is.',
+  transfer: 'because the impact is transferred via insurance or contract.',
+  avoid: 'because we are eliminating the activity that causes this risk.',
+};
+
+const STRATEGY_THIRD_STAT: Record<
+  RiskTreatmentType,
+  { label: string; value: string }
+> = {
+  mitigate: { label: 'Task Completion', value: '' }, // value computed live
+  accept: { label: 'Strategy', value: 'Accepted as-is' },
+  transfer: { label: 'Strategy', value: 'Impact transferred' },
+  avoid: { label: 'Strategy', value: 'Activity eliminated' },
+};
+
+export function TreatmentHero({
+  inherentLikelihood,
+  inherentImpact,
+  strategy,
+  tasks,
+  isEmpty,
+}: TreatmentHeroProps) {
+  const inherent = getRiskScore(inherentLikelihood, inherentImpact);
+  // Target = the residual the strategy would produce at full execution.
+  // Headline numerals are always inherent → target — the forecast you'd land
+  // on if every linked task ships. The numerals don't move based on partial
+  // task completion (that was confusing: the narrative already says
+  // "assuming linked tasks complete on schedule"). Instead, real-time
+  // progress shows up as a smaller "Currently X/10" line under the headline
+  // when the user is part-way through the plan.
+  // Coverage gate: don't claim a target reduction without linked work.
+  // Mitigate / Transfer require operational evidence (a control or task
+  // documenting the arrangement) before we project any reduction. Accept
+  // returns inherent regardless (no work to do), so the gate is a no-op
+  // there.
+  const hasLinkedWork = tasks.length > 0;
+  const target = previewResidual({
+    inherentLikelihood,
+    inherentImpact,
+    strategy,
+    hasLinkedWork,
+  });
+  const targetScore = getRiskScore(target.likelihood, target.impact);
+  const isGatedByCoverage =
+    !hasLinkedWork && strategy !== RiskTreatmentType.accept;
+
+  // Mitigate is the only strategy with a meaningful in-progress concept.
+  // Non-Mitigate strategies are "always at full completion" — the strategy
+  // itself is the action.
+  const completion =
+    strategy === RiskTreatmentType.mitigate
+      ? suggestedResidual({
+          likelihood: inherentLikelihood,
+          impact: inherentImpact,
+          strategy,
+          tasks,
+        }).completion
+      : 1;
+  const completionPct = Math.round(completion * 100);
+
+  // Current interpolated score — shown as a smaller subline under the
+  // headline when partway through (Mitigate, 0 < completion < 1).
+  const currentScore = interpolatedResidualScore({
+    inherentScore: inherent.score,
+    targetScore: targetScore.score,
+    completion,
+  });
+  const currentLevel = getRiskLevelFromScore(currentScore);
+  const showCurrentSubline =
+    strategy === RiskTreatmentType.mitigate && completion > 0 && completion < 1;
+
+  const delta = inherent.score - targetScore.score;
+  const inherentLevel = getRiskLevelFromScore(inherent.score);
+  const residualLevel = getRiskLevelFromScore(targetScore.score);
+
+  const thirdStat = STRATEGY_THIRD_STAT[strategy];
+  const thirdStatValue =
+    strategy === RiskTreatmentType.mitigate ? `${completionPct}%` : thirdStat.value;
+
+  return (
+    <Card>
+      <CardContent>
+        <div className="grid grid-cols-1 items-center gap-10 md:grid-cols-[1.4fr_1fr]">
+          {/* LEFT: narrative */}
+          <div>
+            <div className="flex items-center justify-between gap-3">
+              <div className="text-[10px] font-bold uppercase tracking-[0.08em] text-muted-foreground">
+                Risk Reduction — Treatment Impact
+              </div>
+              <BasePopover.Root>
+                <BasePopover.Trigger
+                  className="inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[11px] text-muted-foreground transition-colors hover:bg-primary/[0.08] hover:text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50"
+                  aria-label="How is this score calculated?"
+                >
+                  <Information size={11} aria-hidden="true" />
+                  <span>How is this calculated?</span>
+                </BasePopover.Trigger>
+                <BasePopover.Portal>
+                  {/* Subtle backdrop blur — focuses attention on the
+                      explainer without making it feel modal. */}
+                  <BasePopover.Backdrop className="fixed inset-0 z-40 bg-background/30 backdrop-blur-[2px] transition-[opacity,backdrop-filter] duration-150 data-[ending-style]:opacity-0 data-[starting-style]:opacity-0" />
+                  <BasePopover.Positioner
+                    align="end"
+                    side="bottom"
+                    sideOffset={6}
+                    className="isolate z-50"
+                  >
+                    <BasePopover.Popup
+                      className="bg-popover text-popover-foreground ring-foreground/10 origin-(--transform-origin) data-open:animate-in data-closed:animate-out data-closed:fade-out-0 data-open:fade-in-0 data-closed:zoom-out-95 data-open:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=top]:slide-in-from-bottom-2 flex w-[360px] flex-col gap-2.5 rounded-lg p-3 text-sm shadow-md ring-1 outline-hidden duration-100"
+                    >
+                      <ScoreExplainer />
+                    </BasePopover.Popup>
+                  </BasePopover.Positioner>
+                </BasePopover.Portal>
+              </BasePopover.Root>
+            </div>
+            <h1
+              className="my-3 flex items-center gap-4 font-mono tabular-nums text-7xl font-normal leading-[0.95] tracking-[-0.05em] md:text-8xl"
+              aria-label={`From ${inherent.score} to ${targetScore.score} out of 10`}
+            >
+              <span style={{ color: LEVEL_COLOR[inherentLevel] }}>
+                {inherent.score}
+                <span className="align-super text-3xl font-light opacity-40">/10</span>
+              </span>
+              <ArrowRight size={28} className="text-muted-foreground" aria-hidden="true" />
+              <span style={{ color: LEVEL_COLOR[residualLevel] }}>
+                {targetScore.score}
+                <span className="align-super text-3xl font-light opacity-40">/10</span>
+              </span>
+            </h1>
+            {showCurrentSubline && (
+              <div className="-mt-1 mb-3 text-xs text-muted-foreground">
+                Currently{' '}
+                <span
+                  className="font-mono font-bold tabular-nums"
+                  style={{ color: LEVEL_COLOR[currentLevel] }}
+                >
+                  {currentScore}/10
+                </span>{' '}
+                — {completionPct}% of plan complete
+              </div>
+            )}
+            <p className="max-w-[540px] text-sm leading-[1.55] text-foreground">
+              The plan moves this risk from{' '}
+              <strong
+                className="font-bold"
+                style={{ color: LEVEL_COLOR[inherentLevel] }}
+              >
+                {LEVEL_LABEL[inherentLevel]}
+              </strong>{' '}
+              to{' '}
+              <strong
+                className="font-bold"
+                style={{ color: LEVEL_COLOR[residualLevel] }}
+              >
+                {LEVEL_LABEL[residualLevel]}
+              </strong>{' '}
+              —{' '}
+              {delta === 0 ? (
+                <span className="font-mono font-bold text-primary tabular-nums">no change</span>
+              ) : (
+                <>
+                  a{' '}
+                  <span className="font-mono font-bold text-primary tabular-nums">
+                    {delta > 0 ? '−' : '+'}
+                    {Math.abs(delta)}
+                  </span>{' '}
+                  point swing
+                </>
+              )}{' '}
+              {/* `isEmpty` (Mitigate + no plan + no linked work) is a
+                   strict subset of `isGatedByCoverage` (no linked work,
+                   strategy != Accept). It's the more specific case, so
+                   it must be checked first — otherwise the gated-by-
+                   coverage branch shadows it and the user never sees
+                   the "no plan in place yet" copy. (Cubic finding on
+                   PR #2671.) */}
+              {isEmpty
+                ? 'since no mitigation plan is in place yet.'
+                : isGatedByCoverage
+                ? strategy === RiskTreatmentType.transfer
+                  ? 'until a task documenting the transfer arrangement is linked.'
+                  : 'until tasks supporting the strategy are linked.'
+                : STRATEGY_NARRATIVE[strategy]}
+            </p>
+            <div className="mt-6 grid grid-cols-3 gap-4 border-t border-border pt-5">
+              <HeroStatPair
+                label="Likelihood"
+                from={LIKELIHOOD_DISPLAY[inherentLikelihood]}
+                to={LIKELIHOOD_DISPLAY[target.likelihood]}
+              />
+              <HeroStatPair
+                label="Impact"
+                from={IMPACT_DISPLAY[inherentImpact]}
+                to={IMPACT_DISPLAY[target.impact]}
+              />
+              <HeroStatSingle label={thirdStat.label} value={thirdStatValue} />
+            </div>
+          </div>
+
+          {/* RIGHT: matrix — Target stays at the strategy's full-completion
+              target cell. Now interpolates from inherent → target by task
+              completion so partial progress is visually reflected. */}
+          <RiskMatrix5x5
+            inherentLikelihood={inherentLikelihood}
+            inherentImpact={inherentImpact}
+            residualLikelihood={target.likelihood}
+            residualImpact={target.impact}
+            completion={completion}
+          />
+        </div>
+
+        <div className="mt-5 border-t border-border pt-5">
+          <RiskScale
+            inherentScore={inherent.score}
+            residualScore={targetScore.score}
+            inherentColor={LEVEL_COLOR[inherentLevel]}
+            residualColor={LEVEL_COLOR[residualLevel]}
+          />
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
+
+function HeroStatPair({ label, from, to }: { label: string; from: string; to: string }) {
+  const sameValue = from === to;
+  return (
+    <div>
+      <div className="text-[10px] font-bold uppercase tracking-[0.08em] text-muted-foreground">
+        {label}
+      </div>
+      <div className="mt-1.5 flex items-center gap-1.5 text-sm">
+        <span
+          className={
+            sameValue
+              ? 'text-foreground'
+              : 'text-muted-foreground line-through decoration-muted-foreground'
+          }
+        >
+          {from}
+        </span>
+        {!sameValue && (
+          <>
+            <ArrowRight size={12} className="text-muted-foreground" aria-hidden="true" />
+            <span className="text-foreground">{to}</span>
+          </>
+        )}
+      </div>
+    </div>
+  );
+}
+
+function HeroStatSingle({ label, value }: { label: string; value: string }) {
+  return (
+    <div>
+      <div className="text-[10px] font-bold uppercase tracking-[0.08em] text-muted-foreground">
+        {label}
+      </div>
+      <div className="mt-1.5 font-mono text-[22px] font-normal tabular-nums tracking-[-0.02em] text-primary">
+        {value}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.spec.tsx b/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.spec.tsx
new file mode 100644
index 0000000000..40c88688eb
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.spec.tsx
@@ -0,0 +1,135 @@
+import { Impact, Likelihood, RiskTreatmentType, TaskStatus } from '@db';
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { TreatmentPlanTab, type TreatmentPlanEntity } from './TreatmentPlanTab';
+
+const baseEntity: TreatmentPlanEntity = {
+  id: 'rsk_1',
+  inherentLikelihood: Likelihood.likely,
+  inherentImpact: Impact.major,
+  residualLikelihood: Likelihood.unlikely,
+  residualImpact: Impact.minor,
+  treatmentStrategy: RiskTreatmentType.mitigate,
+  treatmentStrategyDescription: null,
+  tasks: [],
+};
+
+type Props = Parameters<typeof TreatmentPlanTab>[0];
+
+function buildProps(overrides?: Partial<Props>): Props {
+  return {
+    orgId: 'org_1',
+    entity: baseEntity,
+    canUpdate: true,
+    onUpdateStrategy: vi.fn().mockResolvedValue(undefined),
+    onUpdateDescription: vi.fn().mockResolvedValue(undefined),
+    onRegenerate: vi.fn().mockResolvedValue(undefined),
+    regenerating: false,
+    ...overrides,
+  };
+}
+
+describe('TreatmentPlanTab', () => {
+  it('renders the Linked work column when Mitigate has linked tasks', () => {
+    const entity: TreatmentPlanEntity = {
+      ...baseEntity,
+      treatmentStrategy: RiskTreatmentType.mitigate,
+      tasks: [{ id: 't1', title: 'Task 1', status: TaskStatus.todo, controls: [] }],
+    };
+    render(<TreatmentPlanTab {...buildProps({ entity })} />);
+    expect(screen.getByRole('heading', { name: 'Strategy' })).toBeInTheDocument();
+    expect(screen.getByRole('heading', { name: 'Treatment plan' })).toBeInTheDocument();
+    expect(screen.getByRole('heading', { name: 'Linked work' })).toBeInTheDocument();
+  });
+
+  it('hides Linked work column and stacks the empty CTA in col 02 when Mitigate has no linked tasks', () => {
+    render(<TreatmentPlanTab {...buildProps()} />);
+    expect(screen.getByRole('heading', { name: 'Strategy' })).toBeInTheDocument();
+    expect(screen.getByRole('heading', { name: 'Treatment plan' })).toBeInTheDocument();
+    expect(screen.queryByRole('heading', { name: 'Linked work' })).toBeNull();
+  });
+
+  it('hides Linked Work and shows "Rationale" when strategy is Accept', () => {
+    const entity: TreatmentPlanEntity = {
+      ...baseEntity,
+      treatmentStrategy: RiskTreatmentType.accept,
+    };
+    render(<TreatmentPlanTab {...buildProps({ entity })} />);
+    // Column titles render as <h3>; queries are role-scoped to disambiguate
+    // from the hero's "Strategy" stat label.
+    expect(screen.getByRole('heading', { name: 'Strategy' })).toBeInTheDocument();
+    expect(screen.getByRole('heading', { name: 'Rationale' })).toBeInTheDocument();
+    expect(screen.queryByRole('heading', { name: 'Linked work' })).toBeNull();
+  });
+
+  it('renders the hero numerals using strategy-derived residual', () => {
+    // Mitigate with linked work shows the full-completion target.
+    // inherent: likely × major = 4×4 = 16 raw → ceil(16/2.5) = 7
+    // target:   possible × moderate = 3×3 = 9 raw → ceil(9/2.5) = 4
+    const entity: TreatmentPlanEntity = {
+      ...baseEntity,
+      tasks: [{ id: 't1', title: 'Task 1', status: TaskStatus.todo, controls: [] }],
+    };
+    render(<TreatmentPlanTab {...buildProps({ entity })} />);
+    const headline = screen.getByLabelText(/From 7 to 4 out of 10/i);
+    expect(headline).toBeInTheDocument();
+    expect(headline.textContent).toContain('7');
+    expect(headline.textContent).toContain('4');
+  });
+
+  it('coverage gate: Mitigate with no linked work shows inherent as the target', () => {
+    // No linked tasks → target collapses to inherent regardless of strategy.
+    // The headline shows 7 → 7 ("no change") with the explanatory copy
+    // pointing the user at linking work.
+    render(<TreatmentPlanTab {...buildProps()} />);
+    const headline = screen.getByLabelText(/From 7 to 7 out of 10/i);
+    expect(headline).toBeInTheDocument();
+    expect(
+      screen.getByText(/until tasks supporting the strategy are linked/i),
+    ).toBeInTheDocument();
+  });
+
+  it('calls onUpdateStrategy when strategy card is clicked', async () => {
+    const onUpdateStrategy = vi.fn().mockResolvedValue(undefined);
+    render(<TreatmentPlanTab {...buildProps({ onUpdateStrategy })} />);
+    fireEvent.click(screen.getByRole('radio', { name: 'Mitigate' }));
+    await waitFor(() => {
+      expect(onUpdateStrategy).toHaveBeenCalledWith(RiskTreatmentType.mitigate);
+    });
+  });
+
+  it('disables strategy buttons and Save when canUpdate is false', () => {
+    render(<TreatmentPlanTab {...buildProps({ canUpdate: false })} />);
+    expect(screen.getByRole('radio', { name: 'Mitigate' })).toBeDisabled();
+    expect(screen.getByRole('button', { name: /^Save$/i })).toBeDisabled();
+  });
+
+  it('switches the regenerate label based on description presence', () => {
+    const { rerender } = render(<TreatmentPlanTab {...buildProps()} />);
+    expect(
+      screen.getByRole('button', { name: /Generate treatment plan/i }),
+    ).toBeInTheDocument();
+
+    rerender(
+      <TreatmentPlanTab
+        {...buildProps({
+          entity: { ...baseEntity, treatmentStrategyDescription: 'We isolated this vendor.' },
+        })}
+      />,
+    );
+    expect(screen.getByRole('button', { name: /Regenerate with AI/i })).toBeInTheDocument();
+  });
+
+  it('shows task completion percent in the hero stats', () => {
+    const entity: TreatmentPlanEntity = {
+      ...baseEntity,
+      treatmentStrategy: RiskTreatmentType.mitigate,
+      tasks: [
+        { id: 't1', title: 'Task 1', status: TaskStatus.done, controls: [] },
+        { id: 't2', title: 'Task 2', status: TaskStatus.done, controls: [] },
+      ],
+    };
+    render(<TreatmentPlanTab {...buildProps({ entity })} />);
+    expect(screen.getByText('100%')).toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.tsx b/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.tsx
new file mode 100644
index 0000000000..19e1365521
--- /dev/null
+++ b/apps/app/src/components/risks/treatment-plan/TreatmentPlanTab.tsx
@@ -0,0 +1,274 @@
+'use client';
+
+import { cn } from '@/lib/utils';
+import { Impact, Likelihood, RiskTreatmentType, TaskStatus } from '@db';
+import { useEffect, useState } from 'react';
+import { AutoLinkSuggestions } from './AutoLinkSuggestions';
+import { DescriptionEditor } from './DescriptionEditor';
+import { LinkedWork } from './LinkedWork';
+import { StrategyPicker } from './StrategyPicker';
+import { TreatmentHero } from './TreatmentHero';
+
+export interface TreatmentPlanEntity {
+  id: string;
+  inherentLikelihood: Likelihood;
+  inherentImpact: Impact;
+  residualLikelihood: Likelihood;
+  residualImpact: Impact;
+  treatmentStrategy: RiskTreatmentType;
+  treatmentStrategyDescription: string | null;
+  /**
+   * Per-strategy saved descriptions. Lets the UI swap the displayed
+   * description instantly when the user picks a different strategy,
+   * without waiting for the API to round-trip and the SWR cache to
+   * revalidate. Server keeps these in sync; see
+   * `apps/api/src/risks/strategy-descriptions.ts`.
+   */
+  strategyDescriptions?: Partial<Record<RiskTreatmentType, string>> | null;
+  tasks: {
+    id: string;
+    title: string;
+    status: TaskStatus;
+    controls: { id: string; name: string }[];
+  }[];
+}
+
+interface TreatmentPlanTabProps {
+  orgId: string;
+  entity: TreatmentPlanEntity;
+  canUpdate: boolean;
+  onUpdateStrategy: (strategy: RiskTreatmentType) => Promise<void>;
+  onUpdateDescription: (description: string) => Promise<void>;
+  onRegenerate: () => Promise<void>;
+  regenerating: boolean;
+  /**
+   * Active trigger.dev run handle for an in-flight regeneration. The
+   * description editor subscribes via `useRealtimeRun` to render live
+   * progress until the run terminates.
+   */
+  regenRun?: { runId: string; publicAccessToken: string } | null;
+  /** Called when the regeneration run terminates (success or failure). */
+  onRegenSettled?: (result: { success: boolean; reason?: string }) => void;
+  /**
+   * Triggers the AI scan in suggestionsOnly mode and returns a realtime handle.
+   * The component reads `run.output.suggestions` once status === COMPLETED.
+   * When omitted, the legacy fall-through renders only LinkedWork.
+   */
+  onSuggest?: () => Promise<{ runId: string; publicAccessToken: string }>;
+  /**
+   * Persists the user-confirmed selection.
+   * `replace: true` for re-assess (sync semantics — connect ONLY these).
+   * `replace: false` for fresh suggest (additive).
+   */
+  onApply?: (params: { taskIds: string[]; replace: boolean }) => Promise<void>;
+  /** Optional unlink callback for individual rows in the linked-state list. */
+  onUnlinkTask?: (taskId: string) => Promise<void>;
+  /**
+   * Resume an in-flight or completed-but-unreviewed AI scan. Returns null when
+   * no run is persisted server-side. Used to recover progress after a reload.
+   */
+  onResumeAutoLink?: () => Promise<{ runId: string; publicAccessToken: string } | null>;
+  /** Clears the persisted runId server-side (called from Discard). */
+  onDiscardAutoLinkRun?: () => Promise<void>;
+  /**
+   * @deprecated Use `onSuggest` + `onApply` instead. The previous immediate-
+   * apply auto-link flow is replaced by review-before-apply.
+   */
+  onAutoLink?: () => Promise<{ runId: string; publicAccessToken: string }>;
+  /**
+   * @deprecated Use `onSuggest` + `onApply({ replace: true })` instead.
+   */
+  onRelink?: () => Promise<{ runId: string; publicAccessToken: string }>;
+}
+
+export function TreatmentPlanTab({
+  orgId,
+  entity,
+  canUpdate,
+  onUpdateStrategy,
+  onUpdateDescription,
+  onRegenerate,
+  regenerating,
+  onSuggest,
+  onApply,
+  onUnlinkTask,
+  onResumeAutoLink,
+  onDiscardAutoLinkRun,
+  regenRun,
+  onRegenSettled,
+}: TreatmentPlanTabProps) {
+  const [strategy, setStrategy] = useState(entity.treatmentStrategy);
+
+  useEffect(() => {
+    setStrategy(entity.treatmentStrategy);
+  }, [entity.treatmentStrategy]);
+
+  const handleStrategyChange = async (next: RiskTreatmentType) => {
+    setStrategy(next);
+    try {
+      await onUpdateStrategy(next);
+    } catch {
+      setStrategy(entity.treatmentStrategy);
+    }
+  };
+
+  // When the local strategy state matches the persisted strategy on the
+  // entity, use the active `treatmentStrategyDescription` (most up-to-date).
+  // When it differs (the user just clicked a different strategy and the
+  // SWR cache hasn't revalidated yet), fall back to the saved text for
+  // that strategy from `strategyDescriptions`. Without this, switching
+  // strategies briefly shows the previous strategy's content under the
+  // new strategy's heading.
+  const description =
+    strategy === entity.treatmentStrategy
+      ? (entity.treatmentStrategyDescription ?? '')
+      : (entity.strategyDescriptions?.[strategy] ?? '');
+  const isMitigate = strategy === RiskTreatmentType.mitigate;
+  const hasPlan = description.trim().length > 0;
+  const hasLinkedWork = entity.tasks.length > 0;
+
+  // While Mitigate has no linked work, render only the kick-off CTA panel —
+  // the user picks "Draft plan & suggest links" / "Suggest tasks & controls"
+  // or escapes to the editor via "Start from scratch" / "Edit plan manually".
+  // The editor only appears once linked work exists OR the user dismissed.
+  const [emptyDismissed, setEmptyDismissed] = useState(false);
+  useEffect(() => {
+    if (hasLinkedWork) setEmptyDismissed(false);
+  }, [hasLinkedWork]);
+
+  const showKickoff = isMitigate && !hasLinkedWork && !emptyDismissed;
+  const kickoffVariant: 'kickoff' | 'kickoff-with-plan' = hasPlan
+    ? 'kickoff-with-plan'
+    : 'kickoff';
+  // Linked Work renders only for Mitigate. Accept "lives with the risk",
+  // Transfer ships impact via insurance/contractual instruments, and Avoid
+  // discontinues the activity — none of those are operational mitigations
+  // backed by tasks/controls, so showing the column adds noise and a misread
+  // ("there's still work to do here").
+  const showLinkedWorkColumn = isMitigate && hasLinkedWork;
+
+  // For non-Mitigate strategies the "plan" is just rationale.
+  const planTitle = isMitigate ? 'Treatment plan' : 'Rationale';
+  const planSubtitle = isMitigate
+    ? 'A concrete plan for the strategy above.'
+    : 'Document why this strategy is right for this risk.';
+
+  return (
+    <div className="flex flex-col gap-6">
+      <TreatmentHero
+        inherentLikelihood={entity.inherentLikelihood}
+        inherentImpact={entity.inherentImpact}
+        residualLikelihood={entity.residualLikelihood}
+        residualImpact={entity.residualImpact}
+        strategy={strategy}
+        tasks={entity.tasks}
+        isEmpty={isMitigate && !hasPlan && !hasLinkedWork}
+      />
+
+      <div
+        className={cn(
+          'bg-background grid grid-cols-1 overflow-hidden rounded-md border border-border',
+          showLinkedWorkColumn ? 'lg:grid-cols-[1fr_1.2fr_1fr]' : 'lg:grid-cols-[1fr_2fr]',
+        )}
+      >
+        {/* 01 · Strategy */}
+        <div className="min-w-0 p-6">
+          <ColumnHeader
+            number="01"
+            title="Strategy"
+            subtitle="How is this risk being treated?"
+          />
+          <StrategyPicker
+            value={strategy}
+            onChange={handleStrategyChange}
+            disabled={!canUpdate}
+          />
+        </div>
+
+        {/* 02 · Kickoff CTA when linked work is empty (covers both "fully
+            empty" and "plan exists, no links" cases) — editor stays hidden
+            until linked work appears OR the user dismisses. */}
+        <div className="min-w-0 border-t border-border p-6 lg:border-l lg:border-t-0">
+          {showKickoff && onSuggest && onApply ? (
+            <AutoLinkSuggestions
+              orgId={orgId}
+              tasks={entity.tasks}
+              canUpdate={canUpdate}
+              onSuggest={onSuggest}
+              onApply={onApply}
+              onAfterApply={onRegenerate}
+              emptyVariant={kickoffVariant}
+              onStartFromScratch={() => setEmptyDismissed(true)}
+              onResume={onResumeAutoLink}
+              onDiscardRun={onDiscardAutoLinkRun}
+            />
+          ) : (
+            <>
+              <ColumnHeader number="02" title={planTitle} subtitle={planSubtitle} />
+              <DescriptionEditor
+                value={description}
+                onSave={onUpdateDescription}
+                onRegenerate={onRegenerate}
+                regenerating={regenerating}
+                disabled={!canUpdate}
+                regenRun={regenRun}
+                onRegenSettled={onRegenSettled}
+              />
+            </>
+          )}
+        </div>
+
+        {/* 03 · Linked work — only when Mitigate already has linked tasks. */}
+        {showLinkedWorkColumn && (
+          <div className="min-w-0 border-t border-border p-6 lg:border-l lg:border-t-0">
+            <ColumnHeader
+              number="03"
+              title="Linked work"
+              subtitle="Drives the residual estimate."
+            />
+            {onSuggest && onApply ? (
+              <AutoLinkSuggestions
+                orgId={orgId}
+                tasks={entity.tasks}
+                canUpdate={canUpdate}
+                onSuggest={onSuggest}
+                onApply={onApply}
+                onAfterApply={onRegenerate}
+                onUnlinkTask={onUnlinkTask}
+                onResume={onResumeAutoLink}
+                onDiscardRun={onDiscardAutoLinkRun}
+              />
+            ) : (
+              <LinkedWork orgId={orgId} tasks={entity.tasks} />
+            )}
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
+interface ColumnHeaderProps {
+  number: string;
+  title: string;
+  subtitle: string;
+  action?: React.ReactNode;
+}
+
+function ColumnHeader({ number, title, subtitle, action }: ColumnHeaderProps) {
+  return (
+    <div className="flex flex-col gap-1">
+      <div className="flex items-center gap-2.5">
+        <span className="font-mono text-[11px] tracking-[0.1em] text-primary">{number}</span>
+        <h3 className="text-lg font-normal tracking-[-0.01em]">{title}</h3>
+        {action && (
+          <>
+            <span className="flex-1" />
+            {action}
+          </>
+        )}
+      </div>
+      <div className="text-xs text-muted-foreground">{subtitle}</div>
+    </div>
+  );
+}
diff --git a/apps/app/src/env.mjs b/apps/app/src/env.mjs
index b4e338eab9..d97b739e5d 100644
--- a/apps/app/src/env.mjs
+++ b/apps/app/src/env.mjs
@@ -42,7 +42,6 @@ export const env = createEnv({
     DUB_REFER_URL: z.string().optional(),
     NOVU_API_KEY: z.string().optional(),
     SERVICE_TOKEN_TRIGGER: z.string().optional(),
-    STRIPE_SECRET_KEY: z.string().optional(),
     BACKEND_API_URL: z.string().optional(),
     RETOOL_COMP_API_SECRET: z.string().optional(),
     APP_AWS_ENDPOINT: z.string().optional(),
@@ -107,7 +106,6 @@ export const env = createEnv({
     NOVU_API_KEY: process.env.NOVU_API_KEY,
     NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER: process.env.NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER,
     SERVICE_TOKEN_TRIGGER: process.env.SERVICE_TOKEN_TRIGGER,
-    STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY,
     BACKEND_API_URL: process.env.BACKEND_API_URL,
     RETOOL_COMP_API_SECRET: process.env.RETOOL_COMP_API_SECRET,
     APP_AWS_ENDPOINT: process.env.APP_AWS_ENDPOINT,
diff --git a/apps/app/src/hooks/use-risks.ts b/apps/app/src/hooks/use-risks.ts
index dd23c965b8..a893d5165f 100644
--- a/apps/app/src/hooks/use-risks.ts
+++ b/apps/app/src/hooks/use-risks.ts
@@ -11,8 +11,16 @@ import type {
   Likelihood,
   Impact,
   RiskTreatmentType,
+  TaskStatus,
 } from '@db';
 
+export interface RiskLinkedTask {
+  id: string;
+  title: string;
+  status: TaskStatus;
+  controls: { id: string; name: string }[];
+}
+
 // Default polling interval for real-time updates (5 seconds)
 const DEFAULT_POLLING_INTERVAL = 5000;
 
@@ -42,6 +50,7 @@ export interface Risk {
   organizationId: string;
   assigneeId: string | null;
   assignee?: RiskAssignee | null;
+  tasks?: RiskLinkedTask[];
   createdAt: string;
   updatedAt: string;
 }
@@ -246,7 +255,9 @@ export function useRiskActions() {
   );
 
   const regenerateMitigation = useCallback(
-    async (riskId: string) => {
+    async (
+      riskId: string,
+    ): Promise<{ runId: string; publicAccessToken: string }> => {
       const response = await fetch(`/api/risks/${riskId}/regenerate-mitigation`, {
         method: 'POST',
         credentials: 'include',
@@ -255,6 +266,128 @@ export function useRiskActions() {
         const body = await response.json().catch(() => ({}));
         throw new Error(body.error || 'Failed to trigger mitigation regeneration');
       }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * @deprecated Prefer `suggestRiskLinks` which returns AI suggestions for the
+   * user to review before applying. Kept for any direct callers.
+   */
+  const autoLinkRisk = useCallback(
+    async (riskId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/risks/${riskId}/auto-link`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger auto-link');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * @deprecated The new flow runs `suggestRiskLinks` then `applyRiskLinks`
+   * with `replace: true`. This direct relink endpoint is kept for backwards
+   * compatibility but no longer used by the treatment-plan UI.
+   */
+  const relinkRisk = useCallback(
+    async (riskId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/risks/${riskId}/relink`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger relink');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * Triggers an AI scan that returns suggestions WITHOUT persisting any link.
+   * The realtime run output contains `suggestions: { tasks, controls }` for the
+   * UI to render in a review-before-apply card.
+   */
+  const suggestRiskLinks = useCallback(
+    async (riskId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/risks/${riskId}/auto-link`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger suggest');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * Persists the user-confirmed task selection. `replace: true` is used by the
+   * re-assess flow (sync semantics — connect ONLY these tasks). `replace: false`
+   * is the additive fresh-suggest flow.
+   */
+  const applyRiskLinks = useCallback(
+    async (
+      riskId: string,
+      params: { taskIds: string[]; replace: boolean },
+    ): Promise<void> => {
+      const response = await fetch(`/api/risks/${riskId}/auto-link/apply`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(params),
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to apply suggestions');
+      }
+    },
+    [],
+  );
+
+  /**
+   * Returns the active auto-link run for a risk (and a fresh access token) so
+   * the UI can resume an in-flight scan after a page reload, or `null` when
+   * no run is in flight. The runId is persisted on the Risk row by the auto-
+   * link route; this hook just fetches and re-mints the token.
+   */
+  const fetchActiveRiskAutoLinkRun = useCallback(
+    async (
+      riskId: string,
+    ): Promise<{ runId: string; publicAccessToken: string } | null> => {
+      const response = await fetch(`/api/risks/${riskId}/auto-link/active`, {
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        return null;
+      }
+      const body = (await response.json()) as
+        | { runId: string; publicAccessToken: string }
+        | { runId: null };
+      if (!body.runId) return null;
+      return { runId: body.runId, publicAccessToken: body.publicAccessToken };
+    },
+    [],
+  );
+
+  /** Clears the persisted runId — used when the user discards an AI run. */
+  const discardRiskAutoLinkRun = useCallback(
+    async (riskId: string): Promise<void> => {
+      await fetch(`/api/risks/${riskId}/auto-link/active`, {
+        method: 'DELETE',
+        credentials: 'include',
+      }).catch(() => {
+        /* best-effort; the next /auto-link call replaces the runId anyway */
+      });
     },
     [],
   );
@@ -264,6 +397,12 @@ export function useRiskActions() {
     updateRisk,
     deleteRisk,
     regenerateMitigation,
+    autoLinkRisk,
+    relinkRisk,
+    suggestRiskLinks,
+    applyRiskLinks,
+    fetchActiveRiskAutoLinkRun,
+    discardRiskAutoLinkRun,
   };
 }
 
diff --git a/apps/app/src/hooks/use-vendors.ts b/apps/app/src/hooks/use-vendors.ts
index adaf862fdb..f8e5b44236 100644
--- a/apps/app/src/hooks/use-vendors.ts
+++ b/apps/app/src/hooks/use-vendors.ts
@@ -10,8 +10,17 @@ import type {
   Likelihood,
   Impact,
   Prisma,
+  RiskTreatmentType,
+  TaskStatus,
 } from '@db';
 
+export interface VendorLinkedTask {
+  id: string;
+  title: string;
+  status: TaskStatus;
+  controls: { id: string; name: string }[];
+}
+
 // Default polling interval for real-time updates (5 seconds)
 const DEFAULT_POLLING_INTERVAL = 5000;
 
@@ -40,6 +49,9 @@ export interface Vendor {
   organizationId: string;
   assigneeId: string | null;
   assignee?: VendorAssignee | null;
+  treatmentStrategy: RiskTreatmentType;
+  treatmentStrategyDescription: string | null;
+  tasks?: VendorLinkedTask[];
   createdAt: string;
   updatedAt: string;
 }
@@ -79,6 +91,8 @@ interface UpdateVendorData {
   inherentImpact?: Impact;
   residualProbability?: Likelihood;
   residualImpact?: Impact;
+  treatmentStrategy?: RiskTreatmentType;
+  treatmentStrategyDescription?: string | null;
 }
 
 export interface UseVendorsOptions extends UseApiSWROptions<VendorsResponse> {
@@ -228,14 +242,126 @@ export function useVendorActions() {
   );
 
   const regenerateMitigation = useCallback(
-    async (vendorId: string) => {
+    async (
+      vendorId: string,
+    ): Promise<{ runId: string; publicAccessToken: string }> => {
       const response = await fetch(`/api/vendors/${vendorId}/regenerate-mitigation`, {
         method: 'POST',
+        credentials: 'include',
       });
       if (!response.ok) {
         const body = await response.json().catch(() => ({}));
         throw new Error(body.error || 'Failed to trigger mitigation regeneration');
       }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * @deprecated Prefer `suggestVendorLinks` (review-before-apply flow).
+   */
+  const autoLinkVendor = useCallback(
+    async (vendorId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/vendors/${vendorId}/auto-link`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger auto-link');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * @deprecated The new flow runs `suggestVendorLinks` then `applyVendorLinks`
+   * with `replace: true`.
+   */
+  const relinkVendor = useCallback(
+    async (vendorId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/vendors/${vendorId}/relink`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger relink');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * Triggers an AI scan that returns suggestions WITHOUT persisting any link.
+   */
+  const suggestVendorLinks = useCallback(
+    async (vendorId: string): Promise<{ runId: string; publicAccessToken: string }> => {
+      const response = await fetch(`/api/vendors/${vendorId}/auto-link`, {
+        method: 'POST',
+        credentials: 'include',
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to trigger suggest');
+      }
+      return response.json();
+    },
+    [],
+  );
+
+  /**
+   * Persists the user-confirmed task selection. `replace: true` is used by the
+   * re-assess flow (sync semantics).
+   */
+  const applyVendorLinks = useCallback(
+    async (
+      vendorId: string,
+      params: { taskIds: string[]; replace: boolean },
+    ): Promise<void> => {
+      const response = await fetch(`/api/vendors/${vendorId}/auto-link/apply`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(params),
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new Error(body.error || 'Failed to apply suggestions');
+      }
+    },
+    [],
+  );
+
+  /** See `useRiskActions.fetchActiveRiskAutoLinkRun`. */
+  const fetchActiveVendorAutoLinkRun = useCallback(
+    async (
+      vendorId: string,
+    ): Promise<{ runId: string; publicAccessToken: string } | null> => {
+      const response = await fetch(`/api/vendors/${vendorId}/auto-link/active`, {
+        credentials: 'include',
+      });
+      if (!response.ok) return null;
+      const body = (await response.json()) as
+        | { runId: string; publicAccessToken: string }
+        | { runId: null };
+      if (!body.runId) return null;
+      return { runId: body.runId, publicAccessToken: body.publicAccessToken };
+    },
+    [],
+  );
+
+  const discardVendorAutoLinkRun = useCallback(
+    async (vendorId: string): Promise<void> => {
+      await fetch(`/api/vendors/${vendorId}/auto-link/active`, {
+        method: 'DELETE',
+        credentials: 'include',
+      }).catch(() => {
+        /* best-effort */
+      });
     },
     [],
   );
@@ -246,6 +372,12 @@ export function useVendorActions() {
     deleteVendor,
     triggerAssessment,
     regenerateMitigation,
+    autoLinkVendor,
+    relinkVendor,
+    suggestVendorLinks,
+    applyVendorLinks,
+    fetchActiveVendorAutoLinkRun,
+    discardVendorAutoLinkRun,
   };
 }
 
diff --git a/apps/app/src/lib/embedding/embedding.spec.ts b/apps/app/src/lib/embedding/embedding.spec.ts
new file mode 100644
index 0000000000..e1ee39ea62
--- /dev/null
+++ b/apps/app/src/lib/embedding/embedding.spec.ts
@@ -0,0 +1,247 @@
+import { Departments } from '@db';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+
+const upsertMock = vi.fn();
+const queryMock = vi.fn();
+const infoMock = vi.fn();
+
+vi.mock('@upstash/vector', () => ({
+  Index: vi.fn().mockImplementation(() => ({
+    upsert: upsertMock,
+    query: queryMock,
+    info: infoMock,
+  })),
+}));
+
+vi.mock('@ai-sdk/openai', () => ({
+  openai: {
+    embedding: () => 'mock-embedding-model',
+  },
+}));
+
+vi.mock('ai', () => ({
+  embedMany: vi.fn(async ({ values }: { values: string[] }) => ({
+    embeddings: values.map((_, i) => Array(1536).fill(i / values.length)),
+  })),
+}));
+
+import {
+  upsertEntityEmbeddings,
+  findSimilarTasks,
+  waitForIndexed,
+  type EntityKind,
+} from './index';
+
+beforeEach(() => {
+  upsertMock.mockReset();
+  queryMock.mockReset();
+  infoMock.mockReset();
+  process.env.UPSTASH_VECTOR_REST_URL = 'https://test.upstash.io';
+  process.env.UPSTASH_VECTOR_REST_TOKEN = 'test-token';
+});
+
+describe('upsertEntityEmbeddings', () => {
+  it('upserts each entity with the right id format and returns applied hashes', async () => {
+    const result = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'risk',
+      entities: [
+        { id: 'rsk_a', text: 'phishing risk' },
+        { id: 'rsk_b', text: 'data breach risk' },
+      ],
+    });
+    expect(upsertMock).toHaveBeenCalledTimes(2);
+    expect(upsertMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: 'risk_org_1_rsk_a',
+        metadata: expect.objectContaining({
+          organizationId: 'org_1',
+          sourceType: 'risk',
+          sourceId: 'rsk_a',
+        }),
+      }),
+    );
+    expect(upsertMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: 'risk_org_1_rsk_b',
+      }),
+    );
+    expect(result.appliedHashes.map((h) => h.id).sort()).toEqual(['rsk_a', 'rsk_b']);
+    expect(result.appliedHashes.every((h) => /^[a-f0-9]{64}$/.test(h.hash))).toBe(true);
+    expect(result.skippedCount).toBe(0);
+  });
+
+  it('skips entities with empty text', async () => {
+    const result = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: '' },
+        { id: 'tsk_b', text: '   ' },
+        { id: 'tsk_c', text: 'real task' },
+      ],
+    });
+    expect(upsertMock).toHaveBeenCalledTimes(1);
+    expect(upsertMock).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 'task_org_1_tsk_c' }),
+    );
+    expect(result.appliedHashes.map((h) => h.id)).toEqual(['tsk_c']);
+  });
+
+  it('persists department in metadata when provided', async () => {
+    await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: 'hr task', department: Departments.hr },
+      ],
+    });
+    expect(upsertMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        metadata: expect.objectContaining({ department: 'hr' }),
+      }),
+    );
+  });
+
+  it('skips entities whose existing hash matches (no embed, no upsert)', async () => {
+    // First call: capture the hashes Upstash sees written.
+    const first = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: 'unchanged text', department: Departments.hr },
+        { id: 'tsk_b', text: 'also unchanged' },
+      ],
+    });
+    expect(upsertMock).toHaveBeenCalledTimes(2);
+
+    upsertMock.mockClear();
+
+    // Second call with the SAME content + the recorded hashes — should skip.
+    const existing = new Map(first.appliedHashes.map((h) => [h.id, h.hash]));
+    const second = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: 'unchanged text', department: Departments.hr },
+        { id: 'tsk_b', text: 'also unchanged' },
+      ],
+      existingHashes: existing,
+    });
+    expect(upsertMock).not.toHaveBeenCalled();
+    expect(second.appliedHashes).toEqual([]);
+    expect(second.skippedCount).toBe(2);
+  });
+
+  it('only re-embeds entities whose text or department changed', async () => {
+    const first = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: 'original text' },
+        { id: 'tsk_b', text: 'stable text' },
+        { id: 'tsk_c', text: 'no department' },
+      ],
+    });
+    upsertMock.mockClear();
+
+    const existing = new Map(first.appliedHashes.map((h) => [h.id, h.hash]));
+    const second = await upsertEntityEmbeddings({
+      organizationId: 'org_1',
+      kind: 'task',
+      entities: [
+        { id: 'tsk_a', text: 'updated text' }, // text changed → re-embed
+        { id: 'tsk_b', text: 'stable text' }, // unchanged → skip
+        { id: 'tsk_c', text: 'no department', department: Departments.hr }, // dept added → re-embed
+      ],
+      existingHashes: existing,
+    });
+    expect(upsertMock).toHaveBeenCalledTimes(2);
+    expect(second.appliedHashes.map((h) => h.id).sort()).toEqual(['tsk_a', 'tsk_c']);
+    expect(second.skippedCount).toBe(1);
+  });
+});
+
+describe('findSimilarTasks', () => {
+  it('queries with org + sourceType filter and returns id+score+department', async () => {
+    queryMock.mockResolvedValueOnce([
+      { id: 'task_org_1_tsk_a', score: 0.82, metadata: { sourceId: 'tsk_a', department: 'hr' } },
+      { id: 'task_org_1_tsk_b', score: 0.71, metadata: { sourceId: 'tsk_b', department: 'none' } },
+    ]);
+
+    const results = await findSimilarTasks({
+      organizationId: 'org_1',
+      queryText: 'phishing risk',
+      topK: 10,
+    });
+
+    expect(queryMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        topK: 10,
+        includeMetadata: true,
+        filter: 'organizationId = "org_1" AND sourceType = "task"',
+      }),
+    );
+    expect(results).toEqual([
+      { id: 'tsk_a', score: 0.82, department: 'hr' },
+      { id: 'tsk_b', score: 0.71, department: 'none' },
+    ]);
+  });
+
+  it('returns empty when query text is empty', async () => {
+    const results = await findSimilarTasks({
+      organizationId: 'org_1',
+      queryText: '   ',
+    });
+    expect(results).toEqual([]);
+    expect(queryMock).not.toHaveBeenCalled();
+  });
+});
+
+describe('waitForIndexed', () => {
+  function infoResult(pendingVectorCount: number) {
+    return {
+      vectorCount: 100,
+      pendingVectorCount,
+      indexSize: 1024,
+      dimension: 1536,
+      similarityFunction: 'COSINE' as const,
+      namespaces: {},
+    };
+  }
+
+  it('returns immediately when pending count is already zero', async () => {
+    infoMock.mockResolvedValueOnce(infoResult(0));
+
+    const result = await waitForIndexed({ maxWaitMs: 5000, intervalMs: 50 });
+
+    expect(result.polls).toBe(1);
+    expect(result.pendingAtTimeout).toBeUndefined();
+    expect(infoMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('polls until pending drains to zero', async () => {
+    infoMock
+      .mockResolvedValueOnce(infoResult(5))
+      .mockResolvedValueOnce(infoResult(2))
+      .mockResolvedValueOnce(infoResult(0));
+
+    const result = await waitForIndexed({ maxWaitMs: 5000, intervalMs: 10 });
+
+    expect(result.polls).toBe(3);
+    expect(result.pendingAtTimeout).toBeUndefined();
+    expect(infoMock).toHaveBeenCalledTimes(3);
+  });
+
+  it('returns with pendingAtTimeout when the deadline elapses before pending hits zero', async () => {
+    // Always return non-zero pending — the timeout should kick in.
+    infoMock.mockResolvedValue(infoResult(7));
+
+    const result = await waitForIndexed({ maxWaitMs: 80, intervalMs: 20 });
+
+    expect(result.pendingAtTimeout).toBe(7);
+    expect(result.waitedMs).toBeGreaterThanOrEqual(80);
+    // The timeout polls + the trailing diagnostic info() call.
+    expect(infoMock.mock.calls.length).toBeGreaterThanOrEqual(2);
+  });
+});
diff --git a/apps/app/src/lib/embedding/index.ts b/apps/app/src/lib/embedding/index.ts
new file mode 100644
index 0000000000..57c983815f
--- /dev/null
+++ b/apps/app/src/lib/embedding/index.ts
@@ -0,0 +1,249 @@
+import 'server-only';
+
+import { Departments } from '@db';
+import { Index } from '@upstash/vector';
+import { openai } from '@ai-sdk/openai';
+import { embedMany } from 'ai';
+import { createHash } from 'node:crypto';
+
+export type EntityKind = 'risk' | 'vendor' | 'task';
+
+interface EntityInput {
+  id: string;
+  text: string;
+  department?: Departments;
+}
+
+interface UpsertOptions {
+  organizationId: string;
+  kind: EntityKind;
+  entities: EntityInput[];
+  /**
+   * Optional id → hash map of the embeddings currently stored for these
+   * entities. Any entity whose freshly-computed `contentHash` matches its
+   * stored value is skipped — both the OpenAI embedding call AND the
+   * Upstash upsert. Pass an empty map (or omit) to force re-embedding.
+   *
+   * Stored hashes live on `Task/Risk/Vendor.embeddingHash` in Postgres;
+   * `runLinkage` reads them up-front and writes the new hashes back after
+   * upsert via `appliedHashes`.
+   */
+  existingHashes?: Map<string, string>;
+}
+
+export interface UpsertEntityEmbeddingsResult {
+  /** Newly embedded entities that should have their hash persisted. */
+  appliedHashes: Array<{ id: string; hash: string }>;
+  /** How many entities we skipped because their content was unchanged. */
+  skippedCount: number;
+}
+
+interface FindSimilarTasksOptions {
+  organizationId: string;
+  queryText: string;
+  topK?: number;
+}
+
+export interface SimilarTaskResult {
+  id: string; // raw task id (sourceId), not the prefixed embedding id
+  score: number;
+  department?: Departments;
+}
+
+// `text-embedding-3-large` truncated to 1536 dims via Matryoshka. The
+// truncated 1536-dim form of -3-large still outperforms -3-small on MTEB
+// while keeping the existing Upstash Vector index (which is provisioned at
+// 1536 dims) usable as-is. Bumping to the full 3072 dims would require a
+// new index + a one-time re-embed of every org.
+const EMBEDDING_MODEL = 'text-embedding-3-large';
+const EMBEDDING_DIMENSIONS = 1536;
+const DEFAULT_TOP_K = 25;
+
+let cachedIndex: Index | null = null;
+
+function getIndex(): Index {
+  if (cachedIndex) return cachedIndex;
+  const url = process.env.UPSTASH_VECTOR_REST_URL;
+  const token = process.env.UPSTASH_VECTOR_REST_TOKEN;
+  if (!url || !token) {
+    throw new Error(
+      'Upstash Vector is not configured (UPSTASH_VECTOR_REST_URL / UPSTASH_VECTOR_REST_TOKEN)',
+    );
+  }
+  cachedIndex = new Index({ url, token });
+  return cachedIndex;
+}
+
+function embeddingId(kind: EntityKind, organizationId: string, sourceId: string): string {
+  return `${kind}_${organizationId}_${sourceId}`;
+}
+
+/**
+ * Stable hash of everything that determines the stored embedding: the text
+ * (which produces the vector), the model + dimensions (which model produced
+ * it), and the department (which is stored as metadata and returned by
+ * queries). Any change to these fields requires a re-embed AND a re-upsert.
+ *
+ * Exported so callers writing the hash back to Postgres can compute it
+ * exactly the way the upsert path does.
+ */
+export function computeEntityContentHash({
+  text,
+  department,
+}: {
+  text: string;
+  department?: Departments;
+}): string {
+  return createHash('sha256')
+    .update(`${EMBEDDING_MODEL}:${EMBEDDING_DIMENSIONS}:${department ?? ''}:${text}`)
+    .digest('hex');
+}
+
+/**
+ * Upsert per-org entity embeddings into Upstash Vector.
+ *
+ * NOTE: this duplicates a thin slice of `apps/api/src/vector-store/`. Consolidate
+ * into a shared package as a follow-up — keeping it here avoids cross-app imports
+ * for the trigger task without a refactor.
+ */
+export async function upsertEntityEmbeddings({
+  organizationId,
+  kind,
+  entities,
+  existingHashes,
+}: UpsertOptions): Promise<UpsertEntityEmbeddingsResult> {
+  const valid = entities.filter((e) => e.text.trim().length > 0);
+  if (valid.length === 0) return { appliedHashes: [], skippedCount: 0 };
+
+  // Skip entities whose stored hash matches the current content hash —
+  // text + model + dims + department haven't changed, so the existing
+  // vector is still authoritative. Saves the OpenAI embed AND the Upstash
+  // upsert (the two non-trivial costs in this path).
+  const withHashes = valid.map((entity) => ({
+    entity,
+    hash: computeEntityContentHash({ text: entity.text, department: entity.department }),
+  }));
+  const toEmbed = withHashes.filter(
+    ({ entity, hash }) => existingHashes?.get(entity.id) !== hash,
+  );
+  const skippedCount = withHashes.length - toEmbed.length;
+  if (toEmbed.length === 0) {
+    return { appliedHashes: [], skippedCount };
+  }
+
+  const { embeddings } = await embedMany({
+    model: openai.embedding(EMBEDDING_MODEL),
+    values: toEmbed.map(({ entity }) => entity.text),
+    providerOptions: { openai: { dimensions: EMBEDDING_DIMENSIONS } },
+  });
+
+  const index = getIndex();
+  await Promise.all(
+    toEmbed.map(({ entity }, i) =>
+      index.upsert({
+        id: embeddingId(kind, organizationId, entity.id),
+        vector: embeddings[i],
+        metadata: {
+          organizationId,
+          sourceType: kind,
+          sourceId: entity.id,
+          content: entity.text.substring(0, 1000),
+          ...(entity.department ? { department: entity.department } : {}),
+        },
+      }),
+    ),
+  );
+
+  return {
+    appliedHashes: toEmbed.map(({ entity, hash }) => ({ id: entity.id, hash })),
+    skippedCount,
+  };
+}
+
+/**
+ * Find the top-K most similar Tasks in an org for a given query string.
+ * Returns raw task ids (not prefixed embedding ids) along with score + department.
+ */
+export async function findSimilarTasks({
+  organizationId,
+  queryText,
+  topK = DEFAULT_TOP_K,
+}: FindSimilarTasksOptions): Promise<SimilarTaskResult[]> {
+  if (!queryText.trim()) return [];
+
+  const { embeddings } = await embedMany({
+    model: openai.embedding(EMBEDDING_MODEL),
+    values: [queryText],
+    providerOptions: { openai: { dimensions: EMBEDDING_DIMENSIONS } },
+  });
+
+  const index = getIndex();
+  const results = await index.query({
+    vector: embeddings[0],
+    topK,
+    includeMetadata: true,
+    filter: `organizationId = "${organizationId}" AND sourceType = "task"`,
+  });
+
+  return results.map((r) => {
+    const meta = (r.metadata ?? {}) as { sourceId?: string; department?: string };
+    return {
+      id: meta.sourceId ?? String(r.id),
+      score: r.score,
+      department: meta.department ? (meta.department as Departments) : undefined,
+    };
+  });
+}
+
+interface WaitForIndexedOptions {
+  /** Hard ceiling. Resolves with `pendingAtTimeout` set if exceeded. */
+  maxWaitMs?: number;
+  /** Poll cadence. */
+  intervalMs?: number;
+}
+
+export interface WaitForIndexedResult {
+  waitedMs: number;
+  polls: number;
+  /** Defined only when we hit `maxWaitMs` without reaching pending=0. */
+  pendingAtTimeout?: number;
+}
+
+/**
+ * Block until Upstash Vector has finished indexing every previously-upserted
+ * vector (i.e. `info().pendingVectorCount === 0`).
+ *
+ * Upstash returns 200 from `upsert` as soon as the write is durable, but the
+ * HNSW index is built asynchronously. Vectors sit in `pendingVectorCount` for
+ * a few hundred ms to several seconds before they become queryable. Querying
+ * during that window returns empty results for the not-yet-indexed IDs even
+ * though the upsert succeeded — see ENG-221 for the race we hit during
+ * onboarding (6 of 11 risks got 0 cosine candidates because their queries
+ * raced ahead of indexing).
+ *
+ * Call this AFTER `upsertEntityEmbeddings` and BEFORE any query that depends
+ * on the just-written vectors being searchable.
+ */
+export async function waitForIndexed({
+  maxWaitMs = 30_000,
+  intervalMs = 250,
+}: WaitForIndexedOptions = {}): Promise<WaitForIndexedResult> {
+  const index = getIndex();
+  const start = Date.now();
+  let polls = 0;
+  while (Date.now() - start < maxWaitMs) {
+    polls += 1;
+    const info = await index.info();
+    if (info.pendingVectorCount === 0) {
+      return { waitedMs: Date.now() - start, polls };
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+  // Timed out — fetch one more time so the caller can log how far behind we are.
+  const final = await index.info().catch(() => null);
+  return {
+    waitedMs: Date.now() - start,
+    polls,
+    pendingAtTimeout: final?.pendingVectorCount,
+  };
+}
diff --git a/apps/app/src/lib/embedding/run-linkage.spec.ts b/apps/app/src/lib/embedding/run-linkage.spec.ts
new file mode 100644
index 0000000000..661dce997b
--- /dev/null
+++ b/apps/app/src/lib/embedding/run-linkage.spec.ts
@@ -0,0 +1,705 @@
+import { Departments } from '@db';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { LinkagePhase } from './run-linkage';
+
+const { dbMock, upsertMock, findSimilarTasksMock, waitForIndexedMock, rerankMock } = vi.hoisted(() => ({
+  dbMock: {
+    risk: { findMany: vi.fn(), update: vi.fn() },
+    vendor: { findMany: vi.fn(), update: vi.fn() },
+    task: { findMany: vi.fn(), update: vi.fn() },
+  },
+  upsertMock: vi.fn(),
+  findSimilarTasksMock: vi.fn(),
+  waitForIndexedMock: vi.fn(),
+  rerankMock: vi.fn(),
+}));
+
+function emptyControls() {
+  // Default `task.findMany` shape for the suggestions-enrichment lookup.
+  return [] as unknown[];
+}
+
+vi.mock('@db/server', () => ({ db: dbMock }));
+
+vi.mock('./index', () => ({
+  upsertEntityEmbeddings: upsertMock,
+  findSimilarTasks: findSimilarTasksMock,
+  waitForIndexed: waitForIndexedMock,
+}));
+
+vi.mock('../rerank-suggestions', () => ({
+  rerankSuggestions: rerankMock,
+}));
+
+import { runLinkage } from './run-linkage';
+
+beforeEach(() => {
+  upsertMock.mockReset();
+  findSimilarTasksMock.mockReset();
+  waitForIndexedMock.mockReset();
+  // Default: index is already drained — runLinkage proceeds immediately.
+  // Tests that exercise the race resolve `findSimilarTasks` differently
+  // depending on call order rather than blocking on the wait.
+  waitForIndexedMock.mockResolvedValue({ waitedMs: 0, polls: 1 });
+  // Default: every entity is embedded as if for the first time. Tests that
+  // exercise the cache-skip path override this per-test.
+  upsertMock.mockImplementation(async ({ entities }: { entities: Array<{ id: string }> }) => ({
+    appliedHashes: entities.map((e) => ({ id: e.id, hash: `hash_${e.id}` })),
+    skippedCount: 0,
+  }));
+  rerankMock.mockReset();
+  // Default reranker pass-through: scale cosine 0-1 → 0-10 so existing tests
+  // that don't explicitly mock the reranker still get a deterministic order.
+  rerankMock.mockImplementation(async ({ candidates }: { candidates: Array<{ id: string; cosineScore: number }> }) =>
+    candidates
+      .map((c) => ({ id: c.id, cosineScore: c.cosineScore, rerankScore: c.cosineScore * 10 }))
+      .sort((a, b) => b.rerankScore - a.rerankScore),
+  );
+  Object.values(dbMock).forEach((m) =>
+    Object.values(m as Record<string, ReturnType<typeof vi.fn>>).forEach((fn) => fn.mockReset()),
+  );
+});
+
+describe('runLinkage onPhase', () => {
+  it('emits starting then done with zero counts when org has no tasks', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([]);
+
+    const phases: LinkagePhase[] = [];
+    await runLinkage({ organizationId: 'org_1', onPhase: (p) => phases.push(p) });
+
+    expect(phases.map((p) => p.name)).toEqual(['starting', 'done']);
+    expect(phases[1]).toEqual({ name: 'done', riskLinks: 0, vendorLinks: 0 });
+  });
+
+  it('emits embedding + matching phases with correct counts for a single risk', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'Awareness', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    const phases: LinkagePhase[] = [];
+    await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      onPhase: (p) => phases.push(p),
+    });
+
+    const names = phases.map((p) => p.name);
+    expect(names[0]).toBe('starting');
+    expect(names).toContain('embedding-tasks');
+    expect(names).toContain('embedding-risks');
+    expect(names).toContain('matching-risks');
+    expect(phases[phases.length - 1]).toEqual({
+      name: 'done',
+      riskLinks: 1,
+      vendorLinks: 0,
+    });
+  });
+
+  it('does not emit embedding-vendors when vendors list is empty', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'a',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 't', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    const phases: LinkagePhase[] = [];
+    await runLinkage({ organizationId: 'org_1', onPhase: (p) => phases.push(p) });
+
+    expect(phases.some((p) => p.name === 'embedding-vendors')).toBe(false);
+    expect(phases.some((p) => p.name === 'matching-vendors')).toBe(false);
+  });
+
+  it('does not invoke onPhase when caller omits the callback', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([]);
+
+    await expect(runLinkage({ organizationId: 'org_1' })).resolves.toEqual({
+      riskLinks: 0,
+      vendorLinks: 0,
+    });
+  });
+
+  it('replace=true disconnects all tasks before linking', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'awareness', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    await runLinkage({ organizationId: 'org_1', riskId: 'rsk_1', replace: true });
+
+    // Expect disconnect-all (set: []) BEFORE the connect call. Filter to
+    // only the task-link writes; embeddingHash writes intersperse them.
+    const linkCalls = dbMock.risk.update.mock.calls
+      .map((c) => c[0])
+      .filter((arg) => arg.data?.tasks !== undefined);
+    expect(linkCalls[0]).toEqual({
+      where: { id: 'rsk_1' },
+      data: { tasks: { set: [] } },
+    });
+    expect(linkCalls[1]).toEqual({
+      where: { id: 'rsk_1' },
+      data: { tasks: { connect: [{ id: 'tsk_a' }] } },
+    });
+  });
+
+  it('replace=true on a vendor disconnects vendor tasks', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([
+      { id: 'vnd_1', name: 'V', description: '', category: 'software_as_a_service' },
+    ]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'review', description: '', department: Departments.gov },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.gov },
+    ]);
+
+    await runLinkage({ organizationId: 'org_1', vendorId: 'vnd_1', replace: true });
+
+    const linkCalls = dbMock.vendor.update.mock.calls
+      .map((c) => c[0])
+      .filter((arg) => arg.data?.tasks !== undefined);
+    expect(linkCalls[0]).toEqual({
+      where: { id: 'vnd_1' },
+      data: { tasks: { set: [] } },
+    });
+  });
+
+  it('suggestionsOnly=true does NOT call db.risk.update and returns suggestions', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany
+      .mockResolvedValueOnce([
+        { id: 'tsk_a', title: 'Awareness', description: '', department: Departments.hr },
+        { id: 'tsk_b', title: 'MFA', description: '', department: Departments.hr },
+      ])
+      // Enrichment lookup for suggestions.
+      .mockResolvedValueOnce([
+        {
+          id: 'tsk_a',
+          title: 'Awareness',
+          status: 'todo',
+          controls: [
+            {
+              id: 'ctl_1',
+              name: 'Security Awareness',
+              requirementsMapped: [
+                {
+                  frameworkInstance: { framework: { name: 'SOC 2' } },
+                  requirement: { identifier: 'CC1.1' },
+                  customRequirement: null,
+                },
+              ],
+            },
+          ],
+        },
+        {
+          id: 'tsk_b',
+          title: 'MFA',
+          status: 'in_progress',
+          controls: [
+            {
+              id: 'ctl_1',
+              name: 'Security Awareness',
+              requirementsMapped: [
+                {
+                  frameworkInstance: { framework: { name: 'SOC 2' } },
+                  requirement: { identifier: 'CC1.1' },
+                  customRequirement: null,
+                },
+              ],
+            },
+            {
+              id: 'ctl_2',
+              name: 'MFA Required',
+              requirementsMapped: [
+                {
+                  frameworkInstance: { framework: { name: 'SOC 2' } },
+                  requirement: { identifier: 'CC6.1' },
+                  customRequirement: null,
+                },
+              ],
+            },
+          ],
+        },
+      ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+      { id: 'tsk_b', score: 0.95, department: Departments.hr },
+    ]);
+
+    const result = await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      suggestionsOnly: true,
+    });
+
+    // No task-link persistence (the embeddingHash write is allowed —
+    // suggestionsOnly still upserts vectors and should record their hashes
+    // so subsequent runs can dedup).
+    const linkCalls = dbMock.risk.update.mock.calls
+      .map((c) => c[0])
+      .filter((arg) => arg.data?.tasks !== undefined);
+    expect(linkCalls).toHaveLength(0);
+
+    // Suggestions populated and pinned to the risk.
+    expect(result.suggestions?.forRiskId).toBe('rsk_1');
+    expect(result.suggestions?.tasks.map((t) => t.id).sort()).toEqual(['tsk_a', 'tsk_b']);
+
+    // Controls deduped by id (ctl_1 appears in both tasks but should only show once).
+    const controlIds = result.suggestions?.controls.map((c) => c.id) ?? [];
+    expect(controlIds).toHaveLength(2);
+    expect(controlIds).toContain('ctl_1');
+    expect(controlIds).toContain('ctl_2');
+
+    // ctl_1 should carry the higher of the two task scores. linkSuggestions
+    // applies a +0.05 same-department boost, so raw 0.95 → 1.00 (tsk_b) and
+    // 0.9 → 0.95 (tsk_a). The dedupe should keep the larger score.
+    const ctl1 = result.suggestions?.controls.find((c) => c.id === 'ctl_1');
+    expect(ctl1?.score).toBeCloseTo(1.0, 5);
+    expect(ctl1?.code).toBe('CC1.1');
+    expect(ctl1?.framework).toBe('SOC 2');
+    // viaTaskIds includes both tasks that brought it in.
+    expect(ctl1?.viaTaskIds.sort()).toEqual(['tsk_a', 'tsk_b']);
+  });
+
+  it('suggestionsOnly=true wins over replace=true (no DB writes)', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'a',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany
+      .mockResolvedValueOnce([
+        { id: 'tsk_a', title: 'b', description: '', department: Departments.hr },
+      ])
+      .mockResolvedValueOnce([
+        { id: 'tsk_a', title: 'b', status: 'todo', controls: [] },
+      ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    void emptyControls();
+
+    await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      replace: true,
+      suggestionsOnly: true,
+    });
+
+    // suggestionsOnly wins → no link persistence. Hash writes still allowed.
+    const linkCalls = dbMock.risk.update.mock.calls
+      .map((c) => c[0])
+      .filter((arg) => arg.data?.tasks !== undefined);
+    expect(linkCalls).toHaveLength(0);
+  });
+
+  it('suggestionsOnly=true reorders by LLM rerank score, not cosine', async () => {
+    // Cosine ranks tsk_noise above tsk_real, but the reranker (the precision
+    // step we added precisely for this case) boosts tsk_real to the top.
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Data Leakage via Personal Laptops',
+        description: 'Laptops can be lost or compromised',
+        category: 'technology',
+        department: Departments.it,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany
+      .mockResolvedValueOnce([
+        { id: 'tsk_real', title: 'Secure Devices', description: 'BitLocker, FileVault, MDM', department: Departments.it },
+        { id: 'tsk_noise', title: 'Office Door Monitoring', description: 'Physical access', department: Departments.it },
+      ])
+      // Enrichment lookup for buildSuggestions.
+      .mockResolvedValueOnce([
+        { id: 'tsk_real', title: 'Secure Devices', status: 'todo', controls: [] },
+        { id: 'tsk_noise', title: 'Office Door Monitoring', status: 'todo', controls: [] },
+      ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_noise', score: 0.7, department: Departments.it },
+      { id: 'tsk_real', score: 0.55, department: Departments.it },
+    ]);
+    // Override the default pass-through: the LLM says tsk_real is the primary
+    // control (10) and tsk_noise is irrelevant (1).
+    rerankMock.mockImplementationOnce(async () => [
+      { id: 'tsk_real', cosineScore: 0.55, rerankScore: 10 },
+      { id: 'tsk_noise', cosineScore: 0.7, rerankScore: 1 },
+    ]);
+
+    const result = await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      suggestionsOnly: true,
+    });
+
+    expect(result.suggestions?.tasks.map((t) => t.id)).toEqual(['tsk_real', 'tsk_noise']);
+    expect(result.suggestions?.tasks[0].score).toBe(1.0); // 10/10 → 1.0
+    expect(result.suggestions?.tasks[1].score).toBeCloseTo(0.1, 5); // 1/10 → 0.1
+    expect(rerankMock).toHaveBeenCalledTimes(1);
+    expect(rerankMock.mock.calls[0][0].source).toEqual({
+      kind: 'risk',
+      title: 'Data Leakage via Personal Laptops',
+      description: 'Laptops can be lost or compromised',
+      category: 'technology',
+      department: Departments.it,
+    });
+  });
+
+  it('suggestionsOnly=true falls back to cosine ordering when reranker throws', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'a',
+        description: 'b',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany
+      .mockResolvedValueOnce([
+        { id: 'tsk_a', title: 'A', description: 'a', department: Departments.hr },
+        { id: 'tsk_b', title: 'B', description: 'b', department: Departments.hr },
+      ])
+      .mockResolvedValueOnce([
+        { id: 'tsk_a', title: 'A', status: 'todo', controls: [] },
+        { id: 'tsk_b', title: 'B', status: 'todo', controls: [] },
+      ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.6, department: Departments.hr },
+      { id: 'tsk_b', score: 0.9, department: Departments.hr },
+    ]);
+    rerankMock.mockRejectedValueOnce(new Error('OpenAI down'));
+
+    const result = await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      suggestionsOnly: true,
+    });
+
+    // Fallback: ordered by cosine desc (with dept boost: 0.95, 0.65).
+    expect(result.suggestions?.tasks.map((t) => t.id)).toEqual(['tsk_b', 'tsk_a']);
+  });
+
+  it('replace=false (default) does not disconnect existing links', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'a',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'b', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    await runLinkage({ organizationId: 'org_1', riskId: 'rsk_1' });
+
+    // No `set: []` (disconnect) call should appear. embeddingHash writes
+    // and the connect call are fine; we just want to confirm we didn't
+    // wipe existing links.
+    const setCalls = dbMock.risk.update.mock.calls
+      .map((c) => c[0])
+      .filter((arg) => arg.data?.tasks?.set !== undefined);
+    expect(setCalls).toHaveLength(0);
+  });
+});
+
+describe('runLinkage waits for the vector index to drain before matching', () => {
+  // ENG-221: 6 of 11 risks landed with 0 cosine candidates because their
+  // queries fired before Upstash had finished indexing the just-upserted
+  // task vectors. These tests pin the fix in place.
+
+  it('emits waiting-for-index between embedding and matching phases', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'Awareness', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    const phases: LinkagePhase[] = [];
+    await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      onPhase: (p) => phases.push(p),
+    });
+
+    const names = phases.map((p) => p.name);
+    const embeddingTasksAt = names.indexOf('embedding-tasks');
+    const waitAt = names.indexOf('waiting-for-index');
+    const matchingAt = names.indexOf('matching-risks');
+
+    expect(embeddingTasksAt).toBeGreaterThanOrEqual(0);
+    expect(waitAt).toBeGreaterThan(embeddingTasksAt);
+    expect(matchingAt).toBeGreaterThan(waitAt);
+  });
+
+  it('blocks findSimilarTasks until waitForIndexed resolves (race-condition guard)', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'Awareness', description: '', department: Departments.hr },
+    ]);
+
+    // Track call order: any `findSimilarTasks` call before `waitForIndexed`
+    // resolves would be a regression.
+    const eventLog: string[] = [];
+    let resolveWait: (() => void) | null = null;
+    waitForIndexedMock.mockImplementationOnce(
+      () =>
+        new Promise<{ waitedMs: number; polls: number }>((resolve) => {
+          eventLog.push('waitForIndexed:invoked');
+          resolveWait = () => {
+            eventLog.push('waitForIndexed:resolved');
+            resolve({ waitedMs: 250, polls: 2 });
+          };
+        }),
+    );
+    findSimilarTasksMock.mockImplementationOnce(async () => {
+      eventLog.push('findSimilarTasks:invoked');
+      return [{ id: 'tsk_a', score: 0.9, department: Departments.hr }];
+    });
+
+    const runPromise = runLinkage({ organizationId: 'org_1', riskId: 'rsk_1' });
+
+    // Yield enough microtasks for runLinkage to reach the wait. Without the
+    // fix, findSimilarTasks would have been called by now.
+    await new Promise((r) => setTimeout(r, 20));
+    expect(eventLog).toEqual(['waitForIndexed:invoked']);
+    expect(findSimilarTasksMock).not.toHaveBeenCalled();
+
+    resolveWait!();
+    await runPromise;
+
+    expect(eventLog).toEqual([
+      'waitForIndexed:invoked',
+      'waitForIndexed:resolved',
+      'findSimilarTasks:invoked',
+    ]);
+  });
+
+  it('persists the new embedding hash on each entity that was actually re-embedded', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+        embeddingHash: null,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      {
+        id: 'tsk_a',
+        title: 'Awareness',
+        description: '',
+        department: Departments.hr,
+        embeddingHash: null,
+      },
+      {
+        id: 'tsk_b',
+        title: 'Cached MFA',
+        description: '',
+        department: Departments.hr,
+        embeddingHash: 'old_hash_b',
+      },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+    // Tasks: tsk_a is re-embedded with new hash, tsk_b is cached.
+    upsertMock.mockImplementation(async ({ kind, entities }: { kind: string; entities: Array<{ id: string }> }) => {
+      if (kind === 'task') {
+        return {
+          appliedHashes: [{ id: 'tsk_a', hash: 'new_hash_a' }],
+          skippedCount: 1,
+        };
+      }
+      return {
+        appliedHashes: entities.map((e) => ({ id: e.id, hash: `hash_${e.id}` })),
+        skippedCount: 0,
+      };
+    });
+
+    await runLinkage({ organizationId: 'org_1', riskId: 'rsk_1' });
+
+    // tsk_a got the hash write; tsk_b was cached so no write.
+    const taskUpdateCalls = dbMock.task.update.mock.calls.map((c) => c[0]);
+    const hashWrite = taskUpdateCalls.find(
+      (call) => call.where.id === 'tsk_a' && call.data.embeddingHash === 'new_hash_a',
+    );
+    expect(hashWrite).toBeDefined();
+    expect(
+      taskUpdateCalls.some(
+        (call) => call.where.id === 'tsk_b' && call.data.embeddingHash !== undefined,
+      ),
+    ).toBe(false);
+
+    // The risk also got embedded (it had null hash) → write its new hash.
+    const riskUpdateCalls = dbMock.risk.update.mock.calls.map((c) => c[0]);
+    expect(
+      riskUpdateCalls.some(
+        (call) => call.where.id === 'rsk_1' && call.data.embeddingHash === 'hash_rsk_1',
+      ),
+    ).toBe(true);
+  });
+
+  it('skips the index wait when every embedding is served from the cache', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+        embeddingHash: 'cached',
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      {
+        id: 'tsk_a',
+        title: 'Awareness',
+        description: '',
+        department: Departments.hr,
+        embeddingHash: 'cached',
+      },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+    // Simulate every entity hitting the cache — no new vectors written.
+    upsertMock.mockImplementation(async ({ entities }: { entities: Array<{ id: string }> }) => ({
+      appliedHashes: [],
+      skippedCount: entities.length,
+    }));
+
+    const phases: LinkagePhase[] = [];
+    await runLinkage({
+      organizationId: 'org_1',
+      riskId: 'rsk_1',
+      onPhase: (p) => phases.push(p),
+    });
+
+    // No upserts → no need to wait for the index to drain.
+    expect(waitForIndexedMock).not.toHaveBeenCalled();
+    expect(phases.some((p) => p.name === 'waiting-for-index')).toBe(false);
+  });
+
+  it('still proceeds when the index wait times out (logs but does not throw)', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: '',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'Awareness', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    waitForIndexedMock.mockResolvedValueOnce({
+      waitedMs: 30_000,
+      polls: 120,
+      pendingAtTimeout: 4,
+    });
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+    const result = await runLinkage({ organizationId: 'org_1', riskId: 'rsk_1' });
+
+    // Linkage still completes — the floor mechanism downstream protects us
+    // from zero-link risks even when some vectors are still pending.
+    expect(result.riskLinks).toBeGreaterThan(0);
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+});
diff --git a/apps/app/src/lib/embedding/run-linkage.ts b/apps/app/src/lib/embedding/run-linkage.ts
new file mode 100644
index 0000000000..b1954be0a1
--- /dev/null
+++ b/apps/app/src/lib/embedding/run-linkage.ts
@@ -0,0 +1,767 @@
+import { db } from '@db/server';
+import { upsertEntityEmbeddings, findSimilarTasks, waitForIndexed } from './index';
+import { linkSuggestions } from '../link-suggestions';
+import {
+  rerankSuggestions,
+  type RerankCandidate,
+  type RerankedCandidate,
+  type RerankSource,
+} from '../rerank-suggestions';
+
+/**
+ * Phase emitted by `runLinkage` via the optional `onPhase` callback.
+ *
+ * Consumed by the trigger.dev wrapper to mirror progress into run metadata so
+ * the frontend can render a live progress indicator via `useRealtimeRun`.
+ */
+export type LinkagePhase =
+  | { name: 'starting' }
+  | { name: 'embedding-tasks'; current: number; total: number }
+  | { name: 'embedding-risks'; current: number; total: number }
+  | { name: 'embedding-vendors'; current: number; total: number }
+  /**
+   * Upstash Vector indexes upserted vectors asynchronously — emitted between
+   * the embedding phase and matching phase while we poll `info()` until
+   * `pendingVectorCount === 0`. Without this gate, the cosine queries can
+   * race ahead of indexing and silently return zero candidates.
+   */
+  | { name: 'waiting-for-index' }
+  | { name: 'matching-risks'; current: number; total: number }
+  | { name: 'matching-vendors'; current: number; total: number }
+  | { name: 'done'; riskLinks: number; vendorLinks: number };
+
+export interface RunLinkageInput {
+  organizationId: string;
+  /** When set, only link this single risk. */
+  riskId?: string;
+  /** When set, only link this single vendor. */
+  vendorId?: string;
+  /**
+   * When `true`, disconnect ALL existing task links on the in-scope risk(s) /
+   * vendor(s) before running the embedding match. This is destructive — it
+   * wipes any manual unlinks the user made. Default `false` (additive).
+   */
+  replace?: boolean;
+  /**
+   * When `true`, runs the embedding + matching loop but DOES NOT persist any
+   * task connections. The output includes a `suggestions` block the caller
+   * can render in a review-before-apply UI. Mutually exclusive with `replace`
+   * — when both are passed, suggestionsOnly wins (no DB writes).
+   */
+  suggestionsOnly?: boolean;
+  /**
+   * Optional progress callback. The trigger.dev wrapper passes this and writes
+   * each phase to `metadata.set(...)` so the UI can subscribe via realtime.
+   * Pure callers (e.g. tests, server-side scripts) can omit it.
+   */
+  onPhase?: (phase: LinkagePhase) => void;
+}
+
+export interface SuggestedTask {
+  id: string;
+  title: string;
+  status: string;
+  score: number;
+}
+
+export interface SuggestedControl {
+  id: string;
+  code: string;
+  name: string;
+  framework: string;
+  /** Highest score of any suggested task that brought this control in. */
+  score: number;
+  /** Task ids that introduced this control (used by the UI to dim derived rows). */
+  viaTaskIds: string[];
+}
+
+export interface RunLinkageOutput {
+  riskLinks: number;
+  vendorLinks: number;
+  suggestions?: {
+    forRiskId?: string;
+    forVendorId?: string;
+    tasks: SuggestedTask[];
+    controls: SuggestedControl[];
+  };
+}
+
+const RISK_QUERY_TOP_K = 25;
+// In review-before-apply mode we go wide on recall (50 candidates from the
+// vector store, no threshold filter, top-30 by cosine fed to the reranker),
+// then let the LLM reranker do the precision step and surface the final 15.
+// Cosine alone collapses into a tight 0.6 band on short compliance prose, so
+// it's bad at ordering — but fine at "show me 30 that are at least related".
+const SUGGESTIONS_QUERY_TOP_K = 50;
+const SUGGESTIONS_RERANK_INPUT_TOP_K = 30;
+const SUGGESTIONS_FINAL_TOP_K = 15;
+
+// Autonomous (onboarding bulk) linking shares the same recall + rerank
+// pipeline as suggestions-only. We persist any match scored ≥ 5/10 by
+// the reranker (high confidence) AND always keep at least the top-N
+// reranker scores so a risk never lands with zero linked work just
+// because the LLM was conservative on a niche subject — the user can
+// always unlink, but starting from "nothing" is worse UX than starting
+// from "decent matches the user can review".
+const AUTONOMOUS_QUERY_TOP_K = 50;
+const AUTONOMOUS_RERANK_INPUT_TOP_K = 30;
+const AUTONOMOUS_FINAL_TOP_K = 8;
+const AUTONOMOUS_MIN_RERANK_SCORE = 5;
+const AUTONOMOUS_MIN_LINKS_FLOOR = 3;
+
+// How many risks/vendors to match concurrently in the bulk onboarding path.
+// Each iteration makes 1 vector query (Upstash) + 1 OpenAI rerank call + 1
+// Prisma update — typical wall-clock per iteration is 3–10 seconds (the
+// rerank LLM call dominates). With 32 in-flight at once a 20-entity
+// onboarding finishes in roughly one batch, well within gpt-5-mini /
+// Upstash rate limits.
+//
+// NOTE: this is in-process concurrency on a single trigger.dev task. The
+// natural next step (true fan-out per entity using `task.batchTrigger`)
+// would unlock trigger.dev's queue-level concurrency (50), but requires
+// passing the embedded-task metadata to children rather than rebuilding
+// taskById per child. Filed as a follow-up.
+const MATCH_CONCURRENCY = 32;
+
+async function mapWithConcurrency<T, R>(
+  items: T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results: R[] = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    for (;;) {
+      const i = next++;
+      if (i >= items.length) return;
+      results[i] = await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}
+
+function riskQueryText(risk: {
+  title: string;
+  description: string;
+  category: string;
+  department: string | null;
+}): string {
+  return [
+    risk.title,
+    risk.description,
+    `Category: ${risk.category}`,
+    risk.department ? `Department: ${risk.department}` : null,
+  ]
+    .filter(Boolean)
+    .join('\n');
+}
+
+function vendorQueryText(vendor: {
+  name: string;
+  description: string;
+  category: string;
+}): string {
+  return [vendor.name, vendor.description, `Category: ${vendor.category}`].join('\n');
+}
+
+function taskQueryText(t: { title: string; description: string }): string {
+  return [t.title, t.description].filter(Boolean).join('\n');
+}
+
+interface RawTaskWithControls {
+  id: string;
+  title: string;
+  status: string;
+  controls: Array<{
+    id: string;
+    name: string;
+    requirementsMapped: Array<{
+      frameworkInstance: { framework: { name: string } } | null;
+      requirement: { identifier: string } | null;
+      customRequirement: { identifier: string } | null;
+    }>;
+  }>;
+}
+
+/**
+ * Build SuggestedTask + SuggestedControl arrays for a single source entity
+ * given the candidate task ids + scores returned by the matching step.
+ */
+async function buildSuggestions({
+  organizationId,
+  taskScores,
+}: {
+  organizationId: string;
+  taskScores: Map<string, number>;
+}): Promise<{ tasks: SuggestedTask[]; controls: SuggestedControl[] }> {
+  const ids = [...taskScores.keys()];
+  if (ids.length === 0) return { tasks: [], controls: [] };
+
+  const enriched = (await db.task.findMany({
+    where: { id: { in: ids }, organizationId },
+    select: {
+      id: true,
+      title: true,
+      status: true,
+      controls: {
+        select: {
+          id: true,
+          name: true,
+          requirementsMapped: {
+            select: {
+              frameworkInstance: {
+                select: { framework: { select: { name: true } } },
+              },
+              requirement: { select: { identifier: true } },
+              customRequirement: { select: { identifier: true } },
+            },
+          },
+        },
+      },
+    },
+  })) as unknown as RawTaskWithControls[];
+
+  // Sort by score desc so deterministic ordering survives the trip.
+  const tasks: SuggestedTask[] = enriched
+    .map((t) => ({
+      id: t.id,
+      title: t.title,
+      status: t.status,
+      score: taskScores.get(t.id) ?? 0,
+    }))
+    .sort((a, b) => b.score - a.score);
+
+  const byId = new Map<string, SuggestedControl>();
+  for (const t of enriched) {
+    const taskScore = taskScores.get(t.id) ?? 0;
+    for (const c of t.controls) {
+      const mapping = c.requirementsMapped[0];
+      const code =
+        mapping?.requirement?.identifier ?? mapping?.customRequirement?.identifier ?? c.id;
+      const framework = mapping?.frameworkInstance?.framework?.name ?? 'Custom';
+      const existing = byId.get(c.id);
+      if (existing) {
+        if (taskScore > existing.score) existing.score = taskScore;
+        if (!existing.viaTaskIds.includes(t.id)) existing.viaTaskIds.push(t.id);
+        continue;
+      }
+      byId.set(c.id, {
+        id: c.id,
+        code,
+        name: c.name,
+        framework,
+        score: taskScore,
+        viaTaskIds: [t.id],
+      });
+    }
+  }
+
+  const controls = [...byId.values()].sort((a, b) => b.score - a.score);
+  return { tasks, controls };
+}
+
+/**
+ * Run the LLM reranker against the cosine candidates and return a final score
+ * map (0-1, scaled from the reranker's 0-10 so it slots into the existing
+ * SuggestedTask `score` field). Falls back to cosine ordering if the reranker
+ * call fails so a transient OpenAI outage doesn't break the suggestions UI.
+ */
+async function rerankAndBuildScoreMap({
+  source,
+  links,
+  taskById,
+}: {
+  source: RerankSource;
+  links: Array<{ id: string; score: number }>;
+  taskById: Map<string, { id: string; title: string; description: string }>;
+}): Promise<Map<string, number>> {
+  const candidates: RerankCandidate[] = [];
+  for (const l of links) {
+    const t = taskById.get(l.id);
+    if (!t) continue;
+    candidates.push({
+      id: l.id,
+      title: t.title,
+      description: t.description,
+      cosineScore: l.score,
+    });
+  }
+  if (candidates.length === 0) return new Map();
+
+  let reranked: RerankedCandidate[];
+  try {
+    console.info(
+      `[linkage] reranking ${candidates.length} candidates for ${source.kind} "${source.title}"`,
+    );
+    const t0 = Date.now();
+    reranked = await rerankSuggestions({ source, candidates });
+    const top10 = reranked.slice(0, 10).map((r) => `${r.id}=${r.rerankScore.toFixed(1)}`);
+    console.info(
+      `[linkage] rerank done in ${((Date.now() - t0) / 1000).toFixed(2)}s; top: ${top10.join(', ')}`,
+    );
+  } catch (err) {
+    console.error('[linkage] rerank failed; falling back to cosine', err);
+    reranked = candidates
+      .map((c) => ({
+        id: c.id,
+        cosineScore: c.cosineScore,
+        rerankScore: c.cosineScore * 10,
+      }))
+      .sort((a, b) => b.rerankScore - a.rerankScore);
+  }
+
+  const top = reranked.slice(0, SUGGESTIONS_FINAL_TOP_K);
+  return new Map(top.map((r) => [r.id, r.rerankScore / 10]));
+}
+
+/**
+ * Autonomous-path variant: same recall + rerank pipeline as suggestionsOnly,
+ * but returns the IDs to persist directly. Filters by a minimum reranker
+ * score so we only auto-link confidently-relevant work — the user isn't
+ * reviewing these, so false positives stick until manually unlinked.
+ */
+async function rerankForAutonomousPersist({
+  source,
+  links,
+  taskById,
+}: {
+  source: RerankSource;
+  links: Array<{ id: string; score: number }>;
+  taskById: Map<string, { id: string; title: string; description: string }>;
+}): Promise<string[]> {
+  const candidates: RerankCandidate[] = [];
+  for (const l of links) {
+    const t = taskById.get(l.id);
+    if (!t) continue;
+    candidates.push({
+      id: l.id,
+      title: t.title,
+      description: t.description,
+      cosineScore: l.score,
+    });
+  }
+  if (candidates.length === 0) return [];
+
+  let reranked: RerankedCandidate[];
+  try {
+    reranked = await rerankSuggestions({ source, candidates });
+  } catch (err) {
+    console.error('[linkage] autonomous rerank failed; falling back to cosine', err);
+    reranked = candidates
+      .map((c) => ({
+        id: c.id,
+        cosineScore: c.cosineScore,
+        rerankScore: c.cosineScore * 10,
+      }))
+      .sort((a, b) => b.rerankScore - a.rerankScore);
+  }
+
+  // Sorted desc by rerankScore (rerankSuggestions guarantees this).
+  const highConfidence = reranked.filter(
+    (r) => r.rerankScore >= AUTONOMOUS_MIN_RERANK_SCORE,
+  );
+  // If the reranker was conservative for this entity, fall back to the
+  // top-N by score so the risk isn't left with zero links. The user
+  // reviews via the Linked Work column; better to have 3 decent matches
+  // than nothing.
+  const finalList =
+    highConfidence.length >= AUTONOMOUS_MIN_LINKS_FLOOR
+      ? highConfidence
+      : reranked.slice(0, AUTONOMOUS_MIN_LINKS_FLOOR);
+  return finalList.slice(0, AUTONOMOUS_FINAL_TOP_K).map((r) => r.id);
+}
+
+/**
+ * Embeds the org's risks/vendors/tasks (idempotent), then for each risk and
+ * vendor in scope finds the top-K similar tasks above the threshold and
+ * persists `Risk.tasks` / `Vendor.tasks` connections via Prisma.
+ *
+ * Used by both the onboarding trigger task and the on-demand API endpoints,
+ * so the API route can return the real link count without polling a trigger.
+ *
+ * The optional `onPhase` callback emits structured progress events. The pure
+ * function stays pure — the caller decides whether to wire it to metadata,
+ * logs, or nothing at all.
+ *
+ * When `suggestionsOnly` is true, persistence is skipped and `output.suggestions`
+ * is populated so the caller can present a review-before-apply UI.
+ */
+export async function runLinkage({
+  organizationId,
+  riskId,
+  vendorId,
+  replace,
+  suggestionsOnly,
+  onPhase,
+}: RunLinkageInput): Promise<RunLinkageOutput> {
+  onPhase?.({ name: 'starting' });
+
+  // When the caller pins a specific entity, skip loading the other side
+  // entirely — embedding all vendors when the user only asked about one risk
+  // is wasted OpenAI cost (and vice versa).
+  const wantRisks = !vendorId;
+  const wantVendors = !riskId;
+
+  // The 3 initial scope queries are independent — fan them out instead of
+  // serializing. Tasks are scoped to purchased-framework coverage:
+  // `Control.archivedAt` is set when the org's framework subscription drops
+  // the control, so unarchived implies actively-purchased. Custom user tasks
+  // with no controls are kept (still org-owned and worth suggesting).
+  const [risks, vendors, tasks] = await Promise.all([
+    wantRisks
+      ? db.risk.findMany({
+          where: { organizationId, ...(riskId ? { id: riskId } : {}) },
+          select: {
+            id: true,
+            title: true,
+            description: true,
+            category: true,
+            department: true,
+            embeddingHash: true,
+          },
+        })
+      : Promise.resolve([] as Awaited<ReturnType<typeof db.risk.findMany>>),
+    wantVendors
+      ? db.vendor.findMany({
+          where: { organizationId, ...(vendorId ? { id: vendorId } : {}) },
+          select: {
+            id: true,
+            name: true,
+            description: true,
+            category: true,
+            embeddingHash: true,
+          },
+        })
+      : Promise.resolve([] as Awaited<ReturnType<typeof db.vendor.findMany>>),
+    db.task.findMany({
+      where: {
+        organizationId,
+        OR: [
+          { controls: { some: { archivedAt: null } } },
+          { controls: { none: {} } },
+        ],
+      },
+      select: {
+        id: true,
+        title: true,
+        description: true,
+        department: true,
+        embeddingHash: true,
+      },
+    }),
+  ]);
+
+  console.info(
+    `[linkage] scope: ${tasks.length} tasks, ${risks.length} risks, ${vendors.length} vendors (org=${organizationId})`,
+  );
+
+  // When replace=true, wipe existing task links on every in-scope entity
+  // BEFORE the matching loops so the connect step below builds linkage from
+  // scratch. Run all the disconnects in parallel.
+  // When suggestionsOnly is set, skip this step entirely (no DB writes).
+  if (replace && !suggestionsOnly) {
+    await Promise.all([
+      ...risks.map((r) =>
+        db.risk.update({ where: { id: r.id }, data: { tasks: { set: [] } } }),
+      ),
+      ...vendors.map((v) =>
+        db.vendor.update({ where: { id: v.id }, data: { tasks: { set: [] } } }),
+      ),
+    ]);
+  }
+
+  if (tasks.length === 0) {
+    onPhase?.({ name: 'done', riskLinks: 0, vendorLinks: 0 });
+    return { riskLinks: 0, vendorLinks: 0 };
+  }
+
+  if (tasks.length > 0) {
+    onPhase?.({ name: 'embedding-tasks', current: 0, total: tasks.length });
+  }
+  if (risks.length > 0) {
+    onPhase?.({ name: 'embedding-risks', current: 0, total: risks.length });
+  }
+  if (vendors.length > 0) {
+    onPhase?.({ name: 'embedding-vendors', current: 0, total: vendors.length });
+  }
+
+  // Build id → hash maps for skip-if-unchanged. Anything with a non-null
+  // hash that still matches the current text gets skipped at the upsert
+  // layer — saving both the OpenAI embedding call and the Upstash write.
+  const taskHashes = new Map<string, string>();
+  for (const t of tasks) {
+    if (t.embeddingHash !== null) taskHashes.set(t.id, t.embeddingHash);
+  }
+  const riskHashes = new Map<string, string>();
+  for (const r of risks) {
+    if (r.embeddingHash !== null) riskHashes.set(r.id, r.embeddingHash);
+  }
+  const vendorHashes = new Map<string, string>();
+  for (const v of vendors) {
+    if (v.embeddingHash !== null) vendorHashes.set(v.id, v.embeddingHash);
+  }
+
+  const [taskUpsert, riskUpsert, vendorUpsert] = await Promise.all([
+    upsertEntityEmbeddings({
+      organizationId,
+      kind: 'task',
+      entities: tasks.map((t) => ({
+        id: t.id,
+        text: taskQueryText(t),
+        department: t.department ?? undefined,
+      })),
+      existingHashes: taskHashes,
+    }),
+    upsertEntityEmbeddings({
+      organizationId,
+      kind: 'risk',
+      entities: risks.map((r) => ({
+        id: r.id,
+        text: riskQueryText(r),
+        department: r.department ?? undefined,
+      })),
+      existingHashes: riskHashes,
+    }),
+    upsertEntityEmbeddings({
+      organizationId,
+      kind: 'vendor',
+      entities: vendors.map((v) => ({
+        id: v.id,
+        text: vendorQueryText(v),
+      })),
+      existingHashes: vendorHashes,
+    }),
+  ]);
+
+  // Persist the freshly-computed hashes so the next linkage run can skip
+  // these entities. Rows whose content was unchanged are not in the
+  // appliedHashes list, so they keep their existing hash. Run all three
+  // kinds' updates in parallel.
+  const persistHashWrites: Array<Promise<unknown>> = [];
+  for (const { id, hash } of taskUpsert.appliedHashes) {
+    persistHashWrites.push(db.task.update({ where: { id }, data: { embeddingHash: hash } }));
+  }
+  for (const { id, hash } of riskUpsert.appliedHashes) {
+    persistHashWrites.push(db.risk.update({ where: { id }, data: { embeddingHash: hash } }));
+  }
+  for (const { id, hash } of vendorUpsert.appliedHashes) {
+    persistHashWrites.push(db.vendor.update({ where: { id }, data: { embeddingHash: hash } }));
+  }
+  if (persistHashWrites.length > 0) {
+    await Promise.all(persistHashWrites);
+  }
+
+  console.info(
+    `[linkage] embeddings: tasks ${taskUpsert.appliedHashes.length} new / ${taskUpsert.skippedCount} cached, ` +
+      `risks ${riskUpsert.appliedHashes.length} new / ${riskUpsert.skippedCount} cached, ` +
+      `vendors ${vendorUpsert.appliedHashes.length} new / ${vendorUpsert.skippedCount} cached`,
+  );
+
+  if (tasks.length > 0) {
+    onPhase?.({ name: 'embedding-tasks', current: tasks.length, total: tasks.length });
+  }
+  if (risks.length > 0) {
+    onPhase?.({ name: 'embedding-risks', current: risks.length, total: risks.length });
+  }
+  if (vendors.length > 0) {
+    onPhase?.({ name: 'embedding-vendors', current: vendors.length, total: vendors.length });
+  }
+
+  // Block matching until Upstash has finished indexing the vectors we just
+  // wrote. The HNSW index is built asynchronously after upsert, so cosine
+  // queries that race ahead silently return zero candidates for IDs that
+  // are still pending. We hit this in onboarding when 6 of 11 risks got 0
+  // links because their queries fired ~4s after upsert vs the next 5 risks
+  // that fired ~5s after and got full results.
+  //
+  // Skip the wait entirely when every embedding was served from the cache
+  // (the dedup hash path) — the existing vectors are already queryable
+  // and there's nothing pending from this run.
+  const upsertedCount =
+    taskUpsert.appliedHashes.length +
+    riskUpsert.appliedHashes.length +
+    vendorUpsert.appliedHashes.length;
+  if (upsertedCount > 0) {
+    onPhase?.({ name: 'waiting-for-index' });
+    const indexWait = await waitForIndexed({ maxWaitMs: 30_000 });
+    if (indexWait.pendingAtTimeout !== undefined) {
+      console.warn(
+        `[linkage] vector index still has ${indexWait.pendingAtTimeout} pending vector(s) after ${indexWait.waitedMs}ms (${indexWait.polls} polls); proceeding anyway`,
+      );
+    } else {
+      console.info(
+        `[linkage] vector index drained in ${indexWait.waitedMs}ms (${indexWait.polls} polls)`,
+      );
+    }
+  } else {
+    console.info('[linkage] all embeddings cached; skipping index drain wait');
+  }
+
+  // Map for the LLM reranker (suggestionsOnly path) to look up titles/desc
+  // without an extra DB round trip.
+  const taskById = new Map(tasks.map((t) => [t.id, t]));
+
+  let suggestions: RunLinkageOutput['suggestions'];
+
+  // Risk matching — fan out with bounded concurrency. Each iteration is one
+  // vector query + (rerank | DB update). Order doesn't matter here; we sum
+  // riskLinks at the end and emit `current` based on completion count.
+  if (risks.length > 0) {
+    onPhase?.({ name: 'matching-risks', current: 0, total: risks.length });
+  }
+  let completedRisks = 0;
+  const riskOutcomes = await mapWithConcurrency(risks, MATCH_CONCURRENCY, async (risk) => {
+    const similar = await findSimilarTasks({
+      organizationId,
+      queryText: riskQueryText(risk),
+      topK: suggestionsOnly ? SUGGESTIONS_QUERY_TOP_K : AUTONOMOUS_QUERY_TOP_K,
+    });
+    console.info(
+      `[linkage] risk "${risk.title}" → cosine returned ${similar.length} candidates` +
+        (similar.length > 0
+          ? ` (top scores: ${similar
+              .slice(0, 3)
+              .map((s) => s.score.toFixed(2))
+              .join(', ')})`
+          : ''),
+    );
+    // Both paths feed the reranker — autonomous needs it just as badly to
+    // get past the 0.4-0.6 cosine band that dominates compliance prose.
+    const links = linkSuggestions({
+      source: { department: risk.department ?? undefined },
+      candidates: similar.map((s) => ({ id: s.id, score: s.score, department: s.department })),
+      threshold: 0,
+      topK: suggestionsOnly ? SUGGESTIONS_RERANK_INPUT_TOP_K : AUTONOMOUS_RERANK_INPUT_TOP_K,
+    });
+    let count = 0;
+    let perEntitySuggestions: RunLinkageOutput['suggestions'];
+    const inScopeMatches = links.filter((l) => taskById.has(l.id)).length;
+    if (inScopeMatches !== links.length) {
+      console.warn(
+        `[linkage] risk "${risk.title}" → ${links.length - inScopeMatches} of ${links.length} cosine matches dropped (not in task scope after filter)`,
+      );
+    }
+    if (links.length > 0) {
+      const source: RerankSource = {
+        kind: 'risk',
+        title: risk.title,
+        description: risk.description,
+        category: risk.category,
+        department: risk.department ?? undefined,
+      };
+      if (suggestionsOnly) {
+        const taskScores = await rerankAndBuildScoreMap({
+          source,
+          links,
+          taskById,
+        });
+        const built = await buildSuggestions({ organizationId, taskScores });
+        perEntitySuggestions = { forRiskId: risk.id, ...built };
+        count = taskScores.size;
+        console.info(
+          `[linkage] risk "${risk.title}" → suggestions: ${count} tasks, ${built.controls.length} controls`,
+        );
+      } else {
+        const idsToConnect = await rerankForAutonomousPersist({
+          source,
+          links,
+          taskById,
+        });
+        if (idsToConnect.length > 0) {
+          await db.risk.update({
+            where: { id: risk.id },
+            data: { tasks: { connect: idsToConnect.map((id) => ({ id })) } },
+          });
+        }
+        count = idsToConnect.length;
+        console.info(
+          `[linkage] risk "${risk.title}" → persisted ${count} task link(s)`,
+        );
+      }
+    } else {
+      console.warn(
+        `[linkage] risk "${risk.title}" → 0 candidates after linkSuggestions; skipping rerank`,
+      );
+    }
+    completedRisks += 1;
+    onPhase?.({ name: 'matching-risks', current: completedRisks, total: risks.length });
+    return { count, perEntitySuggestions };
+  });
+  const riskLinks = riskOutcomes.reduce((sum, r) => sum + r.count, 0);
+  // suggestionsOnly endpoints always pass a single riskId, so at most one
+  // outcome carries suggestions — pick the first non-null.
+  for (const r of riskOutcomes) {
+    if (r.perEntitySuggestions) {
+      suggestions = r.perEntitySuggestions;
+      break;
+    }
+  }
+
+  // Vendor matching — same pattern.
+  if (vendors.length > 0) {
+    onPhase?.({ name: 'matching-vendors', current: 0, total: vendors.length });
+  }
+  let completedVendors = 0;
+  const vendorOutcomes = await mapWithConcurrency(vendors, MATCH_CONCURRENCY, async (vendor) => {
+    const similar = await findSimilarTasks({
+      organizationId,
+      queryText: vendorQueryText(vendor),
+      topK: suggestionsOnly ? SUGGESTIONS_QUERY_TOP_K : AUTONOMOUS_QUERY_TOP_K,
+    });
+    const links = linkSuggestions({
+      source: {},
+      candidates: similar.map((s) => ({ id: s.id, score: s.score, department: s.department })),
+      threshold: 0,
+      topK: suggestionsOnly ? SUGGESTIONS_RERANK_INPUT_TOP_K : AUTONOMOUS_RERANK_INPUT_TOP_K,
+    });
+    let count = 0;
+    let perEntitySuggestions: RunLinkageOutput['suggestions'];
+    if (links.length > 0) {
+      const source: RerankSource = {
+        kind: 'vendor',
+        title: vendor.name,
+        description: vendor.description,
+        category: vendor.category,
+      };
+      if (suggestionsOnly) {
+        const taskScores = await rerankAndBuildScoreMap({
+          source,
+          links,
+          taskById,
+        });
+        const built = await buildSuggestions({ organizationId, taskScores });
+        perEntitySuggestions = { forVendorId: vendor.id, ...built };
+        count = taskScores.size;
+      } else {
+        const idsToConnect = await rerankForAutonomousPersist({
+          source,
+          links,
+          taskById,
+        });
+        if (idsToConnect.length > 0) {
+          await db.vendor.update({
+            where: { id: vendor.id },
+            data: { tasks: { connect: idsToConnect.map((id) => ({ id })) } },
+          });
+        }
+        count = idsToConnect.length;
+      }
+    }
+    completedVendors += 1;
+    onPhase?.({ name: 'matching-vendors', current: completedVendors, total: vendors.length });
+    return { count, perEntitySuggestions };
+  });
+  const vendorLinks = vendorOutcomes.reduce((sum, v) => sum + v.count, 0);
+  if (!suggestions) {
+    for (const v of vendorOutcomes) {
+      if (v.perEntitySuggestions) {
+        suggestions = v.perEntitySuggestions;
+        break;
+      }
+    }
+  }
+
+  onPhase?.({ name: 'done', riskLinks, vendorLinks });
+  return suggestionsOnly ? { riskLinks, vendorLinks, suggestions } : { riskLinks, vendorLinks };
+}
diff --git a/apps/app/src/lib/link-suggestions.spec.ts b/apps/app/src/lib/link-suggestions.spec.ts
new file mode 100644
index 0000000000..50ac0fa292
--- /dev/null
+++ b/apps/app/src/lib/link-suggestions.spec.ts
@@ -0,0 +1,130 @@
+import { Departments } from '@db';
+import { describe, expect, it } from 'vitest';
+import { linkSuggestions, type Candidate } from './link-suggestions';
+
+const candidate = (
+  id: string,
+  score: number,
+  department?: Departments,
+): Candidate => ({ id, score, department });
+
+describe('linkSuggestions', () => {
+  it('returns empty when candidates is empty', () => {
+    expect(linkSuggestions({ source: { department: Departments.it }, candidates: [] })).toEqual(
+      [],
+    );
+  });
+
+  it('drops candidates below threshold', () => {
+    const result = linkSuggestions({
+      source: {},
+      candidates: [
+        candidate('a', 0.9),
+        candidate('b', 0.5),
+        candidate('c', 0.3),
+      ],
+      threshold: 0.65,
+    });
+    expect(result.map((r) => r.id)).toEqual(['a']);
+  });
+
+  it('caps results at topK', () => {
+    const result = linkSuggestions({
+      source: {},
+      candidates: [
+        candidate('a', 0.95),
+        candidate('b', 0.94),
+        candidate('c', 0.93),
+        candidate('d', 0.92),
+        candidate('e', 0.91),
+        candidate('f', 0.90),
+        candidate('g', 0.89),
+      ],
+      threshold: 0.65,
+      topK: 5,
+    });
+    expect(result).toHaveLength(5);
+    expect(result.map((r) => r.id)).toEqual(['a', 'b', 'c', 'd', 'e']);
+  });
+
+  it('boosts candidates whose department matches source department', () => {
+    // Without boost, b would beat a (0.66 > 0.62).
+    // With boost (a matches), a's effective score becomes 0.62 + 0.05 = 0.67, beating b.
+    const result = linkSuggestions({
+      source: { department: Departments.hr },
+      candidates: [
+        candidate('a', 0.62, Departments.hr),
+        candidate('b', 0.66, Departments.it),
+      ],
+      threshold: 0.6,
+      topK: 2,
+      departmentBoost: 0.05,
+    });
+    expect(result.map((r) => r.id)).toEqual(['a', 'b']);
+    expect(result[0].score).toBeCloseTo(0.67, 2);
+  });
+
+  it('does not boost when source department is unset', () => {
+    const result = linkSuggestions({
+      source: {},
+      candidates: [
+        candidate('a', 0.6, Departments.hr),
+        candidate('b', 0.7, Departments.it),
+      ],
+      threshold: 0.5,
+      topK: 2,
+      departmentBoost: 0.05,
+    });
+    expect(result[0].id).toBe('b');
+    expect(result[0].score).toBeCloseTo(0.7, 2);
+  });
+
+  it('does not boost when candidate department is "none" (default Task value)', () => {
+    // Source department `none` matches a candidate `none` literally — but
+    // the boost rule excludes `none` explicitly so the boost should NOT
+    // apply. Without the exclusion, the candidate at 0.62 would beat the
+    // one at 0.66 (0.62 + 0.05 > 0.66). Asserting the un-boosted candidate
+    // wins is what proves the rule. (Cubic finding #24 on PR #2671.)
+    const result = linkSuggestions({
+      source: { department: Departments.none },
+      candidates: [
+        candidate('a', 0.62, Departments.none),
+        candidate('b', 0.66, Departments.it),
+      ],
+      threshold: 0.5,
+      topK: 2,
+      departmentBoost: 0.05,
+    });
+    expect(result[0].id).toBe('b');
+    expect(result[0].score).toBeCloseTo(0.66, 2);
+    expect(result[1].id).toBe('a');
+    expect(result[1].score).toBeCloseTo(0.62, 2);
+  });
+
+  it('returns results sorted by descending boosted score', () => {
+    const result = linkSuggestions({
+      source: { department: Departments.hr },
+      candidates: [
+        candidate('a', 0.7),
+        candidate('b', 0.62, Departments.hr),
+        candidate('c', 0.85),
+      ],
+      threshold: 0.5,
+      topK: 5,
+      departmentBoost: 0.05,
+    });
+    expect(result.map((r) => r.id)).toEqual(['c', 'a', 'b']);
+  });
+
+  it('uses sensible defaults when threshold/topK/boost omitted', () => {
+    // Defaults: threshold=0.65, topK=5, departmentBoost=0.05.
+    const result = linkSuggestions({
+      source: { department: Departments.hr },
+      candidates: [
+        candidate('a', 0.7),
+        candidate('b', 0.5),
+      ],
+    });
+    expect(result.map((r) => r.id)).toEqual(['a']);
+  });
+});
diff --git a/apps/app/src/lib/link-suggestions.ts b/apps/app/src/lib/link-suggestions.ts
new file mode 100644
index 0000000000..693affa834
--- /dev/null
+++ b/apps/app/src/lib/link-suggestions.ts
@@ -0,0 +1,57 @@
+import { Departments } from '@db';
+
+const DEFAULT_THRESHOLD = 0.65;
+const DEFAULT_TOP_K = 5;
+const DEFAULT_DEPARTMENT_BOOST = 0.05;
+
+export interface Candidate {
+  id: string;
+  score: number; // raw cosine similarity from the vector store
+  department?: Departments;
+}
+
+export interface LinkSuggestionsOptions {
+  source: { department?: Departments };
+  candidates: Candidate[];
+  threshold?: number;
+  topK?: number;
+  departmentBoost?: number;
+}
+
+export interface LinkSuggestion {
+  id: string;
+  score: number; // boosted score (may be > raw)
+}
+
+/**
+ * Apply department-match boost, threshold filter, and top-K cap to a list of
+ * raw similarity candidates. Pure function; no I/O.
+ *
+ * Coefficients live here — single place to tune the math.
+ */
+export function linkSuggestions({
+  source,
+  candidates,
+  threshold = DEFAULT_THRESHOLD,
+  topK = DEFAULT_TOP_K,
+  departmentBoost = DEFAULT_DEPARTMENT_BOOST,
+}: LinkSuggestionsOptions): LinkSuggestion[] {
+  if (candidates.length === 0) return [];
+
+  const sourceDept = source.department;
+  const shouldBoost = (candidateDept?: Departments) =>
+    sourceDept !== undefined &&
+    candidateDept !== undefined &&
+    candidateDept !== Departments.none &&
+    sourceDept === candidateDept;
+
+  const boosted: LinkSuggestion[] = candidates.map((c) => ({
+    id: c.id,
+    score: shouldBoost(c.department) ? c.score + departmentBoost : c.score,
+  }));
+
+  return boosted
+    .filter((c) => c.score >= threshold)
+    .sort((a, b) => b.score - a.score)
+    .slice(0, topK);
+}
diff --git a/apps/app/src/lib/permissions.server.ts b/apps/app/src/lib/permissions.server.ts
index 8412341ca5..e4ce766c9f 100644
--- a/apps/app/src/lib/permissions.server.ts
+++ b/apps/app/src/lib/permissions.server.ts
@@ -3,12 +3,14 @@ import 'server-only';
 import { auth } from '@/utils/auth';
 import { db } from '@db/server';
 import { headers } from 'next/headers';
+import { NextResponse } from 'next/server';
 import { redirect } from 'next/navigation';
 import {
   type UserPermissions,
   canAccessAuditorView,
   canAccessRoute,
   getDefaultRoute,
+  hasPermission,
   mergePermissions,
   resolveBuiltInPermissions,
 } from './permissions';
@@ -172,3 +174,52 @@ export async function requireAuditorViewAccess(orgId: string): Promise<void> {
     : null;
   redirect(defaultRoute ?? '/no-access');
 }
+
+export interface ApiPermissionContext {
+  organizationId: string;
+  userId: string;
+  permissions: UserPermissions;
+}
+
+/**
+ * Permission guard for Next.js Route Handlers (`app/api/.../route.ts`). On
+ * success, returns a context object with the active org id, user id, and
+ * resolved permissions. On failure, returns a `NextResponse` to forward to
+ * the client. Caller pattern:
+ *
+ *     const ctx = await requireApiPermission(req, 'risk', 'update');
+ *     if (ctx instanceof NextResponse) return ctx;
+ *     // ...use ctx.organizationId, ctx.permissions...
+ *
+ * The Next.js mutation routes for risk/vendor auto-link, relink, and unlink
+ * orchestrate work that the NestJS API doesn't host directly (trigger.dev
+ * tokens, Upstash queries, Prisma joins). These endpoints still need the
+ * same RBAC contract as the API — see Cubic finding #9 on PR #2671.
+ */
+export async function requireApiPermission(
+  req: Request,
+  resource: string,
+  action: string,
+): Promise<ApiPermissionContext | NextResponse> {
+  const session = await auth.api.getSession({ headers: req.headers });
+  if (!session?.user?.id || !session?.session?.activeOrganizationId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+  const organizationId = session.session.activeOrganizationId;
+  const userId = session.user.id;
+
+  const member = await db.member.findFirst({
+    where: { userId, organizationId, deactivated: false },
+    select: { role: true },
+  });
+  if (!member) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const permissions = await resolveUserPermissions(member.role, organizationId);
+  if (!hasPermission(permissions, resource, action)) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  return { organizationId, userId, permissions };
+}
diff --git a/apps/app/src/lib/rerank-suggestions.spec.ts b/apps/app/src/lib/rerank-suggestions.spec.ts
new file mode 100644
index 0000000000..0bf69a5256
--- /dev/null
+++ b/apps/app/src/lib/rerank-suggestions.spec.ts
@@ -0,0 +1,100 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { generateObjectMock } = vi.hoisted(() => ({
+  generateObjectMock: vi.fn(),
+}));
+
+vi.mock('@ai-sdk/openai', () => ({
+  openai: () => 'mock-openai-model',
+}));
+
+vi.mock('ai', () => ({
+  generateObject: generateObjectMock,
+  jsonSchema: <T>(schema: T) => schema,
+}));
+
+import { rerankSuggestions } from './rerank-suggestions';
+
+beforeEach(() => {
+  generateObjectMock.mockReset();
+});
+
+describe('rerankSuggestions', () => {
+  it('returns [] without calling the LLM when candidates is empty', async () => {
+    const out = await rerankSuggestions({
+      source: { kind: 'risk', title: 't', description: 'd' },
+      candidates: [],
+    });
+    expect(out).toEqual([]);
+    expect(generateObjectMock).not.toHaveBeenCalled();
+  });
+
+  it('orders candidates by LLM rerankScore desc', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: {
+        scores: [
+          { id: 'tsk_a', score: 3 },
+          { id: 'tsk_b', score: 9 },
+          { id: 'tsk_c', score: 7 },
+        ],
+      },
+    });
+
+    const out = await rerankSuggestions({
+      source: { kind: 'risk', title: 'Data leakage', description: 'laptops' },
+      candidates: [
+        { id: 'tsk_a', title: 'A', description: 'a', cosineScore: 0.9 },
+        { id: 'tsk_b', title: 'B', description: 'b', cosineScore: 0.6 },
+        { id: 'tsk_c', title: 'C', description: 'c', cosineScore: 0.7 },
+      ],
+    });
+
+    expect(out.map((r) => r.id)).toEqual(['tsk_b', 'tsk_c', 'tsk_a']);
+    expect(out[0].rerankScore).toBe(9);
+    expect(out[0].cosineScore).toBe(0.6);
+  });
+
+  it('clamps scores outside 0-10 (LLM hallucination guard)', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: {
+        scores: [
+          { id: 'tsk_a', score: -2 },
+          { id: 'tsk_b', score: 15 },
+          { id: 'tsk_c', score: Number.NaN },
+        ],
+      },
+    });
+
+    const out = await rerankSuggestions({
+      source: { kind: 'risk', title: 't', description: 'd' },
+      candidates: [
+        { id: 'tsk_a', title: 'A', description: 'a', cosineScore: 0.5 },
+        { id: 'tsk_b', title: 'B', description: 'b', cosineScore: 0.5 },
+        { id: 'tsk_c', title: 'C', description: 'c', cosineScore: 0.5 },
+      ],
+    });
+
+    const byId = Object.fromEntries(out.map((r) => [r.id, r.rerankScore]));
+    expect(byId.tsk_a).toBe(0);
+    expect(byId.tsk_b).toBe(10);
+    expect(byId.tsk_c).toBe(0);
+  });
+
+  it('assigns 0 to candidates the LLM omits', async () => {
+    generateObjectMock.mockResolvedValueOnce({
+      object: { scores: [{ id: 'tsk_a', score: 8 }] },
+    });
+
+    const out = await rerankSuggestions({
+      source: { kind: 'vendor', title: 'V', description: 'd' },
+      candidates: [
+        { id: 'tsk_a', title: 'A', description: 'a', cosineScore: 0.5 },
+        { id: 'tsk_b', title: 'B', description: 'b', cosineScore: 0.5 },
+      ],
+    });
+
+    const byId = Object.fromEntries(out.map((r) => [r.id, r.rerankScore]));
+    expect(byId.tsk_a).toBe(8);
+    expect(byId.tsk_b).toBe(0);
+  });
+});
diff --git a/apps/app/src/lib/rerank-suggestions.ts b/apps/app/src/lib/rerank-suggestions.ts
new file mode 100644
index 0000000000..742d74a64c
--- /dev/null
+++ b/apps/app/src/lib/rerank-suggestions.ts
@@ -0,0 +1,130 @@
+import { openai } from '@ai-sdk/openai';
+import { generateObject, jsonSchema } from 'ai';
+
+/**
+ * LLM reranker for the on-demand auto-link suggestion flow.
+ *
+ * Cosine similarity on `text-embedding-3-small` does a good job at recall (it
+ * pulls the right ballpark of candidates) but is noisy on precision: the
+ * scores collapse into a tight band for short compliance prose, so genuinely
+ * on-target tasks ("Secure Devices: BitLocker / FileVault / MDM") and
+ * surface-keyword matches ("Office Access & Door Monitoring") end up at the
+ * same 0.61–0.64 cosine score.
+ *
+ * The reranker bridges that gap: a cheap GPT call reads each candidate's
+ * title + description and scores 0–10 by actual mitigation effectiveness for
+ * the given risk/vendor. The caller sorts by `rerankScore` and slices to the
+ * final user-facing topK.
+ */
+
+export interface RerankSource {
+  kind: 'risk' | 'vendor';
+  title: string;
+  description: string;
+  category?: string;
+  department?: string;
+}
+
+export interface RerankCandidate {
+  id: string;
+  title: string;
+  description: string;
+  cosineScore: number;
+}
+
+export interface RerankedCandidate {
+  id: string;
+  cosineScore: number;
+  /** 0-10, returned by the LLM. Higher is more relevant. */
+  rerankScore: number;
+}
+
+const RERANK_MODEL = 'gpt-5-mini';
+
+const SYSTEM_PROMPT = `You are a GRC analyst evaluating which compliance tasks would meaningfully reduce a specific risk or vendor exposure.
+
+Score each candidate 0-10 by its actual mitigation effectiveness:
+- 10: directly addresses the root cause (primary control)
+- 7-9: strongly contributes (supporting control)
+- 4-6: weakly related but plausibly relevant
+- 1-3: tangentially related at best
+- 0: not relevant
+
+Be strict. Surface keyword overlap is NOT relevance:
+- A task about office physical security is not relevant to a risk about laptop data leakage just because both mention "employee"
+- A task about employee performance reviews is not relevant to data security risks
+- A task about contact information / public policies is not relevant to security risks
+
+Return a score for every candidate, using the exact id provided.`;
+
+const rerankSchema = jsonSchema<{
+  scores: Array<{ id: string; score: number }>;
+}>({
+  type: 'object',
+  properties: {
+    scores: {
+      type: 'array',
+      items: {
+        type: 'object',
+        properties: {
+          id: { type: 'string' },
+          score: { type: 'number', minimum: 0, maximum: 10 },
+        },
+        required: ['id', 'score'],
+        additionalProperties: false,
+      },
+    },
+  },
+  required: ['scores'],
+  additionalProperties: false,
+});
+
+export async function rerankSuggestions({
+  source,
+  candidates,
+}: {
+  source: RerankSource;
+  candidates: RerankCandidate[];
+}): Promise<RerankedCandidate[]> {
+  if (candidates.length === 0) return [];
+
+  const userPrompt = [
+    `Subject type: ${source.kind === 'risk' ? 'Risk' : 'Vendor'}`,
+    `Title: ${source.title}`,
+    `Description: ${source.description}`,
+    source.category ? `Category: ${source.category}` : null,
+    source.department ? `Department: ${source.department}` : null,
+    '',
+    `Candidate tasks (${candidates.length}):`,
+    ...candidates.map(
+      (c) =>
+        `id=${c.id}\n  title: ${c.title}\n  description: ${(c.description ?? '').slice(0, 400)}`,
+    ),
+  ]
+    .filter((line): line is string => line !== null)
+    .join('\n');
+
+  const result = await generateObject({
+    model: openai(RERANK_MODEL),
+    system: SYSTEM_PROMPT,
+    prompt: userPrompt,
+    schema: rerankSchema,
+  });
+
+  const scoreMap = new Map(
+    result.object.scores.map((s) => [s.id, clamp(s.score, 0, 10)]),
+  );
+
+  return candidates
+    .map((c) => ({
+      id: c.id,
+      cosineScore: c.cosineScore,
+      rerankScore: scoreMap.get(c.id) ?? 0,
+    }))
+    .sort((a, b) => b.rerankScore - a.rerankScore);
+}
+
+function clamp(n: number, lo: number, hi: number): number {
+  if (Number.isNaN(n)) return lo;
+  return Math.min(hi, Math.max(lo, n));
+}
diff --git a/apps/app/src/lib/risk-score.ts b/apps/app/src/lib/risk-score.ts
index 7aa10a4f06..bf7cfa0813 100644
--- a/apps/app/src/lib/risk-score.ts
+++ b/apps/app/src/lib/risk-score.ts
@@ -32,6 +32,45 @@ export function getRiskLevel(raw: number): RiskLevel {
   return 'very-low';
 }
 
+/**
+ * Like `getRiskLevel`, but indexed off the normalized 1-10 score so callers
+ * that show the score (Treatment Plan hero, RiskScale) and the level label
+ * stay consistent. Buckets mirror RiskScale's 5 visual segments (2 score
+ * units each):
+ *
+ *   1-2 → very-low,  3-4 → low,  5-6 → medium,  7-8 → high,  9-10 → very-high
+ */
+export function getRiskLevelFromScore(score: number): RiskLevel {
+  if (score >= 9) return 'very-high';
+  if (score >= 7) return 'high';
+  if (score >= 5) return 'medium';
+  if (score >= 3) return 'low';
+  return 'very-low';
+}
+
+/**
+ * Solid (full-opacity) color tokens for each risk level. Built from the
+ * `--success` / `--warning` / `--destructive` design tokens that drive the
+ * RiskScale bar segments, so any UI surface that shows a level (numeral,
+ * badge, tick, narrative tag, matrix cell) reads as the same color family.
+ */
+export const LEVEL_COLOR: Record<RiskLevel, string> = {
+  'very-low': 'var(--success)',
+  low: 'color-mix(in oklab, var(--success) 50%, var(--warning))',
+  medium: 'var(--warning)',
+  high: 'color-mix(in oklab, var(--warning) 50%, var(--destructive))',
+  'very-high': 'var(--destructive)',
+};
+
+/** Human-readable level labels for risk badges and table cells. */
+export const LEVEL_LABEL: Record<RiskLevel, string> = {
+  'very-low': 'Very low',
+  low: 'Low',
+  medium: 'Medium',
+  high: 'High',
+  'very-high': 'Very high',
+};
+
 export function getRiskScore(likelihood: Likelihood, impact: Impact): RiskScore {
   const raw = LIKELIHOOD_SCORES[likelihood] * IMPACT_SCORES[impact];
   const score = Math.max(1, Math.ceil(raw / 2.5));
diff --git a/apps/app/src/lib/strategy-descriptions.ts b/apps/app/src/lib/strategy-descriptions.ts
new file mode 100644
index 0000000000..0f48161c79
--- /dev/null
+++ b/apps/app/src/lib/strategy-descriptions.ts
@@ -0,0 +1,78 @@
+/**
+ * Builds the `strategyDescriptions` JSON map after writing a new active
+ * `treatmentStrategyDescription`. Keeps each strategy's saved text
+ * independent so switching strategies doesn't lose prior content.
+ *
+ * Mirrored on the API side at `apps/api/src/risks/strategy-descriptions.ts`.
+ */
+export function mirrorActiveDescriptionIntoMap({
+  strategy,
+  description,
+  current,
+}: {
+  strategy: string;
+  description: string;
+  current: unknown;
+}): Record<string, string> {
+  const map: Record<string, string> = {};
+  if (current && typeof current === 'object' && !Array.isArray(current)) {
+    for (const [k, v] of Object.entries(current as Record<string, unknown>)) {
+      if (typeof v === 'string' && v.length > 0) map[k] = v;
+    }
+  }
+  if (description.length > 0) {
+    map[strategy] = description;
+  } else {
+    delete map[strategy];
+  }
+  return map;
+}
+
+/**
+ * Build the data fields to write when the AI mitigation generator emits a
+ * fresh treatment plan. Always lands the plan under the `mitigate` slot
+ * (the plan IS a mitigation plan), forces the active strategy to
+ * mitigate so the user sees the new plan in the correct column, and
+ * preserves any existing non-mitigate description under its own slot so
+ * the user's prior Accept / Transfer / Avoid rationale isn't lost.
+ *
+ * Used by both generate-risk-mitigation and generate-vendor-mitigation.
+ * Without this guarantee, entities created with a non-mitigate default
+ * have the AI plan stored under the wrong strategy and switching back
+ * to mitigate looks empty (the bug fixed in this commit).
+ */
+export function applyMitigationPlanFields({
+  plan,
+  currentStrategy,
+  currentDescription,
+  currentMap,
+}: {
+  plan: string;
+  currentStrategy: string;
+  currentDescription: string | null;
+  currentMap: unknown;
+}): {
+  treatmentStrategy: 'mitigate';
+  treatmentStrategyDescription: string;
+  strategyDescriptions: Record<string, string>;
+} {
+  const map: Record<string, string> = {};
+  if (currentMap && typeof currentMap === 'object' && !Array.isArray(currentMap)) {
+    for (const [k, v] of Object.entries(currentMap as Record<string, unknown>)) {
+      if (typeof v === 'string' && v.length > 0) map[k] = v;
+    }
+  }
+  if (
+    currentStrategy !== 'mitigate' &&
+    currentDescription &&
+    currentDescription.length > 0
+  ) {
+    map[currentStrategy] = currentDescription;
+  }
+  map.mitigate = plan;
+  return {
+    treatmentStrategy: 'mitigate',
+    treatmentStrategyDescription: plan,
+    strategyDescriptions: map,
+  };
+}
diff --git a/apps/app/src/lib/stripe.ts b/apps/app/src/lib/stripe.ts
deleted file mode 100644
index 7fa87b21a7..0000000000
--- a/apps/app/src/lib/stripe.ts
+++ /dev/null
@@ -1,186 +0,0 @@
-import { env } from '@/env.mjs';
-import Stripe from 'stripe';
-
-// Initialize Stripe client with secret key from environment
-const stripeSecretKey = env.STRIPE_SECRET_KEY;
-
-if (!stripeSecretKey) {
-  console.warn('STRIPE_SECRET_KEY is not set - Stripe auto-approval will be disabled');
-}
-
-// Domains that should NEVER be used for domain-based auto-approval.
-// These are shared/public mailbox providers where domain ownership does not imply company affiliation.
-const PUBLIC_EMAIL_DOMAINS = new Set([
-  // Google
-  'gmail.com',
-  'googlemail.com',
-  // Microsoft
-  'outlook.com',
-  'hotmail.com',
-  'live.com',
-  'msn.com',
-  // Yahoo
-  'yahoo.com',
-  'ymail.com',
-  // Apple
-  'icloud.com',
-  'me.com',
-  'mac.com',
-  // Proton
-  'proton.me',
-  'protonmail.com',
-  'pm.me',
-  // AOL
-  'aol.com',
-]);
-
-export const isPublicEmailDomain = (domain: string): boolean => {
-  const normalized = domain.toLowerCase().trim().replace(/\.$/, '');
-  return PUBLIC_EMAIL_DOMAINS.has(normalized);
-};
-
-export const stripe = stripeSecretKey
-  ? new Stripe(stripeSecretKey, {
-      apiVersion: '2026-02-25.clover',
-    })
-  : null;
-
-/**
- * Extract domain from a website URL or email
- * @param input - URL (e.g., "https://example.com") or email (e.g., "user@example.com")
- * @returns Normalized domain (e.g., "example.com")
- */
-export const extractDomain = (input: string): string | null => {
-  if (!input) return null;
-
-  try {
-    // If it looks like an email, extract domain from after @
-    if (input.includes('@') && !input.includes('://')) {
-      const domain = input.split('@')[1]?.toLowerCase().trim();
-      return domain || null;
-    }
-
-    // Otherwise, treat as URL
-    let url = input.trim().toLowerCase();
-
-    // Add protocol if missing
-    if (!url.startsWith('http://') && !url.startsWith('https://')) {
-      url = `https://${url}`;
-    }
-
-    const parsed = new URL(url);
-    return parsed.hostname.replace(/^www\./, '');
-  } catch {
-    return null;
-  }
-};
-
-/**
- * Check if a domain belongs to an existing Stripe customer
- * Searches by customer email domain and metadata
- *
- * @param domain - The domain to check (e.g., "acme.com")
- * @returns Customer ID if found, null otherwise
- */
-export const findStripeCustomerByDomain = async (
-  domain: string,
-): Promise<{ customerId: string; customerName: string | null } | null> => {
-  if (!stripe) {
-    console.warn('Stripe client not initialized - skipping customer lookup');
-    return null;
-  }
-
-  if (!domain) {
-    return null;
-  }
-
-  const normalizedDomain = domain.toLowerCase().trim().replace(/\.$/, '');
-
-  // Defense-in-depth: never treat public mailbox domains as proof of company ownership.
-  if (isPublicEmailDomain(normalizedDomain)) {
-    return null;
-  }
-
-  try {
-    // Prefer exact domain match via metadata when available.
-    const customersWithMetadata = await stripe.customers.search({
-      query: `metadata["domain"]:"${normalizedDomain}"`,
-      limit: 1,
-    });
-
-    if (customersWithMetadata.data.length > 0) {
-      const customer = customersWithMetadata.data[0];
-      return {
-        customerId: customer.id,
-        customerName: customer.name ?? null,
-      };
-    }
-
-    // Fallback: Stripe's email~ operator is substring matching; post-filter for exact email domain.
-    const customers = await stripe.customers.search({
-      query: `email~"@${normalizedDomain}"`,
-      limit: 25,
-    });
-
-    const exactDomainCustomer = customers.data.find((customer) => {
-      const email = customer.email ?? '';
-      const emailDomain = email.split('@')[1]?.toLowerCase().trim() ?? '';
-      return emailDomain === normalizedDomain;
-    });
-
-    if (exactDomainCustomer) {
-      return {
-        customerId: exactDomainCustomer.id,
-        customerName: exactDomainCustomer.name ?? null,
-      };
-    }
-
-    return null;
-  } catch (error) {
-    console.error('Error searching Stripe customers:', error);
-    return null;
-  }
-};
-
-/**
- * Check if a domain is an active Stripe customer with a valid subscription
- *
- * @param domain - The domain to check
- * @returns true if domain has an active subscription
- */
-export const isDomainActiveStripeCustomer = async (domain: string): Promise<boolean> => {
-  const normalizedDomain = domain.toLowerCase().trim().replace(/\.$/, '');
-
-  if (!normalizedDomain) {
-    return false;
-  }
-
-  // Never auto-approve based on public email domains.
-  if (isPublicEmailDomain(normalizedDomain)) {
-    return false;
-  }
-
-  const customer = await findStripeCustomerByDomain(normalizedDomain);
-
-  if (!customer) {
-    return false;
-  }
-
-  if (!stripe) {
-    return false;
-  }
-
-  try {
-    // Check if customer has an active subscription
-    const subscriptions = await stripe.subscriptions.list({
-      customer: customer.customerId,
-      status: 'active',
-      limit: 1,
-    });
-
-    return subscriptions.data.length > 0;
-  } catch (error) {
-    console.error('Error checking Stripe subscriptions:', error);
-    return false;
-  }
-};
diff --git a/apps/app/src/lib/suggested-residual.spec.ts b/apps/app/src/lib/suggested-residual.spec.ts
new file mode 100644
index 0000000000..1f8d16f9ce
--- /dev/null
+++ b/apps/app/src/lib/suggested-residual.spec.ts
@@ -0,0 +1,119 @@
+import { Impact, Likelihood, RiskTreatmentType, TaskStatus } from '@db';
+import { describe, expect, it } from 'vitest';
+import { suggestedResidual } from './suggested-residual';
+
+const task = (status: TaskStatus) => ({ status });
+
+describe('suggestedResidual', () => {
+  it('accept: never moves from inherent regardless of completion', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.very_likely,
+      impact: Impact.severe,
+      strategy: RiskTreatmentType.accept,
+      tasks: [task(TaskStatus.done), task(TaskStatus.done)],
+    });
+    expect(out).toEqual({
+      likelihood: Likelihood.very_likely,
+      impact: Impact.severe,
+      completion: 1,
+    });
+  });
+
+  it('avoid with NO linked tasks stays at inherent (no operational evidence yet)', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.avoid,
+      tasks: [],
+    });
+    expect(out).toEqual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      completion: 0,
+    });
+  });
+
+  it('avoid with linked tasks pins residual to (very_unlikely, insignificant)', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.avoid,
+      tasks: [task(TaskStatus.done), task(TaskStatus.todo)],
+    });
+    expect(out).toEqual({
+      likelihood: Likelihood.very_unlikely,
+      impact: Impact.insignificant,
+      completion: 0.5,
+    });
+  });
+
+  it('transfer at 100% drops impact by 1 step, leaves likelihood', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.transfer,
+      tasks: [task(TaskStatus.done), task(TaskStatus.done)],
+    });
+    expect(out.likelihood).toBe(Likelihood.likely);
+    expect(out.impact).toBe(Impact.moderate);
+    expect(out.completion).toBe(1);
+  });
+
+  it('mitigate at 100% drops both by 1 step', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.mitigate,
+      tasks: [task(TaskStatus.done)],
+    });
+    expect(out.likelihood).toBe(Likelihood.possible);
+    expect(out.impact).toBe(Impact.moderate);
+  });
+
+  it('mitigate at 50% (1 of 2 tasks): floor(0.5) = 0 → no reduction', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.mitigate,
+      tasks: [task(TaskStatus.done), task(TaskStatus.todo)],
+    });
+    expect(out.likelihood).toBe(Likelihood.likely);
+    expect(out.impact).toBe(Impact.major);
+    expect(out.completion).toBe(0.5);
+  });
+
+  it('zero tasks: completion 0, no reduction', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.possible,
+      impact: Impact.moderate,
+      strategy: RiskTreatmentType.mitigate,
+      tasks: [],
+    });
+    expect(out.likelihood).toBe(Likelihood.possible);
+    expect(out.impact).toBe(Impact.moderate);
+    expect(out.completion).toBe(0);
+  });
+
+  it('already-minimum inherent: clamps at (very_unlikely, insignificant)', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.very_unlikely,
+      impact: Impact.insignificant,
+      strategy: RiskTreatmentType.mitigate,
+      tasks: [task(TaskStatus.done)],
+    });
+    expect(out.likelihood).toBe(Likelihood.very_unlikely);
+    expect(out.impact).toBe(Impact.insignificant);
+  });
+
+  it('not_relevant tasks count as done for completion', () => {
+    const out = suggestedResidual({
+      likelihood: Likelihood.likely,
+      impact: Impact.major,
+      strategy: RiskTreatmentType.mitigate,
+      tasks: [task(TaskStatus.done), task(TaskStatus.not_relevant)],
+    });
+    expect(out.completion).toBe(1);
+    expect(out.likelihood).toBe(Likelihood.possible);
+    expect(out.impact).toBe(Impact.moderate);
+  });
+});
diff --git a/apps/app/src/lib/suggested-residual.ts b/apps/app/src/lib/suggested-residual.ts
new file mode 100644
index 0000000000..75a48292e8
--- /dev/null
+++ b/apps/app/src/lib/suggested-residual.ts
@@ -0,0 +1,192 @@
+import { Impact, Likelihood, RiskTreatmentType, TaskStatus } from '@db';
+
+/**
+ * Per-strategy max step reduction, applied pro-rata by completion.
+ * All coefficients live here — the single place to tune the math if a
+ * customer pushes back on conservatism.
+ */
+const STRATEGY_REDUCTION: Record<
+  RiskTreatmentType,
+  { likelihood: number; impact: number } | 'pin-minimum'
+> = {
+  [RiskTreatmentType.accept]: { likelihood: 0, impact: 0 },
+  [RiskTreatmentType.transfer]: { likelihood: 0, impact: 1 },
+  [RiskTreatmentType.mitigate]: { likelihood: 1, impact: 1 },
+  [RiskTreatmentType.avoid]: 'pin-minimum',
+};
+
+const LIKELIHOOD_ORDER: Likelihood[] = [
+  Likelihood.very_unlikely,
+  Likelihood.unlikely,
+  Likelihood.possible,
+  Likelihood.likely,
+  Likelihood.very_likely,
+];
+
+const IMPACT_ORDER: Impact[] = [
+  Impact.insignificant,
+  Impact.minor,
+  Impact.moderate,
+  Impact.major,
+  Impact.severe,
+];
+
+function stepDownLikelihood(current: Likelihood, steps: number): Likelihood {
+  const idx = LIKELIHOOD_ORDER.indexOf(current);
+  return LIKELIHOOD_ORDER[Math.max(0, idx - steps)];
+}
+
+function stepDownImpact(current: Impact, steps: number): Impact {
+  const idx = IMPACT_ORDER.indexOf(current);
+  return IMPACT_ORDER[Math.max(0, idx - steps)];
+}
+
+export interface SuggestedResidualInput {
+  likelihood: Likelihood;
+  impact: Impact;
+  strategy: RiskTreatmentType;
+  tasks: { status: TaskStatus }[];
+}
+
+export interface SuggestedResidualOutput {
+  likelihood: Likelihood;
+  impact: Impact;
+  completion: number;
+}
+
+/**
+ * Computes a conservative "suggested residual" from inherent risk + treatment
+ * strategy + linked-task completion. Uses Math.floor on the applied step
+ * reduction, so partial completion earns no step until fully earned.
+ *
+ * Tune the coefficients in STRATEGY_REDUCTION above to change the math.
+ */
+export function suggestedResidual({
+  likelihood,
+  impact,
+  strategy,
+  tasks,
+}: SuggestedResidualInput): SuggestedResidualOutput {
+  const total = tasks.length;
+  const done = tasks.filter(
+    (t) => t.status === TaskStatus.done || t.status === TaskStatus.not_relevant,
+  ).length;
+  const completion = total === 0 ? 0 : done / total;
+
+  const reduction = STRATEGY_REDUCTION[strategy];
+
+  if (reduction === 'pin-minimum') {
+    // Avoid pins to the floor — but only once there's operational evidence
+    // (at least one linked task) that the avoidance is actually being
+    // executed. With zero linked work the strategy is just a written
+    // intention, so the residual stays at inherent until coverage exists.
+    // Same gate Mitigate / Transfer apply via the `hasLinkedWork` flag in
+    // `previewResidual`. (Cubic finding #39 on PR #2671.)
+    if (total === 0) {
+      return { likelihood, impact, completion: 0 };
+    }
+    return {
+      likelihood: Likelihood.very_unlikely,
+      impact: Impact.insignificant,
+      completion,
+    };
+  }
+
+  const likelihoodSteps = Math.floor(reduction.likelihood * completion);
+  const impactSteps = Math.floor(reduction.impact * completion);
+
+  return {
+    likelihood: stepDownLikelihood(likelihood, likelihoodSteps),
+    impact: stepDownImpact(impact, impactSteps),
+    completion,
+  };
+}
+
+export interface PreviewResidualInput {
+  inherentLikelihood: Likelihood;
+  inherentImpact: Impact;
+  strategy: RiskTreatmentType;
+  /**
+   * Coverage gate — when false, the function returns inherent regardless of
+   * strategy. Forces the projected target to honor the "no linked work, no
+   * claimed reduction" rule for strategies that require operational evidence
+   * (Mitigate, Transfer). Accept naturally returns inherent already, so the
+   * flag has no effect there. Defaults to `true` so existing pure callers
+   * (and the StrategyPicker preview that shows "what would Mitigate look
+   * like") continue to see the full ceiling.
+   */
+  hasLinkedWork?: boolean;
+}
+
+export interface PreviewResidualOutput {
+  likelihood: Likelihood;
+  impact: Impact;
+}
+
+/**
+ * The residual the chosen strategy *would* produce at full execution.
+ * Used as the target marker on the Risk Matrix and the goal score for the
+ * hero's interpolated numeral. Doesn't depend on linked-task completion —
+ * use `interpolatedResidualScore` for the in-progress numeral.
+ *
+ * - Accept   → residual = inherent
+ * - Avoid    → residual pins to (very_unlikely, insignificant)
+ * - Transfer → residual.impact = stepDown(inherent.impact, 1) (assume the
+ *              transfer arrangement — insurance, indemnity — is in place)
+ * - Mitigate → likelihood −1, impact −1 (the full-completion outcome)
+ *
+ * Coverage gate: when `hasLinkedWork === false`, all strategies that
+ * require operational evidence (everything except Accept) collapse to
+ * `inherent`. We don't claim a reduction without at least one linked
+ * task — the strategy alone isn't audit evidence.
+ */
+export function previewResidual({
+  inherentLikelihood,
+  inherentImpact,
+  strategy,
+  hasLinkedWork = true,
+}: PreviewResidualInput): PreviewResidualOutput {
+  if (!hasLinkedWork && strategy !== RiskTreatmentType.accept) {
+    return { likelihood: inherentLikelihood, impact: inherentImpact };
+  }
+  switch (strategy) {
+    case RiskTreatmentType.accept:
+      return { likelihood: inherentLikelihood, impact: inherentImpact };
+    case RiskTreatmentType.avoid:
+      return { likelihood: Likelihood.very_unlikely, impact: Impact.insignificant };
+    case RiskTreatmentType.transfer:
+      return {
+        likelihood: inherentLikelihood,
+        impact: stepDownImpact(inherentImpact, 1),
+      };
+    case RiskTreatmentType.mitigate:
+    default:
+      return {
+        likelihood: stepDownLikelihood(inherentLikelihood, 1),
+        impact: stepDownImpact(inherentImpact, 1),
+      };
+  }
+}
+
+export interface InterpolatedScoreInput {
+  inherentScore: number;
+  targetScore: number;
+  /** 0..1 — only meaningful for Mitigate; non-Mitigate strategies pass 1. */
+  completion: number;
+}
+
+/**
+ * Linearly interpolate between inherent and target score by completion %.
+ * The Mitigate strategy gates on real task completion so the numeral moves
+ * in proportion to actual progress. Non-Mitigate strategies pass
+ * completion=1 (the strategy itself is the action; there's no in-progress
+ * concept).
+ */
+export function interpolatedResidualScore({
+  inherentScore,
+  targetScore,
+  completion,
+}: InterpolatedScoreInput): number {
+  const lerp = inherentScore - (inherentScore - targetScore) * completion;
+  return Math.round(lerp);
+}
diff --git a/apps/app/src/test-utils/setup.ts b/apps/app/src/test-utils/setup.ts
index 28ce909e4d..db80fa28af 100644
--- a/apps/app/src/test-utils/setup.ts
+++ b/apps/app/src/test-utils/setup.ts
@@ -2,6 +2,10 @@
 import '@testing-library/jest-dom/vitest';
 import { afterAll, afterEach, beforeAll, vi } from 'vitest';
 
+// Stub `server-only` so modules that use the marker can still be imported
+// in jsdom test runs (the package throws on client environments by design).
+vi.mock('server-only', () => ({}));
+
 // Mock Next.js modules globally
 vi.mock('next/navigation', () => ({
   useRouter: vi.fn(() => ({
diff --git a/apps/app/src/trigger/tasks/auditor/generate-auditor-content.ts b/apps/app/src/trigger/tasks/auditor/generate-auditor-content.ts
index 6a561b0d38..aad1727f8e 100644
--- a/apps/app/src/trigger/tasks/auditor/generate-auditor-content.ts
+++ b/apps/app/src/trigger/tasks/auditor/generate-auditor-content.ts
@@ -253,7 +253,7 @@ async function generateSectionContent(
   contextHubText: string,
 ): Promise<string> {
   const { text } = await generateText({
-    model: openai('gpt-5.2'),
+    model: openai('gpt-5.5'),
     system: `You are an expert at extracting and organizing company information for audit purposes.
 
 CRITICAL RULES:
diff --git a/apps/app/src/trigger/tasks/onboarding/build-citations-heading.spec.ts b/apps/app/src/trigger/tasks/onboarding/build-citations-heading.spec.ts
new file mode 100644
index 0000000000..5b199bff23
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/build-citations-heading.spec.ts
@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'vitest';
+import { buildCitationsHeading } from './build-citations-heading';
+import type { MitigationCitation } from './select-mitigation-citations';
+
+const ctrl = (code: string, name: string): MitigationCitation => ({
+  kind: 'control',
+  code,
+  name,
+});
+const tsk = (name: string, status = 'todo'): MitigationCitation => ({
+  kind: 'task',
+  name,
+  status,
+});
+const pol = (name: string): MitigationCitation => ({ kind: 'policy', name });
+const gap = (controlTypeHint: string): MitigationCitation => ({
+  kind: 'gap',
+  controlTypeHint,
+});
+
+describe('buildCitationsHeading', () => {
+  it('reports full linked totals (not citation counts) when work is linked', () => {
+    const heading = buildCitationsHeading({
+      citations: [
+        ctrl('CC1.1', 'Awareness'),
+        ctrl('CC6.1', 'MFA'),
+        ctrl('CC7.2', 'Logging'),
+        tsk('Quarterly review'),
+        tsk('Annual audit'),
+      ],
+      linkedTotals: { controls: 6, tasks: 8 },
+    });
+    // 6 + 8 linked, but bullets only reference 3 controls + 2 tasks → highlights
+    expect(heading).toBe(
+      'This plan addresses the risk through 6 controls and 8 tasks. Highlights below:',
+    );
+  });
+
+  it('omits the "Highlights" tail when bullets cover the full linked work', () => {
+    const heading = buildCitationsHeading({
+      citations: [ctrl('CC1.1', 'X'), ctrl('CC1.2', 'Y'), tsk('Z')],
+      linkedTotals: { controls: 2, tasks: 1 },
+    });
+    expect(heading).toBe(
+      'This plan addresses the risk through 2 controls and 1 task:',
+    );
+  });
+
+  it('singularizes correctly', () => {
+    const heading = buildCitationsHeading({
+      citations: [ctrl('CC1.1', 'X'), tsk('Y')],
+      linkedTotals: { controls: 1, tasks: 1 },
+    });
+    expect(heading).toBe('This plan addresses the risk through 1 control and 1 task:');
+  });
+
+  it('shows highlights when policies/gaps are present even at full coverage', () => {
+    const heading = buildCitationsHeading({
+      citations: [ctrl('CC1.1', 'X'), tsk('Y'), pol('Acceptable Use'), gap('compliance')],
+      linkedTotals: { controls: 1, tasks: 1 },
+    });
+    expect(heading).toBe(
+      'This plan addresses the risk through 1 control and 1 task. Highlights below:',
+    );
+  });
+
+  it('falls back to citation kinds when no work is linked (only gaps)', () => {
+    const heading = buildCitationsHeading({
+      citations: [gap('technical'), gap('technical'), gap('compliance')],
+      linkedTotals: { controls: 0, tasks: 0 },
+    });
+    expect(heading).toBe(
+      'This plan addresses the risk through 3 recommended gaps:',
+    );
+  });
+
+  it('falls back to citation kinds when no work is linked (mixed policies + gaps)', () => {
+    const heading = buildCitationsHeading({
+      citations: [pol('A'), pol('B'), gap('compliance')],
+      linkedTotals: { controls: 0, tasks: 0 },
+    });
+    expect(heading).toBe(
+      'This plan addresses the risk through 2 policies and 1 recommended gap:',
+    );
+  });
+
+  it('handles the empty case', () => {
+    expect(
+      buildCitationsHeading({ citations: [], linkedTotals: { controls: 0, tasks: 0 } }),
+    ).toBe('This plan addresses the risk:');
+  });
+});
diff --git a/apps/app/src/trigger/tasks/onboarding/build-citations-heading.ts b/apps/app/src/trigger/tasks/onboarding/build-citations-heading.ts
new file mode 100644
index 0000000000..538fb9a6fa
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/build-citations-heading.ts
@@ -0,0 +1,80 @@
+import type { MitigationCitation } from './select-mitigation-citations';
+
+export interface CitationsHeadingInput {
+  /** The 5 citations the LLM wrote sentences for. */
+  citations: MitigationCitation[];
+  /**
+   * Total linked work counts for the entity (risk or vendor) — these are
+   * what the user sees in the "Linked work" column of the UI. The citation
+   * list is a curated subset (max 3 controls + 2 tasks); the heading uses
+   * these totals so it never under-reports vs. the column.
+   */
+  linkedTotals: { controls: number; tasks: number };
+}
+
+/**
+ * Builds the intro sentence above the citation bullets in a treatment plan.
+ *
+ * The number we publish in the prose has to match what the user sees in the
+ * Linked Work column. The previous version counted citations, which capped
+ * at 3 controls + 2 tasks — so a risk with 6 linked controls + 8 linked
+ * tasks read as "3 controls and 2 tasks" in the prose, contradicting the
+ * UI. We now report the full linked totals and label the bullets below as
+ * "Highlights" when they're a strict subset.
+ *
+ *   linked 6 controls + 8 tasks, citations subset → "...through 6 controls
+ *     and 8 tasks. Highlights below:"
+ *   linked 2 controls + 1 task, citations cover all → "...through 2 controls
+ *     and 1 task:"
+ *   no linked work (only gaps/policies in citations) → fallback intro that
+ *     describes the citation kinds.
+ *
+ * Pure function; lives in its own file so unit tests don't need to load
+ * the DB client (which `onboard-organization-helpers.ts` imports at the
+ * top level).
+ */
+export function buildCitationsHeading({
+  citations,
+  linkedTotals,
+}: CitationsHeadingInput): string {
+  const formatter = new Intl.ListFormat('en', { style: 'long', type: 'conjunction' });
+
+  // Happy path: at least one linked control or task exists. Report the
+  // totals (matches the UI) and add "Highlights below:" when the bullets
+  // are a strict subset of the linked work + any policy/gap citations.
+  if (linkedTotals.controls > 0 || linkedTotals.tasks > 0) {
+    const parts: string[] = [];
+    if (linkedTotals.controls > 0) {
+      parts.push(
+        `${linkedTotals.controls} ${linkedTotals.controls === 1 ? 'control' : 'controls'}`,
+      );
+    }
+    if (linkedTotals.tasks > 0) {
+      parts.push(`${linkedTotals.tasks} ${linkedTotals.tasks === 1 ? 'task' : 'tasks'}`);
+    }
+    const citedControls = citations.filter((c) => c.kind === 'control').length;
+    const citedTasks = citations.filter((c) => c.kind === 'task').length;
+    const showsHighlights =
+      citedControls < linkedTotals.controls ||
+      citedTasks < linkedTotals.tasks ||
+      citations.some((c) => c.kind === 'gap' || c.kind === 'policy');
+    const tail = showsHighlights ? '. Highlights below:' : ':';
+    return `This plan addresses the risk through ${formatter.format(parts)}${tail}`;
+  }
+
+  // No linked work. Fall back to describing the citation kinds present —
+  // these are the only thing the bullets can talk about.
+  const policyCount = citations.filter((c) => c.kind === 'policy').length;
+  const gapCount = citations.filter((c) => c.kind === 'gap').length;
+  const parts: string[] = [];
+  if (policyCount > 0) {
+    parts.push(`${policyCount} ${policyCount === 1 ? 'policy' : 'policies'}`);
+  }
+  if (gapCount > 0) {
+    parts.push(`${gapCount} recommended ${gapCount === 1 ? 'gap' : 'gaps'}`);
+  }
+  if (parts.length === 0) {
+    return 'This plan addresses the risk:';
+  }
+  return `This plan addresses the risk through ${formatter.format(parts)}:`;
+}
diff --git a/apps/app/src/trigger/tasks/onboarding/generate-risk-mitigation.ts b/apps/app/src/trigger/tasks/onboarding/generate-risk-mitigation.ts
index c7d86baf65..b56993af63 100644
--- a/apps/app/src/trigger/tasks/onboarding/generate-risk-mitigation.ts
+++ b/apps/app/src/trigger/tasks/onboarding/generate-risk-mitigation.ts
@@ -20,7 +20,7 @@ export const generateRiskMitigation = task({
   run: async (payload: {
     organizationId: string;
     riskId: string;
-    authorId: string;
+    authorId?: string;
     policies: PolicyContext[];
   }) => {
     const { organizationId, riskId, authorId, policies } = payload;
@@ -40,14 +40,17 @@ export const generateRiskMitigation = task({
     const metadataHandle = metadata.root ?? metadata.parent ?? metadata;
     metadataHandle.set(`risk_${riskId}_status`, 'processing');
 
-    await createRiskMitigationComment(risk, policies, organizationId, authorId);
+    await createRiskMitigationComment(risk, policies, organizationId, authorId ?? '');
 
-    // Mark risk as closed and assign to owner/admin
+    // Mark risk as PENDING (not closed) — the AI drafted a plan but the
+    // user still needs to review it. Closing on the user's behalf would
+    // skip review and feel automated-away. Reassign to owner/admin only
+    // if we have one.
     await db.risk.update({
       where: { id: risk.id, organizationId },
       data: {
-        status: RiskStatus.closed,
-        assigneeId: authorId,
+        status: RiskStatus.pending,
+        ...(authorId ? { assigneeId: authorId } : {}),
       },
     });
 
@@ -105,9 +108,8 @@ export const generateRiskMitigationsForOrg = task({
 
     if (!author) {
       logger.warn(
-        `No onboarding author found for org ${organizationId}; skipping risk mitigations`,
+        `No onboarding author found for org ${organizationId}; treatment descriptions will generate but risks will not be reassigned`,
       );
-      return;
     }
 
     const policies = policyRows.map((p) => ({ name: p.name, description: p.description }));
@@ -117,7 +119,7 @@ export const generateRiskMitigationsForOrg = task({
         payload: {
           organizationId,
           riskId: r.id,
-          authorId: author.id,
+          authorId: author?.id,
           policies,
         },
         concurrencyKey: `${organizationId}:${r.id}`,
diff --git a/apps/app/src/trigger/tasks/onboarding/generate-vendor-mitigation.ts b/apps/app/src/trigger/tasks/onboarding/generate-vendor-mitigation.ts
index 237ab2555e..38c91d44d0 100644
--- a/apps/app/src/trigger/tasks/onboarding/generate-vendor-mitigation.ts
+++ b/apps/app/src/trigger/tasks/onboarding/generate-vendor-mitigation.ts
@@ -23,7 +23,7 @@ export const generateVendorMitigation = task({
   run: async (payload: {
     organizationId: string;
     vendorId: string;
-    authorId: string;
+    authorId?: string;
     policies: PolicyContext[];
   }) => {
     const { organizationId, vendorId, authorId, policies } = payload;
@@ -43,21 +43,26 @@ export const generateVendorMitigation = task({
     const metadataHandle = metadata.root ?? metadata.parent ?? metadata;
     metadataHandle.set(`vendor_${vendorId}_status`, 'processing');
 
-    await createVendorRiskComment(vendor, policies, organizationId, authorId);
+    await createVendorRiskComment(vendor, policies, organizationId, authorId ?? '');
 
-    // Mark vendor as assessed and assign to author (unless they're a platform admin,
-    // since platform admins are hidden from the assignee UI and would block future updates)
-    const author = await db.member.findFirst({
-      where: { id: authorId, organizationId },
-      include: { user: { select: { role: true } } },
-    });
-    const assigneeId = author?.user.role === 'admin' ? null : authorId;
+    // Mark vendor as assessed. Only reassign if we have an author;
+    // platform admins are hidden from the assignee UI, so skip them too.
+    let assigneeUpdate: { assigneeId: string | null } | Record<string, never> = {};
+    if (authorId) {
+      const author = await db.member.findFirst({
+        where: { id: authorId, organizationId },
+        include: { user: { select: { role: true } } },
+      });
+      assigneeUpdate = {
+        assigneeId: author?.user.role === 'admin' ? null : authorId,
+      };
+    }
 
     await db.vendor.update({
       where: { id: vendor.id, organizationId },
       data: {
         status: VendorStatus.assessed,
-        assigneeId,
+        ...assigneeUpdate,
       },
     });
 
@@ -105,9 +110,8 @@ export const generateVendorMitigationsForOrg = task({
 
     if (!author) {
       logger.warn(
-        `No onboarding author found for org ${organizationId}; skipping vendor mitigations`,
+        `No onboarding author found for org ${organizationId}; treatment descriptions will generate but vendors will not be reassigned`,
       );
-      return;
     }
 
     const policies = policyRows.map((p) => ({ name: p.name, description: p.description }));
@@ -117,7 +121,7 @@ export const generateVendorMitigationsForOrg = task({
         payload: {
           organizationId,
           vendorId: v.id,
-          authorId: author.id,
+          authorId: author?.id,
           policies,
         },
         concurrencyKey: `${organizationId}:${v.id}`,
diff --git a/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.spec.ts b/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.spec.ts
new file mode 100644
index 0000000000..08fc9d47f8
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.spec.ts
@@ -0,0 +1,139 @@
+import { Departments } from '@db';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { dbMock, upsertMock, findSimilarTasksMock } = vi.hoisted(() => ({
+  dbMock: {
+    risk: { findMany: vi.fn(), update: vi.fn() },
+    vendor: { findMany: vi.fn(), update: vi.fn() },
+    task: { findMany: vi.fn() },
+  },
+  upsertMock: vi.fn(),
+  findSimilarTasksMock: vi.fn(),
+}));
+
+vi.mock('@db/server', () => ({ db: dbMock }));
+
+vi.mock('@/lib/embedding', () => ({
+  upsertEntityEmbeddings: upsertMock,
+  findSimilarTasks: findSimilarTasksMock,
+}));
+
+vi.mock('@trigger.dev/sdk', () => ({
+  task: (def: { run: Function }) => ({ run: def.run }),
+  logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+  metadata: { set: vi.fn() },
+}));
+
+import { linkRisksAndVendorsToWork } from './link-risks-and-vendors-to-work';
+
+const runTask = (linkRisksAndVendorsToWork as unknown as {
+  run: (payload: { organizationId: string; riskId?: string; vendorId?: string }) => Promise<unknown>;
+}).run;
+
+beforeEach(() => {
+  upsertMock.mockReset();
+  findSimilarTasksMock.mockReset();
+  Object.values(dbMock).forEach((m) =>
+    Object.values(m as Record<string, ReturnType<typeof vi.fn>>).forEach((fn) => fn.mockReset()),
+  );
+});
+
+describe('linkRisksAndVendorsToWork', () => {
+  it('links each risk to top-K matching tasks (above threshold)', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      {
+        id: 'rsk_1',
+        title: 'Phishing',
+        description: 'Email phishing',
+        category: 'people',
+        department: Departments.hr,
+      },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'Awareness training', description: '', department: Departments.hr },
+      { id: 'tsk_b', title: 'Backup', description: '', department: Departments.it },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.8, department: Departments.hr },
+      { id: 'tsk_b', score: 0.5, department: Departments.it },
+    ]);
+
+    await runTask({ organizationId: 'org_1' });
+
+    expect(dbMock.risk.update).toHaveBeenCalledWith({
+      where: { id: 'rsk_1' },
+      data: { tasks: { connect: [{ id: 'tsk_a' }] } },
+    });
+  });
+
+  it('skips a risk with no candidates above threshold', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      { id: 'rsk_1', title: 't', description: 'd', category: 'people', department: Departments.hr },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'irrelevant', description: '', department: Departments.it },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.3, department: Departments.it },
+    ]);
+
+    await runTask({ organizationId: 'org_1' });
+
+    expect(dbMock.risk.update).not.toHaveBeenCalled();
+  });
+
+  it('returns early when org has no tasks', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      { id: 'rsk_1', title: 't', description: 'd', category: 'people', department: Departments.hr },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([]);
+
+    await runTask({ organizationId: 'org_1' });
+
+    expect(findSimilarTasksMock).not.toHaveBeenCalled();
+    expect(dbMock.risk.update).not.toHaveBeenCalled();
+  });
+
+  it('scopes to a single risk when riskId is provided', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([
+      { id: 'rsk_1', title: 'a', description: '', category: 'people', department: Departments.hr },
+    ]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'awareness', description: '', department: Departments.hr },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.9, department: Departments.hr },
+    ]);
+
+    await runTask({ organizationId: 'org_1', riskId: 'rsk_1' });
+
+    expect(dbMock.risk.findMany).toHaveBeenCalledWith({
+      where: { organizationId: 'org_1', id: 'rsk_1' },
+      select: expect.any(Object),
+    });
+  });
+
+  it('links vendors via _TaskToVendor when vendorId is provided', async () => {
+    dbMock.risk.findMany.mockResolvedValueOnce([]);
+    dbMock.vendor.findMany.mockResolvedValueOnce([
+      { id: 'vnd_1', name: 'AcmeSaaS', description: 'cloud crm', category: 'software_as_a_service' },
+    ]);
+    dbMock.task.findMany.mockResolvedValueOnce([
+      { id: 'tsk_a', title: 'vendor review', description: '', department: Departments.gov },
+    ]);
+    findSimilarTasksMock.mockResolvedValueOnce([
+      { id: 'tsk_a', score: 0.85, department: Departments.gov },
+    ]);
+
+    await runTask({ organizationId: 'org_1', vendorId: 'vnd_1' });
+
+    expect(dbMock.vendor.update).toHaveBeenCalledWith({
+      where: { id: 'vnd_1' },
+      data: { tasks: { connect: [{ id: 'tsk_a' }] } },
+    });
+  });
+});
diff --git a/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.ts b/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.ts
new file mode 100644
index 0000000000..dca2847022
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/link-risks-and-vendors-to-work.ts
@@ -0,0 +1,112 @@
+import { logger, metadata, task } from '@trigger.dev/sdk';
+import {
+  runLinkage,
+  type LinkagePhase,
+  type RunLinkageInput,
+} from '@/lib/embedding/run-linkage';
+
+/**
+ * Wraps `runLinkage` and mirrors progress phases into trigger.dev run metadata
+ * so the frontend (subscribed via `useRealtimeRun` with a public-access token)
+ * can render a live progress indicator across embedding + matching phases.
+ *
+ * Metadata schema (read by the UI as `run.metadata as Record<string, unknown>`):
+ * - `phase`:     LinkagePhase['name']  (e.g. 'embedding-tasks', 'done')
+ * - `current`:   number  (only present for phases with progress)
+ * - `total`:     number  (only present for phases with progress)
+ * - `riskLinks`: number  (only on the 'done' phase)
+ * - `vendorLinks`: number  (only on the 'done' phase)
+ */
+export const linkRisksAndVendorsToWork = task({
+  id: 'link-risks-and-vendors-to-work',
+  retry: { maxAttempts: 2 },
+  run: async (payload: RunLinkageInput) => {
+    const { organizationId, riskId, vendorId, replace, suggestionsOnly } = payload;
+    const mode = suggestionsOnly
+      ? 'suggestions-only (no DB writes)'
+      : replace
+        ? 'replace (destructive)'
+        : 'additive';
+    const target = riskId
+      ? `risk=${riskId}`
+      : vendorId
+        ? `vendor=${vendorId}`
+        : 'all risks + all vendors';
+
+    logger.info(`▶ start linkage`, { organizationId, target, mode });
+    const startedAt = Date.now();
+    const phaseStartedAt: Partial<Record<LinkagePhase['name'], number>> = {};
+
+    const onPhase = (phase: LinkagePhase) => {
+      // Mirror to metadata for the realtime UI subscriber. Always write
+      // every field — using `null` when the new phase doesn't include a
+      // field — so subscribers don't see stale `current`/`total` from
+      // an earlier progress phase leak into a later non-progress phase
+      // (e.g. waiting-for-index showing the embedding-tasks counts).
+      // (Cubic finding on PR #2671.)
+      metadata.set('phase', phase.name);
+      metadata.set('current', 'current' in phase ? phase.current : null);
+      metadata.set('total', 'total' in phase ? phase.total : null);
+      metadata.set('riskLinks', 'riskLinks' in phase ? phase.riskLinks : null);
+      metadata.set('vendorLinks', 'vendorLinks' in phase ? phase.vendorLinks : null);
+
+      // Structured per-phase logs. We log once at phase start (current=0 or
+      // first sighting) and once at phase completion (current === total) so
+      // the trigger.dev console reads as a clean timeline rather than a
+      // per-tick stream.
+      const isStart = !phaseStartedAt[phase.name];
+      const hasProgress = 'current' in phase && 'total' in phase;
+      const isCompletion = hasProgress && phase.current === phase.total;
+
+      if (isStart) {
+        phaseStartedAt[phase.name] = Date.now();
+        if (phase.name === 'starting') {
+          logger.info('· initializing scan');
+          return;
+        }
+        if (phase.name === 'done') {
+          // Handled below in the result log.
+          return;
+        }
+        const sizeNote = hasProgress ? ` (${phase.total} item${phase.total === 1 ? '' : 's'})` : '';
+        logger.info(`· ${phase.name}${sizeNote}`);
+        return;
+      }
+      if (isCompletion) {
+        const startMs = phaseStartedAt[phase.name];
+        const elapsed = startMs ? `${((Date.now() - startMs) / 1000).toFixed(2)}s` : '?';
+        logger.info(`· ${phase.name} done in ${elapsed}`);
+      }
+    };
+
+    try {
+      const result = await runLinkage({ ...payload, onPhase });
+      const elapsed = ((Date.now() - startedAt) / 1000).toFixed(2);
+      const suggestionTaskCount = result.suggestions?.tasks.length ?? 0;
+      const suggestionControlCount = result.suggestions?.controls.length ?? 0;
+      logger.info(`✓ linkage complete in ${elapsed}s`, {
+        organizationId,
+        target,
+        mode,
+        riskLinks: result.riskLinks,
+        vendorLinks: result.vendorLinks,
+        ...(suggestionsOnly
+          ? {
+              suggestedTasks: suggestionTaskCount,
+              suggestedControls: suggestionControlCount,
+            }
+          : {}),
+      });
+      return result;
+    } catch (err) {
+      const elapsed = ((Date.now() - startedAt) / 1000).toFixed(2);
+      logger.error(`✗ linkage failed after ${elapsed}s`, {
+        organizationId,
+        target,
+        mode,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      throw err;
+    }
+  },
+});
diff --git a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
index 2b215e2810..c333bdba01 100644
--- a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
+++ b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
@@ -1,6 +1,5 @@
 import { openai } from '@ai-sdk/openai';
 import {
-  CommentEntityType,
   Departments,
   FrameworkEditorFramework,
   Impact,
@@ -14,11 +13,22 @@ import {
 } from '@db';
 import { db } from '@db/server';
 import { logger, metadata, tasks } from '@trigger.dev/sdk';
-import { generateObject, generateText, jsonSchema } from 'ai';
+import { generateObject, jsonSchema } from 'ai';
 import axios from 'axios';
+import { z } from 'zod';
 import type { researchVendor } from '../scrape/research';
+import {
+  applyMitigationPlanFields,
+  mirrorActiveDescriptionIntoMap,
+} from '@/lib/strategy-descriptions';
+import { buildCitationsHeading } from './build-citations-heading';
 import { RISK_MITIGATION_PROMPT } from './prompts/risk-mitigation';
-import { VENDOR_RISK_ASSESSMENT_PROMPT } from './prompts/vendor-risk-assessment';
+import {
+  citationSuffix,
+  GAP_HINT_BY_RISK_CATEGORY,
+  selectMitigationCitations,
+  type MitigationCitation,
+} from './select-mitigation-citations';
 import { updatePolicy } from './update-policy';
 
 type VendorForRiskAssessmentTrigger = {
@@ -82,7 +92,9 @@ const BASELINE_RISKS: Array<{
       'Intentional misrepresentation or deception by an internal actor (employee, contractor) or by the organization as a whole, for the purpose of achieving an unauthorized or improper gain.',
     category: RiskCategory.governance,
     department: Departments.gov,
-    status: RiskStatus.closed,
+    // Pending (not closed) so the user reviews + signs off before the risk
+    // shows up as resolved — same rule we apply after AI mitigation.
+    status: RiskStatus.pending,
   },
 ];
 
@@ -120,6 +132,234 @@ export async function ensureBaselineRisks(organizationId: string): Promise<Risk[
   return created;
 }
 
+type GroundingTask = { title: string; status: string };
+type GroundingControl = { code: string; name: string; framework: string };
+
+/**
+ * Loads tasks + deduped controls linked to a risk for use as grounding context
+ * in the mitigation-plan prompt. Returns null if the risk doesn't exist.
+ */
+async function loadRiskGroundingContext(
+  riskId: string,
+  organizationId: string,
+): Promise<{
+  linkedTasks: GroundingTask[];
+  linkedControls: GroundingControl[];
+} | null> {
+  // Order tasks by createdAt then id, and the controls inside each task
+  // the same way, so the citation selection (which preserves input order
+  // for determinism) produces identical output across re-runs. Without
+  // these `orderBy` clauses Prisma returns relation rows in undefined
+  // order — see Cubic finding #40 on PR #2671.
+  const risk = await db.risk.findFirst({
+    where: { id: riskId, organizationId },
+    include: {
+      tasks: {
+        orderBy: [{ createdAt: 'asc' }, { id: 'asc' }],
+        select: {
+          id: true,
+          title: true,
+          status: true,
+          controls: {
+            orderBy: [{ name: 'asc' }, { id: 'asc' }],
+            select: {
+              id: true,
+              name: true,
+              requirementsMapped: {
+                orderBy: [{ id: 'asc' }],
+                select: {
+                  frameworkInstance: {
+                    select: { framework: { select: { name: true } } },
+                  },
+                  requirement: { select: { identifier: true } },
+                  customRequirement: { select: { identifier: true } },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+
+  if (!risk) return null;
+
+  const linkedTasks: GroundingTask[] = risk.tasks.map((t) => ({
+    title: t.title,
+    status: t.status,
+  }));
+
+  const seen = new Set<string>();
+  const linkedControls: GroundingControl[] = [];
+  for (const t of risk.tasks) {
+    for (const c of t.controls) {
+      const mapping = c.requirementsMapped[0];
+      const code =
+        mapping?.requirement?.identifier ?? mapping?.customRequirement?.identifier ?? c.id;
+      const framework = mapping?.frameworkInstance?.framework?.name ?? 'Custom';
+      const key = `${code}|${c.name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      linkedControls.push({ code, name: c.name, framework });
+    }
+  }
+
+  return { linkedTasks, linkedControls };
+}
+
+function vendorCompliancePostureBlock(vendor: {
+  status: string;
+  complianceBadges: unknown;
+}): string {
+  if (vendor.status !== 'assessed') {
+    return `Assessment status: ${vendor.status} (no verified compliance signal yet).`;
+  }
+  if (!Array.isArray(vendor.complianceBadges) || vendor.complianceBadges.length === 0) {
+    return 'No verified compliance certifications.';
+  }
+  const lines = (vendor.complianceBadges as Array<{ type: string; verified?: boolean }>).map(
+    (b) => `- ${b.type}${b.verified ? ' (verified)' : ' (claimed)'}`,
+  );
+  return `Compliance posture:\n${lines.join('\n')}`;
+}
+
+/**
+ * Loads tasks, deduped controls, and a compliance posture block for a vendor.
+ * Returns null if the vendor doesn't exist.
+ */
+async function loadVendorGroundingContext(
+  vendorId: string,
+  organizationId: string,
+): Promise<{
+  linkedTasks: GroundingTask[];
+  linkedControls: GroundingControl[];
+  compliancePosture: string;
+} | null> {
+  // Same orderBy as the risk loader — see Cubic finding #40.
+  const vendor = await db.vendor.findFirst({
+    where: { id: vendorId, organizationId },
+    include: {
+      tasks: {
+        orderBy: [{ createdAt: 'asc' }, { id: 'asc' }],
+        select: {
+          id: true,
+          title: true,
+          status: true,
+          controls: {
+            orderBy: [{ name: 'asc' }, { id: 'asc' }],
+            select: {
+              id: true,
+              name: true,
+              requirementsMapped: {
+                orderBy: [{ id: 'asc' }],
+                select: {
+                  frameworkInstance: {
+                    select: { framework: { select: { name: true } } },
+                  },
+                  requirement: { select: { identifier: true } },
+                  customRequirement: { select: { identifier: true } },
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  });
+  if (!vendor) return null;
+
+  const linkedTasks: GroundingTask[] = vendor.tasks.map((t) => ({
+    title: t.title,
+    status: t.status,
+  }));
+
+  const seen = new Set<string>();
+  const linkedControls: GroundingControl[] = [];
+  for (const t of vendor.tasks) {
+    for (const c of t.controls) {
+      const mapping = c.requirementsMapped[0];
+      const code =
+        mapping?.requirement?.identifier ?? mapping?.customRequirement?.identifier ?? c.id;
+      const framework = mapping?.frameworkInstance?.framework?.name ?? 'Custom';
+      const key = `${code}|${c.name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      linkedControls.push({ code, name: c.name, framework });
+    }
+  }
+
+  return {
+    linkedTasks,
+    linkedControls,
+    compliancePosture: vendorCompliancePostureBlock({
+      status: vendor.status,
+      complianceBadges: vendor.complianceBadges,
+    }),
+  };
+}
+
+/**
+ * Builds the citations block of the user prompt — a numbered list the LLM
+ * uses as a 1:1 mapping between sentences[i] and citations[i].
+ */
+function formatCitationsBlock(citations: MitigationCitation[]): string {
+  return citations
+    .map((c, i) => {
+      const idx = i + 1;
+      switch (c.kind) {
+        case 'control':
+          return `${idx}. CONTROL — code: ${c.code}, name: ${c.name}`;
+        case 'task':
+          return `${idx}. TASK — name: ${c.name}, status: ${c.status}`;
+        case 'policy':
+          return `${idx}. POLICY — name: ${c.name}`;
+        case 'gap':
+          return `${idx}. GAP — recommend adding ${c.controlTypeHint} control`;
+      }
+    })
+    .join('\n');
+}
+
+const sentencesSchema = z.object({
+  sentences: z.array(z.string().min(8).max(200)).length(5),
+});
+
+/**
+ * Combines deterministic citations with LLM-generated sentences into the
+ * final treatment-plan body that gets persisted to
+ * `treatmentStrategyDescription`.
+ *
+ * The intro line is built from the actual citations so it can never lie
+ * about counts/kinds — e.g. "through 3 controls, 1 task, and 1 recommended
+ * gap" reflects exactly what's in the bullets below.
+ */
+function combineSentencesWithCitations({
+  treatmentStrategy,
+  sentences,
+  citations,
+  linkedTotals,
+}: {
+  treatmentStrategy: string;
+  sentences: string[];
+  citations: MitigationCitation[];
+  /**
+   * Full linked-work totals for the entity. The heading reports these so
+   * the prose matches the Linked Work column, even when the bullets are a
+   * curated subset (max 3 controls + 2 tasks).
+   */
+  linkedTotals: { controls: number; tasks: number };
+}): string {
+  const bullets = sentences.map(
+    (sentence, i) => `- ${sentence.trim()}${citationSuffix(citations[i])}`,
+  );
+  return [
+    `Treatment plan (${treatmentStrategy})`,
+    buildCitationsHeading({ citations, linkedTotals }),
+    ...bullets,
+  ].join('\n');
+}
+
+
 /**
  * Revalidates the organization path for cache busting
  */
@@ -293,8 +533,38 @@ export async function extractVendorsFromContext(
       required: ['vendors'],
       additionalProperties: false,
     }),
-    system:
-      'Extract vendor names from the following questions and answers. Return their name (grammar-correct), website, description, category, inherent probability, inherent impact, residual probability, and residual impact. IMPORTANT: For vendor_name, always use the parent company name, not the product name (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT"). Set original_name to the name as it appeared in the user input.',
+    system: [
+      'Extract vendor names from the following questions and answers. Return their name (grammar-correct), website, description, category, inherent probability, inherent impact, residual probability, and residual impact.',
+      'IMPORTANT: For vendor_name, always use the parent company name, not the product name (e.g. "Anthropic" not "Claude", "OpenAI" not "ChatGPT"). Set original_name to the name as it appeared in the user input.',
+      '',
+      'INHERENT RISK SCORING — read carefully and apply consistently.',
+      '',
+      'You are estimating inherent risk from the user\'s onboarding answers ONLY. You do not have access to the vendor\'s public security posture (certifications, breach history, etc.) — a separate research step fills that in later. Score conservatively from the SIGNALS in the user\'s answers, not from your own knowledge of the vendor.',
+      '',
+      'Default both probability and impact to MIDDLE (possible × moderate → ~5/10) unless a signal in the user\'s answers tells you otherwise. Only deviate when the answers explicitly point to a higher or lower band.',
+      '',
+      'Signals that LOWER inherent_probability:',
+      '- The user describes the vendor as a managed service they trust for similar infra elsewhere',
+      '- The user says they\'ve completed their own due diligence (SOC 2 review, security questionnaire) on this vendor',
+      '- The vendor is mentioned only as a passive utility (e.g. analytics for marketing pages, no customer data)',
+      'Signals that RAISE inherent_probability:',
+      '- The user describes ongoing concerns or past incidents with the vendor',
+      '- The vendor handles a category the user explicitly flags as risky',
+      '- The vendor is described as a small/early-stage provider OR self-hosted by the user',
+      '',
+      'Signals that LOWER inherent_impact:',
+      '- The vendor is used in a non-production / preview / sandbox capacity only',
+      '- The user describes the vendor as handling no customer data, no PII, no auth',
+      '- There is a documented fallback / alternative the user can swap to',
+      'Signals that RAISE inherent_impact:',
+      '- The vendor is described as production infrastructure (cloud, database, identity, payments)',
+      '- The vendor processes PHI, payments, source code, auth secrets, or PII at scale',
+      '- The user says they cannot easily replace the vendor',
+      '',
+      'When the user simply NAMES the vendor with no further context, you have NO signal — return (possible, moderate). Do not infer risk from the vendor\'s name or your prior knowledge of the company; the research step will refine the score later with actual posture data.',
+      '',
+      'residual_probability / residual_impact: default to the same level as inherent. Only LOWER residual when the user\'s answers describe their OWN compensating controls (their own MFA enforcement, network segmentation, data encryption at rest, etc.) — NOT the vendor\'s controls.',
+    ].join('\n'),
     prompt: questionsAndAnswers.map((q) => `${q.question}\n${q.answer}`).join('\n'),
   });
 
@@ -355,7 +625,12 @@ export async function extractVendorsFromContext(
 }
 
 /**
- * Creates a risk mitigation comment for a vendor
+ * Creates a risk mitigation comment for a vendor.
+ *
+ * The 5 citations are picked deterministically by `selectMitigationCitations`
+ * (controls → tasks → policies → gap fillers). The LLM only produces 5 prose
+ * sentences via `generateObject`; the (Control/Task/Policy/gap) suffixes are
+ * appended programmatically so they cannot be hallucinated.
  */
 export async function createVendorRiskComment(
   vendor: any,
@@ -363,35 +638,72 @@ export async function createVendorRiskComment(
   organizationId: string,
   authorId: string,
 ): Promise<void> {
-  const policiesContext =
-    policies.length > 0
-      ? policies
-          .map((p) => `- ${p.name}: ${p.description || 'No description available'}`)
-          .join('\n')
-      : 'No specific policies available - use standard security policy guidance.';
-
-  const riskMitigationComment = await generateText({
-    model: openai('gpt-5-mini'),
-    system: VENDOR_RISK_ASSESSMENT_PROMPT,
-    prompt: `Vendor: ${vendor.name} (${vendor.category}) - ${vendor.description}. Website: ${vendor.website}.
+  const grounding = await loadVendorGroundingContext(vendor.id, organizationId);
+
+  const citations = selectMitigationCitations({
+    linkedControls: grounding?.linkedControls.map((c) => ({ code: c.code, name: c.name })) ?? [],
+    linkedTasks: grounding?.linkedTasks.map((t) => ({ name: t.title, status: t.status })) ?? [],
+    policies: policies.map((p) => ({ name: p.name })),
+    // Vendors don't have a RiskCategory; their plan always centers on
+    // third-party / vendor-management style mitigations.
+    gapHint: 'third-party',
+  });
+
+  const compliancePostureBlock =
+    grounding?.compliancePosture ?? `Assessment status: ${vendor.status ?? 'unknown'}.`;
+
+  const userPrompt = `Vendor: ${vendor.name} (${vendor.category})
+Description: ${vendor.description ?? 'unspecified'}
+Website: ${vendor.website ?? 'unspecified'}
+Status: ${vendor.status ?? 'unknown'}
 
-Available Organization Policies:
-${policiesContext}
+Vendor Compliance Posture:
+${compliancePostureBlock}
 
-Please perform a comprehensive vendor risk assessment for this vendor using the available policies listed above as context for your recommendations.`,
+Citations (write one sentence per item, in order):
+${formatCitationsBlock(citations)}`;
+
+  const result = await generateObject({
+    model: openai('gpt-5-mini'),
+    system: RISK_MITIGATION_PROMPT,
+    prompt: userPrompt,
+    schema: sentencesSchema,
   });
 
-  await db.comment.create({
-    data: {
-      content: riskMitigationComment.text,
-      entityId: vendor.id,
-      entityType: CommentEntityType.vendor,
-      authorId,
-      organizationId,
+  // See createRiskMitigationComment — pin the prose label to 'mitigate'
+  // since the saved strategy is forced to mitigate by
+  // `applyMitigationPlanFields` below.
+  const finalText = combineSentencesWithCitations({
+    treatmentStrategy: 'mitigate',
+    sentences: result.object.sentences,
+    citations,
+    linkedTotals: {
+      controls: grounding?.linkedControls.length ?? 0,
+      tasks: grounding?.linkedTasks.length ?? 0,
     },
   });
 
-  logger.info(`Created risk mitigation comment for vendor: ${vendor.id} (${vendor.name})`);
+  // The AI generated a mitigation plan — force the strategy to mitigate
+  // so the plan lands in the correct slot, even if the vendor was
+  // previously on Accept / Transfer / Avoid (e.g. older rows created
+  // before the schema default flipped to mitigate). Any prior non-
+  // mitigate text is preserved under its own slot.
+  await db.vendor.update({
+    where: { id: vendor.id, organizationId },
+    data: applyMitigationPlanFields({
+      plan: finalText,
+      currentStrategy:
+        typeof vendor.treatmentStrategy === 'string'
+          ? vendor.treatmentStrategy
+          : 'mitigate',
+      currentDescription: vendor.treatmentStrategyDescription ?? null,
+      currentMap: vendor.strategyDescriptions,
+    }),
+  });
+
+  logger.info(
+    `Wrote AI-generated treatmentStrategyDescription for vendor: ${vendor.id} (${vendor.name})`,
+  );
 }
 
 /**
@@ -642,8 +954,16 @@ export async function triggerVendorResearch(vendors: any[]): Promise<void> {
     }
 
     try {
+      // `scoreContext` chains the research run into score-vendor-risk
+      // when GlobalVendors finishes saving, so the per-org Vendor row
+      // gets a posture-grounded score instead of the conservative
+      // (possible × moderate) default the extraction pass set.
       const handle = await tasks.trigger<typeof researchVendor>('research-vendor', {
         website,
+        scoreContext:
+          vendor.id && vendor.organizationId
+            ? { vendorId: vendor.id, organizationId: vendor.organizationId }
+            : undefined,
       });
       logger.info(`Triggered research for vendor ${vendor.name} with handle ${handle.id}`);
     } catch (error) {
@@ -672,7 +992,12 @@ export async function createVendorRiskComments(
 }
 
 /**
- * Creates a risk mitigation comment for a risk
+ * Creates a risk mitigation comment for a risk.
+ *
+ * The 5 citations are picked deterministically by `selectMitigationCitations`
+ * (controls → tasks → policies → gap fillers). The LLM only produces 5 prose
+ * sentences via `generateObject`; the (Control/Task/Policy/gap) suffixes are
+ * appended programmatically so they cannot be hallucinated.
  */
 export async function createRiskMitigationComment(
   risk: Risk,
@@ -680,30 +1005,64 @@ export async function createRiskMitigationComment(
   organizationId: string,
   authorId: string,
 ): Promise<void> {
-  const policiesContext =
-    policies.length > 0
-      ? policies
-          .map((p) => `- ${p.name}: ${p.description || 'No description available'}`)
-          .join('\n')
-      : 'No specific policies available - use standard security policy guidance.';
-
-  const mitigation = await generateText({
+  const grounding = await loadRiskGroundingContext(risk.id, organizationId);
+
+  const citations = selectMitigationCitations({
+    linkedControls: grounding?.linkedControls.map((c) => ({ code: c.code, name: c.name })) ?? [],
+    linkedTasks: grounding?.linkedTasks.map((t) => ({ name: t.title, status: t.status })) ?? [],
+    policies: policies.map((p) => ({ name: p.name })),
+    gapHint: GAP_HINT_BY_RISK_CATEGORY[risk.category] ?? 'general',
+  });
+
+  // The AI mitigation generator always produces a *mitigation* plan, and
+  // `applyMitigationPlanFields` below forces the saved strategy to
+  // 'mitigate'. Pin the prompt + prose label to 'mitigate' too so the
+  // generated text isn't labeled with the row's previous strategy
+  // (e.g. "Treatment plan (accept)" stored under strategy=mitigate).
+  const PLAN_STRATEGY = 'mitigate';
+  const userPrompt = `Risk: ${risk.title}
+Description: ${risk.description}
+Category: ${risk.category}
+Department: ${risk.department ?? 'unspecified'}
+Residual: likelihood=${risk.residualLikelihood}, impact=${risk.residualImpact}
+Treatment strategy: ${PLAN_STRATEGY}
+
+Citations (write one sentence per item, in order):
+${formatCitationsBlock(citations)}`;
+
+  const result = await generateObject({
     model: openai('gpt-5-mini'),
     system: RISK_MITIGATION_PROMPT,
-    prompt: `Risk: ${risk.title} (${risk.category} / ${risk.department})\n\nDescription:\n${risk.description}\n\nTreatment Strategy:\n${risk.treatmentStrategy}: ${risk.treatmentStrategyDescription || 'N/A'}\n\nResidual Assessment: Likelihood ${risk.likelihood}, Impact ${risk.impact}\n\nAvailable Organization Policies:\n${policiesContext}\n\nWrite a pragmatic mitigation plan with concrete steps the team can implement in the next 30-90 days.`,
+    prompt: userPrompt,
+    schema: sentencesSchema,
   });
 
-  await db.comment.create({
-    data: {
-      content: mitigation.text,
-      entityId: risk.id,
-      entityType: CommentEntityType.risk,
-      authorId,
-      organizationId,
+  const finalText = combineSentencesWithCitations({
+    treatmentStrategy: PLAN_STRATEGY,
+    sentences: result.object.sentences,
+    citations,
+    linkedTotals: {
+      controls: grounding?.linkedControls.length ?? 0,
+      tasks: grounding?.linkedTasks.length ?? 0,
     },
   });
 
-  logger.info(`Created risk mitigation comment for risk: ${risk.id} (${risk.title})`);
+  // See createVendorRiskMitigationComment — the AI plan is a mitigation
+  // plan, so force strategy=mitigate and preserve any prior non-mitigate
+  // description under its own slot.
+  await db.risk.update({
+    where: { id: risk.id, organizationId },
+    data: applyMitigationPlanFields({
+      plan: finalText,
+      currentStrategy: risk.treatmentStrategy,
+      currentDescription: risk.treatmentStrategyDescription,
+      currentMap: risk.strategyDescriptions,
+    }),
+  });
+
+  logger.info(
+    `Wrote AI-generated treatmentStrategyDescription for risk: ${risk.id} (${risk.title})`,
+  );
 }
 
 /**
@@ -820,7 +1179,11 @@ export async function createRisksFromData(
     metadata.set(`risk_temp_${index}_status`, 'processing');
   });
 
-  // Create all risks concurrently
+  // Create all risks concurrently. Strategy is intentionally NOT taken
+  // from the LLM extraction — we always start with mitigate (the
+  // workhorse strategy + schema default) so the AI mitigation plan that
+  // runs immediately after lands in the correct slot. The user can
+  // switch to accept / transfer / avoid manually if needed.
   const createPromises = riskData.map((risk) =>
     db.risk.create({
       data: {
@@ -830,8 +1193,6 @@ export async function createRisksFromData(
         department: risk.department,
         likelihood: risk.risk_residual_probability,
         impact: risk.risk_residual_impact,
-        treatmentStrategy: risk.risk_treatment_strategy,
-        treatmentStrategyDescription: risk.risk_treatment_strategy_description,
         organizationId,
       },
     }),
@@ -881,6 +1242,9 @@ async function createRisksFromDataWithBaseline(
         },
       });
     } else if (risk.riskData) {
+      // Same rationale as createRisksFromData — strategy is fixed to
+      // mitigate (schema default) so the AI plan generated right after
+      // lands in the correct slot.
       return db.risk.create({
         data: {
           title: risk.riskData.risk_name,
@@ -889,8 +1253,6 @@ async function createRisksFromDataWithBaseline(
           department: risk.riskData.department,
           likelihood: risk.riskData.risk_residual_probability,
           impact: risk.riskData.risk_residual_impact,
-          treatmentStrategy: risk.riskData.risk_treatment_strategy,
-          treatmentStrategyDescription: risk.riskData.risk_treatment_strategy_description,
           organizationId,
         },
       });
diff --git a/apps/app/src/trigger/tasks/onboarding/onboard-organization.ts b/apps/app/src/trigger/tasks/onboarding/onboard-organization.ts
index d46b898df9..caa3bd1813 100644
--- a/apps/app/src/trigger/tasks/onboarding/onboard-organization.ts
+++ b/apps/app/src/trigger/tasks/onboarding/onboard-organization.ts
@@ -4,6 +4,7 @@ import axios from 'axios';
 import { generateAuditorContentTask } from '../auditor/generate-auditor-content';
 import { generateRiskMitigationsForOrg } from './generate-risk-mitigation';
 import { generateVendorMitigationsForOrg } from './generate-vendor-mitigation';
+import type { linkRisksAndVendorsToWork } from './link-risks-and-vendors-to-work';
 import {
   createRisks,
   createVendors,
@@ -161,14 +162,6 @@ export const onboardOrganization = task({
       metadata.set('vendors', true);
       metadata.set('currentStep', 'Creating Risks...');
 
-      // Fan-out vendor mitigations as separate jobs
-      await tasks.trigger<typeof generateVendorMitigationsForOrg>(
-        'generate-vendor-mitigations-for-org',
-        {
-          organizationId: payload.organizationId,
-        },
-      );
-
       // Create risks (tracking is handled inside createRisks)
       const risks = await createRisks(
         questionsAndAnswers,
@@ -186,17 +179,42 @@ export const onboardOrganization = task({
       // Mark risks step as complete in metadata (real-time)
       metadata.set('risk', true);
 
+      // Auto-link risks + vendors to existing tasks BEFORE mitigation generation
+      // runs, so the AI prompt for both risks AND vendors sees the linked
+      // tasks/controls and produces grounded plans. Fan-out for both happens
+      // after this gate. Fails-soft: a timeout/error degrades to today's
+      // behavior. (ENG-221 + Cubic findings #7 / #26.)
+      metadata.set('currentStep', 'Linking risks to tasks...');
+      try {
+        await tasks.triggerAndWait<typeof linkRisksAndVendorsToWork>(
+          'link-risks-and-vendors-to-work',
+          { organizationId: payload.organizationId },
+        );
+        metadata.set('linkage', true);
+      } catch (err) {
+        logger.warn('linkage step failed; continuing without grounded prompts', {
+          organizationId: payload.organizationId,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+
       // Get policy count for the step message
       const policyCount = policyList.length;
       metadata.set('currentStep', `Tailoring Policies... (0/${policyCount})`);
 
-      // Fan-out risk mitigations as separate jobs
-      await tasks.trigger<typeof generateRiskMitigationsForOrg>(
-        'generate-risk-mitigations-for-org',
-        {
-          organizationId: payload.organizationId,
-        },
-      );
+      // Fan-out vendor + risk mitigations now that linkage has populated the
+      // grounding context for both kinds of entities. Done in parallel —
+      // each fan-out task itself batchTriggers per-entity children.
+      await Promise.all([
+        tasks.trigger<typeof generateVendorMitigationsForOrg>(
+          'generate-vendor-mitigations-for-org',
+          { organizationId: payload.organizationId },
+        ),
+        tasks.trigger<typeof generateRiskMitigationsForOrg>(
+          'generate-risk-mitigations-for-org',
+          { organizationId: payload.organizationId },
+        ),
+      ]);
 
       // Update policies with progress tracking
       await updateOrganizationPolicies(payload.organizationId, questionsAndAnswers, frameworks);
diff --git a/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.spec.ts b/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.spec.ts
new file mode 100644
index 0000000000..e4f17ac6bb
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.spec.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { RISK_MITIGATION_PROMPT } from './risk-mitigation';
+
+describe('RISK_MITIGATION_PROMPT', () => {
+  it('asks for exactly 5 sentences as JSON', () => {
+    expect(RISK_MITIGATION_PROMPT).toMatch(/string × 5/i);
+    expect(RISK_MITIGATION_PROMPT).toContain('"sentences"');
+  });
+
+  it('forbids the model from including codes or names in the sentence', () => {
+    expect(RISK_MITIGATION_PROMPT).toMatch(
+      /Do NOT include the code, name, or any reference to the citation in the sentence/i,
+    );
+  });
+
+  it('explains the four citation kinds', () => {
+    expect(RISK_MITIGATION_PROMPT).toContain('CONTROL');
+    expect(RISK_MITIGATION_PROMPT).toContain('TASK');
+    expect(RISK_MITIGATION_PROMPT).toContain('POLICY');
+    expect(RISK_MITIGATION_PROMPT).toContain('GAP');
+  });
+});
diff --git a/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.ts b/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.ts
index 9400f40c38..7066a2b4b2 100644
--- a/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.ts
+++ b/apps/app/src/trigger/tasks/onboarding/prompts/risk-mitigation.ts
@@ -1,53 +1,21 @@
-export const RISK_MITIGATION_PROMPT = `Comprehensive Risk Mitigation Plan
-You are a risk-management assistant. Your task is to produce a concise, actionable mitigation plan for a given organizational risk using the organization's policy library as context.
-
-IMPORTANT CONTEXT: Assume you are advising a modern SaaS company. Consider realistic constraints:
-- Focus ONLY on controls the COMPANY can implement
-- Leverage governance, oversight, configuration, and contractual controls the company actually manages
-- Consider the organization's maturity and avoid generic security boilerplate
-
-INPUTS
-
-- Risk: [User will insert a risk title, description, category, department, residual assessment, and existing treatment strategy]
-- Available Organization Policies: [User will provide a list of the organization's actual security policies with names and descriptions]
-- CONTEXTUAL KNOWLEDGE: You have access to the organization's actual security policies provided in the prompt. You must use these specific policies to inform your entire response and select the most relevant ones for the risk being mitigated.
-
-MAIN TASKS
-
-When generating your treatment plan, internally consider:
-- What the COMPANY can realistically control
-- The provided risk's category, department, and residual assessment
-- Which policies from the Available Organization Policies list are most relevant
-- Prioritize the most relevant and actionable controls for this specific risk
-
-1. Generate Treatment Plan:
-    - Set the treatment type. Prefer the risk's existing treatment strategy if provided and sensible
-    - Focus ONLY on controls the COMPANY can implement:
-        * Contractual and legal controls (agreements, SLAs, terms)
-        * Governance controls (reviews, assessments, monitoring)
-        * Configuration controls (settings the company controls in its systems)
-        * Access management (roles, permissions, periodic reviews)
-        * Data management (classification, minimization, retention)
-        * Oversight controls (auditing, incident response readiness)
-    - AVOID suggesting controls the vendor implements or generic boilerplate
-    - Rephrase each control in your own words. Do not copy text directly from the policy.
-2. Present Output: Provide your response in the exact plain-text structure below with no extra formatting:
-
-IMPORTANT: Do not include any reasoning, thoughts, analysis, or explanations in your response. Only provide the treatment plan in the exact format below. Do not mention which policies you selected or why - just provide the clean output.
-
-Treatment plan (Type)
-This plan reduces the risk through 5 controls:
-- [Control description]
-- [Control description]
-- [Control description]
-- [Control description]
-- [Control description]
-
-Rules:
-- Output EXACTLY 5 bullets.
-- Each bullet MUST be one concise sentence (aim for 8–16 words).
-- Use plain, simple language; avoid jargon, buzzwords, and fancy wording.
-- Prefer active voice and concrete verbs; avoid unnecessary adjectives/adverbs.
-- When a control clearly maps to a provided policy, append " (Policy: [Policy Name])" to that bullet.
-- Only reference policies from the provided list; if none applies, omit the policy suffix.
-- Do not include numbering, sub-bullets, or extra commentary.`;
+export const RISK_MITIGATION_PROMPT = `You are a risk-management assistant for a SaaS company.
+Your task is to write 5 concrete mitigation sentences for a given risk, ONE per pre-selected citation.
+
+The user will provide:
+- The risk (title, description, category, department, residual assessment, treatment strategy)
+- A numbered list of 5 CITATIONS in priority order. Each citation is one of:
+  - CONTROL: an existing framework control (you'll see code and name)
+  - TASK: an existing operational task (you'll see name and status)
+  - POLICY: a policy from the organization's library (you'll see name)
+  - GAP: a recommended new control (you'll see the type hint)
+
+Output: a JSON object { "sentences": [string × 5] } where sentences[i] corresponds to citation i+1.
+
+Sentence rules:
+- Exactly one short sentence per citation, 8 to 16 words.
+- Active voice, concrete verbs, plain language. No buzzwords. No jargon.
+- For CONTROL/TASK/POLICY citations: describe how this specific item mitigates the risk. Do NOT include the code, name, or any reference to the citation in the sentence — those are appended programmatically by the system.
+- For GAP citations: write a sentence describing why this gap matters for the risk and what the recommended control should achieve.
+- Sentences must be self-contained. No bullet markers, no numbering, no parenthetical attribution.
+
+Return ONLY the JSON object. No commentary, no analysis.`;
diff --git a/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.spec.ts b/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.spec.ts
new file mode 100644
index 0000000000..047f128710
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.spec.ts
@@ -0,0 +1,110 @@
+import { RiskCategory } from '@db';
+import { describe, expect, it } from 'vitest';
+import {
+  GAP_HINT_BY_RISK_CATEGORY,
+  selectMitigationCitations,
+} from './select-mitigation-citations';
+
+const ctrl = (code: string, name: string) => ({ code, name });
+const tsk = (name: string, status: string = 'todo') => ({ name, status });
+const pol = (name: string) => ({ name });
+
+describe('selectMitigationCitations', () => {
+  it('always returns exactly 5 citations', () => {
+    const cites = selectMitigationCitations({
+      linkedControls: [],
+      linkedTasks: [],
+      policies: [],
+      gapHint: 'governance',
+    });
+    expect(cites).toHaveLength(5);
+    expect(cites.every((c) => c.kind === 'gap')).toBe(true);
+  });
+
+  it('prefers controls (up to 3) over tasks and policies', () => {
+    const cites = selectMitigationCitations({
+      linkedControls: [
+        ctrl('cc1-1', 'A'),
+        ctrl('cc1-2', 'B'),
+        ctrl('cc1-3', 'C'),
+        ctrl('cc1-4', 'D'),
+      ],
+      linkedTasks: [tsk('T1'), tsk('T2')],
+      policies: [pol('P1'), pol('P2')],
+      gapHint: 'governance',
+    });
+    expect(cites.filter((c) => c.kind === 'control')).toHaveLength(3);
+    // Remaining 2 slots: tasks first, then policies if needed.
+    expect(cites[3]).toMatchObject({ kind: 'task', name: 'T1' });
+    expect(cites[4]).toMatchObject({ kind: 'task', name: 'T2' });
+  });
+
+  it('fills with tasks then policies then gaps', () => {
+    const cites = selectMitigationCitations({
+      linkedControls: [ctrl('cc1-1', 'A')],
+      linkedTasks: [tsk('T1')],
+      policies: [pol('P1')],
+      gapHint: 'governance',
+    });
+    expect(cites.map((c) => c.kind)).toEqual([
+      'control',
+      'task',
+      'policy',
+      'gap',
+      'gap',
+    ]);
+  });
+
+  it('limits tasks to 2 even when many are available', () => {
+    const cites = selectMitigationCitations({
+      linkedControls: [],
+      linkedTasks: [
+        tsk('T1'),
+        tsk('T2'),
+        tsk('T3'),
+        tsk('T4'),
+        tsk('T5'),
+      ],
+      policies: [],
+      gapHint: 'governance',
+    });
+    expect(cites.filter((c) => c.kind === 'task')).toHaveLength(2);
+    expect(cites.filter((c) => c.kind === 'gap')).toHaveLength(3);
+  });
+
+  it('uses the right gap-type hint for each risk category', () => {
+    const expectations: Array<[RiskCategory, string]> = [
+      [RiskCategory.people, 'awareness'],
+      [RiskCategory.technology, 'technical'],
+      [RiskCategory.vendor_management, 'third-party'],
+      [RiskCategory.fraud, 'governance'],
+      [RiskCategory.regulatory, 'compliance'],
+      [RiskCategory.operations, 'operational'],
+      [RiskCategory.other, 'general'],
+    ];
+    for (const [category, expected] of expectations) {
+      expect(GAP_HINT_BY_RISK_CATEGORY[category]).toBe(expected);
+      const cites = selectMitigationCitations({
+        linkedControls: [],
+        linkedTasks: [],
+        policies: [],
+        gapHint: GAP_HINT_BY_RISK_CATEGORY[category],
+      });
+      expect(cites[0]).toMatchObject({ kind: 'gap', controlTypeHint: expected });
+    }
+  });
+
+  it('preserves input order for controls, tasks, and policies', () => {
+    const cites = selectMitigationCitations({
+      linkedControls: [ctrl('z', 'Z'), ctrl('a', 'A')],
+      linkedTasks: [tsk('Late'), tsk('Early')],
+      policies: [pol('Last'), pol('First')],
+      gapHint: 'governance',
+    });
+    expect(cites[0]).toMatchObject({ code: 'z' });
+    expect(cites[1]).toMatchObject({ code: 'a' });
+    expect(cites[2]).toMatchObject({ name: 'Late' });
+    expect(cites[3]).toMatchObject({ name: 'Early' });
+    expect(cites[4]).toMatchObject({ kind: 'policy', name: 'Last' });
+  });
+});
diff --git a/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.ts b/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.ts
new file mode 100644
index 0000000000..12d14a95b1
--- /dev/null
+++ b/apps/app/src/trigger/tasks/onboarding/select-mitigation-citations.ts
@@ -0,0 +1,97 @@
+import { RiskCategory } from '@db';
+
+export type MitigationCitation =
+  | { kind: 'control'; code: string; name: string }
+  | { kind: 'task'; name: string; status: string }
+  | { kind: 'policy'; name: string }
+  | { kind: 'gap'; controlTypeHint: string };
+
+interface SelectInput {
+  linkedControls: Array<{ code: string; name: string }>;
+  linkedTasks: Array<{ name: string; status: string }>;
+  policies: Array<{ name: string }>;
+  gapHint: string;
+}
+
+const TARGET = 5;
+const MAX_CONTROLS = 3;
+const MAX_TASKS = 2;
+
+/**
+ * Maps a RiskCategory to the type-of-control hint used when filling unmet
+ * citation slots with `gap` entries. Vendors don't use this map — they pass
+ * a fixed `'third-party'` gap hint at the call site.
+ */
+export const GAP_HINT_BY_RISK_CATEGORY: Record<RiskCategory, string> = {
+  [RiskCategory.customer]: 'compliance',
+  [RiskCategory.regulatory]: 'compliance',
+  [RiskCategory.reporting]: 'compliance',
+  [RiskCategory.fraud]: 'governance',
+  [RiskCategory.governance]: 'governance',
+  [RiskCategory.operations]: 'operational',
+  [RiskCategory.resilience]: 'operational',
+  [RiskCategory.people]: 'awareness',
+  [RiskCategory.technology]: 'technical',
+  [RiskCategory.vendor_management]: 'third-party',
+  [RiskCategory.other]: 'general',
+};
+
+/**
+ * Returns exactly 5 citations for a treatment plan, in priority order:
+ *   1. Up to 3 linked controls (input order preserved).
+ *   2. Up to 2 linked tasks (input order preserved).
+ *   3. Policies until the 5 slots fill.
+ *   4. `gap` fillers using the supplied `gapHint`.
+ *
+ * The selection is deterministic — the LLM is never asked which entities to
+ * cite, only what prose to write for each one. This eliminates the
+ * possibility of fabricated control codes / task names / policy names in the
+ * generated treatment plan.
+ */
+export function selectMitigationCitations({
+  linkedControls,
+  linkedTasks,
+  policies,
+  gapHint,
+}: SelectInput): MitigationCitation[] {
+  const out: MitigationCitation[] = [];
+
+  for (const c of linkedControls.slice(0, MAX_CONTROLS)) {
+    if (out.length >= TARGET) break;
+    out.push({ kind: 'control', code: c.code, name: c.name });
+  }
+
+  for (const t of linkedTasks.slice(0, MAX_TASKS)) {
+    if (out.length >= TARGET) break;
+    out.push({ kind: 'task', name: t.name, status: t.status });
+  }
+
+  for (const p of policies) {
+    if (out.length >= TARGET) break;
+    out.push({ kind: 'policy', name: p.name });
+  }
+
+  while (out.length < TARGET) {
+    out.push({ kind: 'gap', controlTypeHint: gapHint });
+  }
+
+  return out;
+}
+
+/**
+ * Deterministic suffix appended to the LLM-generated sentence to attribute
+ * each bullet to the correct entity. Because this is plain string
+ * concatenation, citations cannot drift from reality.
+ */
+export function citationSuffix(c: MitigationCitation): string {
+  switch (c.kind) {
+    case 'control':
+      return ` (Control: ${c.code} ${c.name})`;
+    case 'task':
+      return ` (Task: ${c.name})`;
+    case 'policy':
+      return ` (Policy: ${c.name})`;
+    case 'gap':
+      return ` — gap: recommend adding ${c.controlTypeHint} control`;
+  }
+}
diff --git a/apps/app/src/trigger/tasks/onboarding/update-policy.ts b/apps/app/src/trigger/tasks/onboarding/update-policy.ts
index 5607c01b03..f17bcbafde 100644
--- a/apps/app/src/trigger/tasks/onboarding/update-policy.ts
+++ b/apps/app/src/trigger/tasks/onboarding/update-policy.ts
@@ -6,8 +6,17 @@ if (!process.env.OPENAI_API_KEY) {
   throw new Error('OPENAI_API_KEY is not set');
 }
 
-// v4: define queue ahead of time
-export const updatePolicyQueue = queue({ name: 'update-policy', concurrencyLimit: 50 });
+// v4: define queue ahead of time.
+// concurrencyLimit is intentionally low so a 30+ policy onboarding fan-out
+// can't hog all of dev's 25-slot env budget. Each policy update takes ~20-40s
+// (LLM call + DB writes), while risk + vendor mitigations take ~8-12s. With
+// no cap the slower policies fill every slot first and the user-visible
+// mitigation tasks sit queued for minutes. Capping at 5 leaves ≥20 slots
+// for the faster, latency-sensitive mitigation fan-out to finish quickly,
+// then policies drain through. Total wall time is ~the same, but the user
+// sees their treatment plans populate immediately instead of waiting for
+// every policy to finish first.
+export const updatePolicyQueue = queue({ name: 'update-policy', concurrencyLimit: 5 });
 
 export const updatePolicy = schemaTask({
   id: 'update-policy',
diff --git a/apps/app/src/trigger/tasks/scrape/research.ts b/apps/app/src/trigger/tasks/scrape/research.ts
index a1c1e75cac..a4734173c3 100644
--- a/apps/app/src/trigger/tasks/scrape/research.ts
+++ b/apps/app/src/trigger/tasks/scrape/research.ts
@@ -1,7 +1,19 @@
 import { researchJobCore } from '@/trigger/lib/research';
 import { db } from '@db/server';
-import { schemaTask } from '@trigger.dev/sdk';
+import { logger, queue, schemaTask, tasks } from '@trigger.dev/sdk';
 import { z } from 'zod';
+import type { scoreVendorRisk } from './score-vendor-risk';
+
+// Each research run can hold a slot for minutes (firecrawl scrape + LLM
+// extraction). Without a cap, a 10-vendor onboarding can hog the whole
+// 25-slot dev env budget for the entire research window — starving the
+// mitigation + policy fan-outs that fire right after. Capping at 5 lets
+// research progress in batches while leaving 20 slots free for the rest
+// of the onboarding pipeline.
+const researchVendorQueue = queue({
+  name: 'research-vendor',
+  concurrencyLimit: 5,
+});
 
 const firecrawlDataSchema = z.object({
   company_name: z.string().optional().nullable(),
@@ -35,11 +47,40 @@ const firecrawlDataSchema = z.object({
 
 export const researchVendor = schemaTask({
   id: 'research-vendor',
+  queue: researchVendorQueue,
   schema: z.object({
     website: z.string().url(),
+    /**
+     * Optional: when set, this task triggers `score-vendor-risk` once the
+     * GlobalVendors row is saved (or already exists), so the per-org
+     * Vendor row gets a refined inherent/residual score grounded in the
+     * researched posture data instead of the conservative default that
+     * the onboarding extraction pass set.
+     */
+    scoreContext: z
+      .object({
+        vendorId: z.string(),
+        organizationId: z.string(),
+      })
+      .optional(),
   }),
   maxDuration: 1000 * 60 * 10, // 10 minutes total task duration
   run: async (payload, { ctx }) => {
+    const queueScoring = async () => {
+      if (!payload.scoreContext) return;
+      try {
+        await tasks.trigger<typeof scoreVendorRisk>('score-vendor-risk', {
+          vendorId: payload.scoreContext.vendorId,
+          organizationId: payload.scoreContext.organizationId,
+        });
+      } catch (err) {
+        logger.error('[research-vendor] failed to enqueue score-vendor-risk', {
+          err,
+          ...payload.scoreContext,
+        });
+      }
+    };
+
     // Check if vendor already exists
     const existingVendor = await db.globalVendors.findFirst({
       where: {
@@ -56,13 +97,17 @@ export const researchVendor = schemaTask({
     });
 
     if (existingVendor) {
+      // Even when GlobalVendors is already populated, the per-org Vendor
+      // row hasn't been scored against that data yet — chain into scoring
+      // so the customer doesn't get stuck with the extraction default.
+      await queueScoring();
       return {
         message: 'Vendor already exists in database',
         existingVendor,
       };
     }
 
-    return researchJobCore({
+    const result = await researchJobCore({
       website: payload.website,
       prompt: "You're a cyber security researcher, researching a vendor.",
       schema: {
@@ -125,5 +170,12 @@ export const researchVendor = schemaTask({
         });
       },
     });
+
+    // Now that GlobalVendors is fresh, kick off scoring for the per-org
+    // Vendor row. Fire-and-forget — the scoring task is idempotent and
+    // failures shouldn't fail the research run.
+    await queueScoring();
+
+    return result;
   },
 });
diff --git a/apps/app/src/trigger/tasks/scrape/score-vendor-risk.ts b/apps/app/src/trigger/tasks/scrape/score-vendor-risk.ts
new file mode 100644
index 0000000000..7142cce839
--- /dev/null
+++ b/apps/app/src/trigger/tasks/scrape/score-vendor-risk.ts
@@ -0,0 +1,165 @@
+import { openai } from '@ai-sdk/openai';
+import { Impact, Likelihood } from '@db';
+import { db } from '@db/server';
+import { logger, schemaTask } from '@trigger.dev/sdk';
+import { generateObject } from 'ai';
+import { z } from 'zod';
+
+const ScoreSchema = z.object({
+  inherent_probability: z.nativeEnum(Likelihood),
+  inherent_impact: z.nativeEnum(Impact),
+  residual_probability: z.nativeEnum(Likelihood),
+  residual_impact: z.nativeEnum(Impact),
+  rationale: z.string(),
+});
+
+/**
+ * Refine a vendor's inherent + residual risk scores using the data the
+ * `research-vendor` task gathered into GlobalVendors. The onboarding
+ * extraction pass scores conservatively from the user's Q&A signals only
+ * (no posture data), so it lands a lot of well-attested vendors at the
+ * generic middle. Once research has collected certifications, type, and
+ * description, we can ground the score in actual evidence and refine.
+ *
+ * Idempotent: safe to re-run for the same (vendorId, organizationId)
+ * — overwrites the four risk fields with the latest LLM verdict.
+ */
+export const scoreVendorRisk = schemaTask({
+  id: 'score-vendor-risk',
+  schema: z.object({
+    vendorId: z.string(),
+    organizationId: z.string(),
+  }),
+  maxDuration: 60,
+  retry: { maxAttempts: 2 },
+  run: async (payload) => {
+    const { vendorId, organizationId } = payload;
+
+    const vendor = await db.vendor.findFirst({
+      where: { id: vendorId, organizationId },
+      select: {
+        id: true,
+        name: true,
+        description: true,
+        category: true,
+        website: true,
+      },
+    });
+    if (!vendor) {
+      logger.warn('[score-vendor-risk] vendor not found, skipping', payload);
+      return { skipped: 'vendor-not-found' as const };
+    }
+    if (!vendor.website) {
+      logger.info('[score-vendor-risk] vendor has no website, skipping', payload);
+      return { skipped: 'no-website' as const };
+    }
+
+    const globalVendor = await db.globalVendors.findFirst({
+      where: { website: vendor.website },
+      select: {
+        company_description: true,
+        security_certifications: true,
+        subprocessors: true,
+        type_of_company: true,
+        security_page_url: true,
+        trust_page_url: true,
+      },
+    });
+
+    // Without GlobalVendors data we have nothing more than the extraction
+    // pass already had — re-running the LLM would just burn tokens to
+    // produce the same answer. Bail.
+    if (!globalVendor) {
+      logger.info(
+        '[score-vendor-risk] no GlobalVendors row yet — research probably still in flight; skipping',
+        payload,
+      );
+      return { skipped: 'no-research-data' as const };
+    }
+
+    const certifications = globalVendor.security_certifications ?? [];
+    const subprocessors = globalVendor.subprocessors ?? [];
+    const description = globalVendor.company_description ?? vendor.description ?? '';
+    const typeOfCompany = globalVendor.type_of_company ?? '';
+    const hasTrustOrSecurityPage = Boolean(
+      globalVendor.security_page_url ?? globalVendor.trust_page_url,
+    );
+
+    const promptBlock = [
+      `Vendor: ${vendor.name}`,
+      `Category (customer-set): ${vendor.category}`,
+      typeOfCompany ? `Type (researched): ${typeOfCompany}` : null,
+      description ? `Description: ${description}` : null,
+      certifications.length > 0
+        ? `Certifications / attestations (researched): ${certifications.join(', ')}`
+        : 'Certifications / attestations: none reported',
+      subprocessors.length > 0
+        ? `Subprocessors (researched): ${subprocessors.join(', ')}`
+        : null,
+      hasTrustOrSecurityPage
+        ? 'Vendor publishes a trust portal or security overview page (transparency signal).'
+        : 'No public trust portal / security overview page found.',
+    ]
+      .filter(Boolean)
+      .join('\n');
+
+    const { object } = await generateObject({
+      model: openai('gpt-4.1-mini'),
+      schema: ScoreSchema,
+      system: [
+        'You are scoring inherent vendor risk for a customer that has just listed this vendor as part of their compliance program. Your job is to assign Likelihood and Impact buckets based on the researched data below.',
+        '',
+        'inherent_probability — probability of a meaningful security or availability incident at the vendor over a typical 12-month window:',
+        '- very_unlikely: hyperscaler-tier vendor with multiple top-tier attestations (e.g. SOC 2 Type II + ISO 27001, OR FedRAMP, OR multiple of those) AND clear public transparency.',
+        '- unlikely: established vendor with at least one strong third-party attestation (SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, PCI DSS Level 1, or equivalent) AND a public security/trust page.',
+        '- possible: vendor without independent attestation, OR with minor incidents in the last few years, OR limited public posture data. This is the DEFAULT.',
+        '- likely: vendor with public knowledge of significant security incidents in the last 24 months, OR explicitly no transparency despite handling sensitive data.',
+        '- very_likely: vendor with chronic / repeated security issues, or essentially unknown posture combined with sensitive-data exposure.',
+        '',
+        'inherent_impact — business impact if the vendor is compromised, assuming average customer usage given the vendor\'s category:',
+        '- insignificant: no PII / no business data / purely cosmetic or public utility.',
+        '- minor: anonymous metadata only, non-business utilities.',
+        '- moderate: PII or internal business data, but NOT payments / health / source / auth. DEFAULT for typical SaaS.',
+        '- major: vendor handles authentication, source code, payments, PHI, or production infrastructure that the customer depends on.',
+        '- severe: vendor IS the customer\'s production runtime / cloud / single source of truth — compromise means the customer is offline or fundamentally exposed.',
+        '',
+        'Scoring rules:',
+        '1. Read the certification list. ANY of {SOC 2 Type II, ISO 27001, ISO 42001, HIPAA, PCI DSS, FedRAMP, C5, CSA STAR Level 2+} counts as a strong attestation. Multiple of those, especially combined with FedRAMP / hyperscaler-tier scale, drop probability to very_unlikely. A single strong attestation drops probability to unlikely.',
+        '2. If the certification list is empty, default probability is possible (NOT very_likely). "We don\'t know" is not "definitely bad".',
+        '3. Use the type and description to set impact. Source-code, payments, auth, infrastructure providers → major. Generic CRM / analytics → moderate. Marketing widgets → minor.',
+        '4. Residual: default to inherent. Only LOWER residual when the customer has applied their OWN compensating controls (which we don\'t have visibility into here, so usually leave equal).',
+        '',
+        'Be specific in the rationale — name a certification, name an attribute. Don\'t recite the rubric.',
+      ].join('\n'),
+      prompt: promptBlock,
+    });
+
+    await db.vendor.update({
+      where: { id: vendorId },
+      data: {
+        inherentProbability: object.inherent_probability,
+        inherentImpact: object.inherent_impact,
+        residualProbability: object.residual_probability,
+        residualImpact: object.residual_impact,
+      },
+    });
+
+    logger.info('[score-vendor-risk] scored vendor', {
+      vendorId,
+      organizationId,
+      vendorName: vendor.name,
+      inherent: `${object.inherent_probability} × ${object.inherent_impact}`,
+      residual: `${object.residual_probability} × ${object.residual_impact}`,
+      rationale: object.rationale,
+      certifications,
+    });
+
+    return {
+      inherentProbability: object.inherent_probability,
+      inherentImpact: object.inherent_impact,
+      residualProbability: object.residual_probability,
+      residualImpact: object.residual_impact,
+      rationale: object.rationale,
+    };
+  },
+});
diff --git a/apps/app/trigger.config.ts b/apps/app/trigger.config.ts
index 38626c313e..1a41b7888e 100644
--- a/apps/app/trigger.config.ts
+++ b/apps/app/trigger.config.ts
@@ -1,16 +1,21 @@
-import { PrismaInstrumentation } from '@prisma/instrumentation';
 import { puppeteer } from '@trigger.dev/build/extensions/puppeteer';
 import { defineConfig } from '@trigger.dev/sdk';
+import { caBundleExtension } from './caBundleExtension';
 import { prismaExtension } from './customPrismaExtension';
 
 export default defineConfig({
   runtime: 'node-22',
   project: 'proj_lhxjliiqgcdyqbgtucda',
   logLevel: 'log',
-  instrumentations: [new PrismaInstrumentation()],
+  // PrismaInstrumentation was emitting a `prisma:client:operation` span for
+  // every query, drowning out our own task logs. We rely on per-task
+  // `logger.info` calls for observability instead — see e.g.
+  // `link-risks-and-vendors-to-work.ts`.
+  instrumentations: [],
   maxDuration: 300, // 5 minutes
   build: {
     extensions: [
+      caBundleExtension(),
       prismaExtension({
         version: '7.6.0',
         dbPackageVersion: '^2.0.0',
diff --git a/apps/app/vitest.config.mts b/apps/app/vitest.config.mts
index 8154e80599..12b38534f4 100644
--- a/apps/app/vitest.config.mts
+++ b/apps/app/vitest.config.mts
@@ -9,7 +9,10 @@ export default defineConfig({
     environment: 'jsdom',
     globals: true,
     setupFiles: ['./src/test-utils/setup.ts'],
-    include: ['src/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    include: [
+      'src/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}',
+      'prisma/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}',
+    ],
     exclude: ['node_modules', 'dist', '.next', 'e2e'],
     coverage: {
       reporter: ['text', 'json', 'html'],
diff --git a/apps/framework-editor/prisma/client.ts b/apps/framework-editor/prisma/client.ts
index 1bd8069f56..d7b33cfb60 100644
--- a/apps/framework-editor/prisma/client.ts
+++ b/apps/framework-editor/prisma/client.ts
@@ -1,7 +1,9 @@
 import { PrismaClient } from '@prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
 
-const globalForPrisma = global as unknown as { prisma: PrismaClient };
+const globalForPrisma = global as unknown as { prisma?: PrismaClient };
+
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
@@ -9,14 +11,42 @@ function stripSslMode(connectionString: string): string {
   return url.toString();
 }
 
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    return false;
+  }
+}
+
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const isLocalhost = isLocalhostUrl(rawUrl);
   const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
-  // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+  const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+
+  let ssl:
+    | undefined
+    | { checkServerIdentity: () => undefined }
+    | { rejectUnauthorized: false };
+  if (isLocalhost) {
+    ssl = undefined;
+  } else if (hasCABundle) {
+    // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
+    // RDS CA to the trust store). Skip hostname check because connections may
+    // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
+    // The chain check still rejects forged or wrong-CA certs.
+    ssl = { checkServerIdentity: () => undefined };
+  } else if (allowInsecure) {
+    ssl = { rejectUnauthorized: false };
+  } else {
+    throw new Error(
+      'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+    );
+  }
+
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({
@@ -27,6 +57,21 @@ function createPrismaClient(): PrismaClient {
   });
 }
 
-export const db = globalForPrisma.prisma || createPrismaClient();
+// Lazy initialization. Importing this module does NOT construct a Prisma client
+// — that only happens on first property access on `db`. Critical so that
+// Next.js `next build` (which imports every route handler to analyze it) does
+// not trigger the strict TLS check at build time when no actual queries run.
+function getClient(): PrismaClient {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = createPrismaClient();
+  }
+  return globalForPrisma.prisma;
+}
 
-if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = db;
+export const db = new Proxy({} as PrismaClient, {
+  get(_target, prop, _receiver) {
+    const client = getClient();
+    const value = Reflect.get(client, prop, client);
+    return typeof value === 'function' ? value.bind(client) : value;
+  },
+});
diff --git a/apps/portal/next.config.ts b/apps/portal/next.config.ts
index a1664380a5..051e3e312f 100644
--- a/apps/portal/next.config.ts
+++ b/apps/portal/next.config.ts
@@ -65,6 +65,9 @@ const config = {
   },
   skipTrailingSlashRedirect: true,
   outputFileTracingRoot: path.join(__dirname, '../../'),
+  outputFileTracingIncludes: {
+    '/**/*': ['../../packages/db/certs/rds-global-bundle.pem'],
+  },
   ...(isStandalone
     ? {
         output: 'standalone' as const,
diff --git a/apps/portal/prisma/client.ts b/apps/portal/prisma/client.ts
index e5aae1e148..16db449ea2 100644
--- a/apps/portal/prisma/client.ts
+++ b/apps/portal/prisma/client.ts
@@ -1,7 +1,9 @@
 import { PrismaClient } from '../src/generated/prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
 
-const globalForPrisma = global as unknown as { prisma: PrismaClient };
+const globalForPrisma = global as unknown as { prisma?: PrismaClient };
+
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
@@ -9,14 +11,42 @@ function stripSslMode(connectionString: string): string {
   return url.toString();
 }
 
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    return false;
+  }
+}
+
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const isLocalhost = isLocalhostUrl(rawUrl);
   const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
-  // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+  const allowInsecure = process.env.PRISMA_ALLOW_INSECURE_TLS === '1';
+
+  let ssl:
+    | undefined
+    | { checkServerIdentity: () => undefined }
+    | { rejectUnauthorized: false };
+  if (isLocalhost) {
+    ssl = undefined;
+  } else if (hasCABundle) {
+    // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
+    // RDS CA to the trust store). Skip hostname check because connections may
+    // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
+    // The chain check still rejects forged or wrong-CA certs.
+    ssl = { checkServerIdentity: () => undefined };
+  } else if (allowInsecure) {
+    ssl = { rejectUnauthorized: false };
+  } else {
+    throw new Error(
+      'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+    );
+  }
+
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({
@@ -27,6 +57,21 @@ function createPrismaClient(): PrismaClient {
   });
 }
 
-export const db = globalForPrisma.prisma || createPrismaClient();
+// Lazy initialization. Importing this module does NOT construct a Prisma client
+// — that only happens on first property access on `db`. Critical so that
+// Next.js `next build` (which imports every route handler to analyze it) does
+// not trigger the strict TLS check at build time when no actual queries run.
+function getClient(): PrismaClient {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = createPrismaClient();
+  }
+  return globalForPrisma.prisma;
+}
 
-if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = db;
+export const db = new Proxy({} as PrismaClient, {
+  get(_target, prop, _receiver) {
+    const client = getClient();
+    const value = Reflect.get(client, prop, client);
+    return typeof value === 'function' ? value.bind(client) : value;
+  },
+});
diff --git a/bun.lock b/bun.lock
index 1e26375ff6..a31aac1737 100644
--- a/bun.lock
+++ b/bun.lock
@@ -295,6 +295,7 @@
         "@uiw/react-json-view": "^2.0.0-alpha.40",
         "@uploadthing/react": "^7.3.0",
         "@upstash/ratelimit": "^2.0.5",
+        "@upstash/vector": "^1.2.2",
         "@vercel/analytics": "^1.5.0",
         "@vercel/sandbox": "^0.0.21",
         "@vercel/sdk": "^1.7.1",
@@ -537,7 +538,7 @@
     },
     "packages/db": {
       "name": "@trycompai/db",
-      "version": "2.0.3",
+      "version": "2.1.1",
       "bin": {
         "comp-prisma-postinstall": "./dist/postinstall.js",
       },
@@ -1648,7 +1649,7 @@
 
     "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
 
-    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="],
+    "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
     "@jsonhero/path": ["@jsonhero/path@1.0.21", "", {}, "sha512-gVUDj/92acpVoJwsVJ/RuWOaHyG4oFzn898WNGQItLCTQ+hOaVlEaImhwE1WqOTf+l3dGOUkbSiVKlb3q1hd1Q=="],
 
@@ -3098,7 +3099,7 @@
 
     "@upstash/ratelimit": ["@upstash/ratelimit@2.0.8", "", { "dependencies": { "@upstash/core-analytics": "^0.0.10" }, "peerDependencies": { "@upstash/redis": "^1.34.3" } }, "sha512-YSTMBJ1YIxsoPkUMX/P4DDks/xV5YYCswWMamU8ZIfK9ly6ppjRnVOyBhMDXBmzjODm4UQKcxsJPvaeFAijp5w=="],
 
-    "@upstash/redis": ["@upstash/redis@1.37.0", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-LqOJ3+XWPLSZ2rGSed5DYG3ixybxb8EhZu3yQqF7MdZX1wLBG/FRcI6xcUZXHy/SS7mmXWyadrud0HJHkOc+uw=="],
+    "@upstash/redis": ["@upstash/redis@1.38.0", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-wu+dZBptlLy0+MCUEoHmzrY/TnmgDey3+c7EbIGwrLqAvkP8yi5MWZHYGIFtAygmL4Bkz2TdFu+eU0vFPncIcg=="],
 
     "@upstash/vector": ["@upstash/vector@1.2.3", "", {}, "sha512-yXsWKeuHNYyH72BcSZd3bV5ZD5MybAoTvKxkMaeV2UzuGfNzbHBVh5eO+ysTWTFAf8I9XcOueF4tZfAGjCa4Iw=="],
 
@@ -4120,7 +4121,7 @@
 
     "extract-zip": ["extract-zip@2.0.1", "", { "dependencies": { "debug": "^4.1.1", "get-stream": "^5.1.0", "yauzl": "^2.10.0" }, "optionalDependencies": { "@types/yauzl": "^2.9.1" }, "bin": { "extract-zip": "cli.js" } }, "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg=="],
 
-    "extsprintf": ["extsprintf@1.3.0", "", {}, "sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g=="],
+    "extsprintf": ["extsprintf@1.4.1", "", {}, "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA=="],
 
     "fast-check": ["fast-check@3.23.2", "", { "dependencies": { "pure-rand": "^6.1.0" } }, "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A=="],
 
@@ -6522,7 +6523,7 @@
 
     "vaul": ["vaul@0.9.9", "", { "dependencies": { "@radix-ui/react-dialog": "^1.1.1" }, "peerDependencies": { "react": "^16.8 || ^17.0 || ^18.0", "react-dom": "^16.8 || ^17.0 || ^18.0" } }, "sha512-7afKg48srluhZwIkaU+lgGtFCUsYBSGOl8vcc8N/M3YQlZFlynHD15AE+pwrYdc826o7nrIND4lL9Y6b9WWZZQ=="],
 
-    "verror": ["verror@1.10.0", "", { "dependencies": { "assert-plus": "^1.0.0", "core-util-is": "1.0.2", "extsprintf": "^1.2.0" } }, "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw=="],
+    "verror": ["verror@1.10.1", "", { "dependencies": { "assert-plus": "^1.0.0", "core-util-is": "1.0.2", "extsprintf": "^1.2.0" } }, "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg=="],
 
     "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
 
@@ -6712,6 +6713,8 @@
 
     "@ai-sdk/provider-utils/@ai-sdk/provider": ["@ai-sdk/provider@2.0.3", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-h88OPkavHTiN9tMn2l5awAznGB0lXzjcLhgR1/rvjB2zlLprsNxbM2tt6OJsHUxduLC3klq0/eqaSf6fX5XVww=="],
 
+    "@ai-sdk/provider-utils/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "@ai-sdk/react/@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@4.0.26", "", { "dependencies": { "@ai-sdk/provider": "3.0.10", "@standard-schema/spec": "^1.1.0", "eventsource-parser": "^3.0.8" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-CsKNLKsOpvPujRlIYvoz+Ybw+kGn7J4/fIZa/58+R7iWLLfwn6ifE2G6Yq8K9XvH/I/3bzaDAJ3NhRwEMsLBKQ=="],
 
     "@ai-sdk/react/ai": ["ai@6.0.175", "", { "dependencies": { "@ai-sdk/gateway": "3.0.110", "@ai-sdk/provider": "3.0.10", "@ai-sdk/provider-utils": "4.0.26", "@opentelemetry/api": "1.9.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-6fFFHzbh6FIZnYc31V6osOxq25ABJYCShfG0O6ajHiA4FB/DgnPi1mP8cO5aAU3HNSbQHiMazdlh9bIsp97mVA=="],
@@ -6724,8 +6727,6 @@
 
     "@ai-sdk/xai/@ai-sdk/provider": ["@ai-sdk/provider@2.0.3", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-h88OPkavHTiN9tMn2l5awAznGB0lXzjcLhgR1/rvjB2zlLprsNxbM2tt6OJsHUxduLC3klq0/eqaSf6fX5XVww=="],
 
-    "@ampproject/remapping/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@angular-devkit/core/ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="],
 
     "@angular-devkit/core/rxjs": ["rxjs@7.8.1", "", { "dependencies": { "tslib": "^2.1.0" } }, "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg=="],
@@ -6764,14 +6765,14 @@
 
     "@babel/core/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "@babel/generator/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@babel/helper-compilation-targets/lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
 
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
     "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
+    "@better-auth/core/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "@browserbasehq/sdk/@types/node": ["@types/node@18.19.130", "", { "dependencies": { "undici-types": "~5.26.4" } }, "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg=="],
 
     "@browserbasehq/stagehand/@ai-sdk/provider": ["@ai-sdk/provider@2.0.3", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-h88OPkavHTiN9tMn2l5awAznGB0lXzjcLhgR1/rvjB2zlLprsNxbM2tt6OJsHUxduLC3klq0/eqaSf6fX5XVww=="],
@@ -6802,6 +6803,8 @@
 
     "@commitlint/types/chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="],
 
+    "@cspotcode/source-map-support/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="],
+
     "@discordjs/rest/@discordjs/collection": ["@discordjs/collection@2.1.1", "", {}, "sha512-LiSusze9Tc7qF03sLCujF5iZp7K+vRNEDBZ86FT9aQAv3vxMLihUvKvpsCWiQ2DJq1tVckopKm1rxomgNUc9hg=="],
 
     "@discordjs/rest/@sapphire/snowflake": ["@sapphire/snowflake@3.5.5", "", {}, "sha512-xzvBr1Q1c4lCe7i6sRnrofxeO1QTP/LKQ6A6qy0iB4x5yfiSfARMEQEghojzTNALDTcv8En04qYNIco9/K9eZQ=="],
@@ -6848,8 +6851,6 @@
 
     "@electron/rebuild/tar": ["tar@6.2.1", "", { "dependencies": { "chownr": "^2.0.0", "fs-minipass": "^2.0.0", "minipass": "^5.0.0", "minizlib": "^2.1.1", "mkdirp": "^1.0.3", "yallist": "^4.0.0" } }, "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A=="],
 
-    "@electron/universal/minimatch": ["minimatch@9.0.9", "", { "dependencies": { "brace-expansion": "^2.0.2" } }, "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg=="],
-
     "@emotion/babel-plugin/convert-source-map": ["convert-source-map@1.9.0", "", {}, "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A=="],
 
     "@emotion/babel-plugin/source-map": ["source-map@0.5.7", "", {}, "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ=="],
@@ -6898,28 +6899,16 @@
 
     "@jest/reporters/@bcoe/v8-coverage": ["@bcoe/v8-coverage@0.2.3", "", {}, "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw=="],
 
-    "@jest/reporters/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@jest/reporters/glob": ["glob@10.5.0", "", { "dependencies": { "foreground-child": "^3.1.0", "jackspeak": "^3.1.2", "minimatch": "^9.0.4", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^1.11.1" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg=="],
 
     "@jest/reporters/jest-worker": ["jest-worker@30.3.0", "", { "dependencies": { "@types/node": "*", "@ungap/structured-clone": "^1.3.0", "jest-util": "30.3.0", "merge-stream": "^2.0.0", "supports-color": "^8.1.1" } }, "sha512-DrCKkaQwHexjRUFTmPzs7sHQe0TSj9nvDALKGdwmK5mW9v7j90BudWirKAJHt3QQ9Dhrg1F7DogPzhChppkJpQ=="],
 
     "@jest/reporters/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
-    "@jest/source-map/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@jest/test-sequencer/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
-    "@jest/transform/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@jest/transform/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
 
-    "@jridgewell/gen-mapping/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
-    "@jridgewell/remapping/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
-    "@jridgewell/source-map/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "@langchain/core/ansi-styles": ["ansi-styles@5.2.0", "", {}, "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA=="],
 
     "@langchain/core/p-retry": ["p-retry@4.6.2", "", { "dependencies": { "@types/retry": "0.12.0", "retry": "^0.13.1" } }, "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ=="],
@@ -7248,8 +7237,6 @@
 
     "@testing-library/dom/pretty-format": ["pretty-format@27.5.1", "", { "dependencies": { "ansi-regex": "^5.0.1", "ansi-styles": "^5.0.0", "react-is": "^17.0.1" } }, "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ=="],
 
-    "@testing-library/jest-dom/aria-query": ["aria-query@5.3.2", "", {}, "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw=="],
-
     "@testing-library/jest-dom/dom-accessibility-api": ["dom-accessibility-api@0.6.3", "", {}, "sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w=="],
 
     "@trigger.dev/core/@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.203.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-9B9RU0H7Ya1Dx/Rkyc4stuBZSGVQF27WigitInx2QQoj6KUpEFYPKoWjdFTunJYxmXmh17HeBvbMa1EhGyPmqQ=="],
@@ -7324,7 +7311,7 @@
 
     "@ts-morph/common/minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
 
-    "@types/plist/xmlbuilder": ["xmlbuilder@11.0.1", "", {}, "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA=="],
+    "@types/plist/xmlbuilder": ["xmlbuilder@15.1.1", "", {}, "sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg=="],
 
     "@types/three/fflate": ["fflate@0.8.2", "", {}, "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A=="],
 
@@ -7372,8 +7359,6 @@
 
     "are-we-there-yet/readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
 
-    "ast-v8-to-istanbul/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "ast-v8-to-istanbul/js-tokens": ["js-tokens@10.0.0", "", {}, "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q=="],
 
     "babel-jest/slash": ["slash@3.0.0", "", {}, "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q=="],
@@ -7452,6 +7437,8 @@
 
     "clone-response/mimic-response": ["mimic-response@1.0.1", "", {}, "sha512-j5EctnkH7amfV/q5Hgmoal1g2QHFJRraOtmx0JpIqkxhBhI/lJSl1nMpQ45hVarwNETOoWEimndZ4QK0RHxuxQ=="],
 
+    "cmdk/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.4", "", { "dependencies": { "@radix-ui/react-slot": "1.2.4" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg=="],
+
     "compare-func/dot-prop": ["dot-prop@5.3.0", "", { "dependencies": { "is-obj": "^2.0.0" } }, "sha512-QM8q3zDe58hqUqjraQOmzZ1LIH9SWQJTlEKCH4kJ2oQvLZk7RbQXvtDM2XEq3fwkV9CCvvH4LA0AV+ogFsBM2Q=="],
 
     "compress-commons/is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
@@ -7506,6 +7493,8 @@
 
     "duplexer2/readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
 
+    "effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "electron/@types/node": ["@types/node@22.19.17", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-wGdMcf+vPYM6jikpS/qhg6WiqSV/OhG+jeeHT/KlVqxYfD40iYJf9/AE1uQxVWFvU7MipKRkRv8NSHiCGgPr8Q=="],
 
     "electron-builder/fs-extra": ["fs-extra@10.1.0", "", { "dependencies": { "graceful-fs": "^4.2.0", "jsonfile": "^6.0.1", "universalify": "^2.0.0" } }, "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ=="],
@@ -7664,8 +7653,6 @@
 
     "istanbul-lib-report/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
 
-    "istanbul-lib-source-maps/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "jest-changed-files/execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
 
     "jest-changed-files/p-limit": ["p-limit@3.1.0", "", { "dependencies": { "yocto-queue": "^0.1.0" } }, "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ=="],
@@ -7708,6 +7695,10 @@
 
     "jspdf/fflate": ["fflate@0.8.2", "", {}, "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A=="],
 
+    "jsprim/extsprintf": ["extsprintf@1.3.0", "", {}, "sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g=="],
+
+    "jsprim/verror": ["verror@1.10.0", "", { "dependencies": { "assert-plus": "^1.0.0", "core-util-is": "1.0.2", "extsprintf": "^1.2.0" } }, "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw=="],
+
     "jszip/readable-stream": ["readable-stream@2.3.8", "", { "dependencies": { "core-util-is": "~1.0.0", "inherits": "~2.0.3", "isarray": "~1.0.0", "process-nextick-args": "~2.0.0", "safe-buffer": "~5.1.1", "string_decoder": "~1.1.1", "util-deprecate": "~1.0.1" } }, "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA=="],
 
     "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="],
@@ -8358,8 +8349,6 @@
 
     "terser/commander": ["commander@2.20.3", "", {}, "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="],
 
-    "terser-webpack-plugin/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "terser-webpack-plugin/schema-utils": ["schema-utils@4.3.3", "", { "dependencies": { "@types/json-schema": "^7.0.9", "ajv": "^8.9.0", "ajv-formats": "^2.1.1", "ajv-keywords": "^5.1.0" } }, "sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA=="],
 
     "test-exclude/glob": ["glob@10.5.0", "", { "dependencies": { "foreground-child": "^3.1.0", "jackspeak": "^3.1.2", "minimatch": "^9.0.4", "minipass": "^7.1.2", "package-json-from-dist": "^1.0.0", "path-scurry": "^1.11.1" }, "bin": { "glob": "dist/esm/bin.mjs" } }, "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg=="],
@@ -8398,6 +8387,8 @@
 
     "trigger.dev/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
+    "ts-loader/source-map": ["source-map@0.7.4", "", {}, "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA=="],
+
     "ts-node/diff": ["diff@4.0.4", "", {}, "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ=="],
 
     "tsup/tinyexec": ["tinyexec@0.3.2", "", {}, "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA=="],
@@ -8414,8 +8405,6 @@
 
     "uploadthing/effect": ["effect@3.17.7", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "fast-check": "^3.23.1" } }, "sha512-dpt0ONUn3zzAuul6k4nC/coTTw27AL5nhkORXgTi6NfMPzqWYa1M05oKmOMTxpVSTKepqXVcW9vIwkuaaqx9zA=="],
 
-    "v8-to-istanbul/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
-
     "verror/core-util-is": ["core-util-is@1.0.2", "", {}, "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ=="],
 
     "vite/esbuild": ["esbuild@0.25.12", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.25.12", "@esbuild/android-arm": "0.25.12", "@esbuild/android-arm64": "0.25.12", "@esbuild/android-x64": "0.25.12", "@esbuild/darwin-arm64": "0.25.12", "@esbuild/darwin-x64": "0.25.12", "@esbuild/freebsd-arm64": "0.25.12", "@esbuild/freebsd-x64": "0.25.12", "@esbuild/linux-arm": "0.25.12", "@esbuild/linux-arm64": "0.25.12", "@esbuild/linux-ia32": "0.25.12", "@esbuild/linux-loong64": "0.25.12", "@esbuild/linux-mips64el": "0.25.12", "@esbuild/linux-ppc64": "0.25.12", "@esbuild/linux-riscv64": "0.25.12", "@esbuild/linux-s390x": "0.25.12", "@esbuild/linux-x64": "0.25.12", "@esbuild/netbsd-arm64": "0.25.12", "@esbuild/netbsd-x64": "0.25.12", "@esbuild/openbsd-arm64": "0.25.12", "@esbuild/openbsd-x64": "0.25.12", "@esbuild/openharmony-arm64": "0.25.12", "@esbuild/sunos-x64": "0.25.12", "@esbuild/win32-arm64": "0.25.12", "@esbuild/win32-ia32": "0.25.12", "@esbuild/win32-x64": "0.25.12" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg=="],
@@ -8784,10 +8773,14 @@
 
     "@prisma/config/c12/giget": ["giget@2.0.0", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.0", "defu": "^6.1.4", "node-fetch-native": "^1.6.6", "nypm": "^0.6.0", "pathe": "^2.0.3" }, "bin": { "giget": "dist/cli.mjs" } }, "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA=="],
 
+    "@prisma/config/c12/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
+
     "@prisma/config/c12/ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
 
     "@prisma/config/c12/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
 
+    "@prisma/config/effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "@prisma/instrumentation/@opentelemetry/instrumentation/@opentelemetry/api-logs": ["@opentelemetry/api-logs@0.207.0", "", { "dependencies": { "@opentelemetry/api": "^1.3.0" } }, "sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ=="],
 
     "@prisma/instrumentation/@opentelemetry/instrumentation/import-in-the-middle": ["import-in-the-middle@2.0.6", "", { "dependencies": { "acorn": "^8.15.0", "acorn-import-attributes": "^1.9.5", "cjs-module-lexer": "^2.2.0", "module-details-from-path": "^1.0.4" } }, "sha512-3vZV3jX0XRFW3EJDTwzWoZa+RH1b8eTTx6YOCjglrLyPuepwoBti1k3L2dKwdCUrnVEfc5CuRuGstaC/uQJJaw=="],
@@ -8916,6 +8909,8 @@
 
     "@typescript-eslint/typescript-estree/minimatch/brace-expansion": ["brace-expansion@5.0.5", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ=="],
 
+    "@uploadthing/shared/effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "accepts/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
     "ajv-formats/ajv/json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
@@ -9186,6 +9181,10 @@
 
     "jest-watcher/ansi-escapes/type-fest": ["type-fest@0.21.3", "", {}, "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w=="],
 
+    "jsprim/verror/core-util-is": ["core-util-is@1.0.2", "", {}, "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ=="],
+
+    "jsprim/verror/extsprintf": ["extsprintf@1.4.1", "", {}, "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA=="],
+
     "jszip/readable-stream/isarray": ["isarray@1.0.0", "", {}, "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="],
 
     "jszip/readable-stream/safe-buffer": ["safe-buffer@5.1.2", "", {}, "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="],
@@ -9472,7 +9471,7 @@
 
     "unzipper/readable-stream/string_decoder": ["string_decoder@1.1.1", "", { "dependencies": { "safe-buffer": "~5.1.0" } }, "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg=="],
 
-    "uploadthing/effect/@standard-schema/spec": ["@standard-schema/spec@1.0.0", "", {}, "sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA=="],
+    "uploadthing/effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "vite/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.25.12", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA=="],
 
@@ -9862,10 +9861,14 @@
 
     "prisma/@prisma/config/c12/giget": ["giget@2.0.0", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.0", "defu": "^6.1.4", "node-fetch-native": "^1.6.6", "nypm": "^0.6.0", "pathe": "^2.0.3" }, "bin": { "giget": "dist/cli.mjs" } }, "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA=="],
 
+    "prisma/@prisma/config/c12/jiti": ["jiti@2.6.1", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ=="],
+
     "prisma/@prisma/config/c12/ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
 
     "prisma/@prisma/config/c12/pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
 
+    "prisma/@prisma/config/effect/@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
     "react-syntax-highlighter/refractor/hastscript/@types/hast": ["@types/hast@2.3.10", "", { "dependencies": { "@types/unist": "^2" } }, "sha512-McWspRw8xx8J9HurkVBfYj0xKoE25tOFlHGdx4MJ5xORQrMGZNqJhVQWaIbm6Oyla5kYOXtDiopzKRJzEOkwJw=="],
 
     "react-syntax-highlighter/refractor/hastscript/comma-separated-tokens": ["comma-separated-tokens@1.0.8", "", {}, "sha512-GHuDRO12Sypu2cV70d1dkA2EUmXHgntrzbpvOB+Qy+49ypNfGgFQIC2fhhXbnyrJRynDCAARsT7Ou0M6hirpfw=="],
diff --git a/docs/plans/secure-rds-tls-deploy-checklist.md b/docs/plans/secure-rds-tls-deploy-checklist.md
new file mode 100644
index 0000000000..5ac7e9240c
--- /dev/null
+++ b/docs/plans/secure-rds-tls-deploy-checklist.md
@@ -0,0 +1,52 @@
+# Secure RDS TLS — Deploy Checklist
+
+After merging the secure-rds-tls PR, the following env vars must be set per environment.
+
+## Vercel (apps/app and apps/portal)
+
+Set on each Vercel project, all environments (Production + Preview + Development):
+
+```
+NODE_EXTRA_CA_CERTS=/var/task/packages/db/certs/rds-global-bundle.pem
+```
+
+Verified on staging (apps/app): `process.cwd()` is `/var/task/apps/app`, the cert is traced
+into the deploy at `/var/task/packages/db/certs/rds-global-bundle.pem` (165408 bytes), and
+`/api/health` succeeds end-to-end. The cert is bundled via `outputFileTracingIncludes` in
+each app's `next.config.ts`.
+
+## Downstream consumers (comp-private/apps/enterprise-api, etc.)
+
+The CA bundle now ships with the published `@trycompai/db` package (added to the `files` array
+in this PR). After the next `@trycompai/db` publish, downstream consumers can ship the cert with
+their own Vercel/Docker/Trigger.dev builds without committing a copy.
+
+For Vercel-deployed apps that install `@trycompai/db` from npm:
+
+1. Bump the dependency to the version that includes `certs/`.
+2. Add `outputFileTracingIncludes` to `next.config.{ts,mjs}`:
+   ```ts
+   outputFileTracingIncludes: {
+     '/**/*': ['./node_modules/@trycompai/db/certs/rds-global-bundle.pem'],
+   },
+   ```
+3. Set the Vercel env var:
+   ```
+   NODE_EXTRA_CA_CERTS=/var/task/node_modules/@trycompai/db/certs/rds-global-bundle.pem
+   ```
+4. Apply the same strict-TLS Prisma client logic (or import a shared helper from `@trycompai/db`).
+
+## Trigger.dev (api and app projects, staging + prod)
+
+After deploying with the `caBundleExtension` (already wired in `trigger.config.ts`), remove the
+legacy opt-in that bypasses TLS verification:
+
+```bash
+bunx trigger.dev@4.4.3 envvars remove PRISMA_ALLOW_INSECURE_TLS --env staging
+bunx trigger.dev@4.4.3 envvars remove PRISMA_ALLOW_INSECURE_TLS --env prod
+```
+
+## API Docker (apps/api)
+
+No action — `apps/api/Dockerfile.multistage` already installs the RDS CA bundle and sets
+`NODE_EXTRA_CA_CERTS` at the system level.
diff --git a/packages/db/certs/rds-global-bundle.pem b/packages/db/certs/rds-global-bundle.pem
new file mode 100644
index 0000000000..99351b7e95
--- /dev/null
+++ b/packages/db/certs/rds-global-bundle.pem
@@ -0,0 +1,2736 @@
+-----BEGIN CERTIFICATE-----
+MIID/jCCAuagAwIBAgIQdOCSuA9psBpQd8EI368/0DANBgkqhkiG9w0BAQsFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIHNhLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTE5MTgwNjI2WhgPMjA2MTA1MTkxOTA2MjZaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgc2EtZWFzdC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6ftL6w8v3dB2yW
+LjCxSP1D7ZsOTeLZOSCz1Zv0Gkd0XLhil5MdHOHBvwH/DrXqFU2oGzCRuAy+aZis
+DardJU6ChyIQIciXCO37f0K23edhtpXuruTLLwUwzeEPdcnLPCX+sWEn9Y5FPnVm
+pCd6J8edH2IfSGoa9LdErkpuESXdidLym/w0tWG/O2By4TabkNSmpdrCL00cqI+c
+prA8Bx1jX8/9sY0gpAovtuFaRN+Ivg3PAnWuhqiSYyQ5nC2qDparOWuDiOhpY56E
+EgmTvjwqMMjNtExfYx6Rv2Ndu50TriiNKEZBzEtkekwXInTupmYTvc7U83P/959V
+UiQ+WSMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU4uYHdH0+
+bUeh81Eq2l5/RJbW+vswDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB
+AQBhxcExJ+w74bvDknrPZDRgTeMLYgbVJjx2ExH7/Ac5FZZWcpUpFwWMIJJxtewI
+AnhryzM3tQYYd4CG9O+Iu0+h/VVfW7e4O3joWVkxNMb820kQSEwvZfA78aItGwOY
+WSaFNVRyloVicZRNJSyb1UL9EiJ9ldhxm4LTT0ax+4ontI7zTx6n6h8Sr6r/UOvX
+d9T5aUUENWeo6M9jGupHNn3BobtL7BZm2oS8wX8IVYj4tl0q5T89zDi2x0MxbsIV
+5ZjwqBQ5JWKv7ASGPb+z286RjPA9R2knF4lJVZrYuNV90rHvI/ECyt/JrDqeljGL
+BLl1W/UsvZo6ldLIpoMbbrb5
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBDCCAuygAwIBAgIQUfVbqapkLYpUqcLajpTJWzANBgkqhkiG9w0BAQsFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIG1lLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjIwNTA2MjMyMDA5WhgPMjA2MjA1MDcwMDIwMDlaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJIeovu3
+ewI9FVitXMQzvkh34aQ6WyI4NO3YepfJaePiv3cnyFGYHN2S1cR3UQcLWgypP5va
+j6bfroqwGbCbZZcb+6cyOB4ceKO9Ws1UkcaGHnNDcy5gXR7aCW2OGTUfinUuhd2d
+5bOGgV7JsPbpw0bwJ156+MwfOK40OLCWVbzy8B1kITs4RUPNa/ZJnvIbiMu9rdj4
+8y7GSFJLnKCjlOFUkNI5LcaYvI1+ybuNgphT3nuu5ZirvTswGakGUT/Q0J3dxP0J
+pDfg5Sj/2G4gXiaM0LppVOoU5yEwVewhQ250l0eQAqSrwPqAkdTg9ng360zqCFPE
+JPPcgI1tdGUgneECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+/2AJVxWdZxc8eJgdpbwpW7b0f7IwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQBYm63jTu2qYKJ94gKnqc+oUgqmb1mTXmgmp/lXDbxonjszJDOXFbri
+3CCO7xB2sg9bd5YWY8sGKHaWmENj3FZpCmoefbUx++8D7Mny95Cz8R32rNcwsPTl
+ebpd9A/Oaw5ug6M0x/cNr0qzF8Wk9Dx+nFEimp8RYQdKvLDfNFZHjPa1itnTiD8M
+TorAqj+VwnUGHOYBsT/0NY12tnwXdD+ATWfpEHdOXV+kTMqFFwDyhfgRVNpTc+os
+ygr8SwhnSCpJPB/EYl2S7r+tgAbJOkuwUvGT4pTqrzDQEhwE7swgepnHC87zhf6l
+qN6mVpSnQKQLm6Ob5TeCEFgcyElsF5bH
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAOxu0I1QuMAhIeszB3fJIlkwCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyB1cy13ZXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTI0MjIwNjU5WhgPMjEyMTA1MjQyMzA2NTlaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgdXMtd2VzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEz4bylRcGqqDWdP7gQIIoTHdBK6FNtKH1
+4SkEIXRXkYDmRvL9Bci1MuGrwuvrka5TDj4b7e+csY0llEzHpKfq6nJPFljoYYP9
+uqHFkv77nOpJJ633KOr8IxmeHW5RXgrZo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBQQikVz8wmjd9eDFRXzBIU8OseiGzAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIwf06Mcrpw1O0EBLBBrp84m37NYtOkE/0Z0O+C7D41wnXi
+EQdn6PXUVgdD23Gj82SrAjEAklhKs+liO1PtN15yeZR1Io98nFve+lLptaLakZcH
++hfFuUtCqMbaI8CdvJlKnPqT
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRALyWMTyCebLZOGcZZQmkmfcwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI0MjAyODAzWhgPMjEyMTA1MjQyMTI4MDNa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTMgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+wGFiyDyCrGqgdn4fXG12cxKAAfVvhMea1mw5h9CVRoavkPqhzQpAitSOuMB9DeiP
+wQyqcsiGl/cTEau4L+AUBG8b9v26RlY48exUYBXj8CieYntOT9iNw5WtdYJa3kF/
+JxgI+HDMzE9cmHDs5DOO3S0uwZVyra/xE1ymfSlpOeUIOTpHRJv97CBUEpaZMUW5
+Sr6GruuOwFVpO5FX3A/jQlcS+UN4GjSRgDUJuqg6RRQldEZGCVCCmodbByvI2fGm
+reGpsPJD54KkmAX08nOR8e5hkGoHxq0m2DLD4SrOFmt65vG47qnuwplWJjtk9B3Z
+9wDoopwZLBOtlkPIkUllWm1P8EuHC1IKOA+wSP6XdT7cy8S77wgyHzR0ynxv7q/l
+vlZtH30wnNqFI0y9FeogD0TGMCHcnGqfBSicJXPy9T4fU6f0r1HwqKwPp2GArwe7
+dnqLTj2D7M9MyVtFjEs6gfGWXmu1y5uDrf+CszurE8Cycoma+OfjjuVQgWOCy7Nd
+jJswPxAroTzVfpgoxXza4ShUY10woZu0/J+HmNmqK7lh4NS75q1tz75in8uTZDkV
+be7GK+SEusTrRgcf3tlgPjSTWG3veNzFDF2Vn1GLJXmuZfhdlVQDBNXW4MNREExS
+dG57kJjICpT+r8X+si+5j51gRzkSnMYs7VHulpxfcwECAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQU4JWOpDBmUBuWKvGPZelw87ezhL8wDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBRNLMql7itvXSEFQRAnyOjivHz
+l5IlWVQjAbOUr6ogZcwvK6YpxNAFW5zQr8F+fdkiypLz1kk5irx9TIpff0BWC9hQ
+/odMPO8Gxn8+COlSvc+dLsF2Dax3Hvz0zLeKMo+cYisJOzpdR/eKd0/AmFdkvQoM
+AOK9n0yYvVJU2IrSgeJBiiCarpKSeAktEVQ4rvyacQGr+QAPkkjRwm+5LHZKK43W
+nNnggRli9N/27qYtc5bgr3AaQEhEXMI4RxPRXCLsod0ehMGWyRRK728a+6PMMJAJ
+WHOU0x7LCEMPP/bvpLj3BdvSGqNor4ZtyXEbwREry1uzsgODeRRns5acPwTM6ff+
+CmxO2NZ0OktIUSYRmf6H/ZFlZrIhV8uWaIwEJDz71qvj7buhQ+RFDZ9CNL64C0X6
+mf0zJGEpddjANHaaVky+F4gYMtEy2K2Lcm4JGTdyIzUoIe+atzCnRp0QeIcuWtF+
+s8AjDYCVFNypcMmqbRmNpITSnOoCHSRuVkY3gutVoYyMLbp8Jm9SJnCIlEWTA6Rm
+wADOMGZJVn5/XRTRuetVOB3KlQDjs9OO01XN5NzGSZO2KT9ngAUfh9Eqhf1iRWSP
+nZlRbQ2NRCuY/oJ5N59mLGxnNJSE7giEKEBRhTQ/XEPIUYAUPD5fca0arKRJwbol
+l9Se1Hsq0ZU5f+OZKQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAK7vlRrGVEePJpW1VHMXdlIwDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBhZi1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MTkxOTI4NDNaGA8yMTIxMDUxOTIwMjg0M1owgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBhZi1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMZiHOQC6x4o
+eC7vVOMCGiN5EuLqPYHdceFPm4h5k/ZejXTf7kryk6aoKZKsDIYihkaZwXVS7Y/y
+7Ig1F1ABi2jD+CYprj7WxXbhpysmN+CKG7YC3uE4jSvfvUnpzionkQbjJsRJcrPO
+cZJM4FVaVp3mlHHtvnM+K3T+ni4a38nAd8xrv1na4+B8ZzZwWZXarfg8lJoGskSn
+ou+3rbGQ0r+XlUP03zWujHoNlVK85qUIQvDfTB7n3O4s1XNGvkfv3GNBhYRWJYlB
+4p8T+PFN8wG+UOByp1gV7BD64RnpuZ8V3dRAlO6YVAmINyG5UGrPzkIbLtErUNHO
+4iSp4UqYvztDqJWWHR/rA84ef+I9RVwwZ8FQbjKq96OTnPrsr63A5mXTC9dXKtbw
+XNJPQY//FEdyM3K8sqM0IdCzxCA1MXZ8+QapWVjwyTjUwFvL69HYky9H8eAER59K
+5I7u/CWWeCy2R1SYUBINc3xxLr0CGGukcWPEZW2aPo5ibW5kepU1P/pzdMTaTfao
+F42jSFXbc7gplLcSqUgWwzBnn35HLTbiZOFBPKf6vRRu8aRX9atgHw/EjCebi2xP
+xIYr5Ub8u0QVHIqcnF1/hVzO/Xz0chj3E6VF/yTXnsakm+W1aM2QkZbFGpga+LMy
+mFCtdPrELjea2CfxgibaJX1Q4rdEpc8DAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFDSaycEyuspo/NOuzlzblui8KotFMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEAbosemjeTRsL9o4v0KadBUNS3V7gdAH+X4vH2
+Ee1Jc91VOGLdd/s1L9UX6bhe37b9WjUD69ur657wDW0RzxMYgQdZ27SUl0tEgGGp
+cCmVs1ky3zEN+Hwnhkz+OTmIg1ufq0W2hJgJiluAx2r1ib1GB+YI3Mo3rXSaBYUk
+bgQuujYPctf0PA153RkeICE5GI3OaJ7u6j0caYEixBS3PDHt2MJWexITvXGwHWwc
+CcrC05RIrTUNOJaetQw8smVKYOfRImEzLLPZ5kf/H3Cbj8BNAFNsa10wgvlPuGOW
+XLXqzNXzrG4V3sjQU5YtisDMagwYaN3a6bBf1wFwFIHQoAPIgt8q5zaQ9WI+SBns
+Il6rd4zfvjq/BPmt0uI7rVg/cgbaEg/JDL2neuM9CJAzmKxYxLQuHSX2i3Fy4Y1B
+cnxnRQETCRZNPGd00ADyxPKVoYBC45/t+yVusArFt+2SVLEGiFBr23eG2CEZu+HS
+nDEgIfQ4V3YOTUNa86wvbAss1gbbnT/v1XCnNGClEWCWNCSRjwV2ZmQ/IVTmNHPo
+7axTTBBJbKJbKzFndCnuxnDXyytdYRgFU7Ly3sa27WS2KFyFEDebLFRHQEfoYqCu
+IupSqBSbXsR3U10OTjc9z6EPo1nuV6bdz+gEDthmxKa1NI+Qb1kvyliXQHL2lfhr
+5zT5+Bs=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRAOLV6zZcL4IV2xmEneN1GwswDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyB1cy13ZXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE5MDg1OFoYDzIxMjEwNTE5MjAwODU4WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIHVzLXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC7koAKGXXlLixN
+fVjhuqvz0WxDeTQfhthPK60ekRpftkfE5QtnYGzeovaUAiS58MYVzqnnTACDwcJs
+IGTFE6Wd7sB6r8eI/3CwI1pyJfxepubiQNVAQG0zJETOVkoYKe/5KnteKtnEER3X
+tCBRdV/rfbxEDG9ZAsYfMl6zzhEWKF88G6xhs2+VZpDqwJNNALvQuzmTx8BNbl5W
+RUWGq9CQ9GK9GPF570YPCuURW7kl35skofudE9bhURNz51pNoNtk2Z3aEeRx3ouT
+ifFJlzh+xGJRHqBG7nt5NhX8xbg+vw4xHCeq1aAe6aVFJ3Uf9E2HzLB4SfIT9bRp
+P7c9c0ySGt+3n+KLSHFf/iQ3E4nft75JdPjeSt0dnyChi1sEKDi0tnWGiXaIg+J+
+r1ZtcHiyYpCB7l29QYMAdD0TjfDwwPayLmq//c20cPmnSzw271VwqjUT0jYdrNAm
+gV+JfW9t4ixtE3xF2jaUh/NzL3bAmN5v8+9k/aqPXlU1BgE3uPwMCjrfn7V0I7I1
+WLpHyd9jF3U/Ysci6H6i8YKgaPiOfySimQiDu1idmPld659qerutUSemQWmPD3bE
+dcjZolmzS9U0Ujq/jDF1YayN3G3xvry1qWkTci0qMRMu2dZu30Herugh9vsdTYkf
+00EqngPbqtIVLDrDjEQLqPcb8QvWFQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBQBqg8Za/L0YMHURGExHfvPyfLbOTAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBACAGPMa1QL7P/FIO7jEtMelJ0hQlQepKnGtbKz4r
+Xq1bUX1jnLvnAieR9KZmeQVuKi3g3CDU6b0mDgygS+FL1KDDcGRCSPh238Ou8KcG
+HIxtt3CMwMHMa9gmdcMlR5fJF9vhR0C56KM2zvyelUY51B/HJqHwGvWuexryXUKa
+wq1/iK2/d9mNeOcjDvEIj0RCMI8dFQCJv3PRCTC36XS36Tzr6F47TcTw1c3mgKcs
+xpcwt7ezrXMUunzHS4qWAA5OGdzhYlcv+P5GW7iAA7TDNrBF+3W4a/6s9v2nQAnX
+UvXd9ul0ob71377UhZbJ6SOMY56+I9cJOOfF5QvaL83Sz29Ij1EKYw/s8TYdVqAq
++dCyQZBkMSnDFLVe3J1KH2SUSfm3O98jdPORQrUlORQVYCHPls19l2F6lCmU7ICK
+hRt8EVSpXm4sAIA7zcnR2nU00UH8YmMQLnx5ok9YGhuh3Ehk6QlTQLJux6LYLskd
+9YHOLGW/t6knVtV78DgPqDeEx/Wu/5A8R0q7HunpWxr8LCPBK6hksZnOoUhhb8IP
+vl46Ve5Tv/FlkyYr1RTVjETmg7lb16a8J0At14iLtpZWmwmuv4agss/1iBVMXfFk
++ZGtx5vytWU5XJmsfKA51KLsMQnhrLxb3X3zC+JRCyJoyc8++F3YEcRi2pkRYE3q
+Hing
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAI+asxQA/MB1cGyyrC0MPpkwDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBjYS13ZXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIzMDkxMzIwMjEzNFoYDzIwNjMwOTEzMjEyMTMzWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGNhLXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMHvQITTZcfl2O
+yfzRIAPKwzzlc8eXWdXef7VUsbezg3lm9RC+vArO4JuAzta/aLw1D94wPSRm9JXX
+NkP3obO6Ql80/0doooU6BAPceD0xmEWC4aCFT/5KWsD6Sy2/Rjwq3NKBTwzxLwYK
+GqVsBp8AdrzDTmdRETC+Dg2czEo32mTDAA1uMgqrz6xxeTYroj8NTSTp6jfE6C0n
+YgzYmVQCEIjHqI49j7k3jfT3P2skCVKGJwQzoZnerFacKzXsDB18uIqU7NaMc2cX
+kOd0gRqpyKOzAHU2m5/S4jw4UHdkoI3E7nkayuen8ZPKH2YqWtTXUrXGhSTT34nX
+yiFgu+vTAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHzz1NTd
+TOm9zAv4d8l6XCFKSdJfMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAodBvd0cvXQYhFBef2evnuI9XA+AC/Q9P1nYtbp5MPA4aFhy5v9rjW8wwJX14
+l+ltd2o3tz8PFDBZ1NX2ooiWVlZthQxKn1/xDVKsTXHbYUXItPQ3jI5IscB5IML8
+oCzAbkoLXsSPNOVFP5P4l4cZEMqHGRnBag7hLJZvmvzZSBnz+ioC2jpjVluF8kDX
+fQGNjqPECik68CqbSV0SaQ0cgEoYTDjwON5ZLBeS8sxR2abE/gsj4VFYl5w/uEBd
+w3Tt9uGfIy+wd2tNj6isGC6PcbPMjA31jd+ifs2yNzigqkcYTTWFtnvh4a8xiecm
+GHu2EgH0Jqzz500N7L3uQdPkdg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRALnItUH64VieFPvDUCOG5E0wDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNSBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjQwNTE1MjE1MDQxWhgPMjEyNDA1MTUyMjUwNDFa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTUgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+u2Bc0RjN0vB7EM+h0yts1jSqzDd1v5FcxCDbC7vKPVCq/1pYNTIxQj77HiMcYtvL
+Bfi9AQFibU1C9gN62kUmSe0QaNGqQL2g/6YpB4qI8psIsCt3aIigbhwEEpebhIU/
+vhr/pvLKhkQOSLxJVlX0j18hU5RVqOefCdFm9FmjFLge/m1Yzv2aFifRKIzdtkfp
+4VZBzh7EzP6lxkU3SAcW9yRu/t4oY274ICnGisv2TR15hHlP0wUP6p5S3ot2q/xJ
+57x8nzI3kQyC6a+n+kSzZzITboKWrsx3Jd2PdB4VC84P/YoAC3cwfmacmQVT01c8
+io1eO+BxCtWUNbwCv0Hd10bHI18rVzJhJPb3xg1i1Sc3sbcrADOONsuhxqwffjUe
+XdVMdsjX2mYxQ520qnh5DwQkx3JyW6QwI/ueU9xbMuPTwAauXil7B9qx1IDViYUw
+BvMDnxYbYHlDezYIc4WoNoA2KflMnNtN2WDiM7tvQKmWI8yYZrNdnqBD0HYR+neP
+z69Tqy8i24CDoR9o3s5LxR58SgFPqu9RWu8uL6vfNLL2M8qQ4VueOWSyzRs9b3W5
+GVjA4U1CxlF3EirHEjciq6UEXr5+ZVf79iXGOwBVDzuim1LYfoTBgkMXKxyEzWYT
+QCzf6VPW4x7eMQIriLl18YocHrqJQ7+BfMziYjOh0rcCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUQdyu9F6eLFuxe437iU/GXyFHU1owDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCbbNUJRQ1gy1lKxCoszcyujCI5
+df0EGdadQL6BgaXws/uCFvHepB5lO62InAMTURCREeRtrCNyn1rEKnsqhAW0UokQ
+Z+YOHcclgPsXmSQVjIUgnlE45mrPS/9mO8TzhCI3wyiELp6oa67RSiJ1Qcsypa4z
+zHDkYdhFW3sxY8i2p2tqdkJz1ZEQd7FIpX+vrBVIkoqtGAn4urLaMq4CTNJCNepR
+s4OGaoQVY43q2kcguRPDZVOFK5+GlrC2AzHMSVt5fFSCchgYxBZsS3UIVKm8YJ7v
+1h85RwtNCHwwDt1uP43yLp5qfUmsfeaNmZiOk9AawxPCmy6XaSkQcLz+CQhG9T4W
+siQMg6tagIUw1e4zFm7GXmeOCPc//ycGNDXgprMQzjK+AT4ed8iK+JnWlheMq5uf
+XxQDSfakuAIEgJWPAzebjCo33O2j1PQfzbt1Ahs7f+gFczizfpatYkXcOTmLfG1l
+QKj9jVNOIQSJt5PxH+QTDWQtkX/tGp/HS5a3dWusW/TnC3yakGqqfGx3cB/E00gF
+geg0LYo1uOBjIYQbkp3Z6NKfcc/nb0ksV7feKm5f3rSO8NnA0Ou8YHb84LYDLYDf
+VSR9SwSBhGw31otMTAsJdNTHJwfCcxfGtIvUfAsWUAh6qSo4es/hUV60pj01VWpq
+Er+ItMFHuoSTmx18bw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRANxgyBbnxgTEOpDul2ZnC0UwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNjEwMTgxOTA3WhgPMjA2MTA2MTAxOTE5MDda
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+xnwSDAChrMkfk5TA4Dk8hKzStDlSlONzmd3fTG0Wqr5+x3EmFT6Ksiu/WIwEl9J2
+K98UI7vYyuZfCxUKb1iMPeBdVGqk0zb92GpURd+Iz/+K1ps9ZLeGBkzR8mBmAi1S
+OfpwKiTBzIv6E8twhEn4IUpHsdcuX/2Y78uESpJyM8O5CpkG0JaV9FNEbDkJeBUQ
+Ao2qqNcH4R0Qcr5pyeqA9Zto1RswgL06BQMI9dTpfwSP5VvkvcNUaLl7Zv5WzLQE
+JzORWePvdPzzvWEkY/3FPjxBypuYwssKaERW0fkPDmPtykktP9W/oJolKUFI6pXp
+y+Y6p6/AVdnQD2zZjW5FhQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBT+jEKs96LC+/X4BZkUYUkzPfXdqTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAIGQqgqcQ6XSGkmNebzR6DhadTbfDmbYeN5N0Vuzv+Tdmufb
+tMGjdjnYMg4B+IVnTKQb+Ox3pL9gbX6KglGK8HupobmIRtwKVth+gYYz3m0SL/Nk
+haWPYzOm0x3tJm8jSdufJcEob4/ATce9JwseLl76pSWdl5A4lLjnhPPKudUDfH+1
+BLNUi3lxpp6GkC8aWUPtupnhZuXddolTLOuA3GwTZySI44NfaFRm+o83N1jp+EwD
+6e94M4cTRzjUv6J3MZmSbdtQP/Tk1uz2K4bQZGP0PZC3bVpqiesdE/xr+wbu8uHr
+cM1JXH0AmXf1yIkTgyWzmvt0k1/vgcw5ixAqvvE=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEATCCAumgAwIBAgIRAMhw98EQU18mIji+unM2YH8wDQYJKoZIhvcNAQELBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMjA2MDYyMTQyMjJaGA8yMDYyMDYwNjIyNDIyMlowgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIeeRoLfTm+7
+vqm7ZlFSx+1/CGYHyYrOOryM4/Z3dqYVHFMgWTR7V3ziO8RZ6yUanrRcWVX3PZbF
+AfX0KFE8OgLsXEZIX8odSrq86+/Th5eZOchB2fDBsUB7GuN2rvFBbM8lTI9ivVOU
+lbuTnYyb55nOXN7TpmH2bK+z5c1y9RVC5iQsNAl6IJNvSN8VCqXh31eK5MlKB4DT
++Y3OivCrSGsjM+UR59uZmwuFB1h+icE+U0p9Ct3Mjq3MzSX5tQb6ElTNGlfmyGpW
+Kh7GQ5XU1KaKNZXoJ37H53woNSlq56bpVrKI4uv7ATpdpFubOnSLtpsKlpLdR3sy
+Ws245200pC8CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUp0ki
+6+eWvsnBjQhMxwMW5pwn7DgwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUA
+A4IBAQB2V8lv0aqbYQpj/bmVv/83QfE4vOxKCJAHv7DQ35cJsTyBdF+8pBczzi3t
+3VNL5IUgW6WkyuUOWnE0eqAFOUVj0yTS1jSAtfl3vOOzGJZmWBbqm9BKEdu1D8O6
+sB8bnomwiab2tNDHPmUslpdDqdabbkWwNWzLJ97oGFZ7KNODMEPXWKWNxg33iHfS
+/nlmnrTVI3XgaNK9qLZiUrxu9Yz5gxi/1K+sG9/Dajd32ZxjRwDipOLiZbiXQrsd
+qzIMY4GcWf3g1gHL5mCTfk7dG22h/rhPyGV0svaDnsb+hOt6sv1McMN6Y3Ou0mtM
+/UaAXojREmJmTSCNvs2aBny3/2sy
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBDCCA+ygAwIBAgIQID5K+9PRwKbkBpe2il3rBjANBgkqhkiG9w0BAQwFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIG14LWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjQwOTMwMTYxMzU1WhgPMjEyNDA5MzAxNzEzNTVaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI25WbHf
+qmz3amzhuAXMOIrt/UZpWk24hjRYVmuY7ePaz01cDJ7K/hrEzhXDBBitF+KKxPXD
+XXJ/KCP/joQL4ZaPiYPdeNQcO09wK31HMWsaJeHVHIuoWmKneK/ojpMtirjrdqo+
+3Hy7NMMhnkIy8KUzXTQX8hVFnDVfbjEhWppBFOtGlS8A8I85LALrj3Mvg8BPBl0Z
+JZvPhTzQAu5u5wHaJVgVKflLl1wrpNvVyHx5ryar2bSPwLtu8HEFp1TbgiZ5VD/7
+AUCfa2+fh5BRRVl3fF+7DqKtPXR5a9bJsyiieyhQa43ZDPpLQgurSjO4tBH6Mfhc
+x6cJ0OLOWK2ZhuGZGF4pGwH2srGrVzzecFyd2YTV8yuCTpo/lIIW74T+aV/udJXr
+AwjjOoToYifg3U2ipNCcy+lEit/LE0BVmNNGhggIioitfgOIqhJD12/9f+jewcnI
+pN510DngrY2+jRHYtqbS3rVpG6K5zsE1NPYDoJM6AA1iub/sVZzNU/TIt0TtuvY7
+izkg+o6AtUzlgqGaMM2emH+nkMyYWqteWHLeLEYRQ79laaQRKpuZV+cP5sCHSAYr
+Fwww1SqtR5ad+OexNp0Hqmrl1LMucmWXSjbmEYfPYCkPV/hEWI/am/FX7VlkSNGy
+S7+k0eCBawj/fQj2xlADIQnfa/qf+17e7bypAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFNtXwWHyvClTO1X0qH9DGxcwsgQtMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAjID7uJb3fQzOgjUA24WoBMd784H64geM
+IoYIzm0e7f4ZkI/NZoKAA1UPF+kW49A7Y7Un6YHf1WH9Y8EH3zwaDmak3Lzbw9Q6
++FY9BkynZ3LbGYdo1tdK/7dvRw/+gjMzN70vPmHQINvAt5r+33jwXicsvQtqLTP3
+vYLfR028B94eH73xOUKMoqp0cDNlHoAY413CCYlXUxdPnfQzhaF8EySwa2Ws9HOh
+/oDeU4ztaPfnMIH0jx6tf584HzSgW7h0wXLOodtNlI74+wr/42ltFQxRWZd34FaK
+R0OOJRBESuWeZUiCYucVn6Vw9jhJ5qVPcGPlSWim15UanTPh0+Ysqb4o5NO8GfWH
+wAmLO4MA4BJw1zJSi/7RblwuksdHpQ/sWK+OoGxwhp48KHDTpOJLJ0aJaXQDNF+B
+X/9Vl0zo05IQz+0C0L6RgBFiGnJtYW30Um9aHjbpz15Ov0tpajaL3iB7VlSKi/DS
+e3CsjQqkh0sUpnU+T31eJiDiHZ5z+Oq4VJtI+gK9dcVP4LjSvlMUcl+scQifXr+X
+GlJVyCphLVRtfHUv411ezQGmJFIJRMyfo+SKYWyDAvSrPxs6F6qDr54ShRuWBhrJ
+qLJw1abcDEJFlTFsNcWghF4H0iTMg46UAr+RMJBB0uC9ZqY207wT63px7vgDXSCs
+Pz5G0lqE904=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAMnRxsKLYscJV8Qv5pWbL7swCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyBzYS1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTE5MTgxNjAxWhgPMjEyMTA1MTkxOTE2MDFaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgc2EtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEjFOCZgTNVKxLKhUxffiDEvTLFhrmIqdO
+dKqVdgDoELEzIHWDdC+19aDPitbCYtBVHl65ITu/9pn6mMUl5hhUNtfZuc6A+Iw1
+sBe0v0qI3y9Q9HdQYrGgeHDh8M5P7E2ho0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBS5L7/8M0TzoBZk39Ps7BkfTB4yJTAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIwI43O0NtWKTgnVv9z0LO5UMZYgSve7GvGTwqktZYCMObE
+rUI4QerXM9D6JwLy09mqAjEAypfkdLyVWtaElVDUyHFkihAS1I1oUxaaDrynLNQK
+Ou/Ay+ns+J+GyvyDUjBpVVW1
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/jCCA+agAwIBAgIQR71Z8lTO5Sj+as2jB7IWXzANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIHVzLXdlc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTI0MjIwMzIwWhgPMjEyMTA1MjQyMzAzMjBaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgdXMtd2VzdC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM977bHIs1WJijrS
+XQMfUOhmlJjr2v0K0UjPl52sE1TJ76H8umo1yR4T7Whkd9IwBHNGKXCJtJmMr9zp
+fB38eLTu+5ydUAXdFuZpRMKBWwPVe37AdJRKqn5beS8HQjd3JXAgGKUNNuE92iqF
+qi2fIqFMpnJXWo0FIW6s2Dl2zkORd7tH0DygcRi7lgVxCsw1BJQhFJon3y+IV8/F
+bnbUXSNSDUnDW2EhvWSD8L+t4eiXYsozhDAzhBvojpxhPH9OB7vqFYw5qxFx+G0t
+lSLX5iWi1jzzc3XyGnB6WInZDVbvnvJ4BGZ+dTRpOCvsoMIn9bz4EQTvu243c7aU
+HbS/kvnCASNt+zk7C6lbmaq0AGNztwNj85Opn2enFciWZVnnJ/4OeefUWQxD0EPp
+SjEd9Cn2IHzkBZrHCg+lWZJQBKbUVS0lLIMSsLQQ6WvR38jY7D2nxM1A93xWxwpt
+ZtQnYRCVXH6zt2OwDAFePInWwxUjR5t/wu3XxPgpSfrmTi3WYtr1wFypAJ811e/P
+yBtswWUQ6BNJQvy+KnOEeGfOwmtdDFYR+GOCfvCihzrKJrxOtHIieehR5Iw3cbXG
+sm4pDzfMUVvDDz6C2M6PRlJhhClbatHCjik9hxFYEsAlqtVVK9pxaz9i8hOqSFQq
+kJSQsgWw+oM/B2CyjcSqkSQEu8RLAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFPmrdxpRRgu3IcaB5BTqlprcKdTsMA4GA1UdDwEB/wQEAwIBhjAN
+BgkqhkiG9w0BAQwFAAOCAgEAVdlxWjPvVKky3kn8ZizeM4D+EsLw9dWLau2UD/ls
+zwDCFoT6euagVeCknrn+YEl7g20CRYT9iaonGoMUPuMR/cdtPL1W/Rf40PSrGf9q
+QuxavWiHLEXOQTCtCaVZMokkvjuuLNDXyZnstgECuiZECTwhexUF4oiuhyGk9o01
+QMaiz4HX4lgk0ozALUvEzaNd9gWEwD2qe+rq9cQMTVq3IArUkvTIftZUaVUMzr0O
+ed1+zAsNa9nJhURJ/6anJPJjbQgb5qA1asFcp9UaMT1ku36U3gnR1T/BdgG2jX3X
+Um0UcaGNVPrH1ukInWW743pxWQb7/2sumEEMVh+jWbB18SAyLI4WIh4lkurdifzS
+IuTFp8TEx+MouISFhz/vJDWZ84tqoLVjkEcP6oDypq9lFoEzHDJv3V1CYcIgOusT
+k1jm9P7BXdTG7TYzUaTb9USb6bkqkD9EwJAOSs7DI94aE6rsSws2yAHavjAMfuMZ
+sDAZvkqS2Qg2Z2+CI6wUZn7mzkJXbZoqRjDvChDXEB1mIhzVXhiNW/CR5WKVDvlj
+9v1sdGByh2pbxcLQtVaq/5coM4ANgphoNz3pOYUPWHS+JUrIivBZ+JobjXcxr3SN
+9iDzcu5/FVVNbq7+KN/nvPMngT+gduEN5m+EBjm8GukJymFG0m6BENRA0QSDqZ7k
+zDY=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRAK5EYG3iHserxMqgg+0EFjgwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI0MjAyMzE2WhgPMjA2MTA1MjQyMTIzMTZa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+s1L6TtB84LGraLHVC+rGPhLBW2P0oN/91Rq3AnYwqDOuTom7agANwEjvLq7dSRG/
+sIfZsSV/ABTgArZ5sCmLjHFZAo8Kd45yA9byx20RcYtAG8IZl+q1Cri+s0XefzyO
+U6mlfXZkVe6lzjlfXBkrlE/+5ifVbJK4dqOS1t9cWIpgKqv5fbE6Qbq4LVT+5/WM
+Vd2BOljuBMGMzdZubqFKFq4mzTuIYfnBm7SmHlZfTdfBYPP1ScNuhpjuzw4n3NCR
+EdU6dQv04Q6th4r7eiOCwbWI9LkmVbvBe3ylhH63lApC7MiiPYLlB13xBubVHVhV
+q1NHoNTi+zA3MN9HWicRxQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBSuxoqm0/wjNiZLvqv+JlQwsDvTPDAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAFfTK/j5kv90uIbM8VaFdVbr/6weKTwehafT0pAk1bfLVX+7
+uf8oHgYiyKTTl0DFQicXejghXTeyzwoEkWSR8c6XkhD5vYG3oESqmt/RGvvoxz11
+rHHy7yHYu7RIUc3VQG60c4qxXv/1mWySGwVwJrnuyNT9KZXPevu3jVaWOVHEILaK
+HvzQ2YEcWBPmde/zEseO2QeeGF8FL45Q1d66wqIP4nNUd2pCjeTS5SpB0MMx7yi9
+ki1OH1pv8tOuIdimtZ7wkdB8+JSZoaJ81b8sRrydRwJyvB88rftuI3YB4WwGuONT
+ZezUPsmaoK69B0RChB0ofDpAaviF9V3xOWvVZfo=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGDzCCA/egAwIBAgIRAI0sMNG2XhaBMRN3zD7ZyoEwDQYJKoZIhvcNAQEMBQAw
+gZ8xCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE4MDYGA1UEAwwv
+QW1hem9uIFJEUyBQcmV2aWV3IHVzLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzEx
+EDAOBgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjA1NzUwWhgPMjEyMTA1MTgyMTU3
+NTBaMIGfMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNl
+cywgSW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExODA2BgNV
+BAMML0FtYXpvbiBSRFMgUHJldmlldyB1cy1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2
+IEcxMRAwDgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAh/otSiCu4Uw3hu7OJm0PKgLsLRqBmUS6jihcrkxfN2SHmp2zuRflkweU
+BhMkebzL+xnNvC8okzbgPWtUxSmDnIRhE8J7bvSKFlqs/tmEdiI/LMqe/YIKcdsI
+20UYmvyLIjtDaJIh598SHHlF9P8DB5jD8snJfhxWY+9AZRN+YVTltgQAAgayxkWp
+M1BbvxpOnz4CC00rE0eqkguXIUSuobb1vKqdKIenlYBNxm2AmtgvQfpsBIQ0SB+8
+8Zip8Ef5rtjSw5J3s2Rq0aYvZPfCVIsKYepIboVwXtD7E9J31UkB5onLBQlaHaA6
+XlH4srsMmrew5d2XejQGy/lGZ1nVWNsKO0x/Az2QzY5Kjd6AlXZ8kq6H68hscA5i
+OMbNlXzeEQsZH0YkId3+UsEns35AAjZv4qfFoLOu8vDotWhgVNT5DfdbIWZW3ZL8
+qbmra3JnCHuaTwXMnc25QeKgVq7/rG00YB69tCIDwcf1P+tFJWxvaGtV0g2NthtB
+a+Xo09eC0L53gfZZ3hZw1pa3SIF5dIZ6RFRUQ+lFOux3Q/I3u+rYstYw7Zxc4Zeo
+Y8JiedpQXEAnbw2ECHix/L6mVWgiWCiDzBnNLLdbmXjJRnafNSndSfFtHCnY1SiP
+aCrNpzwZIJejoV1zDlWAMO+gyS28EqzuIq3WJK/TFE7acHkdKIcCAwEAAaNCMEAw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUrmV1YASnuudfmqAZP4sKGTvScaEw
+DgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBGpEKeQoPvE85tN/25
+qHFkys9oHDl93DZ62EnOqAUKLd6v0JpCyEiop4nlrJe+4KrBYVBPyKOJDcIqE2Sp
+3cvgJXLhY4i46VM3Qxe8yuYF1ElqBpg3jJVj/sCQnYz9dwoAMWIJFaDWOvmU2E7M
+MRaKx+sPXFkIjiDA6Bv0m+VHef7aedSYIY7IDltEQHuXoqNacGrYo3I50R+fZs88
+/mB3e/V7967e99D6565yf9Lcjw4oQf2Hy7kl/6P9AuMz0LODnGITwh2TKk/Zo3RU
+Vgq25RDrT4xJK6nFHyjUF6+4cOBxVpimmFw/VP1zaXT8DN5r4HyJ9p4YuSK8ha5N
+2pJc/exvU8Nv2+vS/efcDZWyuEdZ7eh1IJWQZlOZKIAONfRDRTpeQHJ3zzv3QVYy
+t78pYp/eWBHyVIfEE8p2lFKD4279WYe+Uvdb8c4Jm4TJwqkSJV8ifID7Ub80Lsir
+lPAU3OCVTBeVRFPXT2zpC4PB4W6KBSuj6OOcEu2y/HgWcoi7Cnjvp0vFTUhDFdus
+Wz3ucmJjfVsrkEO6avDKu4SwdbVHsk30TVAwPd6srIdi9U6MOeOQSOSE4EsrrS7l
+SVmu2QIDUVFpm8QAHYplkyWIyGkupyl3ashH9mokQhixIU/Pzir0byePxHLHrwLu
+1axqeKpI0F5SBUPsaVNYY2uNFg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECDCCAvCgAwIBAgIQCREfzzVyDTMcNME+gWnTCTANBgkqhkiG9w0BAQsFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yMTA1MjQyMDQyMzNaGA8yMDYxMDUyNDIxNDIzM1ow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDL
+1MT6br3L/4Pq87DPXtcjlXN3cnbNk2YqRAZHJayStTz8VtsFcGPJOpk14geRVeVk
+e9uKFHRbcyr/RM4owrJTj5X4qcEuATYZbo6ou/rW2kYzuWFZpFp7lqm0vasV4Z9F
+fChlhwkNks0UbM3G+psCSMNSoF19ERunj7w2c4E62LwujkeYLvKGNepjnaH10TJL
+2krpERd+ZQ4jIpObtRcMH++bTrvklc+ei8W9lqrVOJL+89v2piN3Ecdd389uphst
+qQdb1BBVXbhUrtuGHgVf7zKqN1SkCoktoWxVuOprVWhSvr7akaWeq0UmlvbEsujU
+vADqxGMcJFyCzxx3CkJjAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFFk8UJmlhoxFT3PP12PvhvazHjT4MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG
+9w0BAQsFAAOCAQEAfFtr2lGoWVXmWAsIo2NYre7kzL8Xb9Tx7desKxCCz5HOOvIr
+8JMB1YK6A7IOvQsLJQ/f1UnKRh3X3mJZjKIywfrMSh0FiDf+rjcEzXxw2dGtUem4
+A+WMvIA3jwxnJ90OQj5rQ8bg3iPtE6eojzo9vWQGw/Vu48Dtw1DJo9210Lq/6hze
+hPhNkFh8fMXNT7Q1Wz/TJqJElyAQGNOXhyGpHKeb0jHMMhsy5UNoW5hLeMS5ffao
+TBFWEJ1gVfxIU9QRxSh+62m46JIg+dwDlWv8Aww14KgepspRbMqDuaM2cinoejv6
+t3dyOyHHrsOyv3ffZUKtQhQbQr+sUcL89lARsg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/jCCAuagAwIBAgIQSDZkikDRk3Yz12jYvk5noDANBgkqhkiG9w0BAQsFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIGFwLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjUwMjAxMDAxMDIxWhgPMjA2NTAyMDEwMTEwMjFaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgYXAtZWFzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKF7hTKGtJjPxPd5
+3reviptmh3QhN9tmcff4AIzU53BowyCGPgLJvw0JRSm4rgfDZAQ2rqQPbnWP9UBW
+dZED3axk2bLWL6fddURHR5ckdb/Lv0NuNG/vdrG7l2V1jBasZNqAEVtASovdEHPX
+Razz3DTedOSSKUttdJZtL4XbVLUMkB3YaT8a1UagQnuKO1pRiy9lvRUdP6hlhFW9
+qGduF/ZsTpFfxHp8VhOpAnMhwd4qHik8GLXdB9ajeKko84MU3tQn52GS4zvXWwY9
+dxeC0QjDcK2dG8m/43e01yDAonaVJPI3R849aNtiBA4U+8au0CNva5n6WNI5LQIO
+XZmp5D8CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUg6d1N4oJ
+YOE1eAtYJexRSiFCpXEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB
+AQAOOBaSlMo+jhgz0ADaFuvFyaI+EVDB9GFT1TLpAmEK0gfNDI/RlY/n7hSKHJj0
+1ZeGfJ+9THD78QBuK7VyYlUkngYDdvEpg45ZEVKWGUtUmrhkikSsa5N8vioE3xg9
+MeSfgP98ykXVQH1kLSTUhLku8aLkwRdK96kSIKHRMUy41A9lK20X9Rc1dSsFJ/qe
+TUFGCxwurKwR6geC+cw8aNjXHZlHZGNJPS+gRTizN1WYjEtJkjd5kQeNPgyppX26
+kRB9Vh54WJNIrs8PB9JsX9exu8f8m3hg5FFZONH5iBg0gdEMvbePP7JsjZD5BbjU
+5C26Juxnw77pZbi0m7m3cmxL
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAIJLTMpzGNxqHZ4t+c1MlCIwDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBhcC1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNTIxMzAzM1oYDzIwNjEwNTI1MjIzMDMzWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGFwLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtdHut0ZhJ9Nn2
+MpVafFcwHdoEzx06okmmhjJsNy4l9QYVeh0UUoek0SufRNMRF4d5ibzpgZol0Y92
+/qKWNe0jNxhEj6sXyHsHPeYtNBPuDMzThfbvsLK8z7pBP7vVyGPGuppqW/6m4ZBB
+lcc9fsf7xpZ689iSgoyjiT6J5wlVgmCx8hFYc/uvcRtfd8jAHvheug7QJ3zZmIye
+V4htOW+fRVWnBjf40Q+7uTv790UAqs0Zboj4Yil+hER0ibG62y1g71XcCyvcVpto
+2/XW7Y9NCgMNqQ7fGN3wR1gjtSYPd7DO32LTzYhutyvfbpAZjsAHnoObmoljcgXI
+QjfBcCFpAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJI3aWLg
+CS5xqU5WYVaeT5s8lpO0MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAUwATpJOcGVOs3hZAgJwznWOoTzOVJKfrqBum7lvkVH1vBwxBl9CahaKj3ZOt
+YYp2qJzhDUWludL164DL4ZjS6eRedLRviyy5cRy0581l1MxPWTThs27z+lCC14RL
+PJZNVYYdl7Jy9Q5NsQ0RBINUKYlRY6OqGDySWyuMPgno2GPbE8aynMdKP+f6G/uE
+YHOf08gFDqTsbyfa70ztgVEJaRooVf5JJq4UQtpDvVswW2reT96qi6tXPKHN5qp3
+3wI0I1Mp4ePmiBKku2dwYzPfrJK/pQlvu0Gu5lKOQ65QdotwLAAoaFqrf9za1yYs
+INUkHLWIxDds+4OHNYcerGp5Dw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtzCCAj2gAwIBAgIQc48r2iRBCPPCj3oRSgZxujAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTI0MDkxMjE1NTQ0MFoYDzIxMjQwOTEyMTY1NDQwWjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEVSBo1+i/T9w0C7C1qdnl
+DfUXpFa+x4QYZvwLtt6m9L96k5irB7Wlw5168uTBW/ssRbv067PBnQEdZfI3iLKK
+xWSpDFZN11tRneyDXag/fj1MCzBQ25WG+BitQdbzzuYuo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBTiqTOsp/NisMSxMzARIGIKFcol4TAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAJlFgjECsVieUHNKE2Cmbj1wujERebHM
+YNqCdnO//DeQ6Rh4SJkNaWB9LRmrmsdvIwIwf2iyQNetoO2JWNt7gzdRjO+7dF2+
+/LdagQCVp4R2N1Q6xzttRqZEK0lyAd0t7wlX
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAIO6ldra1KZvNWJ0TA1ihXEwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIxMjE0NTA1WhgPMjEyMTA1MjEyMjQ1MDVa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+sDN52Si9pFSyZ1ruh3xAN0nVqEs960o2IK5CPu/ZfshFmzAwnx/MM8EHt/jMeZtj
+SM58LADAsNDL01ELpFZATjgZQ6xNAyXRXE7RiTRUvNkK7O3o2qAGbLnJq/UqF7Sw
+LRnB8V6hYOv+2EjVnohtGCn9SUFGZtYDjWXsLd4ML4Zpxv0a5LK7oEC7AHzbUR7R
+jsjkrXqSv7GE7bvhSOhMkmgxgj1F3J0b0jdQdtyyj109aO0ATUmIvf+Bzadg5AI2
+A9UA+TUcGeebhpHu8AP1Hf56XIlzPpaQv3ZJ4vzoLaVNUC7XKzAl1dlvCl7Klg/C
+84qmbD/tjZ6GHtzpLKgg7kQEV7mRoXq8X4wDX2AFPPQl2fv+Kbe+JODqm5ZjGegm
+uskABBi8IFv1hYx9jEulZPxC6uD/09W2+niFm3pirnlWS83BwVDTUBzF+CooUIMT
+jhWkIIZGDDgMJTzouBHfoSJtS1KpUZi99m2WyVs21MNKHeWAbs+zmI6TO5iiMC+T
+uB8spaOiHFO1573Fmeer4sy3YA6qVoqVl6jjTQqOdy3frAMbCkwH22/crV8YA+08
+hLeHXrMK+6XUvU+EtHAM3VzcrLbuYJUI2XJbzTj5g0Eb8I8JWsHvWHR5K7Z7gceR
+78AzxQmoGEfV6KABNWKsgoCQnfb1BidDJIe3BsI0A6UCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUABp0MlB14MSHgAcuNSOhs3MOlUcwDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCv4CIOBSQi/QR9NxdRgVAG/pAh
+tFJhV7OWb/wqwsNKFDtg6tTxwaahdCfWpGWId15OUe7G9LoPiKiwM9C92n0ZeHRz
+4ewbrQVo7Eu1JI1wf0rnZJISL72hVYKmlvaWaacHhWxvsbKLrB7vt6Cknxa+S993
+Kf8i2Psw8j5886gaxhiUtzMTBwoDWak8ZaK7m3Y6C6hXQk08+3pnIornVSFJ9dlS
+PAqt5UPwWmrEfF+0uIDORlT+cvrAwgSp7nUF1q8iasledycZ/BxFgQqzNwnkBDwQ
+Z/aM52ArGsTzfMhkZRz9HIEhz1/0mJw8gZtDVQroD8778h8zsx2SrIz7eWQ6uWsD
+QEeSWXpcheiUtEfzkDImjr2DLbwbA23c9LoexUD10nwohhoiQQg77LmvBVxeu7WU
+E63JqaYUlOLOzEmNJp85zekIgR8UTkO7Gc+5BD7P4noYscI7pPOL5rP7YLg15ZFi
+ega+G53NTckRXz4metsd8XFWloDjZJJq4FfD60VuxgXzoMNT9wpFTNSH42PR2s9L
+I1vcl3w8yNccs9se2utM2nLsItZ3J0m/+QSRiw9hbrTYTcM9sXki0DtH2kyIOwYf
+lOrGJDiYOIrXSQK36H0gQ+8omlrUTvUj4msvkXuQjlfgx6sgp2duOAfnGxE7uHnc
+UhnJzzoe6M+LfGHkVQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICuDCCAj2gAwIBAgIQSAG6j2WHtWUUuLGJTPb1nTAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLW5vcnRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMDE2MzgyNloYDzIxMjEwNTIwMTczODI2WjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLW5vcnRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE2eqwU4FOzW8RV1W381Bd
+olhDOrqoMqzWli21oDUt7y8OnXM/lmAuOS6sr8Nt61BLVbONdbr+jgCYw75KabrK
+ZGg3siqvMOgabIKkKuXO14wtrGyGDt7dnKXg5ERGYOZlo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBS1Acp2WYxOcblv5ikZ3ZIbRCCW+zAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAJL84J08PBprxmsAKPTotBuVI3MyW1r8
+xQ0i8lgCQUf8GcmYjQ0jI4oZyv+TuYJAcwIxAP9Xpzq0Docxb+4N1qVhpiOfWt1O
+FnemFiy9m1l+wv6p3riQMPV7mBVpklmijkIv3Q==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRALZLcqCVIJ25maDPE3sbPCIwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIxMjEzOTM5WhgPMjA2MTA1MjEyMjM5Mzla
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+ypKc+6FfGx6Gl6fQ78WYS29QoKgQiur58oxR3zltWeg5fqh9Z85K5S3UbRSTqWWu
+Xcfnkz0/FS07qHX+nWAGU27JiQb4YYqhjZNOAq8q0+ptFHJ6V7lyOqXBq5xOzO8f
++0DlbJSsy7GEtJp7d7QCM3M5KVY9dENVZUKeJwa8PC5StvwPx4jcLeZRJC2rAVDG
+SW7NAInbATvr9ssSh03JqjXb+HDyywiqoQ7EVLtmtXWimX+0b3/2vhqcH5jgcKC9
+IGFydrjPbv4kwMrKnm6XlPZ9L0/3FMzanXPGd64LQVy51SI4d5Xymn0Mw2kMX8s6
+Nf05OsWcDzJ1n6/Q1qHSxQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBRmaIc8eNwGP7i6P7AJrNQuK6OpFzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAIBeHfGwz3S2zwIUIpqEEI5/sMySDeS+3nJR+woWAHeO0C8i
+BJdDh+kzzkP0JkWpr/4NWz84/IdYo1lqASd1Kopz9aT1+iROXaWr43CtbzjXb7/X
+Zv7eZZFC8/lS5SROq42pPWl4ekbR0w8XGQElmHYcWS41LBfKeHCUwv83ATF0XQ6I
+4t+9YSqZHzj4vvedrvcRInzmwWJaal9s7Z6GuwTGmnMsN3LkhZ+/GD6oW3pU/Pyh
+EtWqffjsLhfcdCs3gG8x9BbkcJPH5aPAVkPn4wc8wuXg6xxb9YGsQuY930GWTYRf
+schbgjsuqznW4HHakq4WNhs1UdTSTKkRdZz7FUQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEDzCCAvegAwIBAgIRAM2zAbhyckaqRim63b+Tib8wDQYJKoZIhvcNAQELBQAw
+gZ8xCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE4MDYGA1UEAwwv
+QW1hem9uIFJEUyBQcmV2aWV3IHVzLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzEx
+EDAOBgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjA0OTQ1WhgPMjA2MTA1MTgyMTQ5
+NDVaMIGfMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNl
+cywgSW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExODA2BgNV
+BAMML0FtYXpvbiBSRFMgUHJldmlldyB1cy1lYXN0LTIgUm9vdCBDQSBSU0EyMDQ4
+IEcxMRAwDgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA1ybjQMH1MkbvfKsWJaCTXeCSN1SG5UYid+Twe+TjuSqaXWonyp4WRR5z
+tlkqq+L2MWUeQQAX3S17ivo/t84mpZ3Rla0cx39SJtP3BiA2BwfUKRjhPwOjmk7j
+3zrcJjV5k1vSeLNOfFFSlwyDiVyLAE61lO6onBx+cRjelu0egMGq6WyFVidTdCmT
+Q9Zw3W6LTrnPvPmEyjHy2yCHzH3E50KSd/5k4MliV4QTujnxYexI2eR8F8YQC4m3
+DYjXt/MicbqA366SOoJA50JbgpuVv62+LSBu56FpzY12wubmDZsdn4lsfYKiWxUy
+uc83a2fRXsJZ1d3whxrl20VFtLFHFQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBRC0ytKmDYbfz0Bz0Psd4lRQV3aNTAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQELBQADggEBAGv8qZu4uaeoF6zsbumauz6ea6tdcWt+hGFuwGrb
+tRbI85ucAmVSX06x59DJClsb4MPhL1XmqO3RxVMIVVfRwRHWOsZQPnXm8OYQ2sny
+rYuFln1COOz1U/KflZjgJmxbn8x4lYiTPZRLarG0V/OsCmnLkQLPtEl/spMu8Un7
+r3K8SkbWN80gg17Q8EV5mnFwycUx9xsTAaFItuG0en9bGsMgMmy+ZsDmTRbL+lcX
+Fq8r4LT4QjrFz0shrzCwuuM4GmcYtBSxlacl+HxYEtAs5k10tmzRf6OYlY33tGf6
+1tkYvKryxDPF/EDgGp/LiBwx6ixYMBfISoYASt4V/ylAlHA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtTCCAjqgAwIBAgIRAK9BSZU6nIe6jqfODmuVctYwCgYIKoZIzj0EAwMwgZkx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h
+em9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTIxMjIxMzA5WhgPMjEyMTA1MjEyMzEzMDlaMIGZMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv
+biBSRFMgY2EtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUkEERcgxneT5H+P+fERcbGmf
+bVx+M7rNWtgWUr6w+OBENebQA9ozTkeSg4c4M+qdYSObFqjxITdYxT1z/nHz1gyx
+OKAhLjWu+nkbRefqy3RwXaWT680uUaAP6ccnkZOMo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBSN6fxlg0s5Wny08uRBYZcQ3TUoyzAOBgNVHQ8BAf8EBAMC
+AYYwCgYIKoZIzj0EAwMDaQAwZgIxAORaz+MBVoFBTmZ93j2G2vYTwA6T5hWzBWrx
+CrI54pKn5g6At56DBrkjrwZF5T1enAIxAJe/LZ9xpDkAdxDgGJFN8gZYLRWc0NRy
+Rb4hihy5vj9L+w9uKc9VfEBIFuhT7Z3ljg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQB/57HSuaqUkLaasdjxUdPjANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE3NDAzNFoYDzIwNjEwNTE5MTg0MDM0WjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbkaoVsUS76o
+TgLFmcnaB8cswBk1M3Bf4IVRcwWT3a1HeJSnaJUqWHCJ+u3ip/zGVOYl0gN1MgBb
+MuQRIJiB95zGVcIa6HZtx00VezDTr3jgGWRHmRjNVCCHGmxOZWvJjsIE1xavT/1j
+QYV/ph4EZEIZ/qPq7e3rHohJaHDe23Z7QM9kbyqp2hANG2JtU/iUhCxqgqUHNozV
+Zd0l5K6KnltZQoBhhekKgyiHqdTrH8fWajYl5seD71bs0Axowb+Oh0rwmrws3Db2
+Dh+oc2PwREnjHeca9/1C6J2vhY+V0LGaJmnnIuOANrslx2+bgMlyhf9j0Bv8AwSi
+dSWsobOhNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQb7vJT
+VciLN72yJGhaRKLn6Krn2TAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAAxEj8N9GslReAQnNOBpGl8SLgCMTejQ6AW/bapQvzxrZrfVOZOYwp/5oV0f
+9S1jcGysDM+DrmfUJNzWxq2Y586R94WtpH4UpJDGqZp+FuOVJL313te4609kopzO
+lDdmd+8z61+0Au93wB1rMiEfnIMkOEyt7D2eTFJfJRKNmnPrd8RjimRDlFgcLWJA
+3E8wca67Lz/G0eAeLhRHIXv429y8RRXDtKNNz0wA2RwURWIxyPjn1fHjA9SPDkeW
+E1Bq7gZj+tBnrqz+ra3yjZ2blss6Ds3/uRY6NYqseFTZWmQWT7FolZEnT9vMUitW
+I0VynUbShVpGf6946e0vgaaKw20=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/jCCAuagAwIBAgIQGyUVTaVjYJvWhroVEiHPpDANBgkqhkiG9w0BAQsFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIHVzLXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTE5MTkwNDA2WhgPMjA2MTA1MTkyMDA0MDZaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgdXMtd2VzdC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANhyXpJ0t4nigRDZ
+EwNtFOem1rM1k8k5XmziHKDvDk831p7QsX9ZOxl/BT59Pu/P+6W6SvasIyKls1sW
+FJIjFF+6xRQcpoE5L5evMgN/JXahpKGeQJPOX9UEXVW5B8yi+/dyUitFT7YK5LZA
+MqWBN/LtHVPa8UmE88RCDLiKkqiv229tmwZtWT7nlMTTCqiAHMFcryZHx0pf9VPh
+x/iPV8p2gBJnuPwcz7z1kRKNmJ8/cWaY+9w4q7AYlAMaq/rzEqDaN2XXevdpsYAK
+TMMj2kji4x1oZO50+VPNfBl5ZgJc92qz1ocF95SAwMfOUsP8AIRZkf0CILJYlgzk
+/6u6qZECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm5jfcS9o
++LwL517HpB6hG+PmpBswDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB
+AQAcQ6lsqxi63MtpGk9XK8mCxGRLCad51+MF6gcNz6i6PAqhPOoKCoFqdj4cEQTF
+F8dCfa3pvfJhxV6RIh+t5FCk/y6bWT8Ls/fYKVo6FhHj57bcemWsw/Z0XnROdVfK
+Yqbc7zvjCPmwPHEqYBhjU34NcY4UF9yPmlLOL8uO1JKXa3CAR0htIoW4Pbmo6sA4
+6P0co/clW+3zzsQ92yUCjYmRNeSbdXbPfz3K/RtFfZ8jMtriRGuO7KNxp8MqrUho
+HK8O0mlSUxGXBZMNicfo7qY8FD21GIPH9w5fp5oiAl7lqFzt3E3sCLD3IiVJmxbf
+fUwpGd1XZBBSdIxysRLM6j48
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrTCCAjOgAwIBAgIQU+PAILXGkpoTcpF200VD/jAKBggqhkjOPQQDAzCBljEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6
+b24gUkRTIGFwLWVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTAgFw0yMTA1MjUyMTQ1MTFaGA8yMTIxMDUyNTIyNDUxMVowgZYxCzAJBgNV
+BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD
+VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE
+UyBhcC1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAAT3tFKE8Kw1sGQAvNLlLhd8OcGhlc7MiW/s
+NXm3pOiCT4vZpawKvHBzD76Kcv+ZZzHRxQEmG1/muDzZGlKR32h8AAj+NNO2Wy3d
+CKTtYMiVF6Z2zjtuSkZQdjuQbe4eQ7qjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFAiSQOp16Vv0Ohpvqcbd2j5RmhYNMA4GA1UdDwEB/wQEAwIBhjAKBggq
+hkjOPQQDAwNoADBlAjBVsi+5Ape0kOhMt/WFkANkslD4qXA5uqhrfAtH29Xzz2NV
+tR7akiA771OaIGB/6xsCMQCZt2egCtbX7J0WkuZ2KivTh66jecJr5DHvAP4X2xtS
+F/5pS+AUhcKTEGjI9jDH3ew=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICuDCCAj2gAwIBAgIQT5mGlavQzFHsB7hV6Mmy6TAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNDIwNTAxNVoYDzIxMjEwNTI0MjE1MDE1WjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEcm4BBBjYK7clwm0HJRWS
+flt3iYwoJbIXiXn9c1y3E+Vb7bmuyKhS4eO8mwO4GefUcXObRfoHY2TZLhMJLVBQ
+7MN2xDc0RtZNj07BbGD3VAIFRTDX0mH9UNYd0JQM3t/Oo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRrd5ITedfAwrGo4FA9UaDaGFK3rjAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAPBNqmVv1IIA3EZyQ6XuVf4gj79/DMO8
+bkicNS1EcBpUqbSuU4Zwt2BYc8c/t7KVOQIxAOHoWkoKZPiKyCxfMtJpCZySUG+n
+sXgB/LOyWE5BJcXUfm+T1ckeNoWeUUMOLmnJjg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRAJcDeinvdNrDQBeJ8+t38WQwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNCBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjIwNTI1MTY0OTE2WhgPMjA2MjA1MjUxNzQ5MTZa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTQgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+k8DBNkr9tMoIM0NHoFiO7cQfSX0cOMhEuk/CHt0fFx95IBytx7GHCnNzpM27O5z6
+x6iRhfNnx+B6CrGyCzOjxvPizneY+h+9zfvNz9jj7L1I2uYMuiNyOKR6FkHR46CT
+1CiArfVLLPaTqgD/rQjS0GL2sLHS/0dmYipzynnZcs613XT0rAWdYDYgxDq7r/Yi
+Xge5AkWQFkMUq3nOYDLCyGGfQqWKkwv6lZUHLCDKf+Y0Uvsrj8YGCI1O8mF0qPCQ
+lmlfaDvbuBu1AV+aabmkvyFj3b8KRIlNLEtQ4N8KGYR2Jdb82S4YUGIOAt4wuuFt
+1B7AUDLk3V/u+HTWiwfoLQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBSNpcjz6ArWBtAA+Gz6kyyZxrrgdDAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAGJEd7UgOzHYIcQRSF7nSYyjLROyalaIV9AX4WXW/Cqlul1c
+MblP5etDZm7A/thliZIWAuyqv2bNicmS3xKvNy6/QYi1YgxZyy/qwJ3NdFl067W0
+t8nGo29B+EVK94IPjzFHWShuoktIgp+dmpijB7wkTIk8SmIoe9yuY4+hzgqk+bo4
+ms2SOXSN1DoQ75Xv+YmztbnZM8MuWhL1T7hA4AMorzTQLJ9Pof8SpSdMHeDsHp0R
+01jogNFkwy25nw7cL62nufSuH2fPYGWXyNDg+y42wKsKWYXLRgUQuDVEJ2OmTFMB
+T0Vf7VuNijfIA9hkN2d3K53m/9z5WjGPSdOjGhg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/jCCAuagAwIBAgIQRiwspKyrO0xoxDgSkqLZczANBgkqhkiG9w0BAQsFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIHVzLXdlc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTI0MjE1OTAwWhgPMjA2MTA1MjQyMjU5MDBaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgdXMtd2VzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL53Jk3GsKiu+4bx
+jDfsevWbwPCNJ3H08Zp7GWhvI3Tgi39opfHYv2ku2BKFjK8N2L6RvNPSR8yplv5j
+Y0tK0U+XVNl8o0ibhqRDhbTuh6KL8CFINWYzAajuxFS+CF0U6c1Q3tXLBdALxA7l
+FlXJ71QrP06W31kRe7kvgrvO7qWU3/OzUf9qYw4LSiR1/VkvvRCTqcVNw09clw/M
+Jbw6FSgweN65M9j7zPbjGAXSHkXyxH1Erin2fa+B9PE4ZDgX9cp2C1DHewYJQL/g
+SepwwcudVNRN1ibKH7kpMrgPnaNIVNx5sXVsTjk6q2ZqYw3SVHegltJpLy/cZReP
+mlivF2kCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUmTcQd6o1
+CuS65MjBrMwQ9JJjmBwwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB
+AQAKSDSIzl956wVddPThf2VAzI8syw9ngSwsEHZvxVGHBvu5gg618rDyguVCYX9L
+4Kw/xJrk6S3qxOS2ZDyBcOpsrBskgahDFIunzoRP3a18ARQVq55LVgfwSDQiunch
+Bd05cnFGLoiLkR5rrkgYaP2ftn3gRBRaf0y0S3JXZ2XB3sMZxGxavYq9mfiEcwB0
+LMTMQ1NYzahIeG6Jm3LqRqR8HkzP/Ztq4dT2AtSLvFebbNMiWqeqT7OcYp94HTYT
+zqrtaVdUg9bwyAUCDgy0GV9RHDIdNAOInU/4LEETovrtuBU7Z1q4tcHXvN6Hd1H8
+gMb0mCG5I393qW5hFsA/diFb
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAIgSQsm7XtddDiXpo3j09qYwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNyBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjQwOTEyMTU1NDM2WhgPMjEyNDA5MTIxNjU0MzZa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTcgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+jLfyuFmUeGd3WSDotJVQ+XjY20Yt75KWDFjXNLNZ7+/97RshOjZ0M3dZ+CcKmIQz
+37vjb80kk0p+jeuaLxprWjc5kLJjaFZNPA8mxM/UmARvMvBRrO4uRRRQvYFyXqi+
+Frsl46t/+nyarL09ICx/1reZIzsOsI9BcDM0CK1hqQSwrIjOK2mXuHVfrufXjLnR
+wZA2rOonQJJAXgOo1RvD11xmOUUIglP2ljAZZskxL+zU8d5k9Ed4HkGsOY3ywbP0
+/E+Fd33Gli3EF01wAbIaZL0vuW2rW4oxjh8QW7O7Sfnsr9fdNU2Tye1jSCxle5e3
+2Sfq+0Iw5TiT0KYTmcpcKzvljd1wwHdiNKeo7ZCVIer/lGl62PoAb2NWeLepk0IO
+IwTZ+Dq76hs9XZJbYxWhXpVcT31b9e3++jROMPz7Mzi/wMg+RBWXgjDuuj1Z16sF
+MFfK6QEmD8SOKL3GAKn7PBQxZea+j6iF7G1nGz1/Wfvzz7I8DocnAmQZabKzEnpR
+LTEU2LZ86pkeLkM3uI9jm/VWeV4xLv/dC7trDkTUSHpJ4J5/ItMecdAlhCEJ2qM2
+x46OUbGYsf9gvacLkqQoS/XFL8R4bxR01URlHU+98yfODBCehulmnKOz3dQOth2c
+sF9v2spYG2gmY3jg7N8suvPbzYKWmL7pVCQtqVOZPkkCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUy2Eg468T4F9w7gg9AxeZBj+gjKYwDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCGLMyGrhwhqoDRtJ6gGx1SkJd4
+uxG3R4VFKS23JhDJKoDISjcCrVQu5Z3xSj157HmDnc/TEHgW/t1y472QOagzN2RD
+9xgFBGfU1sHxKX79WBSf93L3alM+oE1tS+drDlBPV4gzxvCc+zvUYQKWjz/W6q9f
+bdrk16J2/yOyli3XpEqf1o4c9FVnAbi9c3zdugfARskwypo2LHDuo8z+u/Ab7j1y
+NZ8HtLg/hwVjfSoPLD8guYSZHXYn6ed7AmOUUJjlauWUfCCvU/F+Dk51JMLlVVK+
+y9ZgHXa8YDsGsCmpdgfC3MLSEVkx87mxj1rkFLI03q9i6L2BOWQtgd6NmvYd7pJx
+cqx6bmSh43CscGDEngIB50XWqXd4QlVKmPPgDnd55szfnNQzzG9q8I9KTEv+B/Ck
+apl2XxVAEUdb26Wi7RH+9Wms6HQeU4i7cDuWpm+EfZZmdjwvA4bs3Ox07SkenHqu
+Ti6RJf1PiHoE9SHiFUiBnd++YsNByjGqn4Vxla1MlVdkaUMlvvc3/9oky4KfcRdQ
+AK7L9cQqf7g6G4Ne5PNvosG3KaS009xSN1AAalTqS9eqrDYR2yZSixmUYqP57Jm5
+5ERI+pZi2aKpl0ONC7vKIyH+gxjsRPct4DKoxZnt4/KJYhINOlQz8i/j0jfqftmg
+G1bYpbRRbfWoGHjGJA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRAPQAvihfjBg/JDbj6U64K98wDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIwMTYyODQxWhgPMjA2MTA1MjAxNzI4NDFa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+vJ9lgyksCxkBlY40qOzI1TCj/Q0FVGuPL/Z1Mw2YN0l+41BDv0FHApjTUkIKOeIP
+nwDwpXTa3NjYbk3cOZ/fpH2rYJ++Fte6PNDGPgKppVCUh6x3jiVZ1L7wOgnTdK1Q
+Trw8440IDS5eLykRHvz8OmwvYDl0iIrt832V0QyOlHTGt6ZJ/aTQKl12Fy3QBLv7
+stClPzvHTrgWqVU6uidSYoDtzHbU7Vda7YH0wD9IUoMBf7Tu0rqcE4uH47s2XYkc
+SdLEoOg/Ngs7Y9B1y1GCyj3Ux7hnyvCoRTw014QyNB7dTatFMDvYlrRDGG14KeiU
+UL7Vo/+EejWI31eXNLw84wIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBQkgTWFsNg6wA3HbbihDQ4vpt1E2zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAGz1Asiw7hn5WYUj8RpOCzpE0h/oBZcnxP8wulzZ5Xd0YxWO
+0jYUcUk3tTQy1QvoY+Q5aCjg6vFv+oFBAxkib/SmZzp4xLisZIGlzpJQuAgRkwWA
+6BVMgRS+AaOMQ6wKPgz1x4v6T0cIELZEPq3piGxvvqkcLZKdCaeC3wCS6sxuafzZ
+4qA3zMwWuLOzRftgX2hQto7d/2YkRXga7jSvQl3id/EI+xrYoH6zIWgjdU1AUaNq
+NGT7DIo47vVMfnd9HFZNhREsd4GJE83I+JhTqIxiKPNxrKgESzyADmNPt0gXDnHo
+tbV1pMZz5HpJtjnP/qVZhEK5oB0tqlKPv9yx074=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICuTCCAj6gAwIBAgIRAKp1Rn3aL/g/6oiHVIXtCq8wCgYIKoZIzj0EAwMwgZsx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h
+em9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MjQyMDMyMTdaGA8yMTIxMDUyNDIxMzIxN1owgZsx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h
+em9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGTYWPILeBJXfcL3Dz4z
+EWMUq78xB1HpjBwHoTURYfcMd5r96BTVG6yaUBWnAVCMeeD6yTG9a1eVGNhG14Hk
+ZAEjgLiNB7RRbEG5JZ/XV7W/vODh09WCst2y9SLKsdgeAaNCMEAwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUoE0qZHmDCDB+Bnm8GUa/evpfPwgwDgYDVR0PAQH/
+BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCnil5MMwhY3qoXv0xvcKZGxGPaBV15
+0CCssCKn0oVtdJQfJQ3Jrf3RSaEyijXIJsoCMQC35iJi4cWoNX3N/qfgnHohW52O
+B5dg0DYMqy5cNZ40+UcAanRMyqNQ6P7fy3umGco=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtzCCAj2gAwIBAgIQPXnDTPegvJrI98qz8WxrMjAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxODIxNDAxMloYDzIxMjEwNTE4MjI0MDEyWjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEI0sR7gwutK5AB46hM761
+gcLTGBIYlURSEoM1jcBwy56CL+3CJKZwLLyJ7qoOKfWbu5GsVLUTWS8MV6Nw33cx
+2KQD2svb694wi+Px2f4n9+XHkEFQw8BbiodDD7RZA70fo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBTQSioOvnVLEMXwNSDg+zgln/vAkjAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAMwu1hqm5Bc98uE/E0B5iMYbBQ4kpMxO
+tP8FTfz5UR37HUn26nXE0puj6S/Ffj4oJgIwXI7s2c26tFQeqzq6u3lrNJHp5jC9
+Uxlo/hEJOLoDj5jnpxo8dMAtCNoQPaHdfL0P
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/jCCA+agAwIBAgIQEM1pS+bWfBJeu/6j1yIIFzANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIGNhLXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjMwOTE5MjIwMTM5WhgPMjEyMzA5MTkyMzAxMzlaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgY2Etd2VzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Pyp8p5z6HnlGB
+daOj78gZ3ABufxnBFiu5NdFiGoMrS+eY//xxr2iKbnynJAzjmn5A6VKMNxtbuYIZ
+WKAzDb/HrWlIYD2w7ZVBXpylfPhiz3jLNsl03WdPNnEruCcivhY2QMewEVtzjPU0
+ofdbZlO2KpF3biv1gjPuIuE7AUyQAbWnWTlrzETAVWLboJJRRqxASSkFUHNLXod7
+ow02FwlAhcnCp9gSe1SKRDrpvvEvYQBAFB7owfnoQzOGDdd87RGyYfyuW8aFI2Z0
+LHNvsA0dTafO4Rh986c72kDL7ijICQdr5OTgZR2OnuESLk1DSK4xYJ4fA6jb5dJ5
++xsI6tCPykWCW98aO/pha35OsrVNifL/5cH5pdv/ecgQGdffJB+Vdj6f/ZMwR6s/
+Rm37cQ9l3tU8eu/qpzsFjLq1ZUzDaVDWgMW9t49+q/zjhdmbPOabZDao7nHXrVRw
+rwPHWCmEY4OmH6ikEKQW3AChFjOdSg4me/J0Jr5l5jKggLPHWbNLRO8qTTK6N8qk
+ui3aJDi+XQfsTPARXIw4UFErArNImTsoZVyqfX7I4shp0qZbEhP6kRAbfPljw5kW
+Yat7ZlXqDanjsreqbLTaOU10P0rC0/4Ctv5cLSKCrzRLWtpXxhKa2wJTQ74G6fAZ
+1oUA79qg3F8nyM+ZzDsfNI854+PNAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFLRWiDabEQZNkzEPUCr1ZVJV6xpwMA4GA1UdDwEB/wQEAwIBhjAN
+BgkqhkiG9w0BAQwFAAOCAgEATkVVzkkGBjEtLGDtERi+fSpIV0MxwAsA4PAeBBmb
+myxo90jz6kWkKM1Wm4BkZM8/mq5VbxPef1kxHfb5CHksCL6SgG5KujfIvht+KT2a
+MRJB+III3CbcTy0HtwCX5AlPIbXWydhQFoJTW/OkpecUWoyFM6SqYeYZx1itJpxl
+sXshLjYOvw+QgvxRsDxqUfkcaC/N2yhu/30Zo2P8msJfAFry2UmA/TBrWOQKVQxl
+Ee/yWgp4U/bC/GZnjWnWDTwkRFGQtI4wjxbVuX6V4FTLCT7kIoHBhG+zOSduJRn3
+Axej7gkEXEVc/PAnwp/kSJ/b0/JONLWdjGUFkyiMn1yJlhJ2sg39vepBN5r6yVYU
+nJWoZAuupRpoIKfmC3/cZanXqYbYl4yxzX/PMB4kAACfdxGxLawjnnBjSzaWokXs
+YVh2TjWpUMwLOi0RB2mtPUjHdDLKtjOTZ1zHZnR/wVp9BmVI1BXYnz5PAqU5XqeD
+EmanyaAuFCeyol1EtbQhgtysThQ+vwYAXMm2iKzJxq0hik8wyG8X55FhnGEOGV3u
+xxq7odd3/8BXkc3dGdBPQtH+k5glaQyPnAsLVAIUvyzTmy58saL+nJnQY4mmRrwV
+1jJA7nnkaklI/L5fvfCg0W+TMinCOAGd+GQ4hK2SAsJLtcqiBgPf2wJHO8wiwUh9
+Luw=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjWgAwIBAgIQGKVv+5VuzEZEBzJ+bVfx2zAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTE5MTc1MDU5WhgPMjEyMTA1MTkxODUwNTlaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgYXAtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMqdLJ0tZF/DGFZTKZDrGRJZID8ivC2I
+JRCYTWweZKCKSCAzoiuGGHzJhr5RlLHQf/QgmFcgXsdmO2n3CggzhA4tOD9Ip7Lk
+P05eHd2UPInyPCHRgmGjGb0Z+RdQ6zkitKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUC1yhRgVqU5bR8cGzOUCIxRpl4EYwDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2cAMGQCMG0c/zLGECRPzGKJvYCkpFTCUvdP4J74YP0v/dPvKojL
+t/BrR1Tg4xlfhaib7hPc7wIwFvgqHes20CubQnZmswbTKLUrgSUW4/lcKFpouFd2
+t2/ewfi/0VhkeUW+IiHhOMdU
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAOXxJuyXVkbfhZCkS/dOpfEwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI1MjE1OTEwWhgPMjEyMTA1MjUyMjU5MTBa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+xiP4RDYm4tIS12hGgn1csfO8onQDmK5SZDswUpl0HIKXOUVVWkHNlINkVxbdqpqH
+FhbyZmNN6F/EWopotMDKe1B+NLrjNQf4zefv2vyKvPHJXhxoKmfyuTd5Wk8k1F7I
+lNwLQzznB+ElhrLIDJl9Ro8t31YBBNFRGAGEnxyACFGcdkjlsa52UwfYrwreEg2l
+gW5AzqHgjFfj9QRLydeU/n4bHm0F1adMsV7P3rVwilcUlqsENDwXnWyPEyv3sw6F
+wNemLEs1129mB77fwvySb+lLNGsnzr8w4wdioZ74co+T9z2ca+eUiP+EQccVw1Is
+D4Fh57IjPa6Wuc4mwiUYKkKY63+38aCfEWb0Qoi+zW+mE9nek6MOQ914cN12u5LX
+dBoYopphRO5YmubSN4xcBy405nIdSdbrAVWwxXnVVyjqjknmNeqQsPZaxAhdoKhV
+AqxNr8AUAdOAO6Sz3MslmcLlDXFihrEEOeUbpg/m1mSUUHGbu966ajTG1FuEHHwS
+7WB52yxoJo/tHvt9nAWnh3uH5BHmS8zn6s6CGweWKbX5yICnZ1QFR1e4pogxX39v
+XD6YcNOO+Vn+HY4nXmjgSYVC7l+eeP8eduMg1xJujzjrbmrXU+d+cBObgdTOAlpa
+JFHaGwYw1osAwPCo9cZ2f04yitBfj9aPFia8ASKldakCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUqKS+ltlior0SyZKYAkJ/efv55towDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQAdElvp8bW4B+Cv+1WSN87dg6TN
+wGyIjJ14/QYURgyrZiYpUmZpj+/pJmprSWXu4KNyqHftmaidu7cdjL5nCAvAfnY5
+/6eDDbX4j8Gt9fb/6H9y0O0dn3mUPSEKG0crR+JRFAtPhn/2FNvst2P82yguWLv0
+pHjHVUVcq+HqDMtUIJsTPYjSh9Iy77Q6TOZKln9dyDOWJpCSkiUWQtMAKbCSlvzd
+zTs/ahqpT+zLfGR1SR+T3snZHgQnbnemmz/XtlKl52NxccARwfcEEKaCRQyGq/pR
+0PVZasyJS9JY4JfQs4YOdeOt4UMZ8BmW1+BQWGSkkb0QIRl8CszoKofucAlqdPcO
+IT/ZaMVhI580LFGWiQIizWFskX6lqbCyHqJB3LDl8gJISB5vNTHOHpvpMOMs5PYt
+cRl5Mrksx5MKMqG7y5R734nMlZxQIHjL5FOoOxTBp9KeWIL/Ib89T2QDaLw1SQ+w
+ihqWBJ4ZdrIMWYpP3WqM+MXWk7WAem+xsFJdR+MDgOOuobVQTy5dGBlPks/6gpjm
+rO9TjfQ36ppJ3b7LdKUPeRfnYmlR5RU4oyYJ//uLbClI443RZAgxaCXX/nyc12lr
+eVLUMNF2abLX4/VF63m2/Z9ACgMRfqGshPssn1NN33OonrotQoj4S3N9ZrjvzKt8
+iHcaqd60QKpfiH2A3A==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrTCCAjOgAwIBAgIQOsXM3iPpLzFtjuRCpLsrlDAKBggqhkjOPQQDAzCBljEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6
+b24gUkRTIGFwLWVhc3QtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTAgFw0yNTAyMDEwMDEwMzFaGA8yMTI1MDIwMTAxMTAzMVowgZYxCzAJBgNV
+BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD
+VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE
+UyBhcC1lYXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ+7GUElCbaFRRjg6gT4QTBuontLCF4sLso
+/sHZ60qQI8SVEsDTF7C3zebh+VlNtPhgF1Le61HW86KlDQYf49pVN2guXBrdf3qb
+RQCwSHSKs4S2bMyRMZ6xjwoGOrEKFEKjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFKc0lLMy1OaSxQ+rtD7tyY3bFlv5MA4GA1UdDwEB/wQEAwIBhjAKBggq
+hkjOPQQDAwNoADBlAjEA5Rhu3YN+PyIHg3NXSw1DbowJIHNZgnieTD4BPkZLy4rs
+8le5S3JjQQGyh+bsJf7RAjBPUMBF4CJDLE5nmetgXLlOl3oXwd/gHTls7YDr+R18
+cTBI0+RV4Z6yT5p1OF9AcnA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICuDCCAj2gAwIBAgIQPaVGRuu86nh/ylZVCLB0MzAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLW5vcnRoZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNTIyMDMxNloYDzIxMjEwNTI1MjMwMzE2WjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLW5vcnRoZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEexNURoB9KE93MEtEAlJG
+obz4LS/pD2hc8Gczix1WhVvpJ8bN5zCDXaKdnDMCebetyRQsmQ2LYlfmCwpZwSDu
+0zowB11Pt3I5Avu2EEcuKTlKIDMBeZ1WWuOd3Tf7MEAMo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBSaYbZPBvFLikSAjpa8mRJvyArMxzAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAOEJkuh3Zjb7Ih/zuNRd1RBqmIYcnyw0
+nwUZczKXry+9XebYj3VQxSRNadrarPWVqgIxAMg1dyGoDAYjY/L/9YElyMnvHltO
+PwpJShmqHvCLc/mXMgjjYb/akK7yGthvW6j/uQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgIQChu3v5W1Doil3v6pgRIcVzANBgkqhkiG9w0BAQwFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yMTA1MTgyMTM0MTVaGA8yMTIxMDUxODIyMzQxNVow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBCZXRhIHVzLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1
+FUGQ5tf3OwpDR6hGBxhUcrkwKZhaXP+1St1lSOQvjG8wXT3RkKzRGMvb7Ee0kzqI
+mzKKe4ASIhtV3UUWdlNmP0EA3XKnif6N79MismTeGkDj75Yzp5A6tSvqByCgxIjK
+JqpJrch3Dszoyn8+XhwDxMZtkUa5nQVdJgPzJ6ltsQ8E4SWLyLtTu0S63jJDkqYY
+S7cQblk7y7fel+Vn+LS5dGTdRRhMvSzEnb6mkVBaVzRyVX90FNUED06e8q+gU8Ob
+htvQlf9/kRzHwRAdls2YBhH40ZeyhpUC7vdtPwlmIyvW5CZ/QiG0yglixnL6xahL
+pbmTuTSA/Oqz4UGQZv2WzHe1lD2gRHhtFX2poQZeNQX8wO9IcUhrH5XurW/G9Xwl
+Sat9CMPERQn4KC3HSkat4ir2xaEUrjfg6c4XsGyh2Pk/LZ0gLKum0dyWYpWP4JmM
+RQNjrInXPbMhzQObozCyFT7jYegS/3cppdyy+K1K7434wzQGLU1gYXDKFnXwkX8R
+bRKgx2pHNbH5lUddjnNt75+e8m83ygSq/ZNBUz2Ur6W2s0pl6aBjwaDES4VfWYlI
+jokcmrGvJNDfQWygb1k00eF2bzNeNCHwgWsuo3HSxVgc/WGsbcGrTlDKfz+g3ich
+bXUeUidPhRiv5UQIVCLIHpHuin3bj9lQO/0t6p+tAQIDAQABo0IwQDAPBgNVHRMB
+Af8EBTADAQH/MB0GA1UdDgQWBBSFmMBgm5IsRv3hLrvDPIhcPweXYTAOBgNVHQ8B
+Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAAa2EuozymOsQDJlEi7TqnyA2OhT
+GXPfYqCyMJVkfrqNgcnsNpCAiNEiZbb+8sIPXnT8Ay8hrwJYEObJ5b7MHXpLuyft
+z0Pu1oFLKnQxKjNxrIsCvaB4CRRdYjm1q7EqGhMGv76se9stOxkOqO9it31w/LoU
+ENDk7GLsSqsV1OzYLhaH8t+MaNP6rZTSNuPrHwbV3CtBFl2TAZ7iKgKOhdFz1Hh9
+Pez0lG+oKi4mHZ7ajov6PD0W7njn5KqzCAkJR6OYmlNVPjir+c/vUtEs0j+owsMl
+g7KE5g4ZpTRShyh5BjCFRK2tv0tkqafzNtxrKC5XNpEkqqVTCnLcKG+OplIEadtr
+C7UWf4HyhCiR+xIyxFyR05p3uY/QQU/5uza7GlK0J+U1sBUytx7BZ+Fo8KQfPPqV
+CqDCaYUksoJcnJE/KeoksyqNQys7sDGJhkd0NeUGDrFLKHSLhIwAMbEWnqGxvhli
+E7sP2E5rI/I9Y9zTbLIiI8pfeZlFF8DBdoP/Hzg8pqsiE/yiXSFTKByDwKzGwNqz
+F0VoFdIZcIbLdDbzlQitgGpJtvEL7HseB0WH7B2PMMD8KPJlYvPveO3/6OLzCsav
++CAkvk47NQViKMsUTKOA0JDCW+u981YRozxa3K081snhSiSe83zIPBz1ikldXxO9
+6YYLNPRrj3mi9T/f
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAMkvdFnVDb0mWWFiXqnKH68wCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyB1cy13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTE5MTkxMzI0WhgPMjEyMTA1MTkyMDEzMjRaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgdXMtd2VzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEy86DB+9th/0A5VcWqMSWDxIUblWTt/R0
+ao6Z2l3vf2YDF2wt1A2NIOGpfQ5+WAOJO/IQmnV9LhYo+kacB8sOnXdQa6biZZkR
+IyouUfikVQAKWEJnh1Cuo5YMM4E2sUt5o0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBQ8u3OnecANmG8OoT7KLWDuFzZwBTAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIwQ817qkb7mWJFnieRAN+m9W3E0FLVKaV3zC5aYJUk2fcZ
+TaUx3oLp3jPLGvY5+wgeAjEA6wAicAki4ZiDfxvAIuYiIe1OS/7H5RA++R8BH6qG
+iRzUBM/FItFpnkus7u/eTkvo
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrzCCAjWgAwIBAgIQS/+Ryfgb/IOVEa1pWoe8oTAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGFwLXNvdXRoLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjIwNjA2MjE1NDQyWhgPMjEyMjA2MDYyMjU0NDJaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgYXAtc291dGgtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDsX6fhdUWBQpYTdseBD/P3s96Dtw2Iw
+OrXKNToCnmX5nMkUGdRn9qKNiz1pw3EPzaPxShbYwQ7LYP09ENK/JN4QQjxMihxC
+jLFxS85nhBQQQGRCWikDAe38mD8fSvREQKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUIh1xZiseQYFjPYKJmGbruAgRH+AwDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2gAMGUCMFudS4zLy+UUGrtgNLtRMcu/DZ9BUzV4NdHxo0bkG44O
+thnjl4+wTKI6VbyAbj2rkgIxAOHps8NMITU5DpyiMnKTxV8ubb/WGHrLl0BjB8Lw
+ETVJk5DNuZvsIIcm7ykk6iL4Tw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBDCCA+ygAwIBAgIQDcEmNIAVrDpUw5cH5ynutDANBgkqhkiG9w0BAQwFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIG1lLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjIwNTA3MDA0MDIzWhgPMjEyMjA1MDcwMTQwMjNaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKvADk8t
+Fl9bFlU5sajLPPDSOUpPAkKs6iPlz+27o1GJC88THcOvf3x0nVAcu9WYe9Qaas+4
+j4a0vv51agqyODRD/SNi2HnqW7DbtLPAm6KBHe4twl28ItB/JD5g7u1oPAHFoXMS
+cH1CZEAs5RtlZGzJhcBXLFsHNv/7+SCLyZ7+2XFh9OrtgU4wMzkHoRNndhfwV5bu
+17bPTwuH+VxH37zXf1mQ/KjhuJos0C9dL0FpjYBAuyZTAWhZKs8dpSe4DI544z4w
+gkwUB4bC2nA1TBzsywEAHyNuZ/xRjNpWvx0ToWAA2iFJqC3VO3iKcnBplMvaUuMt
+jwzVSNBnKcoabXCZL2XDLt4YTZR8FSwz05IvsmwcPB7uNTBXq3T9sjejW8QQK3vT
+tzyfLq4jKmQE7PoS6cqYm+hEPm2hDaC/WP9bp3FdEJxZlPH26fq1b7BWYWhQ9pBA
+Nv9zTnzdR1xohTyOJBUFQ81ybEzabqXqVXUIANqIOaNcTB09/sLJ7+zuMhp3mwBu
+LtjfJv8PLuT1r63bU3seROhKA98b5KfzjvbvPSg3vws78JQyoYGbqNyDfyjVjg3U
+v//AdVuPie6PNtdrW3upZY4Qti5IjP9e3kimaJ+KAtTgMRG56W0WxD3SP7+YGGbG
+KhntDOkKsN39hLpn9UOafTIqFu7kIaueEy/NAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFHAems86dTwdZbLe8AaPy3kfIUVoMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAOBHpp0ICx81kmeoBcZTrMdJs2gnhcd85
+FoSCjXx9H5XE5rmN/lQcxxOgj8hr3uPuLdLHu+i6THAyzjrl2NA1FWiqpfeECGmy
+0jm7iZsYORgGQYp/VKnDrwnKNSqlZvOuRr0kfUexwFlr34Y4VmupvEOK/RdGsd3S
++3hiemcHse9ST/sJLHx962AWMkN86UHPscJEe4+eT3f2Wyzg6La8ARwdWZSNS+WH
+ZfybrncMmuiXuUdHv9XspPsqhKgtHhcYeXOGUtrwQPLe3+VJZ0LVxhlTWr9951GZ
+GfmWwTV/9VsyKVaCFIXeQ6L+gjcKyEzYF8wpMtQlSc7FFqwgC4bKxvMBSaRy88Nr
+lV2+tJD/fr8zGUeBK44Emon0HKDBWGX+/Hq1ZIv0Da0S+j6LbA4fusWxtGfuGha+
+luhHgVInCpALIOamiBEdGhILkoTtx7JrYppt3/Raqg9gUNCOOYlCvGhqX7DXeEfL
+DGabooiY2FNWot6h04JE9nqGj5QqT8D6t/TL1nzxhRPzbcSDIHUd/b5R+a0bAA+7
+YTU6JqzEVCWKEIEynYmqikgLMGB/OzWsgyEL6822QW6hJAQ78XpbNeCzrICF4+GC
+7KShLnwuWoWpAb26268lvOEvCTFM47VC6jNQl97md+2SA9Ma81C9wflid2M83Wle
+cuLMVcQZceE=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQAhAteLRCvizAElaWORFU2zANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMDE3MDkxNloYDzIwNjEwNTIwMTgwOTE2WjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+qg7JAcOVKjh
+N83SACnBFZPyB63EusfDr/0V9ZdL8lKcmZX9sv/CqoBo3N0EvBqHQqUUX6JvFb7F
+XrMUZ740kr28gSRALfXTFgNODjXeDsCtEkKRTkac/UM8xXHn+hR7UFRPHS3e0GzI
+iLiwQWDkr0Op74W8aM0CfaVKvh2bp4BI1jJbdDnQ9OKXpOxNHGUf0ZGb7TkNPkgI
+b2CBAc8J5o3H9lfw4uiyvl6Fz5JoP+A+zPELAioYBXDrbE7wJeqQDJrETWqR9VEK
+BXURCkVnHeaJy123MpAX2ozf4pqk0V0LOEOZRS29I+USF5DcWr7QIXR/w2I8ws1Q
+7ys+qbE+kQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQFJ16n
+1EcCMOIhoZs/F9sR+Jy++zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAOc5nXbT3XTDEZsxX2iD15YrQvmL5m13B3ImZWpx/pqmObsgx3/dg75rF2nQ
+qS+Vl+f/HLh516pj2BPP/yWCq12TRYigGav8UH0qdT3CAClYy2o+zAzUJHm84oiB
+ud+6pFVGkbqpsY+QMpJUbZWu52KViBpJMYsUEy+9cnPSFRVuRAHjYynSiLk2ZEjb
+Wkdc4x0nOZR5tP0FgrX0Ve2KcjFwVQJVZLgOUqmFYQ/G0TIIGTNh9tcmR7yp+xJR
+A2tbPV2Z6m9Yxx4E8lLEPNuoeouJ/GR4CkMEmF8cLwM310t174o3lKKUXJ4Vs2HO
+Wj2uN6R9oI+jGLMSswTzCNV1vgc=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtjCCAj2gAwIBAgIQM+ObZzo0HZj7HpGdeMmx/zAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTI0MDUxNTIxNTA0NloYDzIxMjQwNTE1MjI1MDQ2WjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhSrJY/MXuQyTqK1dnLK6
+uWUx/KxsGCMCBXKthi0spP90CjfOYYxDcGD7zgUtk+LCEK2vneuewAPhlUgqXzaZ
+PYDzk2WUznIPiIBvVo32U4vUnV/vSWqzhSKevsOakiPso0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRw/PJZ4fwnZo25vVSB80KtyKWqmTAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDZwAwZAIwLNcaZNOvCLTumHlJydm+9lB6bcxnaLmb
+esoToveXQABKl84kGNI1gaDKOvvLsPbWAjBIqfDMb83RXw7q2C501W5hzsbZ1ZQs
+8+tffIuCrMMGWDLqoUksWJHiocLOfe9gwm4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICuDCCAj6gAwIBAgIRAOocLeZWjYkG/EbHmscuy8gwCgYIKoZIzj0EAwMwgZsx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h
+em9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MjEyMTUwMDFaGA8yMTIxMDUyMTIyNTAwMVowgZsx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h
+em9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABCEr3jq1KtRncnZfK5cq
+btY0nW6ZG3FMbh7XwBIR6Ca0f8llGZ4vJEC1pXgiM/4Dh045B9ZIzNrR54rYOIfa
+2NcYZ7mk06DjIQML64hbAxbQzOAuNzLPx268MrlL2uW2XaNCMEAwDwYDVR0TAQH/
+BAUwAwEB/zAdBgNVHQ4EFgQUln75pChychwN4RfHl+tOinMrfVowDgYDVR0PAQH/
+BAQDAgGGMAoGCCqGSM49BAMDA2gAMGUCMGiyPINRU1mwZ4Crw01vpuPvxZxb2IOr
+yX3RNlOIu4We1H+5dQk5tIvH8KGYFbWEpAIxAO9NZ6/j9osMhLgZ0yj0WVjb+uZx
+YlZR9fyFisY/jNfX7QhSk+nrc3SFLRUNtpXrng==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBTCCAu2gAwIBAgIRAKiaRZatN8eiz9p0s0lu0rQwDQYJKoZIhvcNAQELBQAw
+gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq
+QW1hem9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYD
+VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMDIzNVoYDzIwNjEwNTIxMjMwMjM1WjCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGNhLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCygVMf
+qB865IR9qYRBRFHn4eAqGJOCFx+UbraQZmjr/mnRqSkY+nhbM7Pn/DWOrRnxoh+w
+q5F9ZxdZ5D5T1v6kljVwxyfFgHItyyyIL0YS7e2h7cRRscCM+75kMedAP7icb4YN
+LfWBqfKHbHIOqvvQK8T6+Emu/QlG2B5LvuErrop9K0KinhITekpVIO4HCN61cuOe
+CADBKF/5uUJHwS9pWw3uUbpGUwsLBuhJzCY/OpJlDqC8Y9aToi2Ivl5u3/Q/sKjr
+6AZb9lx4q3J2z7tJDrm5MHYwV74elGSXoeoG8nODUqjgklIWAPrt6lQ3WJpO2kug
+8RhCdSbWkcXHfX95AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
+FOIxhqTPkKVqKBZvMWtKewKWDvDBMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0B
+AQsFAAOCAQEAqoItII89lOl4TKvg0I1EinxafZLXIheLcdGCxpjRxlZ9QMQUN3yb
+y/8uFKBL0otbQgJEoGhxm4h0tp54g28M6TN1U0332dwkjYxUNwvzrMaV5Na55I2Z
+1hq4GB3NMXW+PvdtsgVOZbEN+zOyOZ5MvJHEQVkT3YRnf6avsdntltcRzHJ16pJc
+Y8rR7yWwPXh1lPaPkxddrCtwayyGxNbNmRybjR48uHRhwu7v2WuAMdChL8H8bp89
+TQLMrMHgSbZfee9hKhO4Zebelf1/cslRSrhkG0ESq6G5MUINj6lMg2g6F0F7Xz2v
+ncD/vuRN5P+vT8th/oZ0Q2Gc68Pun0cn/g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAJYlnmkGRj4ju/2jBQsnXJYwDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyB1cy1lYXN0LTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMTIzMDQ0NFoYDzIwNjEwNTIyMDAwNDQ0WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIHVzLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC74V3eigv+pCj5
+nqDBqplY0Jp16pTeNB06IKbzb4MOTvNde6QjsZxrE1xUmprT8LxQqN9tI3aDYEYk
+b9v4F99WtQVgCv3Y34tYKX9NwWQgwS1vQwnIR8zOFBYqsAsHEkeJuSqAB12AYUSd
+Zv2RVFjiFmYJho2X30IrSLQfS/IE3KV7fCyMMm154+/K1Z2IJlcissydEAwgsUHw
+edrE6CxJVkkJ3EvIgG4ugK/suxd8eEMztaQYJwSdN8TdfT59LFuSPl7zmF3fIBdJ
+//WexcQmGabaJ7Xnx+6o2HTfkP8Zzzzaq8fvjAcvA7gyFH5EP26G2ZqMG+0y4pTx
+SPVTrQEXAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIWWuNEF
+sUMOC82XlfJeqazzrkPDMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAgClmxcJaQTGpEZmjElL8G2Zc8lGc+ylGjiNlSIw8X25/bcLRptbDA90nuP+q
+zXAMhEf0ccbdpwxG/P5a8JipmHgqQLHfpkvaXx+0CuP++3k+chAJ3Gk5XtY587jX
++MJfrPgjFt7vmMaKmynndf+NaIJAYczjhJj6xjPWmGrjM3MlTa9XesmelMwP3jep
+bApIWAvCYVjGndbK9byyMq1nyj0TUzB8oJZQooaR3MMjHTmADuVBylWzkRMxbKPl
+4Nlsk4Ef1JvIWBCzsMt+X17nuKfEatRfp3c9tbpGlAE/DSP0W2/Lnayxr4RpE9ds
+ICF35uSis/7ZlsftODUe8wtpkQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECDCCAvCgAwIBAgIQTcWg4evi5wHEIHLNrHCqQjANBgkqhkiG9w0BAQsFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yNDA5MTIxNTU0MzFaGA8yMDY0MDkxMjE2NTQzMVow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNyBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCS
+X21nYtSipOhpdF6QfLE4BTwbtrXCR3EBhOHB1MfwwjNh25uex3X/gHW/sUTgC/oe
+Oboi+3I/HN6a5MneTcVVps8AL8rJGym0ShSIYza/3MyT+PtfqDNmYfmF8VRIhNSR
+CoYW93F/BoZF7bFk4ljOrBSrRbfb1qmEtkTPNGBRnJ0jh05Fwq5a5XnkGcOGNDyH
+kGt9ZaUm+cJmzAa1omHspCjgg6854CNs4k5ovT2vaZ/0yAogdSpkB9INLM0ZMqJ+
+QoKAyN6hdISjwEEZrl+0OKymc2jR+NpQcd3378bDIfg3iYvuvTp84kKpZ4gRaukm
+mSUg/PQqmGdBlAivOiknAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFDsAilCg2DzFiZheGlKVb74AubP2MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG
+9w0BAQsFAAOCAQEACUGKd2GVv87xnVnPajqbi7GkMd+XGwyG1P8Nkon9rfUgwgHR
+dHDsO6jIKf3ZEzNcMgMyV5sXs2944WRhGkYxQ62wbkEaqtjNExmlmUiS3vvrGOfg
+BmRhJvAOM5HbNMqmi5BC4GlhHWQKhRbStwhvbVYnARBVfR/Wz4Qb4fizaXbuNWAo
+V0XBQc+67lto2eBQ84KQXTp60FdwSBzltbM7sZmp6dMNgnfPNUrdxurVboF+VsxS
+3aUJnmEi6TJAGL2SXLermB6HiTgxtxOJUiefu4Ipv0JEg41OzbKWsJXTaSH0QDb1
+nSeMyoXqF3ixcAhQbw/7NrzMMlf3NmMaVlohVA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjOgAwIBAgIQS7vMpOTVq2Jw457NdZ2ffjAKBggqhkjOPQQDAzCBljEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6
+b24gUkRTIGNhLXdlc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTAgFw0yMzA5MTkyMjExNDNaGA8yMTIzMDkxOTIzMTE0M1owgZYxCzAJBgNV
+BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD
+VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE
+UyBjYS13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAARdgGSs/F2lpWKqS1ZpcmatFED1JurmNbXG
+Sqhv1A/geHrKCS15MPwjtnfZiujYKY4fNkCCUseoGDwkC4281nwkokvnfWR1/cXy
+LxfACoXNxsI4b+37CezSUBl48/5p1/OjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFFhLokGBuJGwKJhZcYSYKyZIitJtMA4GA1UdDwEB/wQEAwIBhjAKBggq
+hkjOPQQDAwNpADBmAjEA8aQQlzJRHbqFsRY4O3u/cN0T8dzjcqnYn4NV1w+jvhzt
+QPJLB+ggGyQhoFR6G2UrAjEA0be8OP5MWXD8d01KKbo5Dpy6TwukF5qoJmkFJKS3
+bKfEMvFWxXoV06HNZFWdI80u
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRAPvvd+MCcp8E36lHziv0xhMwDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyB1cy1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMTIzMTEwNloYDzIxMjEwNTIyMDAxMTA2WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIHVzLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDbvwekKIKGcV/s
+lDU96a71ZdN2pTYkev1X2e2/ICb765fw/i1jP9MwCzs8/xHBEQBJSxdfO4hPeNx3
+ENi0zbM+TrMKliS1kFVe1trTTEaHYjF8BMK9yTY0VgSpWiGxGwg4tshezIA5lpu8
+sF6XMRxosCEVCxD/44CFqGZTzZaREIvvFPDTXKJ6yOYnuEkhH3OcoOajHN2GEMMQ
+ShuyRFDQvYkqOC/Q5icqFbKg7eGwfl4PmimdV7gOVsxSlw2s/0EeeIILXtHx22z3
+8QBhX25Lrq2rMuaGcD3IOMBeBo2d//YuEtd9J+LGXL9AeOXHAwpvInywJKAtXTMq
+Wsy3LjhuANFrzMlzjR2YdjkGVzeQVx3dKUzJ2//Qf7IXPSPaEGmcgbxuatxjnvfT
+H85oeKr3udKnXm0Kh7CLXeqJB5ITsvxI+Qq2iXtYCc+goHNR01QJwtGDSzuIMj3K
+f+YMrqBXZgYBwU2J/kCNTH31nfw96WTbOfNGwLwmVRDgguzFa+QzmQsJW4FTDMwc
+7cIjwdElQQVA+Gqa67uWmyDKAnoTkudmgAP+OTBkhnmc6NJuZDcy6f/iWUdl0X0u
+/tsfgXXR6ZovnHonM13ANiN7VmEVqFlEMa0VVmc09m+2FYjjlk8F9sC7Rc4wt214
+7u5YvCiCsFZwx44baP5viyRZgkJVpQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBQgCZCsc34nVTRbWsniXBPjnUTQ2DAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBAAQas3x1G6OpsIvQeMS9BbiHG3+kU9P/ba6Rrg+E
+lUz8TmL04Bcd+I+R0IyMBww4NznT+K60cFdk+1iSmT8Q55bpqRekyhcdWda1Qu0r
+JiTi7zz+3w2v66akofOnGevDpo/ilXGvCUJiLOBnHIF0izUqzvfczaMZGJT6xzKq
+PcEVRyAN1IHHf5KnGzUlVFv9SGy47xJ9I1vTk24JU0LWkSLzMMoxiUudVmHSqJtN
+u0h+n/x3Q6XguZi1/C1KOntH56ewRh8n5AF7c+9LJJSRM9wunb0Dzl7BEy21Xe9q
+03xRYjf5wn8eDELB8FZPa1PrNKXIOLYM9egdctbKEcpSsse060+tkyBrl507+SJT
+04lvJ4tcKjZFqxn+bUkDQvXYj0D3WK+iJ7a8kZJPRvz8BDHfIqancY8Tgw+69SUn
+WqIb+HNZqFuRs16WFSzlMksqzXv6wcDSyI7aZOmCGGEcYW9NHk8EuOnOQ+1UMT9C
+Qb1GJcipjRzry3M4KN/t5vN3hIetB+/PhmgTO4gKhBETTEyPC3HC1QbdVfRndB6e
+U/NF2U/t8U2GvD26TTFLK4pScW7gyw4FQyXWs8g8FS8f+R2yWajhtS9++VDJQKom
+fAUISoCH+PlPRJpu/nHd1Zrddeiiis53rBaLbXu2J1Q3VqjWOmtj0HjxJJxWnYmz
+Pqj2
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAI/U4z6+GF8/znpHM8Dq8G0wDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMjA2MDYyMTQ4MThaGA8yMTIyMDYwNjIyNDgxOFowgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK5WqMvyq888
+3uuOtEj1FcP6iZhqO5kJurdJF59Otp2WCg+zv6I+QwaAspEWHQsKD405XfFsTGKV
+SKTCwoMxwBniuChSmyhlagQGKSnRY9+znOWq0v7hgmJRwp6FqclTbubmr+K6lzPy
+hs86mEp68O5TcOTYWUlPZDqfKwfNTbtCl5YDRr8Gxb5buHmkp6gUSgDkRsXiZ5VV
+b3GBmXRqbnwo5ZRNAzQeM6ylXCn4jKs310lQGUrFbrJqlyxUdfxzqdlaIRn2X+HY
+xRSYbHox3LVNPpJxYSBRvpQVFSy9xbX8d1v6OM8+xluB31cbLBtm08KqPFuqx+cO
+I2H5F0CYqYzhyOSKJsiOEJT6/uH4ewryskZzncx9ae62SC+bB5n3aJLmOSTkKLFY
+YS5IsmDT2m3iMgzsJNUKVoCx2zihAzgBanFFBsG+Xmoq0aKseZUI6vd2qpd5tUST
+/wS1sNk0Ph7teWB2ACgbFE6etnJ6stwjHFZOj/iTYhlnR2zDRU8akunFdGb6CB4/
+hMxGJxaqXSJeGtHm7FpadlUTf+2ESbYcVW+ui/F8sdBJseQdKZf3VdZZMgM0bcaX
+NE47cauDTy72WdU9YJX/YXKYMLDE0iFHTnGpfVGsuWGPYhlwZ3dFIO07mWnCRM6X
+u5JXRB1oy5n5HRluMsmpSN/R92MeBxKFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFNtH0F0xfijSLHEyIkRGD9gW6NazMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEACo+5jFeY3ygxoDDzL3xpfe5M0U1WxdKk+az4
+/OfjZvkoma7WfChi3IIMtwtKLYC2/seKWA4KjlB3rlTsCVNPnK6D+gAnybcfTKk/
+IRSPk92zagwQkSUWtAk80HpVfWJzpkSU16ejiajhedzOBRtg6BwsbSqLCDXb8hXr
+eXWC1S9ZceGc+LcKRHewGWPu31JDhHE9bNcl9BFSAS0lYVZqxIRWxivZ+45j5uQv
+wPrC8ggqsdU3K8quV6dblUQzzA8gKbXJpCzXZihkPrYpQHTH0szvXvgebh+CNUAG
+rUxm8+yTS0NFI3U+RLbcLFVzSvjMOnEwCX0SPj5XZRYYXs5ajtQCoZhTUkkwpDV8
+RxXk8qGKiXwUxDO8GRvmvM82IOiXz5w2jy/h7b7soyIgdYiUydMq4Ja4ogB/xPZa
+gf4y0o+bremO15HFf1MkaU2UxPK5FFVUds05pKvpSIaQWbF5lw4LHHj4ZtVup7zF
+CLjPWs4Hs/oUkxLMqQDw0FBwlqa4uot8ItT8uq5BFpz196ZZ+4WXw5PVzfSxZibI
+C/nwcj0AS6qharXOs8yPnPFLPSZ7BbmWzFDgo3tpglRqo3LbSPsiZR+sLeivqydr
+0w4RK1btRda5Ws88uZMmW7+2aufposMKcbAdrApDEAVzHijbB/nolS5nsnFPHZoA
+KDPtFEk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtzCCAj2gAwIBAgIQVZ5Y/KqjR4XLou8MCD5pOjAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC00IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIyMDUyNTE2NTgzM1oYDzIxMjIwNTI1MTc1ODMzWjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC00IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEbo473OmpD5vkckdJajXg
+brhmNFyoSa0WCY1njuZC2zMFp3zP6rX4I1r3imrYnJd9pFH/aSiV/r6L5ACE5RPx
+4qdg5SQ7JJUaZc3DWsTOiOed7BCZSzM+KTYK/2QzDMApo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBTmogc06+1knsej1ltKUOdWFvwgsjAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAIs7TlLMbGTWNXpGiKf9DxaM07d/iDHe
+F/Vv/wyWSTGdobxBL6iArQNVXz0Gr4dvPAIwd0rsoa6R0x5mtvhdRPtM37FYrbHJ
+pbV+OMusQqcSLseunLBoCHenvJW0QOCQ8EDY
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBTCCA+2gAwIBAgIRAO9dVdiLTEGO8kjUFExJmgowDQYJKoZIhvcNAQEMBQAw
+gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq
+QW1hem9uIFJEUyBpbC1jZW50cmFsLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYD
+VQQHDAdTZWF0dGxlMCAXDTIyMTIwMjIwMjYwOFoYDzIxMjIxMjAyMjEyNjA4WjCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDkVHmJ
+bUc8CNDGBcgPmXHSHj5dS1PDnnpk3doCu6pahyYXW8tqAOmOqsDuNz48exY7YVy4
+u9I9OPBeTYB9ZUKwxq+1ZNLsr1cwVz5DdOyDREVFOjlU4rvw0eTgzhP5yw/d+Ai/
++WmPebZG0irwPKN2f60W/KJ45UNtR+30MT8ugfnPuSHWjjV+dqCOCp/mj8nOCckn
+k8GoREwjuTFJMKInpQUC0BaVVX6LiIdgtoLY4wdx00EqNBuROoRTAvrked0jvm7J
+UI39CSYxhNZJ9F6LdESZXjI4u2apfNQeSoy6WptxFHr+kh2yss1B2KT6lbwGjwWm
+l9HODk9kbBNSy2NeewAms36q+p8wSLPavL28IRfK0UaBAiN1hr2a/2RDGCwOJmw6
+5erRC5IIX5kCStyXPEGhVPp18EvMuBd37eLIxjZBBO8AIDf4Ue8QmxSeZH0cT204
+3/Bd6XR6+Up9iMTxkHr1URcL1AR8Zd62lg/lbEfxePNMK9mQGxKP8eTMG5AjtW9G
+TatEoRclgE0wZQalXHmKpBNshyYdGqQZhzL1MxCxWzfHNgZkTKIsdzxrjnP7RiBR
+jdRH0YhXn6Y906QfLwMCaufwfQ5J8+nj/tu7nG138kSxsu6VUkhnQJhUcUsxuHD/
+NnBx0KGVEldtZiZf7ccgtRVp1lA0OrVtq3ZLMQIDAQABo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBQ2WC3p8rWeE2N0S4Om01KsNLpk/jAOBgNVHQ8BAf8E
+BAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAFFEVDt45Obr6Ax9E4RMgsKjj4QjMFB9
+wHev1jL7hezl/ULrHuWxjIusaIZEIcKfn+v2aWtqOq13P3ht7jV5KsV29CmFuCdQ
+q3PWiAXVs+hnMskTOmGMDnptqd6/UuSIha8mlOKKAvnmRQJvfX9hIfb/b/mVyKWD
+uvTTmcy3cOTJY5ZIWGyzuvmcqA0YNcb7rkJt/iaLq4RX3/ofq4y4w36hefbcvj++
+pXHOmXk3dAej3y6SMBOUcGMyCJcCluRPNYKDTLn+fitcPxPC3JG7fI5bxQ0D6Hpa
+qbyGBQu96sfahQyMc+//H8EYlo4b0vPeS5RFFXJS/VBf0AyNT4vVc7H17Q6KjeNp
+wEARqsIa7UalHx9MnxrQ/LSTTxiC8qmDkIFuQtw8iQMN0SoL5S0eCZNRD31awgaY
+y1PvY8JMN549ugIUjOXnown/OxharLW1evWUraU5rArq3JfeFpPXl4K/u10T5SCL
+iJRoxFilGPMFE3hvnmbi5rEy8wRUn7TpLb4I4s/CB/lT2qZTPqvQHwxKCnMm9BKF
+NHb4rLL5dCvUi5NJ6fQ/exOoGdOVSfT7jqFeq2TtNunERSz9vpriweliB6iIe1Al
+Thj8aEs1GqA764rLVGA+vUe18NhjJm9EemrdIzjSQFy/NdbN/DMaHqEzJogWloAI
+izQWYnCS19TJ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICvTCCAkOgAwIBAgIQCIY7E/bFvFN2lK9Kckb0dTAKBggqhkjOPQQDAzCBnjEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTcwNQYDVQQDDC5BbWF6
+b24gUkRTIFByZXZpZXcgdXMtZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYD
+VQQHDAdTZWF0dGxlMCAXDTIxMDUxODIxMDUxMFoYDzIxMjEwNTE4MjIwNTEwWjCB
+njELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTcwNQYDVQQDDC5B
+bWF6b24gUkRTIFByZXZpZXcgdXMtZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEMI0hzf1JCEOI
+Eue4+DmcNnSs2i2UaJxHMrNGGfU7b42a7vwP53F7045ffHPBGP4jb9q02/bStZzd
+VHqfcgqkSRI7beBKjD2mfz82hF/wJSITTgCLs+NRpS6zKMFOFHUNo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MB0GA1UdDgQWBBS8uF/6hk5mPLH4qaWv9NVZaMmyTjAOBgNV
+HQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAO7Pu9wzLyM0X7Q08uLIL+vL
+qaxe3UFuzFTWjM16MLJHbzLf1i9IDFKz+Q4hXCSiJwIwClMBsqT49BPUxVsJnjGr
+EbyEk6aOOVfY1p2yQL649zh3M4h8okLnwf+bYIb1YpeU
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQY+JhwFEQTe36qyRlUlF8ozANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE5MjQxNloYDzIwNjEwNTE5MjAyNDE2WjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnIye77j6ev40
+8wRPyN2OdKFSUfI9jB20Or2RLO+RDoL43+USXdrze0Wv4HMRLqaen9BcmCfaKMp0
+E4SFo47bXK/O17r6G8eyq1sqnHE+v288mWtYH9lAlSamNFRF6YwA7zncmE/iKL8J
+0vePHMHP/B6svw8LULZCk+nZk3tgxQn2+r0B4FOz+RmpkoVddfqqUPMbKUxhM2wf
+fO7F6bJaUXDNMBPhCn/3ayKCjYr49ErmnpYV2ZVs1i34S+LFq39J7kyv6zAgbHv9
++/MtRMoRB1CjpqW0jIOZkHBdYcd1o9p1zFn591Do1wPkmMsWdjIYj+6e7UXcHvOB
+2+ScIRAcnwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQGtq2W
+YSyMMxpdQ3IZvcGE+nyZqTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAEgoP3ixJsKSD5FN8dQ01RNHERl/IFbA7TRXfwC+L1yFocKnQh4Mp/msPRSV
++OeHIvemPW/wtZDJzLTOFJ6eTolGekHK1GRTQ6ZqsWiU2fmiOP8ks4oSpI+tQ9Lw
+VrfZqTiEcS5wEIqyfUAZZfKDo7W1xp+dQWzfczSBuZJZwI5iaha7+ILM0r8Ckden
+TVTapc5pLSoO15v0ziRuQ2bT3V3nwu/U0MRK44z+VWOJdSiKxdnOYDs8hFNnKhfe
+klbTZF7kW7WbiNYB43OaAQBJ6BALZsIskEaqfeZT8FD71uN928TcEQyBDXdZpRN+
+iGQZDGhht0r0URGMDSs9waJtTfA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtDCCAjqgAwIBAgIRANtElQUxBpw5GPpq+Tqajs4wCgYIKoZIzj0EAwMwgZkx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h
+em9uIFJEUyBteC1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjQwOTMwMTYxNDAwWhgPMjEyNDA5MzAxNzEzNTlaMIGZMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv
+biBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEB5xlumRhIemjIWjxWQHqDYG7
+I24vWwUWZjcxcqpDHv6ThnJRsN4TCbWiSfjCOTeW9ZMQiMm6xlxug1nXkDGAyuHL
+ze0PqtP0rUPi25wmp3F6L4vq96az41xtGa4wc/xSo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBSEfpD78dOGnSCKk9cYr2mAc4j9cTAOBgNVHQ8BAf8EBAMC
+AYYwCgYIKoZIzj0EAwMDaAAwZQIxANNu+hmW2xOajUvFzdVV4fO0Slj6BRklQfjO
+hSF/1NvfZK9pF/QDIyknmK5KS+bY+QIwZCxY71nDC4n4Jw1l0gF+krPg3gNS2KKF
+FdrlaY1qdiyvyG6t6tp84q9XmGJ1rOhJ
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECDCCAvCgAwIBAgIQEbIZbn8kcnd/sTnZkdoDkzANBgkqhkiG9w0BAQsFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yNDA1MTUyMTUwMzdaGA8yMDY0MDUxNTIyNTAzN1ow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNSBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCK
+c15oRFUw/MiZQ/qkfOlrcc/PC9TdxGjUqdZyQGqBWrFauIbsK7U0qTeTibt7t7cL
+hBWmqb3eefU8e+JZwJ20/cFfWINEjp9xLKV5pzfcRH+BJF3Sa4iLeLSi8CEp5qvf
+k70ADs2kye17q29G01NfCG9T2oMEEJQof1nKcfwjayjx7uyBPHtR0a2SC88QlSl9
+9a009S0pUoISV3Zu/U+B6vUlBnGuIt+EsEFH0r19w/VRSO5mg9ylxh0/X5HXeBK5
+UxpNpXI9rPNd/AMTrv7FTyWsqkeSRS2lyT/8wyatApcCdPLyJDx7wZLY8/wARz7p
+zi/uEKlhrrSDhDq2I7JFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFAHKs1jyaNzThRo5XHN/dNJDtVNHMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG
+9w0BAQsFAAOCAQEAVAdR60a4czTpyu3JHj6oNVQUTt1D1jD/y1fZcc5a77fa2Qc6
+ZZEVBadpXAwkUQDbVRu/h6OrPhWKbQNLlTS1xzGuGeVbXSczvj37UB11WQfFN3M9
+Dpe5LTL0MCPO+elHzXrBhjhi9euCHXHDdvv4AZl7tfWuOrBdeBThXIehKniJmAjt
+vq2mIHHThw2Wr+E65WerOVU+jepsG//1EkgrKfcGoS646jQXXKabW3cn0ymEV1/M
+DhFbV05Jfvu969qcA3+TH1FaN/lAbwuSLFZ4HLFFjq7RVl/X//lyXl1q/coUdQXC
+awfL88gOd/cYz0n5xm/S+gJUtOcz/dR6kV36NQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/jCCA+agAwIBAgIQXY/dmS+72lZPranO2JM9jjANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIGFwLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTI1MjEzNDUxWhgPMjEyMTA1MjUyMjM0NTFaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgYXAtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMyW9kBJjD/hx8e8
+b5E1sF42bp8TXsz1htSYE3Tl3T1Aq379DfEhB+xa/ASDZxt7/vwa81BkNo4M6HYq
+okYIXeE7cu5SnSgjWXqcERhgPevtAwgmhdE3yREe8oz2DyOi2qKKZqah+1gpPaIQ
+fK0uAqoeQlyHosye3KZZKkDHBatjBsQ5kf8lhuf7wVulEZVRHY2bP2X7N98PfbpL
+QdH7mWXzDtJJ0LiwFwds47BrkgK1pkHx2p1mTo+HMkfX0P6Fq1atkVC2RHHtbB/X
+iYyH7paaHBzviFrhr679zNqwXIOKlbf74w3mS11P76rFn9rS1BAH2Qm6eY5S/Fxe
+HEKXm4kjPN63Zy0p3yE5EjPt54yPkvumOnT+RqDGJ2HCI9k8Ehcbve0ogfdRKNqQ
+VHWYTy8V33ndQRHZlx/CuU1yN61TH4WSoMly1+q1ihTX9sApmlQ14B2pJi/9DnKW
+cwECrPy1jAowC2UJ45RtC8UC05CbP9yrIy/7Noj8gQDiDOepm+6w1g6aNlWoiuQS
+kyI6nzz1983GcnOHya73ga7otXo0Qfg9jPghlYiMomrgshlSLDHZG0Ib/3hb8cnR
+1OcN9FpzNmVK2Ll1SmTMLrIhuCkyNYX9O/bOknbcf706XeESxGduSkHEjIw/k1+2
+Atteoq5dT6cwjnJ9hyhiueVlVkiDAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFLUI+DD7RJs+0nRnjcwIVWzzYSsFMA4GA1UdDwEB/wQEAwIBhjAN
+BgkqhkiG9w0BAQwFAAOCAgEAb1mcCHv4qMQetLGTBH9IxsB2YUUhr5dda0D2BcHr
+UtDbfd0VQs4tux6h/6iKwHPx0Ew8fuuYj99WknG0ffgJfNc5/fMspxR/pc1jpdyU
+5zMQ+B9wi0lOZPO9uH7/pr+d2odcNEy8zAwqdv/ihsTwLmGP54is9fVbsgzNW1cm
+HKAVL2t/Ope+3QnRiRilKCN1lzhav4HHdLlN401TcWRWKbEuxF/FgxSO2Hmx86pj
+e726lweCTMmnq/cTsPOVY0WMjs0or3eHDVlyLgVeV5ldyN+ptg3Oit60T05SRa58
+AJPTaVKIcGQ/gKkKZConpu7GDofT67P/ox0YNY57LRbhsx9r5UY4ROgz7WMQ1yoS
+Y+19xizm+mBm2PyjMUbfwZUyCxsdKMwVdOq5/UmTmdms+TR8+m1uBHPOTQ2vKR0s
+Pd/THSzPuu+d3dbzRyDSLQbHFFneG760CUlD/ZmzFlQjJ89/HmAmz8IyENq+Sjhx
+Jgzy+FjVZb8aRUoYLlnffpUpej1n87Ynlr1GrvC4GsRpNpOHlwuf6WD4W0qUTsC/
+C9JO+fBzUj/aWlJzNcLEW6pte1SB+EdkR2sZvWH+F88TxemeDrV0jKJw5R89CDf8
+ZQNfkxJYjhns+YeV0moYjqQdc7tq4i04uggEQEtVzEhRLU5PE83nlh/K2NZZm8Kj
+dIA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAPVSMfFitmM5PhmbaOFoGfUwDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyB1cy1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNTIyMzQ1N1oYDzIwNjEwNTI1MjMzNDU3WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIHVzLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDu9H7TBeGoDzMr
+dxN6H8COntJX4IR6dbyhnj5qMD4xl/IWvp50lt0VpmMd+z2PNZzx8RazeGC5IniV
+5nrLg0AKWRQ2A/lGGXbUrGXCSe09brMQCxWBSIYe1WZZ1iU1IJ/6Bp4D2YEHpXrW
+bPkOq5x3YPcsoitgm1Xh8ygz6vb7PsvJvPbvRMnkDg5IqEThapPjmKb8ZJWyEFEE
+QRrkCIRueB1EqQtJw0fvP4PKDlCJAKBEs/y049FoOqYpT3pRy0WKqPhWve+hScMd
+6obq8kxTFy1IHACjHc51nrGII5Bt76/MpTWhnJIJrCnq1/Uc3Qs8IVeb+sLaFC8K
+DI69Sw6bAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFE7PCopt
+lyOgtXX0Y1lObBUxuKaCMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAFj+bX8gLmMNefr5jRJfHjrL3iuZCjf7YEZgn89pS4z8408mjj9z6Q5D1H7yS
+jNETVV8QaJip1qyhh5gRzRaArgGAYvi2/r0zPsy+Tgf7v1KGL5Lh8NT8iCEGGXwF
+g3Ir+Nl3e+9XUp0eyyzBIjHtjLBm6yy8rGk9p6OtFDQnKF5OxwbAgip42CD75r/q
+p421maEDDvvRFR4D+99JZxgAYDBGqRRceUoe16qDzbMvlz0A9paCZFclxeftAxv6
+QlR5rItMz/XdzpBJUpYhdzM0gCzAzdQuVO5tjJxmXhkSMcDP+8Q+Uv6FA9k2VpUV
+E/O5jgpqUJJ2Hc/5rs9VkAPXeA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrzCCAjWgAwIBAgIQW0yuFCle3uj4vWiGU0SaGzAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTE5MTkzNTE2WhgPMjEyMTA1MTkyMDM1MTZaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgYWYtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDPiKNZSaXs3Un/J/v+LTsFDANHpi7en
+oL2qh0u0DoqNzEBTbBjvO23bLN3k599zh6CY3HKW0r2k1yaIdbWqt4upMCRCcUFi
+I4iedAmubgzh56wJdoMZztjXZRwDthTkJKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUWbYkcrvVSnAWPR5PJhIzppcAnZIwDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2gAMGUCMCESGqpat93CjrSEjE7z+Hbvz0psZTHwqaxuiH64GKUm
+mYynIiwpKHyBrzjKBmeDoQIxANGrjIo6/b8Jl6sdIZQI18V0pAyLfLiZjlHVOnhM
+MOTVgr82ZuPoEHTX78MxeMnYlw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRAIbsx8XOl0sgTNiCN4O+18QwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI1MjE1NDU4WhgPMjA2MTA1MjUyMjU0NTha
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+tROxwXWCgn5R9gI/2Ivjzaxc0g95ysBjoJsnhPdJEHQb7w3y2kWrVWU3Y9fOitgb
+CEsnEC3PrhRnzNVW0fPsK6kbvOeCmjvY30rdbxbc8h+bjXfGmIOgAkmoULEr6Hc7
+G1Q/+tvv4lEwIs7bEaf+abSZxRJbZ0MBxhbHn7UHHDiMZYvzK+SV1MGCxx7JVhrm
+xWu3GC1zZCsGDhB9YqY9eR6PmjbqA5wy8vqbC57dZZa1QVtWIQn3JaRXn+faIzHx
+nLMN5CEWihsdmHBXhnRboXprE/OS4MFv1UrQF/XM/h5RBeCywpHePpC+Oe1T3LNC
+iP8KzRFrjC1MX/WXJnmOVQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBS33XbXAUMs1znyZo4B0+B3D68WFTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBADuadd2EmlpueY2VlrIIPC30QkoA1EOSoCmZgN6124apkoY1
+HiV4r+QNPljN4WP8gmcARnNkS7ZeR4fvWi8xPh5AxQCpiaBMw4gcbTMCuKDV68Pw
+P2dZCTMspvR3CDfM35oXCufdtFnxyU6PAyINUqF/wyTHguO3owRFPz64+sk3r2pT
+WHmJjG9E7V+KOh0s6REgD17Gqn6C5ijLchSrPUHB0wOIkeLJZndHxN/76h7+zhMt
+fFeNxPWHY2MfpcaLjz4UREzZPSB2U9k+y3pW1omCIcl6MQU9itGx/LpQE+H3ZeX2
+M2bdYd5L+ow+bdbGtsVKOuN+R9Dm17YpswF+vyQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAKlQ+3JX9yHXyjP/Ja6kZhkwDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MTkxNzQ1MjBaGA8yMTIxMDUxOTE4NDUyMFowgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKtahBrpUjQ6
+H2mni05BAKU6Z5USPZeSKmBBJN3YgD17rJ93ikJxSgzJ+CupGy5rvYQ0xznJyiV0
+91QeQN4P+G2MjGQR0RGeUuZcfcZitJro7iAg3UBvw8WIGkcDUg+MGVpRv/B7ry88
+7E4OxKb8CPNoa+a9j6ABjOaaxaI22Bb7j3OJ+JyMICs6CU2bgkJaj3VUV9FCNUOc
+h9PxD4jzT9yyGYm/sK9BAT1WOTPG8XQUkpcFqy/IerZDfiQkf1koiSd4s5VhBkUn
+aQHOdri/stldT7a+HJFVyz2AXDGPDj+UBMOuLq0K6GAT6ThpkXCb2RIf4mdTy7ox
+N5BaJ+ih+Ro3ZwPkok60egnt/RN98jgbm+WstgjJWuLqSNInnMUgkuqjyBWwePqX
+Kib+wdpyx/LOzhKPEFpeMIvHQ3A0sjlulIjnh+j+itezD+dp0UNxMERlW4Bn/IlS
+sYQVNfYutWkRPRLErXOZXtlxxkI98JWQtLjvGzQr+jywxTiw644FSLWdhKa6DtfU
+2JWBHqQPJicMElfZpmfaHZjtXuCZNdZQXWg7onZYohe281ZrdFPOqC4rUq7gYamL
+T+ZB+2P+YCPOLJ60bj/XSvcB7mesAdg8P0DNddPhHUFWx2dFqOs1HxIVB4FZVA9U
+Ppbv4a484yxjTgG7zFZNqXHKTqze6rBBAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFCEAqjighncv/UnWzBjqu1Ka2Yb4MA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEAYyvumblckIXlohzi3QiShkZhqFzZultbFIu9
+GhA5CDar1IFMhJ9vJpO9nUK/camKs1VQRs8ZsBbXa0GFUM2p8y2cgUfLwFULAiC/
+sWETyW5lcX/xc4Pyf6dONhqFJt/ovVBxNZtcmMEWv/1D6Tf0nLeEb0P2i/pnSRR4
+Oq99LVFjossXtyvtaq06OSiUUZ1zLPvV6AQINg8dWeBOWRcQYhYcEcC2wQ06KShZ
+0ahuu7ar5Gym3vuLK6nH+eQrkUievVomN/LpASrYhK32joQ5ypIJej3sICIgJUEP
+UoeswJ+Z16f3ECoL1OSnq4A0riiLj1ZGmVHNhM6m/gotKaHNMxsK9zsbqmuU6IT/
+P6cR0S+vdigQG8ZNFf5vEyVNXhl8KcaJn6lMD/gMB2rY0qpaeTg4gPfU5wcg8S4Y
+C9V//tw3hv0f2n+8kGNmqZrylOQDQWSSo8j8M2SRSXiwOHDoTASd1fyBEIqBAwzn
+LvXVg8wQd1WlmM3b0Vrsbzltyh6y4SuKSkmgufYYvC07NknQO5vqvZcNoYbLNea3
+76NkFaMHUekSbwVejZgG5HGwbaYBgNdJEdpbWlA3X4yGRVxknQSUyt4dZRnw/HrX
+k8x6/wvtw7wht0/DOqz1li7baSsMazqxx+jDdSr1h9xML416Q4loFCLgqQhil8Jq
+Em4Hy3A=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBDCCAuygAwIBAgIQFn6AJ+uxaPDpNVx7174CpjANBgkqhkiG9w0BAQsFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjIxMjAyMjAxNDA4WhgPMjA2MjEyMDIyMTE0MDhaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgaWwtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2xGTSJ
+fXorki/dkkTqdLyv4U1neeFYEyUCPN/HJ7ZloNwhj8RBrHYhZ4qtvUAvN+rs8fUm
+L0wmaL69ye61S+CSfDzNwBDGwOzUm/cc1NEJOHCm8XA0unBNBvpJTjsFk2LQ+rz8
+oU0lVV4mjnfGektrTDeADonO1adJvUTYmF6v1wMnykSkp8AnW9EG/6nwcAJuAJ7d
+BfaLThm6lfxPdsBNG81DLKi2me2TLQ4yl+vgRKJi2fJWwA77NaDqQuD5upRIcQwt
+5noJt2kFFmeiro98ZMMRaDTHAHhJfWkwkw5f2QNIww7T4r85IwbQCgJVRo4m4ZTC
+W/1eiEccU2407mECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+DNhVvGHzKXv0Yh6asK0apP9jJlUwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQCoEVTUY/rF9Zrlpb1Y1hptEguw0i2pCLakcmv3YNj6thsubbGeGx8Z
+RjUA/gPKirpoae2HU1y64WEu7akwr6pdTRtXXjbe9NReT6OW/0xAwceSXCOiStqS
+cMsWWTGg6BA3uHqad5clqITjDZr1baQ8X8en4SXRBxXyhJXbOkB60HOQeFR9CNeh
+pJdrWLeNYXwU0Z59juqdVMGwvDAYdugWUhW2rhafVUXszfRA5c8Izc+E31kq90aY
+LmxFXUHUfG0eQOmxmg+Z/nG7yLUdHIFA3id8MRh22hye3KvRdQ7ZVGFni0hG2vQQ
+Q01AvD/rhzyjg0czzJKLK9U/RttwdMaV
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBTCCA+2gAwIBAgIRAJfKe4Zh4aWNt3bv6ZjQwogwDQYJKoZIhvcNAQEMBQAw
+gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq
+QW1hem9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYD
+VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMDg1M1oYDzIxMjEwNTIxMjMwODUzWjCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGNhLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpgUH6
+Crzd8cOw9prAh2rkQqAOx2vtuI7xX4tmBG4I/um28eBjyVmgwQ1fpq0Zg2nCKS54
+Nn0pCmT7f3h6Bvopxn0J45AzXEtajFqXf92NQ3iPth95GVfAJSD7gk2LWMhpmID9
+JGQyoGuDPg+hYyr292X6d0madzEktVVGO4mKTF989qEg+tY8+oN0U2fRTrqa2tZp
+iYsmg350ynNopvntsJAfpCO/srwpsqHHLNFZ9jvhTU8uW90wgaKO9i31j/mHggCE
++CAOaJCM3g+L8DPl/2QKsb6UkBgaaIwKyRgKSj1IlgrK+OdCBCOgM9jjId4Tqo2j
+ZIrrPBGl6fbn1+etZX+2/tf6tegz+yV0HHQRAcKCpaH8AXF44bny9andslBoNjGx
+H6R/3ib4FhPrnBMElzZ5i4+eM/cuPC2huZMBXb/jKgRC/QN1Wm3/nah5FWq+yn+N
+tiAF10Ga0BYzVhHDEwZzN7gn38bcY5yi/CjDUNpY0OzEe2+dpaBKPlXTaFfn9Nba
+CBmXPRF0lLGGtPeTAgjcju+NEcVa82Ht1pqxyu2sDtbu3J5bxp4RKtj+ShwN8nut
+Tkf5Ea9rSmHEY13fzgibZlQhXaiFSKA2ASUwgJP19Putm0XKlBCNSGCoECemewxL
++7Y8FszS4Uu4eaIwvXVqUEE2yf+4ex0hqQ1acQIDAQABo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBSeUnXIRxNbYsZLtKomIz4Y1nOZEzAOBgNVHQ8BAf8E
+BAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAIpRvxVS0dzoosBh/qw65ghPUGSbP2D4
+dm6oYCv5g/zJr4fR7NzEbHOXX5aOQnHbQL4M/7veuOCLNPOW1uXwywMg6gY+dbKe
+YtPVA1as8G9sUyadeXyGh2uXGsziMFXyaESwiAXZyiYyKChS3+g26/7jwECFo5vC
+XGhWpIO7Hp35Yglp8AnwnEAo/PnuXgyt2nvyTSrxlEYa0jus6GZEZd77pa82U1JH
+qFhIgmKPWWdvELA3+ra1nKnvpWM/xX0pnMznMej5B3RT3Y+k61+kWghJE81Ix78T
++tG4jSotgbaL53BhtQWBD1yzbbilqsGE1/DXPXzHVf9yD73fwh2tGWSaVInKYinr
+a4tcrB3KDN/PFq0/w5/21lpZjVFyu/eiPj6DmWDuHW73XnRwZpHo/2OFkei5R7cT
+rn/YdDD6c1dYtSw5YNnS6hdCQ3sOiB/xbPRN9VWJa6se79uZ9NLz6RMOr73DNnb2
+bhIR9Gf7XAA5lYKqQk+A+stoKbIT0F65RnkxrXi/6vSiXfCh/bV6B41cf7MY/6YW
+ehserSdjhQamv35rTFdM+foJwUKz1QN9n9KZhPxeRmwqPitAV79PloksOnX25ElN
+SlyxdndIoA1wia1HRd26EFm2pqfZ2vtD2EjU3wD42CXX4H8fKVDna30nNFSYF0yn
+jGKc3k6UNxpg
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/jCCA+agAwIBAgIQaRHaEqqacXN20e8zZJtmDDANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIHVzLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTI1MjIzODM1WhgPMjEyMTA1MjUyMzM4MzVaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgdXMtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAInfBCaHuvj6Rb5c
+L5Wmn1jv2PHtEGMHm+7Z8dYosdwouG8VG2A+BCYCZfij9lIGszrTXkY4O7vnXgru
+JUNdxh0Q3M83p4X+bg+gODUs3jf+Z3Oeq7nTOk/2UYvQLcxP4FEXILxDInbQFcIx
+yen1ESHggGrjEodgn6nbKQNRfIhjhW+TKYaewfsVWH7EF2pfj+cjbJ6njjgZ0/M9
+VZifJFBgat6XUTOf3jwHwkCBh7T6rDpgy19A61laImJCQhdTnHKvzTpxcxiLRh69
+ZObypR7W04OAUmFS88V7IotlPmCL8xf7kwxG+gQfvx31+A9IDMsiTqJ1Cc4fYEKg
+bL+Vo+2Ii4W2esCTGVYmHm73drznfeKwL+kmIC/Bq+DrZ+veTqKFYwSkpHRyJCEe
+U4Zym6POqQ/4LBSKwDUhWLJIlq99bjKX+hNTJykB+Lbcx0ScOP4IAZQoxmDxGWxN
+S+lQj+Cx2pwU3S/7+OxlRndZAX/FKgk7xSMkg88HykUZaZ/ozIiqJqSnGpgXCtED
+oQ4OJw5ozAr+/wudOawaMwUWQl5asD8fuy/hl5S1nv9XxIc842QJOtJFxhyeMIXt
+LVECVw/dPekhMjS3Zo3wwRgYbnKG7YXXT5WMxJEnHu8+cYpMiRClzq2BEP6/MtI2
+AZQQUFu2yFjRGL2OZA6IYjxnXYiRAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFADCcQCPX2HmkqQcmuHfiQ2jjqnrMA4GA1UdDwEB/wQEAwIBhjAN
+BgkqhkiG9w0BAQwFAAOCAgEASXkGQ2eUmudIKPeOIF7RBryCoPmMOsqP0+1qxF8l
+pGkwmrgNDGpmd9s0ArfIVBTc1jmpgB3oiRW9c6n2OmwBKL4UPuQ8O3KwSP0iD2sZ
+KMXoMEyphCEzW1I2GRvYDugL3Z9MWrnHkoaoH2l8YyTYvszTvdgxBPpM2x4pSkp+
+76d4/eRpJ5mVuQ93nC+YG0wXCxSq63hX4kyZgPxgCdAA+qgFfKIGyNqUIqWgeyTP
+n5OgKaboYk2141Rf2hGMD3/hsGm0rrJh7g3C0ZirPws3eeJfulvAOIy2IZzqHUSY
+jkFzraz6LEH3IlArT3jUPvWKqvh2lJWnnp56aqxBR7qHH5voD49UpJWY1K0BjGnS
+OHcurpp0Yt/BIs4VZeWdCZwI7JaSeDcPMaMDBvND3Ia5Fga0thgYQTG6dE+N5fgF
+z+hRaujXO2nb0LmddVyvE8prYlWRMuYFv+Co8hcMdJ0lEZlfVNu0jbm9/GmwAZ+l
+9umeYO9yz/uC7edC8XJBglMAKUmVK9wNtOckUWAcCfnPWYLbYa/PqtXBYcxrso5j
+iaS/A7iEW51uteHBGrViCy1afGG+hiUWwFlesli+Rq4dNstX3h6h2baWABaAxEVJ
+y1RnTQSz6mROT1VmZSgSVO37rgIyY0Hf0872ogcTS+FfvXgBxCxsNWEbiQ/XXva4
+0Ws=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBDCCAuygAwIBAgIQHK008RFz9XJfPKvg2ONLCjANBgkqhkiG9w0BAQsFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIG14LWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjQwOTMwMTYxMzUwWhgPMjA2NDA5MzAxNzEzNTBaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIbH+1jM
+u1AF7AnEnUU64au5HHnWlQZ5PJCRXmiG4q8NGooNG5A6Qd8lIboWnH6DKAfl3AL+
+ihAsLl9biZ/A/wvoNtW/EizjeYXmiuuCyY/Vo/yv78TW7YNspLYbhc35Lt5V+Hi1
+jnKgNf5IAPG4yIXuIYT+9pD6uCcHuoyzsI8f45oUX3o9PJKaBFWccsgIao1cmZhe
+9ButRjAPPtEXyHhLoBgObn5D4G/RWyqXZg0xYTUHHAq6a61UPW8oQ1eqc0aqH+o8
+ZCekjwvgiqTRbUpcWm12KviLgZT1J+9noB7ZX5uY9N5FbOsuG92kkFwgS7cEqEXs
+AUCm/EdPZyj6dyUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+e8h4FODoLdxY0tZkQY5RRjCEQsUwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQA7iEZTjpddHEaTQR3jbR98g8zO5aXKO9gfDmeD1Yuov50rV22gpYgU
+Pz2TtFT2ftDmtqKZevzXCS0sE2a1SxP8jTUGTnRlGdMmeKGKfERneit26AQ6A3VW
+qTB5Sv11oqTs2bgrM0Zd//DRWboqRuctjTl+AWCmFqTLTxYHefaDW6zHkVL/2jcP
+V8MniRMzHKtDKURpl1R9lG3/HvC54XP63pJpmMRwE4b6LUuuwr6AIKKRMCLFIrGh
+8g2OMeOMnXawUxQubTLqqT8yMrZwBD2W6yJnHtECJsBVj1rd3EZ/Cq64JbolFk7/
+fVTZlb5aHfj8sie/qmmiP+T45facauKY
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtDCCAjqgAwIBAgIRAMyaTlVLN0ndGp4ffwKAfoMwCgYIKoZIzj0EAwMwgZkx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h
+em9uIFJEUyBtZS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjIwNTA3MDA0NDM3WhgPMjEyMjA1MDcwMTQ0MzdaMIGZMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv
+biBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE19nCV1nsI6CohSor13+B25cr
+zg+IHdi9Y3L7ziQnHWI6yjBazvnKD+oC71aRRlR8b5YXsYGUQxWzPLHN7EGPcSGv
+bzA9SLG1KQYCJaQ0m9Eg/iGrwKWOgylbhVw0bCxoo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBS4KsknsJXM9+QPEkBdZxUPaLr11zAOBgNVHQ8BAf8EBAMC
+AYYwCgYIKoZIzj0EAwMDaAAwZQIxAJaRgrYIEfXQMZQQDxMTYS0azpyWSseQooXo
+L3nYq4OHGBgYyQ9gVjvRYWU85PXbfgIwdi82DtANQFkCu+j+BU0JBY/uRKPEeYzo
+JG92igKIcXPqCoxIJ7lJbbzmuf73gQu5
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAJwCobx0Os8F7ihbJngxrR8wDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBtZS1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MjAxNzE1MzNaGA8yMTIxMDUyMDE4MTUzM1owgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBtZS1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANukKwlm+ZaI
+Y5MkWGbEVLApEyLmlrHLEg8PfiiEa9ts7jssQcin3bzEPdTqGr5jo91ONoZ3ccWq
+xJgg1W3bLu5CAO2CqIOXTXHRyCO/u0Ch1FGgWB8xETPSi3UHt/Vn1ltdO6DYdbDU
+mYgwzYrvLBdRCwxsb9o+BuYQHVFzUYonqk/y9ujz3gotzFq7r55UwDTA1ita3vb4
+eDKjIb4b1M4Wr81M23WHonpje+9qkkrAkdQcHrkgvSCV046xsq/6NctzwCUUNsgF
+7Q1a8ut5qJEYpz5ta8vI1rqFqAMBqCbFjRYlmAoTTpFPOmzAVxV+YoqTrW5A16su
+/2SXlMYfJ/n/ad/QfBNPPAAQMpyOr2RCL/YiL/PFZPs7NxYjnZHNWxMLSPgFyI+/
+t2klnn5jR76KJK2qimmaXedB90EtFsMRUU1e4NxH9gDuyrihKPJ3aVnZ35mSipvR
+/1KB8t8gtFXp/VQaz2sg8+uxPMKB81O37fL4zz6Mg5K8+aq3ejBiyHucpFGnsnVB
+3kQWeD36ONkybngmgWoyPceuSWm1hQ0Z7VRAQX+KlxxSaHmSaIk1XxZu9h9riQHx
+fMuev6KXjRn/CjCoUTn+7eFrt0dT5GryQEIZP+nA0oq0LKxogigHNZlwAT4flrqb
+JUfZJrqgoce5HjZSXl10APbtPjJi0fW9AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFEfV+LztI29OVDRm0tqClP3NrmEWMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEAvSNe+0wuk53KhWlRlRf2x/97H2Q76X3anzF0
+5fOSVm022ldALzXMzqOfdnoKIhAu2oVKiHHKs7mMas+T6TL+Mkphx0CYEVxFE3PG
+061q3CqJU+wMm9W9xsB79oB2XG47r1fIEywZZ3GaRsatAbjcNOT8uBaATPQAfJFN
+zjFe4XyN+rA4cFrYNvfHTeu5ftrYmvks7JlRaJgEGWsz+qXux7uvaEEVPqEumd2H
+uYeaRNOZ2V23R009X5lbgBFx9tq5VDTnKhQiTQ2SeT0rc1W3Dz5ik6SbQQNP3nSR
+0Ywy7r/sZ3fcDyfFiqnrVY4Ympfvb4YW2PZ6OsQJbzH6xjdnTG2HtzEU30ngxdp1
+WUEF4zt6rjJCp7QBUqXgdlHvJqYu6949qtWjEPiFN9uSsRV2i1YDjJqN52dLjAPn
+AipJKo8x1PHTwUzuITqnB9BdP+5TlTl8biJfkEf/+08eWDTLlDHr2VrZLOLompTh
+bS5OrhDmqA2Q+O+EWrTIhMflwwlCpR9QYM/Xwvlbad9H0FUHbJsCVNaru3wGOgWo
+tt3dNSK9Lqnv/Ej9K9v6CRr36in4ylJKivhJ5B9E7ABHg7EpBJ1xi7O5eNDkNoJG
++pFyphJq3AkBR2U4ni2tUaTAtSW2tks7IaiDV+UMtqZyGabT5ISQfWLLtLHSWn2F
+Tspdjbg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECTCCAvGgAwIBAgIRAJZFh4s9aZGzKaTMLrSb4acwDQYJKoZIhvcNAQELBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBCZXRhIHVzLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjEyODQxWhgPMjA2MTA1MTgyMjI4NDFa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgQmV0YSB1cy1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+17i2yoU6diep+WrqxIn2CrDEO2NdJVwWTSckx4WMZlLpkQDoymSmkNHjq9ADIApD
+A31Cx+843apL7wub8QkFZD0Tk7/ThdHWJOzcAM3ov98QBPQfOC1W5zYIIRP2F+vQ
+TRETHQnLcW3rLv0NMk5oQvIKpJoC9ett6aeVrzu+4cU4DZVWYlJUoC/ljWzCluau
+8blfW0Vwin6OB7s0HCG5/wijQWJBU5SrP/KAIPeQi1GqG5efbqAXDr/ple0Ipwyo
+Xjjl73LenGUgqpANlC9EAT4i7FkJcllLPeK3NcOHjuUG0AccLv1lGsHAxZLgjk/x
+z9ZcnVV9UFWZiyJTKxeKPwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBRWyMuZUo4gxCR3Luf9/bd2AqZ7CjAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI
+hvcNAQELBQADggEBAIqN2DlIKlvDFPO0QUZQVFbsi/tLdYM98/vvzBpttlTGVMyD
+gJuQeHVz+MnhGIwoCGOlGU3OOUoIlLAut0+WG74qYczn43oA2gbMd7HoD7oL/IGg
+njorBwJVcuuLv2G//SqM3nxGcLRtkRnQ+lvqPxMz9+0fKFUn6QcIDuF0QSfthLs2
+WSiGEPKO9c9RSXdRQ4pXA7c3hXng8P4A2ZmdciPne5Nu4I4qLDGZYRrRLRkNTrOi
+TyS6r2HNGUfgF7eOSeKt3NWL+mNChcYj71/Vycf5edeczpUgfnWy9WbPrK1svKyl
+aAs2xg+X6O8qB+Mnj2dNBzm+lZIS3sIlm+nO9sg=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAPAlEk8VJPmEzVRRaWvTh2AwCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyB1cy1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTI1MjI0MTU1WhgPMjEyMTA1MjUyMzQxNTVaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEx5xjrup8II4HOJw15NTnS3H5yMrQGlbj
+EDA5MMGnE9DmHp5dACIxmPXPMe/99nO7wNdl7G71OYPCgEvWm0FhdvVUeTb3LVnV
+BnaXt32Ek7/oxGk1T+Df03C+W0vmuJ+wo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBTGXmqBWN/1tkSea4pNw0oHrjk2UDAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIxAIqqZWCSrIkZ7zsv/FygtAusW6yvlL935YAWYPVXU30m
+jkMFLM+/RJ9GMvnO8jHfCgIwB+whlkcItzE9CRQ6CsMo/d5cEHDUu/QW6jSIh9BR
+OGh9pTYPVkUbBiKPA7lVVhre
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRAJGY9kZITwfSRaAS/bSBOw8wDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBzYS1lYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE4MTEyMFoYDzIxMjEwNTE5MTkxMTIwWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIHNhLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDe2vlDp6Eo4WQi
+Wi32YJOgdXHhxTFrLjB9SRy22DYoMaWfginJIwJcSR8yse8ZDQuoNhERB9LRggAE
+eng23mhrfvtL1yQkMlZfBu4vG1nOb22XiPFzk7X2wqz/WigdYNBCqa1kK3jrLqPx
+YUy7jk2oZle4GLVRTNGuMfcid6S2hs3UCdXfkJuM2z2wc3WUlvHoVNk37v2/jzR/
+hSCHZv5YHAtzL/kLb/e64QkqxKll5QmKhyI6d7vt6Lr1C0zb+DmwxUoJhseAS0hI
+dRk5DklMb4Aqpj6KN0ss0HAYqYERGRIQM7KKA4+hxDMUkJmt8KqWKZkAlCZgflzl
+m8NZ31o2cvBzf6g+VFHx+6iVrSkohVQydkCxx7NJ743iPKsh8BytSM4qU7xx4OnD
+H2yNXcypu+D5bZnVZr4Pywq0w0WqbTM2bpYthG9IC4JeVUvZ2mDc01lqOlbMeyfT
+og5BRPLDXdZK8lapo7se2teh64cIfXtCmM2lDSwm1wnH2iSK+AWZVIM3iE45WSGc
+vZ+drHfVgjJJ5u1YrMCWNL5C2utFbyF9Obw9ZAwm61MSbPQL9JwznhNlCh7F2ANW
+ZHWQPNcOAJqzE4uVcJB1ZeVl28ORYY1668lx+s9yYeMXk3QQdj4xmdnvoBFggqRB
+ZR6Z0D7ZohADXe024RzEo1TukrQgKQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBT7Vs4Y5uG/9aXnYGNMEs6ycPUT3jAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBACN4Htp2PvGcQA0/sAS+qUVWWJoAXSsu8Pgc6Gar
+7tKVlNJ/4W/a6pUV2Xo/Tz3msg4yiE8sMESp2k+USosD5n9Alai5s5qpWDQjrqrh
+76AGyF2nzve4kIN19GArYhm4Mz/EKEG1QHYvBDGgXi3kNvL/a2Zbybp+3LevG+q7
+xtx4Sz9yIyMzuT/6Y7ijtiMZ9XbuxGf5wab8UtwT3Xq1UradJy0KCkzRJAz/Wy/X
+HbTkEvKSaYKExH6sLo0jqdIjV/d2Io31gt4e0Ly1ER2wPyFa+pc/swu7HCzrN+iz
+A2ZM4+KX9nBvFyfkHLix4rALg+WTYJa/dIsObXkdZ3z8qPf5A9PXlULiaa1mcP4+
+rokw74IyLEYooQ8iSOjxumXhnkTS69MAdGzXYE5gnHokABtGD+BB5qLhtLt4fqAp
+8AyHpQWMyV42M9SJLzQ+iOz7kAgJOBOaVtJI3FV/iAg/eqWVm3yLuUTWDxSHrKuL
+N19+pSjF6TNvUSFXwEa2LJkfDqIOCE32iOuy85QY//3NsgrSQF6UkSPa95eJrSGI
+3hTRYYh3Up2GhBGl1KUy7/o0k3KRZTk4s38fylY8bZ3TakUOH5iIGoHyFVVcp361
+Pyy25SzFSmNalWoQd9wZVc/Cps2ldxhcttM+WLkFNzprd0VJa8qTz8vYtHP0ouDN
+nWS0
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtDCCAjmgAwIBAgIQKKqVZvk6NsLET+uYv5myCzAKBggqhkjOPQQDAzCBmTEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTIwMAYDVQQDDClBbWF6
+b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTAgFw0yMjEyMDIyMDMyMjBaGA8yMTIyMTIwMjIxMzIyMFowgZkxCzAJ
+BgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMw
+EQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1hem9u
+IFJEUyBpbC1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASYwfvj8BmvLAP6UkNQ4X4dXBB/
+webBO7swW+8HnFN2DAu+Cn/lpcDpu+dys1JmkVX435lrCH3oZjol0kCDIM1lF4Cv
++78yoY1Jr/YMat22E4iz4AZd9q0NToS7+ZA0r2yjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFO/8Py16qPr7J2GWpvxlTMB+op7XMA4GA1UdDwEB/wQEAwIB
+hjAKBggqhkjOPQQDAwNpADBmAjEAwk+rg788+u8JL6sdix7l57WTo8E/M+o3TO5x
+uRuPdShrBFm4ArGR2PPs4zCQuKgqAjEAi0TA3PVqAxKpoz+Ps8/054p9WTgDfBFZ
+i/lm2yTaPs0xjY6FNWoy7fsVw5oEKxOn
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAOY7gfcBZgR2tqfBzMbFQCUwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNCBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjIwNTI1MTY1NDU5WhgPMjEyMjA1MjUxNzU0NTla
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTQgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+lfxER43FuLRdL08bddF0YhbCP+XXKj1A/TFMXmd2My8XDei8rPXFYyyjMig9+xZw
+uAsIxLwz8uiA26CKA8bCZKg5VG2kTeOJAfvBJaLv1CZefs3Z4Uf1Sjvm6MF2yqEj
+GoORfyfL9HiZFTDuF/hcjWoKYCfMuG6M/wO8IbdICrX3n+BiYQJu/pFO660Mg3h/
+8YBBWYDbHoCiH/vkqqJugQ5BM3OI5nsElW51P1icEEqti4AZ7JmtSv9t7fIFBVyR
+oaEyOgpp0sm193F/cDJQdssvjoOnaubsSYm1ep3awZAUyGN/X8MBrPY95d0hLhfH
+Ehc5Icyg+hsosBljlAyksmt4hFQ9iBnWIz/ZTfGMck+6p3HVL9RDgvluez+rWv59
+8q7omUGsiPApy5PDdwI/Wt/KtC34/2sjslIJfvgifdAtkRPkhff1WEwER00ADrN9
+eGGInaCpJfb1Rq8cV2n00jxg7DcEd65VR3dmIRb0bL+jWK62ni/WdEyomAOMfmGj
+aWf78S/4rasHllWJ+QwnaUYY3u6N8Cgio0/ep4i34FxMXqMV3V0/qXdfhyabi/LM
+wCxNo1Dwt+s6OtPJbwO92JL+829QAxydfmaMTeHBsgMPkG7RwAekeuatKGHNsc2Z
+x2Q4C2wVvOGAhcHwxfM8JfZs3nDSZJndtVVnFlUY0UECAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUpnG7mWazy6k97/tb5iduRB3RXgQwDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCDLqq1Wwa9Tkuv7vxBnIeVvvFF
+ecTn+P+wJxl9Qa2ortzqTHZsBDyJO62d04AgBwiDXkJ9a+bthgG0H1J7Xee8xqv1
+xyX2yKj24ygHjspLotKP4eDMdDi5TYq+gdkbPmm9Q69B1+W6e049JVGXvWG8/7kU
+igxeuCYwtCCdUPRLf6D8y+1XMGgVv3/DSOHWvTg3MJ1wJ3n3+eve3rjGdRYWZeJu
+k21HLSZYzVrCtUsh2YAeLnUbSxVuT2Xr4JehYe9zW5HEQ8Je/OUfnCy9vzoN/ITw
+osAH+EBJQey7RxEDqMwCaRefH0yeHFcnOll0OXg/urnQmwbEYzQ1uutJaBPsjU0J
+Qf06sMxI7GiB5nPE+CnI2sM6A9AW9kvwexGXpNJiLxF8dvPQthpOKGcYu6BFvRmt
+6ctfXd9b7JJoVqMWuf5cCY6ihpk1e9JTlAqu4Eb/7JNyGiGCR40iSLvV28un9wiE
+plrdYxwcNYq851BEu3r3AyYWw/UW1AKJ5tM+/Gtok+AphMC9ywT66o/Kfu44mOWm
+L3nSLSWEcgfUVgrikpnyGbUnGtgCmHiMlUtNVexcE7OtCIZoVAlCGKNu7tyuJf10
+Qlk8oIIzfSIlcbHpOYoN79FkLoDNc2er4Gd+7w1oPQmdAB0jBJnA6t0OUBPKdDdE
+Ufff2jrbfbzECn1ELg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgIQIuO1A8LOnmc7zZ/vMm3TrDANBgkqhkiG9w0BAQwFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yMTA1MjQyMDQ2MThaGA8yMTIxMDUyNDIxNDYxOFow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDq
+qRHKbG8ZK6/GkGm2cenznEF06yHwI1gD5sdsHjTgekDZ2Dl9RwtDmUH2zFuIQwGj
+SeC7E2iKwrJRA5wYzL9/Vk8NOILEKQOP8OIKUHbc7q8rEtjs401KcU6pFBBEdO9G
+CTiRhogq+8mhC13AM/UriZJbKhwgM2UaDOzAneGMhQAGjH8z83NsNcPxpYVE7tqM
+sch5yLtIJLkJRusrmQQTeHUev16YNqyUa+LuFclFL0FzFCimkcxUhXlbfEKXbssS
+yPzjiv8wokGyo7+gA0SueceMO2UjfGfute3HlXZDcNvBbkSY+ver41jPydyRD6Qq
+oEkh0tyIbPoa3oU74kwipJtz6KBEA3u3iq61OUR0ENhR2NeP7CSKrC24SnQJZ/92
+qxusrbyV/0w+U4m62ug/o4hWNK1lUcc2AqiBOvCSJ7qpdteTFxcEIzDwYfERDx6a
+d9+3IPvzMb0ZCxBIIUFMxLTF7yAxI9s6KZBBXSZ6tDcCCYIgEysEPRWMRAcG+ye/
+fZVn9Vnzsj4/2wchC2eQrYpb1QvG4eMXA4M5tFHKi+/8cOPiUzJRgwS222J8YuDj
+yEBval874OzXk8H8Mj0JXJ/jH66WuxcBbh5K7Rp5oJn7yju9yqX6qubY8gVeMZ1i
+u4oXCopefDqa35JplQNUXbWwSebi0qJ4EK0V8F9Q+QIDAQABo0IwQDAPBgNVHRMB
+Af8EBTADAQH/MB0GA1UdDgQWBBT4ysqCxaPe7y+g1KUIAenqu8PAgzAOBgNVHQ8B
+Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBALU8WN35KAjPZEX65tobtCDQFkIO
+uJjv0alD7qLB0i9eY80C+kD87HKqdMDJv50a5fZdqOta8BrHutgFtDm+xo5F/1M3
+u5/Vva5lV4xy5DqPajcF4Mw52czYBmeiLRTnyPJsU93EQIC2Bp4Egvb6LI4cMOgm
+4pY2hL8DojOC5PXt4B1/7c1DNcJX3CMzHDm4SMwiv2MAxSuC/cbHXcWMk+qXdrVx
++ayLUSh8acaAOy3KLs1MVExJ6j9iFIGsDVsO4vr4ZNsYQiyHjp+L8ops6YVBO5AT
+k/pI+axHIVsO5qiD4cFWvkGqmZ0gsVtgGUchZaacboyFsVmo6QPrl28l6LwxkIEv
+GGJYvIBW8sfqtGRspjfX5TlNy5IgW/VOwGBdHHsvg/xpRo31PR3HOFw7uPBi7cAr
+FiZRLJut7af98EB2UvovZnOh7uIEGPeecQWeOTQfJeWet2FqTzFYd0NUMgqPuJx1
+vLKferP+ajAZLJvVnW1J7Vccx/pm0rMiUJEf0LRb/6XFxx7T2RGjJTi0EzXODTYI
+gnLfBBjnolQqw+emf4pJ4pAtly0Gq1KoxTG2QN+wTd4lsCMjnelklFDjejwnl7Uy
+vtxzRBAu/hi/AqDkDFf94m6j+edIrjbi9/JDFtQ9EDlyeqPgw0qwi2fwtJyMD45V
+fejbXelUSJSzDIdY
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRALKta9z9tKpZhJN2aJJe8ekwDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBhcC1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTI1MDIwMTAwMTAyNloYDzIxMjUwMjAxMDExMDI2WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGFwLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCg3M+MSjABBW+N
+IIlr+XMnQoMYy40snt+HM7GFCSTC/NvYxbaMa5DuEy2gPXvtioO0bQrc0tw4VsHv
+seudmrO0I2OBzEqvB6y0c7DWcAmDVQyccoth35ueXpxowhl6JqHPyKTB3TXXU30F
+zku4HujjEoOzveIa8kfRnwkNySMXlKic6aBPcefoxjECrdlmJJHR6k/kFzAerWht
+kPUmgMCjYH4gu+JLf8caEvPwmGrzWcUFEzcaF880O2bP+4dpcklfU6Vu5/8DzJyU
+BVpBLaMoD3yvee4No5YSa0FvAGFUy50TWC2ycMDCcn7R0NCHBgQmwlalwEor8rr/
+ntnRhor/do98VZlTJmTS4WmYH3BZHVJar2kBDbb8mtxXrZzaXn92r20QvehD1QEA
+8OFllftP7UVcLCWUL0CTsW6jzciTfSgYJNkWN/RCXZFaaGRZp+kHJ9m2eWAJqICH
+oug9KFDgBCW68GJiZM+Xs86Vt/sNfu1u9JMAgeDvSeMpaHJRw3EJuS7fP8x7Tj8u
+RUY+TbLnsSFYDzPMiup0CZjS1aqQn3jQMp8AWlP59mUbGq5OKNZ/HTDGKNFcvo9X
+hkxdE305j+K1lcfNmaS7ACI8PyLgkIS8KAEK+H5ib4Z/+lF5Z8hvNxK//DmlXlWb
+YfmQVckZfM4R8ny8DiQQRfAZ1LszwQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBT5hL3+jgVmIfysNjG07vfdRLyP0zAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBAHjQevQPydKkUu2mT2wmwi9ukD07gt6r1vdTHqjs
+qbfqnH/BMGkaLsu5ECgcTyesueVVYQxDsRSPQr/EQh/knx5qAbJtV0IwiwXHFcat
+JZ4lCh8Acuh1Lk2GbDzkJjkNh4QuriN5RCF6a8wqcjceuulKAo/oLxfI563M7bBQ
+qs+NV5wqyeHsjVhK8xdgnGqxAyDQVOwVtaiZYmdGF0GwRAibYNs7JsPa1ZdDnPhI
+rpAzOSE5W1gHSLC/NcQe2pHmgjNcr8KfxjVC6WgZ1IqiVNxGVjNBooT0lk4oi1w/
+TrWjTC3EhiwoU6ta/o2qBYQ+YVl9uleeIAhfqV+r4xgKfWWVvldA/VAyZBZzUwOF
+JuD0TeiEjF6jllV49PxkI+P9oxa+JzUErrD0oQVEljkCCY7liGc2hWVUCWi7m+9D
+BNunnlSwW9YOfnj1YX4tMD/62DJKH49wNh+sQb4PR9LKk5xwJQXBcPxMqgm+9BzY
+Jb63ZG3l9Y4sQSnDUPCc64I7S7rhxpuaSypS6IB343F6UQTKTaiKLFkuhs3p6kd3
+rOzKVzieh3ejrpolg/8KZXBSahp2PBkFtFBIA7r5iy19LT7qhmK1KrZUuC/8CPrC
+HtnCzGNHi9Xgho/LIvFkGtDYyKEQlj/mNoWOjqqsphEYZOsG1qyIhY+9HG3XTLQE
+7BP7
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAN7Y9G9i4I+ZaslPobE7VL4wDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIwMTYzMzIzWhgPMjEyMTA1MjAxNzMzMjNa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+4BEPCiIfiK66Q/qa8k+eqf1Q3qsa6Xuu/fPkpuStXVBShhtXd3eqrM0iT4Xxs420
+Va0vSB3oZ7l86P9zYfa60n6PzRxdYFckYX330aI7L/oFIdaodB/C9szvROI0oLG+
+6RwmIF2zcprH0cTby8MiM7G3v9ykpq27g4WhDC1if2j8giOQL3oHpUaByekZNIHF
+dIllsI3RkXmR3xmmxoOxJM1B9MZi7e1CvuVtTGOnSGpNCQiqofehTGwxCN2wFSK8
+xysaWlw48G0VzZs7cbxoXMH9QbMpb4tpk0d+T8JfAPu6uWO9UwCLWWydf0CkmA/+
+D50/xd1t33X9P4FEaPSg5lYbHXzSLWn7oLbrN2UqMLaQrkoEBg/VGvzmfN0mbflw
++T87bJ/VEOVNlG+gepyCTf89qIQVWOjuYMox4sK0PjzZGsYEuYiq1+OUT3vk/e5K
+ag1fCcq2Isy4/iwB2xcXrsQ6ljwdk1fc+EmOnjGKrhuOHJY3S+RFv4ToQBsVyYhC
+XGaC3EkqIX0xaCpDimxYhFjWhpDXAjG/zJ+hRLDAMCMhl/LPGRk/D1kzSbPmdjpl
+lEMK5695PeBvEBTQdBQdOiYgOU3vWU6tzwwHfiM2/wgvess/q0FDAHfJhppbgbb9
+3vgsIUcsvoC5o29JvMsUxsDRvsAfEmMSDGkJoA/X6GECAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUgEWm1mZCbGD6ytbwk2UU1aLaOUUwDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBb4+ABTGBGwxK1U/q4g8JDqTQM
+1Wh8Oz8yAk4XtPJMAmCctxbd81cRnSnePWw/hxViLVtkZ/GsemvXfqAQyOn1coN7
+QeYSw+ZOlu0j2jEJVynmgsR7nIRqE7QkCyZAU+d2FTJUfmee+IiBiGyFGgxz9n7A
+JhBZ/eahBbiuoOik/APW2JWLh0xp0W0GznfJ8lAlaQTyDa8iDXmVtbJg9P9qzkvl
+FgPXQttzEOyooF8Pb2LCZO4kUz+1sbU7tHdr2YE+SXxt6D3SBv+Yf0FlvyWLiqVk
+GDEOlPPTDSjAWgKnqST8UJ0RDcZK/v1ixs7ayqQJU0GUQm1I7LGTErWXHMnCuHKe
+UKYuiSZwmTcJ06NgdhcCnGZgPq13ryMDqxPeltQc3n5eO7f1cL9ERYLDLOzm6A9P
+oQ3MfcVOsbHgGHZWaPSeNrQRN9xefqBXH0ZPasgcH9WJdsLlEjVUXoultaHOKx3b
+UCCb+d3EfqF6pRT488ippOL6bk7zNubwhRa/+y4wjZtwe3kAX78ACJVcjPobH9jZ
+ErySads5zdQeaoee5wRKdp3TOfvuCe4bwLRdhOLCHWzEcXzY3g/6+ppLvNom8o+h
+Bh5X26G6KSfr9tqhQ3O9IcbARjnuPbvtJnoPY0gz3EHHGPhy0RNW8i2gl3nUp0ah
+PtjwbKW0hYAhIttT0Q==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtzCCAj2gAwIBAgIQQRBQTs6Y3H1DDbpHGta3lzAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDYxMTAwMTI0M1oYDzIxMjEwNjExMDExMjQzWjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEs0942Xj4m/gKA+WA6F5h
+AHYuek9eGpzTRoLJddM4rEV1T3eSueytMVKOSlS3Ub9IhyQrH2D8EHsLYk9ktnGR
+pATk0kCYTqFbB7onNo070lmMJmGT/Q7NgwC8cySChFxbo0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBQ20iKBKiNkcbIZRu0y1uoF1yJTEzAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIwYv0wTSrpQTaPaarfLN8Xcqrqu3hzl07n
+FrESIoRw6Cx77ZscFi2/MV6AFyjCV/TlAjEAhpwJ3tpzPXpThRML8DMJYZ3YgMh3
+CMuLqhPpla3cL0PhybrD27hJWl29C4el6aMO
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrDCCAjOgAwIBAgIQGcztRyV40pyMKbNeSN+vXTAKBggqhkjOPQQDAzCBljEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6
+b24gUkRTIHVzLWVhc3QtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTAgFw0yMTA1MjEyMzE1NTZaGA8yMTIxMDUyMjAwMTU1NlowgZYxCzAJBgNV
+BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD
+VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE
+UyB1cy1lYXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfDcv+GGRESD9wT+I5YIPRsD3L+/jsiIis
+Tr7t9RSbFl+gYpO7ZbDXvNbV5UGOC5lMJo/SnqFRTC6vL06NF7qOHfig3XO8QnQz
+6T5uhhrhnX2RSY3/10d2kTyHq3ZZg3+jQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFLDyD3PRyNXpvKHPYYxjHXWOgfPnMA4GA1UdDwEB/wQEAwIBhjAKBggq
+hkjOPQQDAwNnADBkAjB20HQp6YL7CqYD82KaLGzgw305aUKw2aMrdkBR29J183jY
+6Ocj9+Wcif9xnRMS+7oCMAvrt03rbh4SU9BohpRUcQ2Pjkh7RoY0jDR4Xq4qzjNr
+5UFr3BXpFvACxXF51BksGQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjWgAwIBAgIQeKbS5zvtqDvRtwr5H48cAjAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTIwMTcxOTU1WhgPMjEyMTA1MjAxODE5NTVaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgbWUtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABEKjgUaAPmUlRMEQdBC7BScAGosJ1zRV
+LDd38qTBjzgmwBfQJ5ZfGIvyEK5unB09MB4e/3qqK5I/L6Qn5Px/n5g4dq0c7MQZ
+u7G9GBYm90U3WRJBf7lQrPStXaRnS4A/O6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUNKcAbGEIn03/vkwd8g6jNyiRdD4wDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2cAMGQCMHIeTrjenCSYuGC6txuBt/0ZwnM/ciO9kHGWVCoK8QLs
+jGghb5/YSFGZbmQ6qpGlSAIwVOQgdFfTpEfe5i+Vs9frLJ4QKAfc27cTNYzRIM0I
+E+AJgK4C4+DiyyMzOpiCfmvq
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgIQSFkEUzu9FYgC5dW+5lnTgjANBgkqhkiG9w0BAQwFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yMTA2MTEwMDA4MzZaGA8yMTIxMDYxMTAxMDgzNlow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDx
+my5Qmd8zdwaI/KOKV9Xar9oNbhJP5ED0JCiigkuvCkg5qM36klszE8JhsUj40xpp
+vQw9wkYW4y+C8twBpzKGBvakqMnoaVUV7lOCKx0RofrnNwkZCboTBB4X/GCZ3fIl
+YTybS7Ehi1UuiaZspIT5A2jidoA8HiBPk+mTg1UUkoWS9h+MEAPa8L4DY6fGf4pO
+J1Gk2cdePuNzzIrpm2yPto+I8MRROwZ3ha7ooyymOXKtz2c7jEHHJ314boCXAv9G
+cdo27WiebewZkHHH7Zx9iTIVuuk2abyVSzvLVeGv7Nuy4lmSqa5clWYqWsGXxvZ2
+0fZC5Gd+BDUMW1eSpW7QDTk3top6x/coNoWuLSfXiC5ZrJkIKimSp9iguULgpK7G
+abMMN4PR+O+vhcB8E879hcwmS2yd3IwcPTl3QXxufqeSV58/h2ibkqb/W4Bvggf6
+5JMHQPlPHOqMCVFIHP1IffIo+Of7clb30g9FD2j3F4qgV3OLwEDNg/zuO1DiAvH1
+L+OnmGHkfbtYz+AVApkAZrxMWwoYrwpauyBusvSzwRE24vLTd2i80ZDH422QBLXG
+rN7Zas8rwIiBKacJLYtBYETw8mfsNt8gb72aIQX6cZOsphqp6hUtKaiMTVgGazl7
+tBXqbB+sIv3S9X6bM4cZJKkMJOXbnyCCLZFYv8TurwIDAQABo0IwQDAPBgNVHRMB
+Af8EBTADAQH/MB0GA1UdDgQWBBTOVtaS1b/lz6yJDvNk65vEastbQTAOBgNVHQ8B
+Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBABEONg+TmMZM/PrYGNAfB4S41zp1
+3CVjslZswh/pC4kgXSf8cPJiUOzMwUevuFQj7tCqxQtJEygJM2IFg4ViInIah2kh
+xlRakEGGw2dEVlxZAmmLWxlL1s1lN1565t5kgVwM0GVfwYM2xEvUaby6KDVJIkD3
+aM6sFDBshvVA70qOggM6kU6mwTbivOROzfoIQDnVaT+LQjHqY/T+ok6IN0YXXCWl
+Favai8RDjzLDFwXSRvgIK+1c49vlFFY4W9Efp7Z9tPSZU1TvWUcKdAtV8P2fPHAS
+vAZ+g9JuNfeawhEibjXkwg6Z/yFUueQCQOs9TRXYogzp5CMMkfdNJF8byKYqHscs
+UosIcETnHwqwban99u35sWcoDZPr6aBIrz7LGKTJrL8Nis8qHqnqQBXu/fsQEN8u
+zJ2LBi8sievnzd0qI0kaWmg8GzZmYH1JCt1GXSqOFkI8FMy2bahP7TUQR1LBUKQ3
+hrOSqldkhN+cSAOnvbQcFzLr+iEYEk34+NhcMIFVE+51KJ1n6+zISOinr6mI3ckX
+6p2tmiCD4Shk2Xx/VTY/KGvQWKFcQApWezBSvDNlGe0yV71LtLf3dr1pr4ofo7cE
+rYucCJ40bfxEU/fmzYdBF32xP7AOD9U0FbOR3Mcthc6Z6w20WFC+zru8FGY08gPf
+WT1QcNdw7ntUJP/w
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrzCCAjWgAwIBAgIQARky6+5PNFRkFVOp3Ob1CTAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjIwNTIzMTg0MTI4WhgPMjEyMjA1MjMxOTQxMjdaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgZXUtc291dGgtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABNVGL5oF7cfIBxKyWd2PVK/S5yQfaJY3
+QFHWvEdt6951n9JhiiPrHzfVHsxZp1CBjILRMzjgRbYWmc8qRoLkgGE7htGdwudJ
+Fa/WuKzO574Prv4iZXUnVGTboC7JdvKbh6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUgDeIIEKynwUbNXApdIPnmRWieZwwDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2gAMGUCMEOOJfucrST+FxuqJkMZyCM3gWGZaB+/w6+XUAJC6hFM
+uSTY0F44/bERkA4XhH+YGAIxAIpJQBakCA1/mXjsTnQ+0El9ty+LODp8ibkn031c
+8DKDS7pR9UK7ZYdR6zFg3ZCjQw==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjOgAwIBAgIQJvkWUcYLbnxtuwnyjMmntDAKBggqhkjOPQQDAzCBljEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6
+b24gUkRTIGV1LXdlc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTAgFw0yMTA1MjUyMjI2MTJaGA8yMTIxMDUyNTIzMjYxMlowgZYxCzAJBgNV
+BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD
+VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE
+UyBldS13ZXN0LTMgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw
+djAQBgcqhkjOPQIBBgUrgQQAIgNiAARENn8uHCyjn1dFax4OeXxvbV861qsXFD9G
+DshumTmFzWWHN/69WN/AOsxy9XN5S7Cgad4gQgeYYYgZ5taw+tFo/jQvCLY//uR5
+uihcLuLJ78opvRPvD9kbWZ6oXfBtFkWjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFKiK3LpoF+gDnqPldGSwChBPCYciMA4GA1UdDwEB/wQEAwIBhjAKBggq
+hkjOPQQDAwNpADBmAjEA+7qfvRlnvF1Aosyp9HzxxCbN7VKu+QXXPhLEBWa5oeWW
+UOcifunf/IVLC4/FGCsLAjEAte1AYp+iJyOHDB8UYkhBE/1sxnFaTiEPbvQBU0wZ
+SuwWVLhu2wWDuSW+K7tTuL8p
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAKeDpqX5WFCGNo94M4v69sUwDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBldS13ZXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNTIyMTgzM1oYDzIwNjEwNTI1MjMxODMzWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LXdlc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCcKOTEMTfzvs4H
+WtJR8gI7GXN6xesulWtZPv21oT+fLGwJ+9Bv8ADCGDDrDxfeH/HxJmzG9hgVAzVn
+4g97Bn7q07tGZM5pVi96/aNp11velZT7spOJKfJDZTlGns6DPdHmx48whpdO+dOb
+6+eR0VwCIv+Vl1fWXgoACXYCoKjhxJs+R+fwY//0JJ1YG8yjZ+ghLCJmvlkOJmE1
+TCPUyIENaEONd6T+FHGLVYRRxC2cPO65Jc4yQjsXvvQypoGgx7FwD5voNJnFMdyY
+754JGPOOe/SZdepN7Tz7UEq8kn7NQSbhmCsgA/Hkjkchz96qN/YJ+H/okiQUTNB0
+eG9ogiVFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFjayw9Y
+MjbxfF14XAhMM2VPl0PfMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAAtmx6d9+9CWlMoU0JCirtp4dSS41bBfb9Oor6GQ8WIr2LdfZLL6uES/ubJPE
+1Sh5Vu/Zon5/MbqLMVrfniv3UpQIof37jKXsjZJFE1JVD/qQfRzG8AlBkYgHNEiS
+VtD4lFxERmaCkY1tjKB4Dbd5hfhdrDy29618ZjbSP7NwAfnwb96jobCmMKgxVGiH
+UqsLSiEBZ33b2hI7PJ6iTJnYBWGuiDnsWzKRmheA4nxwbmcQSfjbrNwa93w3caL2
+v/4u54Kcasvcu3yFsUwJygt8z43jsGAemNZsS7GWESxVVlW93MJRn6M+MMakkl9L
+tWaXdHZ+KUV7LhfYLb0ajvb40w==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBDCCAuygAwIBAgIQJ5oxPEjefCsaESSwrxk68DANBgkqhkiG9w0BAQsFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGV1LWNlbnRyYWwtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjIwNjA2MjExNzA1WhgPMjA2MjA2MDYyMjE3MDVaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALTQt5eX
+g+VP3BjO9VBkWJhE0GfLrU/QIk32I6WvrnejayTrlup9H1z4QWlXF7GNJrqScRMY
+KhJHlcP05aPsx1lYco6pdFOf42ybXyWHHJdShj4A5glU81GTT+VrXGzHSarLmtua
+eozkQgPpDsSlPt0RefyTyel7r3Cq+5K/4vyjCTcIqbfgaGwTU36ffjM1LaPCuE4O
+nINMeD6YuImt2hU/mFl20FZ+IZQUIFZZU7pxGLqTRz/PWcH8tDDxnkYg7tNuXOeN
+JbTpXrw7St50/E9ZQ0llGS+MxJD8jGRAa/oL4G/cwnV8P2OEPVVkgN9xDDQeieo0
+3xkzolkDkmeKOnUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+bwu8635iQGQMRanekesORM8Hkm4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB
+CwUAA4IBAQAgN6LE9mUgjsj6xGCX1afYE69fnmCjjb0rC6eEe1mb/QZNcyw4XBIW
+6+zTXo4mjZ4ffoxb//R0/+vdTE7IvaLgfAZgFsLKJCtYDDstXZj8ujQnGR9Pig3R
+W+LpNacvOOSJSawNQq0Xrlcu55AU4buyD5VjcICnfF1dqBMnGTnh27m/scd/ZMx/
+kapHZ/fMoK2mAgSX/NvUKF3UkhT85vSSM2BTtET33DzCPDQTZQYxFBa4rFRmFi4c
+BLlmIReiCGyh3eJhuUUuYAbK6wLaRyPsyEcIOLMQmZe1+gAFm1+1/q5Ke9ugBmjf
+PbTWjsi/lfZ5CdVAhc5lmZj/l5aKqwaS
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAKKPTYKln9L4NTx9dpZGUjowCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyBldS13ZXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTIxMjI1NTIxWhgPMjEyMTA1MjEyMzU1MjFaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgZXUtd2VzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE/owTReDvaRqdmbtTzXbyRmEpKCETNj6O
+hZMKH0F8oU9Tmn8RU7kQQj6xUKEyjLPrFBN7c+26TvrVO1KmJAvbc8bVliiJZMbc
+C0yV5PtJTalvlMZA1NnciZuhxaxrzlK1o0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBT4i5HaoHtrs7Mi8auLhMbKM1XevDAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIxAK9A+8/lFdX4XJKgfP+ZLy5ySXC2E0Spoy12Gv2GdUEZ
+p1G7c1KbWVlyb1d6subzkQIwKyH0Naf/3usWfftkmq8SzagicKz5cGcEUaULq4tO
+GzA/AMpr63IDBAqkZbMDTCmH
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrzCCAjWgAwIBAgIQTgIvwTDuNWQo0Oe1sOPQEzAKBggqhkjOPQQDAzCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTI0MjEwNjM4WhgPMjEyMTA1MjQyMjA2MzhaMIGXMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
+RFMgZXUtbm9ydGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
+ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJuzXLU8q6WwSKXBvx8BbdIi3mPhb7Xo
+rNJBfuMW1XRj5BcKH1ZoGaDGw+BIIwyBJg8qNmCK8kqIb4cH8/Hbo3Y+xBJyoXq/
+cuk8aPrxiNoRsKWwiDHCsVxaK9L7GhHHAqNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
+BgNVHQ4EFgQUYgcsdU4fm5xtuqLNppkfTHM2QMYwDgYDVR0PAQH/BAQDAgGGMAoG
+CCqGSM49BAMDA2gAMGUCMQDz/Rm89+QJOWJecYAmYcBWCcETASyoK1kbr4vw7Hsg
+7Ew3LpLeq4IRmTyuiTMl0gMCMAa0QSjfAnxBKGhAnYxcNJSntUyyMpaXzur43ec0
+3D8npJghwC4DuICtKEkQiI5cSg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAORIGqQXLTcbbYT2upIsSnQwDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBldS1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMjA1MjMxODM0MjJaGA8yMTIyMDUyMzE5MzQyMlowgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBldS1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPKukwsW2s/h
+1k+Hf65pOP0knVBnOnMQyT1mopp2XHGdXznj9xS49S30jYoUnWccyXgD983A1bzu
+w4fuJRHg4MFdz/NWTgXvy+zy0Roe83OPIJjUmXnnzwUHQcBa9vl6XUO65iQ3pbSi
+fQfNDFXD8cvuXbkezeADoy+iFAlzhXTzV9MD44GTuo9Z3qAXNGHQCrgRSCL7uRYt
+t1nfwboCbsVRnElopn2cTigyVXE62HzBUmAw1GTbAZeFAqCn5giBWYAfHwTUldRL
+6eEa6atfsS2oPNus4ZENa1iQxXq7ft+pMdNt0qKXTCZiiCZjmLkY0V9kWwHTRRF8
+r+75oSL//3di43QnuSCgjwMRIeWNtMud5jf3eQzSBci+9njb6DrrSUbx7blP0srg
+94/C/fYOp/0/EHH34w99Th14VVuGWgDgKahT9/COychLOubXUT6vD1As47S9KxTv
+yYleVKwJnF9cVjepODN72fNlEf74BwzgSIhUmhksmZSeJBabrjSUj3pdyo/iRZN/
+CiYz9YPQ29eXHPQjBZVIUqWbOVfdwsx0/Xu5T1e7yyXByQ3/oDulahtcoKPAFQ3J
+ee6NJK655MdS7pM9hJnU2Rzu3qZ/GkM6YK7xTlMXVouPUZov/VbiaCKbqYDs8Dg+
+UKdeNXAT6+BMleGQzly1X7vjhgeA8ugVAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFJdaPwpCf78UolFTEn6GO85/QwUIMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEAWkxHIT3mers5YnZRSVjmpxCLivGj1jMB9VYC
+iKqTAeIvD0940L0YaZgivQll5pue8UUcQ6M2uCdVVAsNJdmQ5XHIYiGOknYPtxzO
+aO+bnZp7VIZw/vJ49hvH6RreA2bbxYMZO/ossYdcWsWbOKHFrRmAw0AhtK/my51g
+obV7eQg+WmlE5Iqc75ycUsoZdc3NimkjBi7LQoNP1HMvlLHlF71UZhQDdq+/WdV7
+0zmg+epkki1LjgMmuPyb+xWuYkFKT1/faX+Xs62hIm5BY+aI4if4RuQ+J//0pOSs
+UajrjTo+jLGB8A96jAe8HaFQenbwMjlaHRDAF0wvbkYrMr5a6EbneAB37V05QD0Y
+Rh4L4RrSs9DX2hbSmS6iLDuPEjanHKzglF5ePEvnItbRvGGkynqDVlwF+Bqfnw8l
+0i8Hr1f1/LP1c075UjkvsHlUnGgPbLqA0rDdcxF8Fdlv1BunUjX0pVlz10Ha5M6P
+AdyWUOneOfaA5G7jjv7i9qg3r99JNs1/Lmyg/tV++gnWTAsSPFSSEte81kmPhlK3
+2UtAO47nOdTtk+q4VIRAwY1MaOR7wTFZPfer1mWs4RhKNu/odp8urEY87iIzbMWT
+QYO/4I6BGj9rEWNGncvR5XTowwIthMCj2KWKM3Z/JxvjVFylSf+s+FFfO1bNIm6h
+u3UBpZI=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtDCCAjmgAwIBAgIQenQbcP/Zbj9JxvZ+jXbRnTAKBggqhkjOPQQDAzCBmTEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTIwMAYDVQQDDClBbWF6
+b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTAgFw0yMTA1MjEyMjMzMjRaGA8yMTIxMDUyMTIzMzMyNFowgZkxCzAJ
+BgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMw
+EQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1hem9u
+IFJEUyBldS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATlBHiEM9LoEb1Hdnd5j2VpCDOU
+5nGuFoBD8ROUCkFLFh5mHrHfPXwBc63heW9WrP3qnDEm+UZEUvW7ROvtWCTPZdLz
+Z4XaqgAlSqeE2VfUyZOZzBSgUUJk7OlznXfkCMOjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFDT/ThjQZl42Nv/4Z/7JYaPNMly2MA4GA1UdDwEB/wQEAwIB
+hjAKBggqhkjOPQQDAwNpADBmAjEAnZWmSgpEbmq+oiCa13l5aGmxSlfp9h12Orvw
+Dq/W5cENJz891QD0ufOsic5oGq1JAjEAp5kSJj0MxJBTHQze1Aa9gG4sjHBxXn98
+4MP1VGsQuhfndNHQb4V0Au7OWnOeiobq
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/zCCAuegAwIBAgIRAMgnyikWz46xY6yRgiYwZ3swDQYJKoZIhvcNAQELBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMDE2NDkxMloYDzIwNjEwNTIwMTc0OTEyWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCi8JYOc9cYSgZH
+gYPxLk6Xcc7HqzamvsnjYU98Dcb98y6iDqS46Ra2Ne02MITtU5MDL+qjxb8WGDZV
+RUA9ZS69tkTO3gldW8QdiSh3J6hVNJQW81F0M7ZWgV0gB3n76WCmfT4IWos0AXHM
+5v7M/M4tqVmCPViQnZb2kdVlM3/Xc9GInfSMCgNfwHPTXl+PXX+xCdNBePaP/A5C
+5S0oK3HiXaKGQAy3K7VnaQaYdiv32XUatlM4K2WS4AMKt+2cw3hTCjlmqKRHvYFQ
+veWCXAuc+U5PQDJ9SuxB1buFJZhT4VP3JagOuZbh5NWpIbOTxlAJOb5pGEDuJTKi
+1gQQQVEFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNXm+N87
+OFxK9Af/bjSxDCiulGUzMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC
+AQEAkqIbkgZ45spvrgRQ6n9VKzDLvNg+WciLtmVrqyohwwJbj4pYvWwnKQCkVc7c
+hUOSBmlSBa5REAPbH5o8bdt00FPRrD6BdXLXhaECKgjsHe1WW08nsequRKD8xVmc
+8bEX6sw/utBeBV3mB+3Zv7ejYAbDFM4vnRsWtO+XqgReOgrl+cwdA6SNQT9oW3e5
+rSQ+VaXgJtl9NhkiIysq9BeYigxqS/A13pHQp0COMwS8nz+kBPHhJTsajHCDc8F4
+HfLi6cgs9G0gaRhT8FCH66OdGSqn196sE7Y3bPFFFs/3U+vxvmQgoZC6jegQXAg5
+Prxd+VNXtNI/azitTysQPumH7A==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEBTCCAu2gAwIBAgIRAO8bekN7rUReuNPG8pSTKtEwDQYJKoZIhvcNAQELBQAw
+gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq
+QW1hem9uIFJEUyBldS1jZW50cmFsLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYD
+VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMjM0N1oYDzIwNjEwNTIxMjMyMzQ3WjCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV
+BAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCTTYds
+Tray+Q9VA5j5jTh5TunHKFQzn68ZbOzdqaoi/Rq4ohfC0xdLrxCpfqn2TGDHN6Zi
+2qGK1tWJZEd1H0trhzd9d1CtGK+3cjabUmz/TjSW/qBar7e9MA67/iJ74Gc+Ww43
+A0xPNIWcL4aLrHaLm7sHgAO2UCKsrBUpxErOAACERScVYwPAfu79xeFcX7DmcX+e
+lIqY16pQAvK2RIzrekSYfLFxwFq2hnlgKHaVgZ3keKP+nmXcXmRSHQYUUr72oYNZ
+HcNYl2+gxCc9ccPEHM7xncVEKmb5cWEWvVoaysgQ+osi5f5aQdzgC2X2g2daKbyA
+XL/z5FM9GHpS5BJjAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE
+FBDAiJ7Py9/A9etNa/ebOnx5l5MGMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0B
+AQsFAAOCAQEALMh/+81fFPdJV/RrJUeoUvFCGMp8iaANu97NpeJyKitNOv7RoeVP
+WjivS0KcCqZaDBs+p6IZ0sLI5ZH098LDzzytcfZg0PsGqUAb8a0MiU/LfgDCI9Ee
+jsOiwaFB8k0tfUJK32NPcIoQYApTMT2e26lPzYORSkfuntme2PTHUnuC7ikiQrZk
+P+SZjWgRuMcp09JfRXyAYWIuix4Gy0eZ4rpRuaTK6mjAb1/LYoNK/iZ/gTeIqrNt
+l70OWRsWW8jEmSyNTIubGK/gGGyfuZGSyqoRX6OKHESkP6SSulbIZHyJ5VZkgtXo
+2XvyRyJ7w5pFyoofrL3Wv0UF8yt/GDszmg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRAMDk/F+rrhdn42SfE+ghPC8wDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBldS13ZXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMTIyNTEyMloYDzIxMjEwNTIxMjM1MTIyWjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LXdlc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2twMALVg9vRVu
+VNqsr6N8thmp3Dy8jEGTsm3GCQ+C5P2YcGlD/T/5icfWW84uF7Sx3ezcGlvsqFMf
+Ukj9sQyqtz7qfFFugyy7pa/eH9f48kWFHLbQYm9GEgbYBIrWMp1cy3vyxuMCwQN4
+DCncqU+yNpy0CprQJEha3PzY+3yJOjDQtc3zr99lyECCFJTDUucxHzyQvX89eL74
+uh8la0lKH3v9wPpnEoftbrwmm5jHNFdzj7uXUHUJ41N7af7z7QUfghIRhlBDiKtx
+5lYZemPCXajTc3ryDKUZC/b+B6ViXZmAeMdmQoPE0jwyEp/uaUcdp+FlUQwCfsBk
+ayPFEApTWgPiku2isjdeTVmEgL8bJTDUZ6FYFR7ZHcYAsDzcwHgIu3GGEMVRS3Uf
+ILmioiyly9vcK4Sa01ondARmsi/I0s7pWpKflaekyv5boJKD/xqwz9lGejmJHelf
+8Od2TyqJScMpB7Q8c2ROxBwqwB72jMCEvYigB+Wnbb8RipliqNflIGx938FRCzKL
+UQUBmNAznR/yRRL0wHf9UAE/8v9a09uZABeiznzOFAl/frHpgdAbC00LkFlnwwgX
+g8YfEFlkp4fLx5B7LtoO6uVNFVimLxtwirpyKoj3G4M/kvSTux8bTw0heBCmWmKR
+57MS6k7ODzbv+Kpeht2hqVZCNFMxoQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBRuMnDhJjoj7DcKALj+HbxEqj3r6jAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBALSnXfx72C3ldhBP5kY4Mo2DDaGQ8FGpTOOiD95d
+0rf7I9LrsBGVqu/Nir+kqqP80PB70+Jy9fHFFigXwcPBX3MpKGxK8Cel7kVf8t1B
+4YD6A6bqlzP+OUL0uGWfZpdpDxwMDI2Flt4NEldHgXWPjvN1VblEKs0+kPnKowyg
+jhRMgBbD/y+8yg0fIcjXUDTAw/+INcp21gWaMukKQr/8HswqC1yoqW9in2ijQkpK
+2RB9vcQ0/gXR0oJUbZQx0jn0OH8Agt7yfMAnJAdnHO4M3gjvlJLzIC5/4aGrRXZl
+JoZKfJ2fZRnrFMi0nhAYDeInoS+Rwx+QzaBk6fX5VPyCj8foZ0nmqvuYoydzD8W5
+mMlycgxFqS+DUmO+liWllQC4/MnVBlHGB1Cu3wTj5kgOvNs/k+FW3GXGzD3+rpv0
+QTLuwSbMr+MbEThxrSZRSXTCQzKfehyC+WZejgLb+8ylLJUA10e62o7H9PvCrwj+
+ZDVmN7qj6amzvndCP98sZfX7CFZPLfcBd4wVIjHsFjSNEwWHOiFyLPPG7cdolGKA
+lOFvonvo4A1uRc13/zFeP0Xi5n5OZ2go8aOOeGYdI2vB2sgH9R2IASH/jHmr0gvY
+0dfBCcfXNgrS0toq0LX/y+5KkKOxh52vEYsJLdhqrveuZhQnsFEm/mFwjRXkyO7c
+2jpC
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGADCCA+igAwIBAgIQYe0HgSuFFP9ivYM2vONTrTANBgkqhkiG9w0BAQwFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE4MzMyMVoYDzIxMjEwNTE5MTkzMzIxWjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuO7QPKfPMTo2
+POQWvzDLwi5f++X98hGjORI1zkN9kotCYH5pAzSBwBPoMNaIfedgmsIxGHj2fq5G
+4oXagNhNuGP79Zl6uKW5H7S74W7aWM8C0s8zuxMOI4GZy5h2IfQk3m/3AzZEX5w8
+UtNPkzo2feDVOkerHT+j+vjXgAxZ4wHnuMDcRT+K4r9EXlAH6X9b/RO0JlfEwmNz
+xlqqGxocq9qRC66N6W0HF2fNEAKP84n8H80xcZBOBthQORRi8HSmKcPdmrvwCuPz
+M+L+j18q6RAVaA0ABbD0jMWcTf0UvjUfBStn5mvu/wGlLjmmRkZsppUTRukfwqXK
+yltUsTq0tOIgCIpne5zA4v+MebbR5JBnsvd4gdh5BI01QH470yB7BkUefZ9bobOm
+OseAAVXcYFJKe4DAA6uLDrqOfFSxV+CzVvEp3IhLRaik4G5MwI/h2c/jEYDqkg2J
+HMflxc2gcSMdk7E5ByLz5f6QrFfSDFk02ZJTs4ssbbUEYohht9znPMQEaWVqATWE
+3n0VspqZyoBNkH/agE5GiGZ/k/QyeqzMNj+c9kr43Upu8DpLrz8v2uAp5xNj3YVg
+ihaeD6GW8+PQoEjZ3mrCmH7uGLmHxh7Am59LfEyNrDn+8Rq95WvkmbyHSVxZnBmo
+h/6O3Jk+0/QhIXZ2hryMflPcYWeRGH0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQU2eFK7+R3x/me8roIBNxBrplkM6EwDgYDVR0PAQH/BAQDAgGG
+MA0GCSqGSIb3DQEBDAUAA4ICAQB5gWFe5s7ObQFj1fTO9L6gYgtFhnwdmxU0q8Ke
+HWCrdFmyXdC39qdAFOwM5/7fa9zKmiMrZvy9HNvCXEp4Z7z9mHhBmuqPZQx0qPgU
+uLdP8wGRuWryzp3g2oqkX9t31Z0JnkbIdp7kfRT6ME4I4VQsaY5Y3mh+hIHOUvcy
+p+98i3UuEIcwJnVAV9wTTzrWusZl9iaQ1nSYbmkX9bBssJ2GmtW+T+VS/1hJ/Q4f
+AlE3dOQkLFoPPb3YRWBHr2n1LPIqMVwDNAuWavRA2dSfaLl+kzbn/dua7HTQU5D4
+b2Fu2vLhGirwRJe+V7zdef+tI7sngXqjgObyOeG5O2BY3s+um6D4fS0Th3QchMO7
+0+GwcIgSgcjIjlrt6/xJwJLE8cRkUUieYKq1C4McpZWTF30WnzOPUzRzLHkcNzNA
+0A7sKMK6QoYWo5Rmo8zewUxUqzc9oQSrYADP7PEwGncLtFe+dlRFx+PA1a+lcIgo
+1ZGfXigYtQ3VKkcknyYlJ+hN4eCMBHtD81xDy9iP2MLE41JhLnoB2rVEtewO5diF
+7o95Mwl84VMkLhhHPeGKSKzEbBtYYBifHNct+Bst8dru8UumTltgfX6urH3DN+/8
+JF+5h3U8oR2LL5y76cyeb+GWDXXy9zoQe2QvTyTy88LwZq1JzujYi2k8QiLLhFIf
+FEv9Bg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICsDCCAjagAwIBAgIRAMgApnfGYPpK/fD0dbN2U4YwCgYIKoZIzj0EAwMwgZcx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwnQW1h
+em9uIFJEUyBldS1zb3V0aC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMCAXDTIxMDUxOTE4MzgxMVoYDzIxMjEwNTE5MTkzODExWjCBlzELMAkG
+A1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4xEzAR
+BgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6b24g
+UkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0
+bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfEWl6d4qSuIoECdZPp+39LaKsfsX7
+THs3/RrtT0+h/jl3bjZ7Qc68k16x+HGcHbaayHfqD0LPdzH/kKtNSfQKqemdxDQh
+Z4pwkixJu8T1VpXZ5zzCvBXCl75UqgEFS92jQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFFPrSNtWS5JU+Tvi6ABV231XbjbEMA4GA1UdDwEB/wQEAwIBhjAK
+BggqhkjOPQQDAwNoADBlAjEA+a7hF1IrNkBd2N/l7IQYAQw8chnRZDzh4wiGsZsC
+6A83maaKFWUKIb3qZYXFSi02AjAbp3wxH3myAmF8WekDHhKcC2zDvyOiKLkg9Y6v
+ZVmyMR043dscQbcsVoacOYv198c=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtDCCAjqgAwIBAgIRAPhVkIsQ51JFhD2kjFK5uAkwCgYIKoZIzj0EAwMwgZkx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h
+em9uIFJEUyBldS1jZW50cmFsLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjIwNjA2MjEyOTE3WhgPMjEyMjA2MDYyMjI5MTdaMIGZMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv
+biBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEA5xnIEBtG5b2nmbj49UEwQza
+yX0844fXjccYzZ8xCDUe9dS2XOUi0aZlGblgSe/3lwjg8fMcKXLObGGQfgIx1+5h
+AIBjORis/dlyN5q/yH4U5sjS8tcR0GDGVHrsRUZCo0IwQDAPBgNVHRMBAf8EBTAD
+AQH/MB0GA1UdDgQWBBRK+lSGutXf4DkTjR3WNfv4+KeNFTAOBgNVHQ8BAf8EBAMC
+AYYwCgYIKoZIzj0EAwMDaAAwZQIxAJ4NxQ1Gerqr70ZrnUqc62Vl8NNqTzInamCG
+Kce3FTsMWbS9qkgrjZkO9QqOcGIw/gIwSLrwUT+PKr9+H9eHyGvpq9/3AIYSnFkb
+Cf3dyWPiLKoAtLFwjzB/CkJlsAS1c8dS
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/jCCA+agAwIBAgIQGZH12Q7x41qIh9vDu9ikTjANBgkqhkiG9w0BAQwFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIGV1LXdlc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTI1MjIyMjMzWhgPMjEyMTA1MjUyMzIyMzNaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgZXUtd2VzdC0zIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMqE47sHXWzdpuqj
+JHb+6jM9tDbQLDFnYjDWpq4VpLPZhb7xPNh9gnYYTPKG4avG421EblAHqzy9D2pN
+1z90yKbIfUb/Sy2MhQbmZomsObhONEra06fJ0Dydyjswf1iYRp2kwpx5AgkVoNo7
+3dlws73zFjD7ImKvUx2C7B75bhnw2pJWkFnGcswl8fZt9B5Yt95sFOKEz2MSJE91
+kZlHtya19OUxZ/cSGci4MlOySzqzbGwUqGxEIDlY8I39VMwXaYQ8uXUN4G780VcL
+u46FeyRGxZGz2n3hMc805WAA1V5uir87vuirTvoSVREET97HVRGVVNJJ/FM6GXr1
+VKtptybbo81nefYJg9KBysxAa2Ao2x2ry/2ZxwhS6VZ6v1+90bpZA1BIYFEDXXn/
+dW07HSCFnYSlgPtSc+Muh15mdr94LspYeDqNIierK9i4tB6ep7llJAnq0BU91fM2
+JPeqyoTtc3m06QhLf68ccSxO4l8Hmq9kLSHO7UXgtdjfRVaffngopTNk8qK7bIb7
+LrgkqhiQw/PRCZjUdyXL153/fUcsj9nFNe25gM4vcFYwH6c5trd2tUl31NTi1MfG
+Mgp3d2dqxQBIYANkEjtBDMy3SqQLIo9EymqmVP8xx2A/gCBgaxvMAsI6FSWRoC7+
+hqJ8XH4mFnXSHKtYMe6WPY+/XZgtAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFIkXqTnllT/VJnI2NqipA4XV8rh1MA4GA1UdDwEB/wQEAwIBhjAN
+BgkqhkiG9w0BAQwFAAOCAgEAKjSle8eenGeHgT8pltWCw/HzWyQruVKhfYIBfKJd
+MhV4EnH5BK7LxBIvpXGsFUrb0ThzSw0fn0zoA9jBs3i/Sj6KyeZ9qUF6b8ycDXd+
+wHonmJiQ7nk7UuMefaYAfs06vosgl1rI7eBHC0itexIQmKh0aX+821l4GEgEoSMf
+loMFTLXv2w36fPHHCsZ67ODldgcZbKNnpCTX0YrCwEYO3Pz/L398btiRcWGrewrK
+jdxAAyietra8DRno1Zl87685tfqc6HsL9v8rVw58clAo9XAQvT+fmSOFw/PogRZ7
+OMHUat3gu/uQ1M5S64nkLLFsKu7jzudBuoNmcJysPlzIbqJ7vYc82OUGe9ucF3wi
+3tbKQ983hdJiTExVRBLX/fYjPsGbG3JtPTv89eg2tjWHlPhCDMMxyRKl6isu2RTq
+6VT489Z2zQrC33MYF8ZqO1NKjtyMAMIZwxVu4cGLkVsqFmEV2ScDHa5RadDyD3Ok
+m+mqybhvEVm5tPgY6p0ILPMN3yvJsMSPSvuBXhO/X5ppNnpw9gnxpwbjQKNhkFaG
+M5pkADZ14uRguOLM4VthSwUSEAr5VQYCFZhEwK+UOyJAGiB/nJz6IxL5XBNUXmRM
+Hl8Xvz4riq48LMQbjcVQj0XvH941yPh+P8xOi00SGaQRaWp55Vyr4YKGbV0mEDz1
+r1o=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF/zCCA+egAwIBAgIRAKwYju1QWxUZpn6D1gOtwgQwDQYJKoZIhvcNAQEMBQAw
+gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn
+QW1hem9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyMDE2NTM1NFoYDzIxMjEwNTIwMTc1MzU0WjCBlzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
+b24gUkRTIGV1LXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCKdBP1U4lqWWkc
+Cb25/BKRTsvNVnISiKocva8GAzJyKfcGRa85gmgu41U+Hz6+39K+XkRfM0YS4BvQ
+F1XxWT0bNyypuvwCvmYShSTjN1TY0ltncDddahTajE/4MdSOZb/c98u0yt03cH+G
+hVwRyT50h0v/UEol50VfwcVAEZEgcQQYhf1IFUFlIvKpmDOqLuFakOnc7c9akK+i
+ivST+JO1tgowbnNkn2iLlSSgUWgb1gjaOsNfysagv1RXdlyPw3EyfwkFifAQvF2P
+Q0ayYZfYS640cccv7efM1MSVyFHR9PrrDsF/zr2S2sGPbeHr7R/HwLl+S5J/l9N9
+y0rk6IHAWV4dEkOvgpnuJKURwA48iu1Hhi9e4moNS6eqoK2KmY3VFpuiyWcA73nH
+GSmyaH+YuMrF7Fnuu7GEHZL/o6+F5cL3mj2SJJhL7sz0ryf5Cs5R4yN9BIEj/f49
+wh84pM6nexoI0Q4wiSFCxWiBpjSmOK6h7z6+2utaB5p20XDZHhxAlmlx4vMuWtjh
+XckgRFxc+ZpVMU3cAHUpVEoO49e/+qKEpPzp8Xg4cToKw2+AfTk3cmyyXQfGwXMQ
+ZUHNZ3w9ILMWihGCM2aGUsLcGDRennvNmnmin/SENsOQ8Ku0/a3teEzwV9cmmdYz
+5iYs1YtgPvKFobY6+T2RXXh+A5kprwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBSyUrsQVnKmA8z6/2Ech0rCvqpNmTAOBgNVHQ8BAf8EBAMCAYYw
+DQYJKoZIhvcNAQEMBQADggIBAFlj3IFmgiFz5lvTzFTRizhVofhTJsGr14Yfkuc7
+UrXPuXOwJomd4uot2d/VIeGJpfnuS84qGdmQyGewGTJ9inatHsGZgHl9NHNWRwKZ
+lTKTbBiq7aqgtUSFa06v202wpzU+1kadxJJePrbABxiXVfOmIW/a1a4hPNcT3syH
+FIEg1+CGsp71UNjBuwg3JTKWna0sLSKcxLOSOvX1fzxK5djzVpEsvQMB4PSAzXca
+vENgg2ErTwgTA+4s6rRtiBF9pAusN1QVuBahYP3ftrY6f3ycS4K65GnqscyfvKt5
+YgjtEKO3ZeeX8NpubMbzC+0Z6tVKfPFk/9TXuJtwvVeqow0YMrLLyRiYvK7EzJ97
+rrkxoKnHYQSZ+rH2tZ5SE392/rfk1PJL0cdHnkpDkUDO+8cKsFjjYKAQSNC52sKX
+74AVh6wMwxYwVZZJf2/2XxkjMWWhKNejsZhUkTISSmiLs+qPe3L67IM7GyKm9/m6
+R3r8x6NGjhTsKH64iYJg7AeKeax4b2e4hBb6GXFftyOs7unpEOIVkJJgM6gh3mwn
+R7v4gwFbLKADKt1vHuerSZMiTuNTGhSfCeDM53XI/mjZl2HeuCKP1mCDLlaO+gZR
+Q/G+E0sBKgEX4xTkAc3kgkuQGfExdGtnN2U2ehF80lBHB8+2y2E+xWWXih/ZyIcW
+wOx+
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBDCCA+ygAwIBAgIQM4C8g5iFRucSWdC8EdqHeDANBgkqhkiG9w0BAQwFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjEwNTIxMjIyODI2WhgPMjEyMTA1MjEyMzI4MjZaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgZXUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANeTsD/u
+6saPiY4Sg0GlJlMXMBltnrcGAEkwq34OKQ0bCXqcoNJ2rcAMmuFC5x9Ho1Y3YzB7
+NO2GpIh6bZaO76GzSv4cnimcv9n/sQSYXsGbPD+bAtnN/RvNW1avt4C0q0/ghgF1
+VFS8JihIrgPYIArAmDtGNEdl5PUrdi9y6QGggbRfidMDdxlRdZBe1C18ZdgERSEv
+UgSTPRlVczONG5qcQkUGCH83MMqL5MKQiby/Br5ZyPq6rxQMwRnQ7tROuElzyYzL
+7d6kke+PNzG1mYy4cbYdjebwANCtZ2qYRSUHAQsOgybRcSoarv2xqcjO9cEsDiRU
+l97ToadGYa4VVERuTaNZxQwrld4mvzpyKuirqZltOqg0eoy8VUsaRPL3dc5aChR0
+dSrBgRYmSAClcR2/2ZCWpXemikwgt031Dsc0A/+TmVurrsqszwbr0e5xqMow9LzO
+MI/JtLd0VFtoOkL/7GG2tN8a+7gnLFxpv+AQ0DH5n4k/BY/IyS+H1erqSJhOTQ11
+vDOFTM5YplB9hWV9fp5PRs54ILlHTlZLpWGs3I2BrJwzRtg/rOlvsosqcge9ryai
+AKm2j+JBg5wJ19R8oxRy8cfrNTftZePpISaLTyV2B16w/GsSjqixjTQe9LRN2DHk
+cC+HPqYyzW2a3pUVyTGHhW6a7YsPBs9yzt6hAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFIqA8QkOs2cSirOpCuKuOh9VDfJfMA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAOUI90mEIsa+vNJku0iUwdBMnHiO4gm7E
+5JloP7JG0xUr7d0hypDorMM3zVDAL+aZRHsq8n934Cywj7qEp1304UF6538ByGdz
+tkfacJsUSYfdlNJE9KbA4T+U+7SNhj9jvePpVjdQbhgzxITE9f8CxY/eM40yluJJ
+PhbaWvOiRagzo74wttlcDerzLT6Y/JrVpWhnB7IY8HvzK+BwAdaCsBUPC3HF+kth
+CIqLq7J3YArTToejWZAp5OOI6DLPM1MEudyoejL02w0jq0CChmZ5i55ElEMnapRX
+7GQTARHmjgAOqa95FjbHEZzRPqZ72AtZAWKFcYFNk+grXSeWiDgPFOsq6mDg8DDB
+0kfbYwKLFFCC9YFmYzR2YrWw2NxAScccUc2chOWAoSNHiqBbHR8ofrlJSWrtmKqd
+YRCXzn8wqXnTS3NNHNccqJ6dN+iMr9NGnytw8zwwSchiev53Fpc1mGrJ7BKTWH0t
+ZrA6m32wzpMymtKozlOPYoE5mtZEzrzHEXfa44Rns7XIHxVQSXVWyBHLtIsZOrvW
+U5F41rQaFEpEeUQ7sQvqUoISfTUVRNDn6GK6YaccEhCji14APLFIvhRQUDyYMIiM
+4vll0F/xgVRHTgDVQ8b8sxdhSYlqB4Wc2Ym41YRz+X2yPqk3typEZBpc4P5Tt1/N
+89cEIGdbjsA=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQYjbPSg4+RNRD3zNxO1fuKDANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUyNDIwNTkyMVoYDzIwNjEwNTI0MjE1OTIxWjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA179eQHxcV0YL
+XMkqEmhSBazHhnRVd8yICbMq82PitE3BZcnv1Z5Zs/oOgNmMkOKae4tCXO/41JCX
+wAgbs/eWWi+nnCfpQ/FqbLPg0h3dqzAgeszQyNl9IzTzX4Nd7JFRBVJXPIIKzlRf
++GmFsAhi3rYgDgO27pz3ciahVSN+CuACIRYnA0K0s9lhYdddmrW/SYeWyoB7jPa2
+LmWpAs7bDOgS4LlP2H3eFepBPgNufRytSQUVA8f58lsE5w25vNiUSnrdlvDrIU5n
+Qwzc7NIZCx4qJpRbSKWrUtbyJriWfAkGU7i0IoainHLn0eHp9bWkwb9D+C/tMk1X
+ERZw2PDGkwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSFmR7s
+dAblusFN+xhf1ae0KUqhWTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAHsXOpjPMyH9lDhPM61zYdja1ebcMVgfUvsDvt+w0xKMKPhBzYDMs/cFOi1N
+Q8LV79VNNfI2NuvFmGygcvTIR+4h0pqqZ+wjWl3Kk5jVxCrbHg3RBX02QLumKd/i
+kwGcEtTUvTssn3SM8bgM0/1BDXgImZPC567ciLvWDo0s/Fe9dJJC3E0G7d/4s09n
+OMdextcxFuWBZrBm/KK3QF0ByA8MG3//VXaGO9OIeeOJCpWn1G1PjT1UklYhkg61
+EbsTiZVA2DLd1BGzfU4o4M5mo68l0msse/ndR1nEY6IywwpgIFue7+rEleDh6b9d
+PYkG1rHVw2I0XDG4o17aOn5E94I=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQC6W4HFghUkkgyQw14a6JljANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIyMDUyMzE4MTYzMloYDzIwNjIwNTIzMTkxNjMyWjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM/t4FV2R9Nx
+UQG203UY83jInTa/6TMq0SPyg617FqYZxvz2kkx09x3dmxepUg9ttGMlPgjsRZM5
+LCFEi1FWk+hxHzt7vAdhHES5tdjwds3aIkgNEillmRDVrUsbrDwufLaa+MMDO2E1
+wQ/JYFXw16WBCCi2g1EtyQ2Xp+tZDX5IWOTnvhZpW8vVDptZ2AcJ5rMhfOYO3OsK
+5EF0GGA5ldzuezP+BkrBYGJ4wVKGxeaq9+5AT8iVZrypjwRkD7Y5CurywK3+aBwm
+s9Q5Nd8t45JCOUzYp92rFKsCriD86n/JnEvgDfdP6Hvtm0/DkwXK40Wz2q0Zrd0k
+mjP054NRPwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRR7yqd
+SfKcX2Q8GzhcVucReIpewTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAEszBRDwXcZyNm07VcFwI1Im94oKwKccuKYeJEsizTBsVon8VpEiMwDs+yGu
+3p8kBhvkLwWybkD/vv6McH7T5b9jDX2DoOudqYnnaYeypsPH/00Vh3LvKagqzQza
+orWLx+0tLo8xW4BtU+Wrn3JId8LvAhxyYXTn9bm+EwPcStp8xGLwu53OPD1RXYuy
+uu+3ps/2piP7GVfou7H6PRaqbFHNfiGg6Y+WA0HGHiJzn8uLmrRJ5YRdIOOG9/xi
+qTmAZloUNM7VNuurcMM2hWF494tQpsQ6ysg2qPjbBqzlGoOt3GfBTOZmqmwmqtam
+K7juWM/mdMQAJ3SMlE5wI8nVdx4=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICrjCCAjSgAwIBAgIRAL9SdzVPcpq7GOpvdGoM80IwCgYIKoZIzj0EAwMwgZYx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h
+em9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
+YXR0bGUwIBcNMjEwNTIwMTY1ODA3WhgPMjEyMTA1MjAxNzU4MDdaMIGWMQswCQYD
+VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
+A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS
+RFMgZXUtd2VzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJWDgXebvwjR+Ce+hxKOLbnsfN5W5dOlP
+Zn8kwWnD+SLkU81Eac/BDJsXGrMk6jFD1vg16PEkoSevsuYWlC8xR6FmT6F6pmeh
+fsMGOyJpfK4fyoEPhKeQoT23lFIc5Orjo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G
+A1UdDgQWBBSVNAN1CHAz0eZ77qz2adeqjm31TzAOBgNVHQ8BAf8EBAMCAYYwCgYI
+KoZIzj0EAwMDaAAwZQIxAMlQeHbcjor49jqmcJ9gRLWdEWpXG8thIf6zfYQ/OEAg
+d7GDh4fR/OUk0VfjsBUN/gIwZB0bGdXvK38s6AAE/9IT051cz/wMe9GIrX1MnL1T
+1F5OqnXJdiwfZRRTHsRQ/L00
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGBDCCA+ygAwIBAgIQalr16vDfX4Rsr+gfQ4iVFDANBgkqhkiG9w0BAQwFADCB
+mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB
+bWF6b24gUkRTIGV1LWNlbnRyYWwtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV
+BAcMB1NlYXR0bGUwIBcNMjIwNjA2MjEyNTIzWhgPMjEyMjA2MDYyMjI1MjNaMIGa
+MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j
+LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt
+YXpvbiBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANbHbFg7
+2VhZor1YNtez0VlNFaobS3PwOMcEn45BE3y7HONnElIIWXGQa0811M8V2FnyqnE8
+Z5aO1EuvijvWf/3D8DPZkdmAkIfh5hlZYY6Aatr65kEOckwIAm7ZZzrwFogYuaFC
+z/q0CW+8gxNK+98H/zeFx+IxiVoPPPX6UlrLvn+R6XYNERyHMLNgoZbbS5gGHk43
+KhENVv3AWCCcCc85O4rVd+DGb2vMVt6IzXdTQt6Kih28+RGph+WDwYmf+3txTYr8
+xMcCBt1+whyCPlMbC+Yn/ivtCO4LRf0MPZDRQrqTTrFf0h/V0BGEUmMGwuKgmzf5
+Kl9ILdWv6S956ioZin2WgAxhcn7+z//sN++zkqLreSf90Vgv+A7xPRqIpTdJ/nWG
+JaAOUofBfsDsk4X4SUFE7xJa1FZAiu2lqB/E+y7jnWOvFRalzxVJ2Y+D/ZfUfrnK
+4pfKtyD1C6ni1celrZrAwLrJ3PoXPSg4aJKh8+CHex477SRsGj8KP19FG8r0P5AG
+8lS1V+enFCNvT5KqEBpDZ/Y5SQAhAYFUX+zH4/n4ql0l/emS+x23kSRrF+yMkB9q
+lhC/fMk6Pi3tICBjrDQ8XAxv56hfud9w6+/ljYB2uQ1iUYtlE3JdIiuE+3ws26O8
+i7PLMD9zQmo+sVi12pLHfBHQ6RRHtdVRXbXRAgMBAAGjQjBAMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFBFot08ipEL9ZUXCG4lagmF53C0/MA4GA1UdDwEB/wQE
+AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAi2mcZi6cpaeqJ10xzMY0F3L2eOKYnlEQ
+h6QyhmNKCUF05q5u+cok5KtznzqMwy7TFOZtbVHl8uUX+xvgq/MQCxqFAnuStBXm
+gr2dg1h509ZwvTdk7TDxGdftvPCfnPNJBFbMSq4CZtNcOFBg9Rj8c3Yj+Qvwd56V
+zWs65BUkDNJrXmxdvhJZjUkMa9vi/oFN+M84xXeZTaC5YDYNZZeW9706QqDbAVES
+5ulvKLavB8waLI/lhRBK5/k0YykCMl0A8Togt8D1QsQ0eWWbIM8/HYJMPVFhJ8Wj
+vT1p/YVeDA3Bo1iKDOttgC5vILf5Rw1ZEeDxjf/r8A7VS13D3OLjBmc31zxRTs3n
+XvHKP9MieQHn9GE44tEYPjK3/yC6BDFzCBlvccYHmqGb+jvDEXEBXKzimdC9mcDl
+f4BBQWGJBH5jkbU9p6iti19L/zHhz7qU6UJWbxY40w92L9jS9Utljh4A0LCTjlnR
+NQUgjnGC6K+jkw8hj0LTC5Ip87oqoT9w7Av5EJ3VJ4hcnmNMXJJ1DkWYdnytcGpO
+DMVITQzzDZRwhbitCVPHagTN2wdi9TEuYE33J0VmFeTc6FSI50wP2aOAZ0Q1/8Aj
+bxeM5jS25eaHc2CQAuhrc/7GLnxOcPwdWQb2XWT8eHudhMnoRikVv/KSK3mf6om4
+1YfpdH2jp30=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIID/jCCAuagAwIBAgIQTDc+UgTRtYO7ZGTQ8UWKDDANBgkqhkiG9w0BAQsFADCB
+lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB
+bWF6b24gUkRTIGV1LXdlc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM
+B1NlYXR0bGUwIBcNMjEwNTIxMjI0NjI0WhgPMjA2MTA1MjEyMzQ2MjRaMIGXMQsw
+CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET
+MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv
+biBSRFMgZXUtd2VzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh
+dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM1oGtthQ1YiVIC2
+i4u4swMAGxAjc/BZp0yq0eP5ZQFaxnxs7zFAPabEWsrjeDzrRhdVO0h7zskrertP
+gblGhfD20JfjvCHdP1RUhy/nzG+T+hn6Takan/GIgs8grlBMRHMgBYHW7tklhjaH
+3F7LujhceAHhhgp6IOrpb6YTaTTaJbF3GTmkqxSJ3l1LtEoWz8Al/nL/Ftzxrtez
+Vs6ebpvd7sw37sxmXBWX2OlvUrPCTmladw9OrllGXtCFw4YyLe3zozBlZ3cHzQ0q
+lINhpRcajTMfZrsiGCkQtoJT+AqVJPS2sHjqsEH8yiySW9Jbq4zyMbM1yqQ2vnnx
+MJgoYMcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaQG88UnV
+JPTI+Pcti1P+q3H7pGYwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB
+AQBAkgr75V0sEJimC6QRiTVWEuj2Khy7unjSfudbM6zumhXEU2/sUaVLiYy6cA/x
+3v0laDle6T07x9g64j5YastE/4jbzrGgIINFlY0JnaYmR3KZEjgi1s1fkRRf3llL
+PJm9u4Q1mbwAMQK/ZjLuuRcL3uRIHJek18nRqT5h43GB26qXyvJqeYYpYfIjL9+/
+YiZAbSRRZG+Li23cmPWrbA1CJY121SB+WybCbysbOXzhD3Sl2KSZRwSw4p2HrFtV
+1Prk0dOBtZxCG9luf87ultuDZpfS0w6oNBAMXocgswk24ylcADkkFxBWW+7BETn1
+EpK+t1Lm37mU4sxtuha00XAi
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEADCCAuigAwIBAgIQcY44/8NUvBwr6LlHfRy7KjANBgkqhkiG9w0BAQsFADCB
+mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
+bWF6b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTIxMDUxOTE4MjcxOFoYDzIwNjEwNTE5MTkyNzE4WjCBmDEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
+b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
+ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0UaBeC+Usalu
+EtXnV7+PnH+gi7/71tI/jkKVGKuhD2JDVvqLVoqbMHRh3+wGMvqKCjbHPcC2XMWv
+566fpAj4UZ9CLB5fVzss+QVNTl+FH2XhEzigopp+872ajsNzcZxrMkifxGb4i0U+
+t0Zi+UrbL5tsfP2JonKR1crOrbS6/DlzHBjIiJazGOQcMsJjNuTOItLbMohLpraA
+/nApa3kOvI7Ufool1/34MG0+wL3UUA4YkZ6oBJVxjZvvs6tI7Lzz/SnhK2widGdc
+snbLqBpHNIZQSorVoiwcFaRBGYX/uzYkiw44Yfa4cK2V/B5zgu1Fbr0gbI2am4eh
+yVYyg4jPawIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBS9gM1m
+IIjyh9O5H/7Vj0R/akI7UzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
+ggEBAF0Sm9HC2AUyedBVnwgkVXMibnYChOzz7T+0Y+fOLXYAEXex2s8oqGeZdGYX
+JHkjBn7JXu7LM+TpTbPbFFDoc1sgMguD/ls+8XsqAl1CssW+amryIL+jfcfbgQ+P
+ICwEUD9hGdjBgJ5WcuS+qqxHsEIlFNci3HxcxfBa9VsWs5TjI7Vsl4meL5lf7ZyL
+wDV7dHRuU+cImqG1MIvPRIlvPnT7EghrCYi2VCPhP2pM/UvShuwVnkz4MJ29ebIk
+WR9kpblFxFdE92D5UUvMCjC2kmtgzNiErvTcwIvOO9YCbBHzRB1fFiWrXUHhJWq9
+IkaxR5icb/IpAV0A1lYZEWMVsfQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIRAMa0TPL+QgbWfUPpYXQkf8wwDQYJKoZIhvcNAQEMBQAw
+gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
+QW1hem9uIFJEUyBldS1ub3J0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
+BwwHU2VhdHRsZTAgFw0yMTA1MjQyMTAzMjBaGA8yMTIxMDUyNDIyMDMyMFowgZgx
+CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
+MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
+em9uIFJEUyBldS1ub3J0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
+U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANhS9LJVJyWp
+6Rudy9t47y6kzvgnFYDrvJVtgEK0vFn5ifdlHE7xqMz4LZqWBFTnS+3oidwVRqo7
+tqsuuElsouStO8m315/YUzKZEPmkw8h5ufWt/lg3NTCoUZNkB4p4skr7TspyMUwE
+VdlKQuWTCOLtofwmWT+BnFF3To6xTh3XPlT3ssancw27Gob8kJegD7E0TSMVsecP
+B8je65+3b8CGwcD3QB3kCTGLy87tXuS2+07pncHvjMRMBdDQQQqhXWsRSeUNg0IP
+xdHTWcuwMldYPWK5zus9M4dCNBDlmZjKdcZZVUOKeBBAm7Uo7CbJCk8r/Fvfr6mw
+nXXDtuWhqn/WhJiI/y0QU27M+Hy5CQMxBwFsfAjJkByBpdXmyYxUgTmMpLf43p7H
+oWfH1xN0cT0OQEVmAQjMakauow4AQLNkilV+X6uAAu3STQVFRSrpvMen9Xx3EPC3
+G9flHueTa71bU65Xe8ZmEmFhGeFYHY0GrNPAFhq9RThPRY0IPyCZe0Th8uGejkek
+jQjm0FHPOqs5jc8CD8eJs4jSEFt9lasFLVDcAhx0FkacLKQjGHvKAnnbRwhN/dF3
+xt4oL8Z4JGPCLau056gKnYaEyviN7PgO+IFIVOVIdKEBu2ASGE8/+QJB5bcHefNj
+04hEkDW0UYJbSfPpVbGAR0gFI/QpycKnAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFFMXvvjoaGGUcul8GA3FT05DLbZcMA4GA1UdDwEB/wQEAwIB
+hjANBgkqhkiG9w0BAQwFAAOCAgEAQLwFhd2JKn4K/6salLyIA4mP58qbA/9BTB/r
+D9l0bEwDlVPSdY7R3gZCe6v7SWLfA9RjE5tdWDrQMi5IU6W2OVrVsZS/yGJfwnwe
+a/9iUAYprA5QYKDg37h12XhVsDKlYCekHdC+qa5WwB1SL3YUprDLPWeaIQdg+Uh2
++LxvpZGoxoEbca0fc7flwq9ke/3sXt/3V4wJDyY6AL2YNdjFzC+FtYjHHx8rYxHs
+aesP7yunuN17KcfOZBBnSFRrx96k+Xm95VReTEEpwiBqAECqEpMbd+R0mFAayMb1
+cE77GaK5yeC2f67NLYGpkpIoPbO9p9rzoXLE5GpSizMjimnz6QCbXPFAFBDfSzim
+u6azp40kEUO6kWd7rBhqRwLc43D3TtNWQYxMve5mTRG4Od+eMKwYZmQz89BQCeqm
+aZiJP9y9uwJw4p/A5V3lYHTDQqzmbOyhGUk6OdpdE8HXs/1ep1xTT20QDYOx3Ekt
+r4mmNYfH/8v9nHNRlYJOqFhmoh1i85IUl5IHhg6OT5ZTTwsGTSxvgQQXrmmHVrgZ
+rZIqyBKllCgVeB9sMEsntn4bGLig7CS/N1y2mYdW/745yCLZv2gj0NXhPqgEIdVV
+f9DhFD4ohE1C63XP0kOQee+LYg/MY5vH8swpCSWxQgX5icv5jVDz8YTdCKgUc5u8
+rM2p0kk=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIECDCCAvCgAwIBAgIQYWF2Yb4HiQV2OJlcN2BhUDANBgkqhkiG9w0BAQsFADCB
+nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB
+bWF6b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G
+A1UEBwwHU2VhdHRsZTAgFw0yNTA1MjAwMTQzNTdaGA8yMDY1MDUyMDAyNDM1N1ow
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNiBSb290IENBIFJTQTIwNDggRzExEDAO
+BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp
+7R+Rclm+GQyjwytLA5lg6AH6IzXEsp8Q5ZtYzjYizhzOWhdqYfYQsv43IJjzY3Cd
+Wwtp+/+WOegfFntFfEN7Cy2zP+Ib18TT4alkalo45mbTjcKAflDhLuwLZCrXq7Sk
+ECm0lveumAlVXXUW0mFEOd48XvTzvY1tNO8hGlN2l1n2wG6TfOU317q+PLF2F79J
+iAqVt2ZUIvFgwIS3qfQK0n6c5OKzPrpsvfecFZePhL20YH/2yCNxGb6rNBRErXxV
+oNICqsl03LNOcgpm1WvXINWLJT/le6IEAbHMgMeG3DIG3q4sYiEyE5qi8SSR6S5P
+ky3+mtWZL/ZWp2HFQ8xZAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFAlH8qgMxdi5cVGO+FTynv4hC3sOMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG
+9w0BAQsFAAOCAQEAS+oW1l/6C3lh4WWE2aBGCdC713mjpBjgTjzpUnyIdQDaBuzD
+vHpm+p6bK+a4WP/jtjniUvZhyYD9VbaQhHYa9nSX+LHIkF1cxMTqHMjK8dgnenF7
+KhUbmaERlk7MPAGLoRKngoS8NRjizFiBLUTKn62KvI4DKiswxWJklpd3HIn9qq8q
+eR2PLoHHc4WJ/E1UXpCIt9dbWwB22xHp0Gb0vFcdWE76uwR5C4x8eAqct8455NrC
+gh3UCCsNEu57aUjNRA+PwvCUDEsJj72mKCzUNGG4bTDCqY1DMlx2TaXByxs7Ctwx
+wiK/vWV+ZChc5mMDzf9csrOQzDPPJpiUfp11rg==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCTCCA/GgAwIBAgIRAKEoQBLrmKhwHJppfnj9miEwDQYJKoZIhvcNAQEMBQAw
+gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
+bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws
+QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNiBSb290IENBIFJTQTQwOTYgRzExEDAO
+BgNVBAcMB1NlYXR0bGUwIBcNMjUwNTIwMDE0NDAyWhgPMjEyNTA1MjAwMjQ0MDJa
+MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg
+SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM
+LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTYgUm9vdCBDQSBSU0E0MDk2IEcxMRAw
+DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+m5LnhN6bm6BRlvFolsYe4EuK0uIWhLFItpCs4GbfAyQMJUEFc9pUIayg9+N6/B7q
+4VVRvIDYfqEIjywkWaJwBu58/B2EE47iLTHvAU9HyxojKvucFFHRmrrsQG5Fyn/0
+LNDDiOpik6BTKp4b32JnEe+X5ASd4pU7ibOSec6m+mISIEIAsjaRw8WdcrglJpIu
+69NKoM9QJRkiECWe6MSxwuTdNgh5SouuABThg7ROPrxlxt1pkwlN1nA1Czb2GrBe
+XV4Be1h1djEC7UoehaVxOs4VFJfOuHg72YHHf3zVhtpJAGR0/HypOcFnXd+DXoXL
+wjMUm3mDNyMEJLHQUwYA99QheEl7+aprpe9gM3RQ85sg5XQJ3YUOPuErqDnnVveH
+bckOkkTYTfSZUY9fpQmX7YxFv/QN6UpMXh7pzxOeM+VTvsH3JH0HweFNWCSALcbg
+/no7Z8mIkOEE9gMCzqoFz0uILQzFM/n5yrAnmCzU+EM5HC3+oxO9mGGwiNp/LQUY
+nWqkHHLQjurxmqlLQoBofpYiyi9vdh3IbULtYZJTUT87OA5BsKOH5Vaq6J9vw701
+1zCQnpg8B6tp7+Z2/vCRr1sY7tNmh8gQoiwFfx9Qpkc83/mlyoenvqeevQ42bok8
+0KZvJ/dYKNRZLO7kX8kHZTWkzGOYpfI5djYCWAAlPRUCAwEAAaNCMEAwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUri9+CM+fxgpdvEDFDhb0smAKHy4wDgYDVR0P
+AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQAUOKOXItwvve85tuPTLBNVP18f
+40rf8RPhH1JFKMePXcQ2gav7t9KwxnUk6iqVo/Pt/knUeXJ+uLMRHfjzVpadlUoT
+6zH+TndeljwG1QFuYOxwYI+VNwZnb7lF0O0cADkhDfc8/QvG/ZkrAx7s2kWWC8by
+fWpsjDt3xDD3ump+Qr+o0jpZyXPbWZQeIo5wmnMOc0PXxeFlIOCeUaJDtaJMRHBq
+CpdPT5xkNaRJnZzKJiUZx3NZe4du5lVuz5gT9YmooFGRFHU26hANkHQGxsDTkTx9
+Mg+5QXeDFQ7MnvFmFu2rb2cizZuKL9ZpiLE5f2/Hcd7apY7z8dSJhDWhvmTeeJPr
+GbplpepGVt5BIhg395guJ8Kww4Ux7a/8ERdQHkRd+ykspQNfveqLl+IP8s/snLDP
+lcILGYvHLq02HGrM8chU5mzNe5lyYmSI3cYxEZdDMiuOVpLlNuNUGadyafFx13Y0
+a6wDpXcot9Qh6W+JFpq0TbgbVezkk+1YzDJK7ShBQqckPlGHl9uyWjX3xuC4KD6g
+epx7UmkEP56BhvLMoT+o3KDBts9ujuJIZt+uGoo+rYIZaSuGLKdA60B4ZS3ONrws
+G3+o22y0lMvHGMHiwCIH+RQQBt5brmfkjD+QJh5K/1iJaZtFecgeuZnuar5W37k2
+IGstLzLjZODMnBQoSA==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICtzCCAj2gAwIBAgIQbliDBFi6VBnhtzveX+/ALjAKBggqhkjOPQQDAzCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMCAXDTI1MDUyMDAxNDQwN1oYDzIxMjUwNTIwMDI0NDA3WjCBmzEL
+MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
+EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6
+b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH
+DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf1cgi4GHIBFSOQMW6NPm
+/MUlTNs34ONxLDenJ/m3tkuMjoDSrimTAwQcCoIUrlwOpauaW4le0aFb+SUw6IEW
+axCohHeASRW5P7rV/MBgiSWcKxgAj0XSWXaGMXM9ycfso0IwQDAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBTTHGkZp0gQNJj2xYOEKgB+WoGw/zAOBgNVHQ8BAf8E
+BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIwSZoT6sdk5Duk2oqvI9kbYDH84vut3CmX
+EtJwpeusN5Uv0fm//WfNwXZmZ3RB7L9qAjEAqFQK/AKtmyTePw4w+LQVljNOh1UQ
+sfb8fO9Mt9eYGJ0i1QYo60u/qIypql6ZsIvW
+-----END CERTIFICATE-----
diff --git a/packages/db/package.json b/packages/db/package.json
index 33e7ed3f80..3aae3c16f9 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.0.3",
+    "version": "2.1.1",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",
@@ -21,9 +21,14 @@
             "default": "./dist/index.js"
         },
         "./postinstall": {
-            "import": "./dist/postinstall.js",
             "types": "./src/postinstall.ts",
+            "import": "./dist/postinstall.js",
             "default": "./dist/postinstall.js"
+        },
+        "./ssl-config": {
+            "types": "./dist/ssl-config.d.ts",
+            "import": "./dist/ssl-config.js",
+            "default": "./dist/ssl-config.js"
         }
     },
     "bin": {
@@ -31,6 +36,7 @@
     },
     "files": [
         "dist",
+        "certs",
         "README.md",
         "INTEGRATION_GUIDE.md"
     ],
diff --git a/packages/db/prisma/migrations/20260424171059_vendor_treatment_strategy/migration.sql b/packages/db/prisma/migrations/20260424171059_vendor_treatment_strategy/migration.sql
new file mode 100644
index 0000000000..e07e0d6b35
--- /dev/null
+++ b/packages/db/prisma/migrations/20260424171059_vendor_treatment_strategy/migration.sql
@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "Vendor" ADD COLUMN     "treatmentStrategy" "RiskTreatmentType" NOT NULL DEFAULT 'accept',
+ADD COLUMN     "treatmentStrategyDescription" TEXT;
diff --git a/packages/db/prisma/migrations/20260501205142_auto_link_run_persistence/migration.sql b/packages/db/prisma/migrations/20260501205142_auto_link_run_persistence/migration.sql
new file mode 100644
index 0000000000..fc89dfa5ec
--- /dev/null
+++ b/packages/db/prisma/migrations/20260501205142_auto_link_run_persistence/migration.sql
@@ -0,0 +1,7 @@
+-- AlterTable
+ALTER TABLE "Risk" ADD COLUMN     "autoLinkRunId" TEXT,
+ADD COLUMN     "autoLinkRunStartedAt" TIMESTAMP(3);
+
+-- AlterTable
+ALTER TABLE "Vendor" ADD COLUMN     "autoLinkRunId" TEXT,
+ADD COLUMN     "autoLinkRunStartedAt" TIMESTAMP(3);
diff --git a/packages/db/prisma/migrations/20260505095610_strategy_descriptions_per_strategy/migration.sql b/packages/db/prisma/migrations/20260505095610_strategy_descriptions_per_strategy/migration.sql
new file mode 100644
index 0000000000..09906768ee
--- /dev/null
+++ b/packages/db/prisma/migrations/20260505095610_strategy_descriptions_per_strategy/migration.sql
@@ -0,0 +1,24 @@
+-- AlterTable
+ALTER TABLE "Risk" ADD COLUMN     "strategyDescriptions" JSONB;
+
+-- AlterTable
+ALTER TABLE "Vendor" ADD COLUMN     "strategyDescriptions" JSONB;
+
+-- Backfill: seed `strategyDescriptions` with each row's existing
+-- `treatmentStrategyDescription` keyed by its current `treatmentStrategy`.
+-- Rows without text are left as null so we don't seed empty strings.
+UPDATE "Risk"
+SET    "strategyDescriptions" = jsonb_build_object(
+         "treatmentStrategy"::text,
+         "treatmentStrategyDescription"
+       )
+WHERE  "treatmentStrategyDescription" IS NOT NULL
+   AND "treatmentStrategyDescription" <> '';
+
+UPDATE "Vendor"
+SET    "strategyDescriptions" = jsonb_build_object(
+         "treatmentStrategy"::text,
+         "treatmentStrategyDescription"
+       )
+WHERE  "treatmentStrategyDescription" IS NOT NULL
+   AND "treatmentStrategyDescription" <> '';
diff --git a/packages/db/prisma/migrations/20260505140651_embedding_hash_dedup/migration.sql b/packages/db/prisma/migrations/20260505140651_embedding_hash_dedup/migration.sql
new file mode 100644
index 0000000000..3e0b94526d
--- /dev/null
+++ b/packages/db/prisma/migrations/20260505140651_embedding_hash_dedup/migration.sql
@@ -0,0 +1,8 @@
+-- AlterTable
+ALTER TABLE "Risk" ADD COLUMN     "embeddingHash" TEXT;
+
+-- AlterTable
+ALTER TABLE "Task" ADD COLUMN     "embeddingHash" TEXT;
+
+-- AlterTable
+ALTER TABLE "Vendor" ADD COLUMN     "embeddingHash" TEXT;
diff --git a/packages/db/prisma/migrations/20260506130119_default_treatment_strategy_to_mitigate/migration.sql b/packages/db/prisma/migrations/20260506130119_default_treatment_strategy_to_mitigate/migration.sql
new file mode 100644
index 0000000000..dec23b75e2
--- /dev/null
+++ b/packages/db/prisma/migrations/20260506130119_default_treatment_strategy_to_mitigate/migration.sql
@@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "Risk" ALTER COLUMN "treatmentStrategy" SET DEFAULT 'mitigate';
+
+-- AlterTable
+ALTER TABLE "Vendor" ALTER COLUMN "treatmentStrategy" SET DEFAULT 'mitigate';
diff --git a/packages/db/prisma/schema/risk.prisma b/packages/db/prisma/schema/risk.prisma
index 56fc65e86b..b4a95441dd 100644
--- a/packages/db/prisma/schema/risk.prisma
+++ b/packages/db/prisma/schema/risk.prisma
@@ -11,7 +11,28 @@ model Risk {
   residualLikelihood           Likelihood        @default(very_unlikely)
   residualImpact               Impact            @default(insignificant)
   treatmentStrategyDescription String?
-  treatmentStrategy            RiskTreatmentType @default(accept)
+  // Mitigate is the workhorse — the AI mitigation generator writes a
+  // mitigation plan for every new risk, and the plan is stored under
+  // the active strategy. Defaulting to anything other than mitigate
+  // would put the AI plan under the wrong slot.
+  treatmentStrategy            RiskTreatmentType @default(mitigate)
+  // Per-strategy text store. When the user switches strategies, the current
+  // `treatmentStrategyDescription` is moved into this map under the OLD
+  // strategy key, and the NEW strategy's saved value is loaded back into the
+  // active field. Lets users keep an independent Mitigate plan + Accept
+  // rationale + Transfer rationale on the same risk.
+  // Shape: { mitigate?: string, accept?: string, transfer?: string, avoid?: string }
+  strategyDescriptions         Json?
+
+  // Active auto-link suggestion run (trigger.dev). Set when the user kicks
+  // off an AI suggest scan; cleared when the user applies or discards. Lets
+  // the UI resume an in-flight or completed-but-unreviewed scan after a
+  // page reload so progress isn't lost.
+  autoLinkRunId        String?
+  autoLinkRunStartedAt DateTime?
+
+  // See Task.embeddingHash — skip-if-unchanged guard for re-embedding.
+  embeddingHash String?
 
   // Dates
   createdAt DateTime @default(now())
diff --git a/packages/db/prisma/schema/task.prisma b/packages/db/prisma/schema/task.prisma
index 020fc904fd..7b44c7f6a3 100644
--- a/packages/db/prisma/schema/task.prisma
+++ b/packages/db/prisma/schema/task.prisma
@@ -43,6 +43,12 @@ model Task {
   // Sync-driven archive — see Control.archivedAt.
   archivedAt DateTime?
 
+  // Skip-if-unchanged guard for the auto-linkage embedding pipeline. Holds
+  // a hash of (text + model + dims + department) — when re-running linkage
+  // we skip OpenAI embed + Upstash upsert for any task whose hash matches.
+  // Null means "never embedded" so the next linkage run will embed.
+  embeddingHash String?
+
   @@index([organizationId, archivedAt])
 }
 
diff --git a/packages/db/prisma/schema/vendor.prisma b/packages/db/prisma/schema/vendor.prisma
index 94988d5e7e..afdd196e3a 100644
--- a/packages/db/prisma/schema/vendor.prisma
+++ b/packages/db/prisma/schema/vendor.prisma
@@ -8,6 +8,12 @@ model Vendor {
   inherentImpact      Impact         @default(insignificant)
   residualProbability Likelihood     @default(very_unlikely)
   residualImpact      Impact         @default(insignificant)
+  // See Risk.treatmentStrategy — default mitigate so AI plans land in
+  // the right slot.
+  treatmentStrategy            RiskTreatmentType @default(mitigate)
+  treatmentStrategyDescription String?
+  // See `Risk.strategyDescriptions`.
+  strategyDescriptions         Json?
   website             String?
   isSubProcessor      Boolean        @default(false)
 
@@ -17,6 +23,14 @@ model Vendor {
   trustPortalOrder  Int?
   complianceBadges  Json? // Array of { type: 'soc2' | 'iso27001' | etc, verified: boolean }
 
+  // Active auto-link suggestion run (trigger.dev). Same semantics as
+  // Risk.autoLinkRunId — lets the UI resume an in-flight scan on reload.
+  autoLinkRunId        String?
+  autoLinkRunStartedAt DateTime?
+
+  // See Task.embeddingHash — skip-if-unchanged guard for re-embedding.
+  embeddingHash String?
+
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
diff --git a/packages/db/prisma/seed/primitives/FindingTemplate.json b/packages/db/prisma/seed/primitives/FindingTemplate.json
index cef1a14e63..d99ec2528d 100644
--- a/packages/db/prisma/seed/primitives/FindingTemplate.json
+++ b/packages/db/prisma/seed/primitives/FindingTemplate.json
@@ -1,83 +1,119 @@
 [
   {
-    "id": "fnd_t_evidence_issue_01",
+    "id": "fnd_t_69cd108ab21a08f93e582cba",
     "category": "evidence_issue",
-    "title": "Missing organization context",
-    "content": "The uploaded evidence does not clearly show the Organization Name or URL. Please provide a screenshot showing the context.",
-    "order": 1,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "title": "Pull Requests Samples",
+    "content": "Please upload a sample of recently merged Pull Requests (5 examples). The evidence must clearly show: 1. The Author, 2. The Approver (must be different from the author), and 3. The Build/Test Status checks.",
+    "order": 0,
+    "createdAt": "2026-04-01 12:33:13.504",
+    "updatedAt": "2026-04-01 12:33:13.504"
   },
   {
-    "id": "fnd_t_evidence_issue_02",
+    "id": "fnd_t_69d4f4c983e48b8f30dd2287",
     "category": "evidence_issue",
-    "title": "Evidence outside audit window",
-    "content": "The evidence date falls outside the currently active audit observation window. Please ensure evidence is relevant to the current period.",
-    "order": 2,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "title": "Missing evidence – general",
+    "content": "The evidence provided does not currently demonstrate that this control requirement has been met. Please provide documentation, screenshots, records, or reports that show the control is implemented and operating.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:12:56.833",
+    "updatedAt": "2026-04-07 12:12:56.833"
   },
   {
-    "id": "fnd_t_evidence_issue_03",
+    "id": "fnd_t_69d4f4dab76e1864fa09c55a",
     "category": "evidence_issue",
-    "title": "Unreadable or corrupted file",
-    "content": "The auditor could not open or read the file due to low resolution or corruption. Please re-upload a clear copy.",
-    "order": 3,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "title": "Evidence referenced but not included",
+    "content": "The submission references supporting documentation, but the referenced evidence is not included. Please upload the referenced materials for review.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:13:14.348",
+    "updatedAt": "2026-04-07 12:13:14.348"
   },
   {
-    "id": "fnd_t_further_evidence_01",
-    "category": "further_evidence",
-    "title": "Statement of intent - need proof of operation",
-    "content": "The attached document(s) is a statement of intent. This control requires Evidence of Operation (proof of action). Please upload specific logs, screenshots, system configs, or tickets that demonstrate this policy is currently being enforced.",
-    "order": 1,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "id": "fnd_t_69d4f512d67eb0ae06f32d58",
+    "category": "evidence_issue",
+    "title": "Insufficient detail",
+    "content": "The current evidence does not provide enough detail to confirm the control design or operation. Please provide additional supporting information, such as expanded screenshots, system settings, further logs, or procedure details.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:14:10.343",
+    "updatedAt": "2026-04-07 12:14:10.343"
   },
   {
-    "id": "fnd_t_further_evidence_02",
-    "category": "further_evidence",
-    "title": "No evidence attached",
-    "content": "This task was marked as 'Done', but no file was attached. For an external audit, every completed task requires proof of execution. Please upload the specific evidence (screenshot, PDF, or export) and re-submit.",
-    "order": 2,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "id": "fnd_t_69d4fb57f1f2214c213701fd",
+    "category": "evidence_issue",
+    "title": "Further evidence samples required",
+    "content": "The evidence provided is not currently sufficient to complete testing for this requirement. Please provide further evidence samples covering 5 samples or 10% of the organization’s headcount, whichever is greater. The samples should be representative of the relevant population for the period under review and include sufficient supporting documentation to allow assessment of control operation.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:40:55.039",
+    "updatedAt": "2026-04-07 12:40:55.039"
   },
   {
-    "id": "fnd_t_task_specific_01",
-    "category": "task_specific",
-    "title": "Pull Request samples required",
-    "content": "Please upload a sample of recently merged Pull Requests (5 examples). The evidence must clearly show: 1. The Author, 2. The Approver (must be different from the author), and 3. The Build/Test Status checks.",
-    "order": 1,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "id": "fnd_t_69d4fb8390ce6bd186c87492",
+    "category": "evidence_issue",
+    "title": "One or more devices are failing",
+    "content": "The evidence provided indicates that one or more devices are currently in a failing or non-compliant state. Please review the affected devices and provide updated evidence.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:41:38.763",
+    "updatedAt": "2026-04-07 12:41:38.763"
   },
   {
-    "id": "fnd_t_task_specific_02",
-    "category": "task_specific",
-    "title": "Alert screenshot required",
-    "content": "Please upload a screenshot of an actual triggered alert (e.g., a notification from PagerDuty, Slack, or Email). The evidence must clearly show: 1. The Alert Name, 2. The Timestamp, and 3. The Severity Level.",
-    "order": 2,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "id": "fnd_t_69d4fbae4fb6a512f01c618d",
+    "category": "evidence_issue",
+    "title": "One or more employees show incomplete training",
+    "content": "The evidence provided indicates that one or more employees have not completed the required training in full. ",
+    "order": 0,
+    "createdAt": "2026-04-07 12:42:21.501",
+    "updatedAt": "2026-04-07 12:42:21.501"
   },
   {
-    "id": "fnd_t_task_specific_03",
-    "category": "task_specific",
-    "title": "System logs sample required",
-    "content": "Please provide a sample of System or Infrastructure Logs (e.g., AWS CloudWatch, Google Cloud Logging, Datadog). The sample must clearly show headers including: Timestamp, Event/Error Message, and Source/User.",
-    "order": 3,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "id": "fnd_t_69d4fc1c1113cd6a2cac9f49",
+    "category": "evidence_issue",
+    "title": "Evidence unclear or illegible",
+    "content": "The submitted evidence is unclear and cannot be reliably assessed. Please provide a clearer version of the document or screenshot.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:44:12.123",
+    "updatedAt": "2026-04-07 12:44:12.123"
   },
   {
-    "id": "fnd_t_na_incorrect_01",
-    "category": "na_incorrect",
-    "title": "Control required for compliance",
-    "content": "This control is required for SOC 2 compliance, regardless of company size. However, the evidence can be scaled down to fit your stage. Please see the guidance documentation for acceptable lightweight evidence.",
+    "id": "fnd_t_69d4fc31b0b632da4020f804",
+    "category": "evidence_issue",
+    "title": "Evidence not current",
+    "content": "The evidence provided appears outdated and does not demonstrate current operation of the control. Please provide more recent evidence for the applicable review period.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:44:32.547",
+    "updatedAt": "2026-04-07 12:44:32.547"
+  },
+  {
+    "id": "fnd_t_69d4fd25ff4d03074ecaa0ee",
+    "category": "evidence_issue",
+    "title": "Backup restoration evidence required",
+    "content": "Backup restoration evidence is incomplete. A report has been provided, but supporting evidence such as a recording or screenshots of the restore test is also required.",
+    "order": 0,
+    "createdAt": "2026-04-07 12:48:36.879",
+    "updatedAt": "2026-04-07 12:48:36.879"
+  },
+  {
+    "id": "fnd_t_69df9438c85454008e652d2b",
+    "category": "evidence_issue",
+    "title": "Logging evidence missing",
+    "content": "The evidence provided does not currently demonstrate logging for the relevant systems or activities. Please provide supporting evidence such as configuration screenshots, sample log output, or other records showing that logging is enabled and available for review.",
+    "order": 0,
+    "createdAt": "2026-04-15 13:35:51.809",
+    "updatedAt": "2026-04-15 13:35:51.809"
+  },
+  {
+    "id": "fnd_t_69df94702fc4ed39f0d07bf2",
+    "category": "evidence_issue",
+    "title": "No evidence provided",
+    "content": "No evidence has been provided for this requirement. Please upload supporting evidence for review.",
     "order": 1,
-    "createdAt": "2025-01-26 00:00:00.000",
-    "updatedAt": "2025-01-26 00:00:00.000"
+    "createdAt": "2026-04-15 13:36:48.345",
+    "updatedAt": "2026-04-15 13:37:02.287"
+  },
+  {
+    "id": "fnd_t_69df940c52b31c4abed9a9e0",
+    "category": "evidence_issue",
+    "title": "Alerts evidence missing",
+    "content": "The submission does not clearly demonstrate how security or operational alerts are generated, triaged, and resolved. Please provide monitoring workflow documentation or alert records.",
+    "order": 0,
+    "createdAt": "2026-04-15 13:35:07.725",
+    "updatedAt": "2026-04-15 13:37:46.984"
   }
-]
+]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
index 725d7e3524..0e881f1fad 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorControlTemplate.json
@@ -4,349 +4,1699 @@
     "name": "Secure Data Transfer",
     "description": "Protect Information in Transit",
     "createdAt": "2025-06-04 16:09:44.637",
-    "updatedAt": "2025-06-04 19:41:05.066"
+    "updatedAt": "2025-06-04 19:41:05.066",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684071e280c4e0f777b957f7",
     "name": "Data Privacy",
     "description": "Protect Privacy and Personal Data (PII)",
     "createdAt": "2025-06-04 16:18:42.339",
-    "updatedAt": "2025-06-04 19:41:05.908"
+    "updatedAt": "2025-06-04 19:41:05.908",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684073617d0706858cceb8c7",
     "name": "Asset Return",
     "description": "Ensure Return of Assets Upon Termination",
     "createdAt": "2025-06-04 16:25:04.708",
-    "updatedAt": "2025-06-04 19:41:06.360"
+    "updatedAt": "2025-06-04 19:41:06.360",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68407429371f33886d8ab80d",
     "name": "Encryption Key Management",
     "description": "Implement Cryptographic Key Lifecycle Management",
     "createdAt": "2025-06-04 16:28:25.083",
-    "updatedAt": "2025-06-04 19:41:06.998"
+    "updatedAt": "2025-06-04 19:41:06.998",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_6840705b6dcee0506dabacfb",
     "name": "Regulatory Compliance",
     "description": "Identify and Comply with Legal and Contractual Requirements",
     "createdAt": "2025-06-04 16:12:11.272",
-    "updatedAt": "2025-06-04 19:41:05.205"
+    "updatedAt": "2025-06-04 19:41:05.205",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_6840738800f98fa3c0f3a3ae",
     "name": "Configuration & Patch Management",
     "description": "Harden baselines; patch swiftly",
     "createdAt": "2025-06-04 16:25:43.882",
-    "updatedAt": "2025-06-04 19:41:06.507"
+    "updatedAt": "2025-06-04 19:41:06.507",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684072e06f4a49ee669076cc",
     "name": "Endpoint Protection",
     "description": "Protect Systems Against Malware",
     "createdAt": "2025-06-04 16:22:56.279",
-    "updatedAt": "2025-06-09 02:50:51.955"
+    "updatedAt": "2025-06-09 02:50:51.955",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684070831cc83c4ab4c2c4d8",
     "name": "Security Logging",
     "description": "Enable Logging of Security Events",
     "createdAt": "2025-06-04 16:12:50.757",
-    "updatedAt": "2025-06-04 19:41:05.344"
+    "updatedAt": "2025-06-04 19:41:05.344",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_6840731ae0b857152b35ca8f",
     "name": "Remote-Work Security",
     "description": "Implement Secure Remote Working Practices",
     "createdAt": "2025-06-04 16:23:54.000",
-    "updatedAt": "2025-06-04 19:41:06.238"
+    "updatedAt": "2025-06-04 19:41:06.238",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684073ba24475a83ba048022",
     "name": "Segregation of duties",
     "description": "Implement Segregation of Duties",
     "createdAt": "2025-06-04 16:26:33.778",
-    "updatedAt": "2025-06-04 19:41:06.631"
+    "updatedAt": "2025-06-04 19:41:06.631",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684073d541bfb8b8b777e529",
     "name": "Threat intelligence",
     "description": "Implement a Threat Intelligence Program",
     "createdAt": "2025-06-04 16:27:01.369",
-    "updatedAt": "2025-06-04 19:41:06.752"
+    "updatedAt": "2025-06-04 19:41:06.752",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68407c9513000617776104c7",
     "name": "Acceptable Use",
     "description": "Establish an Acceptable Use Policy for Information and Assets",
     "createdAt": "2025-06-04 17:04:20.799",
-    "updatedAt": "2025-06-04 19:41:07.258"
-  },
-  {
-    "id": "frk_ct_6849ba93636ff0155eb89158",
-    "name": "Utility Tool monitoring",
-    "description": "Audits the execution of privileged program",
-    "createdAt": "2025-06-11 17:19:15.284",
-    "updatedAt": "2025-06-11 17:19:15.284"
-  },
-  {
-    "id": "frk_ct_683f4a410cf5bf6d40bf3583",
-    "name": "Access Rights",
-    "description": "Manage User Access Rights Lifecycle",
-    "createdAt": "2025-06-03 19:17:20.504",
-    "updatedAt": "2025-06-04 19:41:03.426"
+    "updatedAt": "2025-06-04 19:41:07.258",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4ae4acbd63d0e558a6f5",
     "name": "Credential Management",
     "description": "Protect Authentication Information",
     "createdAt": "2025-06-03 19:20:04.055",
-    "updatedAt": "2025-06-04 19:41:03.601"
+    "updatedAt": "2025-06-04 19:41:03.601",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4b7614d209f8b6ffd477",
     "name": "Resource Capacity Management",
     "description": "Perform Capacity Management for Resources",
     "createdAt": "2025-06-03 19:22:30.199",
-    "updatedAt": "2025-06-04 19:41:03.729"
+    "updatedAt": "2025-06-04 19:41:03.729",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4c30e2d3f1117fa58e13",
     "name": "Change management",
     "description": "Apply Change Management for Information Systems",
     "createdAt": "2025-06-03 19:25:36.373",
-    "updatedAt": "2025-06-04 19:41:03.850"
+    "updatedAt": "2025-06-04 19:41:03.850",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4c9db20e7cf4a303af1f",
     "name": "Compliance Register",
     "description": "Maintain compliance register exceptions",
     "createdAt": "2025-06-03 19:27:24.623",
-    "updatedAt": "2025-06-04 19:41:03.972"
-  },
-  {
-    "id": "frk_ct_683f4dd564057a97ae323c9f",
-    "name": "Disaster Recovery Planning",
-    "description": "Test DR; meet RTO/RPO",
-    "createdAt": "2025-06-03 19:32:37.325",
-    "updatedAt": "2025-06-04 19:41:04.410"
+    "updatedAt": "2025-06-04 19:41:03.972",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4ef6c6a5481a377be413",
     "name": "Standard Operating Procedures (SOPs)",
     "description": "Document Operational Procedures",
     "createdAt": "2025-06-03 19:37:26.001",
-    "updatedAt": "2025-06-04 19:41:04.534"
+    "updatedAt": "2025-06-04 19:41:04.534",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4f59dea367ca96145e14",
     "name": "Independent ISMS Review",
     "description": "Conduct Independent Review of the ISMS",
     "createdAt": "2025-06-03 19:39:04.628",
-    "updatedAt": "2025-06-04 19:41:04.669"
+    "updatedAt": "2025-06-04 19:41:04.669",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f50556124040dc15d62cb",
     "name": "Continuity-Time Security",
     "description": "Maintain Security During Disruptions",
     "createdAt": "2025-06-03 19:43:16.530",
-    "updatedAt": "2025-06-04 19:41:04.806"
+    "updatedAt": "2025-06-04 19:41:04.806",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f50aae46f5e4e096e6bb3",
     "name": "Secure SDLC Integration",
     "description": "Integrate Information Security into Project Management",
     "createdAt": "2025-06-03 19:44:41.732",
-    "updatedAt": "2025-06-04 19:41:04.941"
+    "updatedAt": "2025-06-04 19:41:04.941",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_684070c1f0091d850df02e59",
     "name": "Mobile Security",
     "description": "Enforce MDM on mobile",
     "createdAt": "2025-06-04 16:13:52.979",
-    "updatedAt": "2025-06-04 19:41:05.484"
+    "updatedAt": "2025-06-04 19:41:05.484",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68407122565b1968676d93db",
     "name": "Physical Access Control",
     "description": "Control Physical Entry to Facilities",
     "createdAt": "2025-06-04 16:15:29.760",
-    "updatedAt": "2025-06-04 19:41:05.759"
+    "updatedAt": "2025-06-04 19:41:05.759",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68407406644c56d42eac3295",
     "name": "Endpoint Security",
     "description": "Secure User Endpoint Devices",
     "createdAt": "2025-06-04 16:27:49.808",
-    "updatedAt": "2025-06-04 19:41:06.874"
-  },
-  {
-    "id": "frk_ct_683f4d7360a876b972aba39a",
-    "name": "Vulnerability Management",
-    "description": "Manage both software and code vulnerabilities",
-    "createdAt": "2025-06-03 19:30:59.173",
-    "updatedAt": "2025-06-09 03:19:38.679"
-  },
-  {
-    "id": "frk_ct_683f3ecd42e62fde624c59c1",
-    "name": "Policy Compliance",
-    "description": "Ensure Compliance with Security Policies and Standards",
-    "createdAt": "2025-06-03 18:28:29.154",
-    "updatedAt": "2025-06-04 19:41:01.555"
+    "updatedAt": "2025-06-04 19:41:06.874",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4036b541126388e2989a",
     "name": "Security Governance Roles",
     "description": "Define Security Roles and Responsibilities",
     "createdAt": "2025-06-03 18:34:29.668",
-    "updatedAt": "2025-06-04 19:41:01.679"
-  },
-  {
-    "id": "frk_ct_683f41e775f4ca03d8f6bae2",
-    "name": "Management Security Accountability",
-    "description": "Ensure Management Addresses Security Responsibilities",
-    "createdAt": "2025-06-03 18:41:43.467",
-    "updatedAt": "2025-06-04 19:41:01.801"
-  },
-  {
-    "id": "frk_ct_683f42c71eea99f22f9df060",
-    "name": "Asset Inventory",
-    "description": "Maintain an Inventory of Information Assets",
-    "createdAt": "2025-06-03 18:45:27.396",
-    "updatedAt": "2025-06-04 19:41:01.922"
+    "updatedAt": "2025-06-04 19:41:01.679",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f43a65de3b6044e63220f",
     "name": "Personnel Security",
     "description": "Screen onboard offboard securely",
     "createdAt": "2025-06-03 18:49:09.819",
-    "updatedAt": "2025-06-04 19:41:02.105"
+    "updatedAt": "2025-06-04 19:41:02.105",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f4457b14856e700c8c25b",
     "name": "Disciplinary process",
     "description": "Establish a Disciplinary Process for Security Violations",
     "createdAt": "2025-06-03 18:52:06.698",
-    "updatedAt": "2025-06-04 19:41:02.231"
+    "updatedAt": "2025-06-04 19:41:02.231",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f44c8074680be528353c1",
     "name": "Data Retention & Destruction",
     "description": "Follow retention; securely dispose",
     "createdAt": "2025-06-03 18:54:00.325",
-    "updatedAt": "2025-06-04 19:41:02.378"
+    "updatedAt": "2025-06-04 19:41:02.378",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f45c5058c486f3fa5b7bc",
     "name": "Regulatory Liaison",
     "description": "Maintain Contact with Authorities",
     "createdAt": "2025-06-03 18:58:13.372",
-    "updatedAt": "2025-06-04 19:41:02.510"
+    "updatedAt": "2025-06-04 19:41:02.510",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f464bec8bea67de7b9c31",
     "name": "Information Classification",
     "description": "Classify Information by Sensitivity",
     "createdAt": "2025-06-03 19:00:26.503",
-    "updatedAt": "2025-06-04 19:41:02.645"
+    "updatedAt": "2025-06-04 19:41:02.645",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f46f3f181af3f93773c1d",
     "name": "Security Monitoring & Detection",
     "description": "Central SIEM with alerting",
     "createdAt": "2025-06-03 19:03:14.483",
-    "updatedAt": "2025-06-04 19:41:02.777"
+    "updatedAt": "2025-06-04 19:41:02.777",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f47cc2faa426603d6bee8",
     "name": "Security Incident Management",
     "description": "Establish an Incident Management Policy and Procedures",
     "createdAt": "2025-06-03 19:06:52.138",
-    "updatedAt": "2025-06-04 19:41:03.035"
-  },
-  {
-    "id": "frk_ct_683f484fc7b5506ab97c26af",
-    "name": "Risk Management",
-    "description": "Maintain a Risk Management Program",
-    "createdAt": "2025-06-03 19:09:02.849",
-    "updatedAt": "2025-06-04 19:41:03.156"
+    "updatedAt": "2025-06-04 19:41:03.035",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_683f48ee9534e1e0a088e922",
     "name": "Supplier Security",
     "description": "Ensure Security in Supplier Relationships",
     "createdAt": "2025-06-03 19:11:41.449",
-    "updatedAt": "2025-06-04 19:41:03.278"
+    "updatedAt": "2025-06-04 19:41:03.278",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_6849c343d7fbe4e71446ce78",
     "name": "Data Masking",
     "description": "Hide sensitive fields",
     "createdAt": "2025-06-11 17:56:19.307",
-    "updatedAt": "2025-06-11 17:56:19.307"
-  },
-  {
-    "id": "frk_ct_68b59a16b172e5c360e57536",
-    "name": "GDPR",
-    "description": "GDPR Controls",
-    "createdAt": "2025-09-01 13:05:26.037",
-    "updatedAt": "2025-09-01 13:05:26.037"
+    "updatedAt": "2025-06-11 17:56:19.307",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68b59e50eeb9f92ce425327c",
     "name": "ISO",
     "description": "ISO Controls",
     "createdAt": "2025-09-01 13:23:28.289",
-    "updatedAt": "2025-09-01 13:23:28.289"
+    "updatedAt": "2025-09-01 13:23:28.289",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68c1eb1c5f317f452216e2d7",
     "name": "PCI",
     "description": "PCI Controls",
     "createdAt": "2025-09-10 21:18:19.912",
-    "updatedAt": "2025-09-10 21:18:19.912"
+    "updatedAt": "2025-09-10 21:18:19.912",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68cc25ac90e3fe79c1beb98d",
     "name": "ISO 42001",
     "description": "Additional ISO 42001 Controls",
     "createdAt": "2025-09-18 15:30:51.512",
-    "updatedAt": "2025-09-18 15:30:51.512"
+    "updatedAt": "2025-09-18 15:30:51.512",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68e1364141d03b5e6d70e728",
     "name": "NEN 7510",
     "description": "NEN 7510 Controls",
     "createdAt": "2025-10-04 14:59:12.925",
-    "updatedAt": "2025-10-04 14:59:12.925"
+    "updatedAt": "2025-10-04 14:59:12.925",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68e8079750107bcc63fc79d9",
     "name": "Encrypted Data at Rest",
     "description": "The organization encrypts all production databases containing customer data at rest",
     "createdAt": "2025-10-09 19:05:59.357",
-    "updatedAt": "2025-10-09 19:05:59.357"
+    "updatedAt": "2025-10-09 19:05:59.357",
+    "documentTypes": []
   },
   {
     "id": "frk_ct_68e80a11f225cb2253e31fa0",
     "name": "Organization Structure & Reporting Lines",
     "description": "Management establishes, with board oversight, structures, reporting lines, authorities, and responsibilities",
     "createdAt": "2025-10-09 19:16:33.433",
-    "updatedAt": "2025-10-09 19:16:33.433"
+    "updatedAt": "2025-10-09 19:16:33.433",
+    "documentTypes": []
   },
   {
-    "id": "frk_ct_684070f0b4f6c2036306e23c",
-    "name": "Network Security",
-    "description": "Enforce segmentation and firewalls",
-    "createdAt": "2025-06-04 16:14:40.321",
-    "updatedAt": "2025-11-19 11:44:13.157"
+    "id": "frk_ct_6849ba93636ff0155eb89158",
+    "name": "Utility Tool monitoring",
+    "description": "Audits the execution of privileged program",
+    "createdAt": "2025-06-11 17:19:15.284",
+    "updatedAt": "2026-04-20 15:33:55.351",
+    "documentTypes": [
+      "infrastructure_inventory"
+    ]
   },
   {
     "id": "frk_ct_691e53f4024ab9cc096bbc70",
     "name": "ISO 9001",
     "description": "ISO 9001 Controls",
     "createdAt": "2025-11-19 23:34:11.538",
-    "updatedAt": "2025-11-19 23:34:11.538"
+    "updatedAt": "2025-11-19 23:34:11.538",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69becde6133891181f5fbfe1",
+    "name": "Fridge kept between 2-5",
+    "description": "Keep fridge between 2and 5degrees",
+    "createdAt": "2026-03-21 16:57:10.184",
+    "updatedAt": "2026-03-21 17:05:13.971",
+    "documentTypes": [
+      "board_meeting"
+    ]
+  },
+  {
+    "id": "frk_ct_69bed10053f2dfa2421b5e4e",
+    "name": "New Control",
+    "description": "Bla",
+    "createdAt": "2026-03-21 17:10:24.047",
+    "updatedAt": "2026-03-21 17:10:24.047",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "name": "PCI DSS scope & cardholder data environment (CDE)",
+    "description": "Defines and maintains the PCI DSS scope, CDE boundary, and inventory of in-scope components; records periodic scope confirmation and significant-change reviews.",
+    "createdAt": "2026-04-13 18:19:18.314",
+    "updatedAt": "2026-04-13 18:19:18.314",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69dd33a6c094ddd8a7268013",
+    "name": "PCI DSS program management",
+    "description": "Governs the overall PCI DSS compliance program: executive ownership, SP-specific duties, customer attestations, and coordination of PCI-driven reviews and testing cadences.",
+    "createdAt": "2026-04-13 18:19:18.460",
+    "updatedAt": "2026-04-13 18:19:18.460",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "name": "Access Rights",
+    "description": "Manage User Access Rights Lifecycle",
+    "createdAt": "2025-06-03 19:17:20.504",
+    "updatedAt": "2026-04-13 22:30:52.353",
+    "documentTypes": [
+      "access_request"
+    ]
+  },
+  {
+    "id": "frk_ct_684070f0b4f6c2036306e23c",
+    "name": "Network Security",
+    "description": "Enforce segmentation and firewalls",
+    "createdAt": "2025-06-04 16:14:40.321",
+    "updatedAt": "2026-04-20 15:33:55.130",
+    "documentTypes": [
+      "network_diagram"
+    ]
+  },
+  {
+    "id": "frk_ct_683f42c71eea99f22f9df060",
+    "name": "Asset Inventory",
+    "description": "Maintain an Inventory of Information Assets",
+    "createdAt": "2025-06-03 18:45:27.396",
+    "updatedAt": "2026-04-20 15:33:55.801",
+    "documentTypes": [
+      "infrastructure_inventory"
+    ]
+  },
+  {
+    "id": "frk_ct_683f4dd564057a97ae323c9f",
+    "name": "Disaster Recovery Planning",
+    "description": "Test DR; meet RTO/RPO",
+    "createdAt": "2025-06-03 19:32:37.325",
+    "updatedAt": "2026-04-20 17:55:13.005",
+    "documentTypes": [
+      "board_meeting",
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "name": "Management Security Accountability",
+    "description": "Ensure Management Addresses Security Responsibilities",
+    "createdAt": "2025-06-03 18:41:43.467",
+    "updatedAt": "2026-04-27 17:12:09.307",
+    "documentTypes": [
+      "rbac_matrix"
+    ]
+  },
+  {
+    "id": "frk_ct_683f3ecd42e62fde624c59c1",
+    "name": "Policy Compliance",
+    "description": "Ensure Compliance with Security Policies and Standards",
+    "createdAt": "2025-06-03 18:28:29.154",
+    "updatedAt": "2026-04-27 17:12:14.631",
+    "documentTypes": [
+      "rbac_matrix"
+    ]
+  },
+  {
+    "id": "frk_ct_683f484fc7b5506ab97c26af",
+    "name": "Risk Management",
+    "description": "Maintain a Risk Management Program",
+    "createdAt": "2025-06-03 19:09:02.849",
+    "updatedAt": "2026-04-27 17:12:22.641",
+    "documentTypes": [
+      "rbac_matrix"
+    ]
+  },
+  {
+    "id": "frk_ct_69dd33a73264cb77236367ba",
+    "name": "E-commerce & payment page integrity",
+    "description": "Protects online payment pages from unauthorized scripts and content changes: authorized script lists, integrity/subresource controls, and monitoring for skimming-related tampering.",
+    "createdAt": "2026-04-13 18:19:18.749",
+    "updatedAt": "2026-04-13 18:19:18.749",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69dd3265dadac07cd88ae96c",
+    "name": "Payment terminals & POI",
+    "description": "Addresses card-present capture devices: inventory (make/model/serial/location), tamper checks, staff awareness, and substitution controls—not general building access alone.",
+    "createdAt": "2026-04-13 18:13:56.945",
+    "updatedAt": "2026-04-13 18:19:18.854",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "name": "ASV & PCI assessment interfaces",
+    "description": "Runs the PCI external scanning channel (ASV), tracks passing scans and disputes, and interfaces with assessors (e.g. QSA) separately from day-to-day internal vulnerability scanning.",
+    "createdAt": "2026-04-13 18:19:18.620",
+    "updatedAt": "2026-04-13 22:28:31.756",
+    "documentTypes": [
+      "penetration_test"
+    ]
+  },
+  {
+    "id": "frk_ct_69e639b8c95150ea34dc07bf",
+    "name": "Physical & Environmental Security",
+    "description": "Defines and maintains physical perimeters, entry controls, environmental threat protections, cabling security, and secure siting of equipment.",
+    "createdAt": "2026-04-20 14:35:36.406",
+    "updatedAt": "2026-04-20 14:35:36.406",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "name": "Supplier & Third-Party Security",
+    "description": "Manages supplier due diligence, contract clauses, ongoing monitoring, and supply-chain risk for ICT services.",
+    "createdAt": "2026-04-20 14:35:36.585",
+    "updatedAt": "2026-04-20 14:35:36.585",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e639b9d5ced482c12ae932",
+    "name": "Business Continuity & ICT Readiness",
+    "description": "Extends DR to include BIA, continuity strategy, tabletop/real exercises, and ICT readiness commitments per service tier.",
+    "createdAt": "2026-04-20 14:35:36.850",
+    "updatedAt": "2026-04-20 14:35:36.850",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e639b9148c96a37c8936fc",
+    "name": "Legal, Regulatory & IP Compliance",
+    "description": "Maintains an obligations register for applicable laws, regulations, contracts, and IP; tracks assurance for PII handling.",
+    "createdAt": "2026-04-20 14:35:37.106",
+    "updatedAt": "2026-04-20 15:31:42.642",
+    "documentTypes": [
+      "board_meeting",
+      "meeting"
+    ]
+  },
+  {
+    "id": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "name": "Risk Management",
+    "description": "Formal risk identification, assessment, treatment, and monitoring process, including risk register and treatment plans.",
+    "createdAt": "2026-04-20 14:35:36.757",
+    "updatedAt": "2026-04-20 15:33:55.473",
+    "documentTypes": [
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_69e639b96ad6c5e729676acb",
+    "name": "Internal Audit & Management Review",
+    "description": "Plans and executes internal ISMS audits, tracks findings, and facilitates periodic management review of ISMS effectiveness.",
+    "createdAt": "2026-04-20 14:35:36.934",
+    "updatedAt": "2026-04-20 15:33:55.598",
+    "documentTypes": [
+      "tabletop_exercise",
+      "infrastructure_inventory",
+      "rbac_matrix",
+      "access_request"
+    ]
+  },
+  {
+    "id": "frk_ct_683f4d7360a876b972aba39a",
+    "name": "Vulnerability Management",
+    "description": "Manage both software and code vulnerabilities",
+    "createdAt": "2025-06-03 19:30:59.173",
+    "updatedAt": "2026-04-20 15:33:55.918",
+    "documentTypes": [
+      "penetration_test"
+    ]
+  },
+  {
+    "id": "frk_ct_69e65ef9c20933590d85cc31",
+    "name": "Physical & Environmental Security",
+    "description": "Defines and maintains physical perimeters, entry controls, environmental threat protections, cabling security, and secure siting of equipment.",
+    "createdAt": "2026-04-20 17:14:33.358",
+    "updatedAt": "2026-04-20 17:14:33.358",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e669af7fd9ef27754dc041",
+    "name": "Encrypted Data at Rest",
+    "description": "The organization encrypts all production databases containing customer data at rest",
+    "createdAt": "2026-04-20 18:00:14.801",
+    "updatedAt": "2026-04-20 18:00:14.801",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e6766bd8ca18f572d4c34f",
+    "name": "Scope & Governance",
+    "description": "Defines the scope and boundaries of the Information Security Management System (ISMS), including internal and external context, interested parties, and the organizational roles, responsibilities, and authorities that lead information security. Establishes top-management commitment and the governance structure that keeps the ISMS aligned with the business.",
+    "createdAt": "2026-04-20 18:54:35.207",
+    "updatedAt": "2026-04-20 18:54:35.207",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e6766b7c6c7a214eea9c3c",
+    "name": "Statement of Applicability (SoA)",
+    "description": "Produces and maintains the ISO 27001 Statement of Applicability: the authoritative list of every Annex A control showing whether it is included or excluded from the ISMS, the justification for each decision, and the current implementation status. Updated whenever risk treatment decisions change.",
+    "createdAt": "2026-04-20 18:54:35.277",
+    "updatedAt": "2026-04-20 18:54:35.277",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e6766b4fd2b466bf7686cf",
+    "name": "Performance Monitoring & Measurement",
+    "description": "Measures how well the ISMS is achieving its intended outcomes by defining security metrics and KPIs (e.g. control coverage, incident MTTD/MTTR, training completion, audit findings aging), collecting results on a defined cadence, and reporting them to management. Evaluates compliance with legal, regulatory, and contractual requirements over time.",
+    "createdAt": "2026-04-20 18:54:35.339",
+    "updatedAt": "2026-04-20 18:54:35.339",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e6766bd483954a1f0b8445",
+    "name": "Continual Improvement & Corrective Action",
+    "description": "Captures nonconformities identified through audits, incidents, management reviews, or day-to-day operations, performs root-cause analysis, and drives corrective and preventive actions to completion. Feeds lessons learned back into policies, controls, and the risk register so the ISMS improves over time.",
+    "createdAt": "2026-04-20 18:54:35.391",
+    "updatedAt": "2026-04-20 18:54:35.391",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e676cf185023edccc55755",
+    "name": "Scope & Governance",
+    "description": "Defines the scope and boundaries of the Information Security Management System (ISMS), including internal and external context, interested parties, and the organizational roles, responsibilities, and authorities that lead information security. Establishes top-management commitment and the governance structure that keeps the ISMS aligned with the business.",
+    "createdAt": "2026-04-20 18:56:15.151",
+    "updatedAt": "2026-04-20 18:56:15.151",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e6789971bc8d38d8df1c7c",
+    "name": " Accountability and governance",
+    "description": "",
+    "createdAt": "2026-04-20 19:03:53.126",
+    "updatedAt": "2026-04-20 19:03:53.126",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e678bab215222879333e90",
+    "name": " Accountability and governance",
+    "description": "",
+    "createdAt": "2026-04-20 19:04:25.931",
+    "updatedAt": "2026-04-20 19:04:25.931",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e678c48b22e4ca14c99684",
+    "name": " Accountability and governance",
+    "description": " Accountability and governance",
+    "createdAt": "2026-04-20 19:04:36.248",
+    "updatedAt": "2026-04-20 19:04:36.248",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e69e7b48867208ff473273",
+    "name": " Privacy rights",
+    "description": "",
+    "createdAt": "2026-04-20 21:45:30.896",
+    "updatedAt": "2026-04-20 21:45:30.896",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e914db8cd2039367ccbf0f",
+    "name": "ASV Scanning",
+    "description": "Engage a PCI SSC Approved Scanning Vendor (ASV) to perform external vulnerability scans at least quarterly and after any significant change, and remediate findings to meet ASV passing criteria.",
+    "createdAt": "2026-04-22 18:35:07.366",
+    "updatedAt": "2026-04-22 18:35:07.366",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e7f403f696c2577de1",
+    "name": "Lawful Basis Register",
+    "description": "Document and maintain a register of the lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) relied on for each processing activity, including the assessment supporting the chosen basis.",
+    "createdAt": "2026-04-22 18:52:22.734",
+    "updatedAt": "2026-04-22 18:52:22.734",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e7f7739946f5034799",
+    "name": "Privacy Notice",
+    "description": "Publish a clear, concise, and accessible privacy notice that describes processing activities, lawful bases, data subject rights, recipients, retention, international transfers, and contact details for the controller and DPO. Review and update on material changes.",
+    "createdAt": "2026-04-22 18:52:23.184",
+    "updatedAt": "2026-04-22 18:52:23.184",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e805776785f8f80a14",
+    "name": "Privacy by Design and by Default",
+    "description": "Embed data protection principles into the design of systems and processes. Require privacy review at product inception and at every change that affects personal data processing, and default all settings to the most privacy-protective option.",
+    "createdAt": "2026-04-22 18:52:23.661",
+    "updatedAt": "2026-04-22 18:52:23.661",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e639b958a20954c4afa186",
+    "name": "Human Resources Security",
+    "description": "Owns pre-employment screening, confidentiality agreements, awareness training curriculum, and disciplinary handling for security violations.",
+    "createdAt": "2026-04-20 14:35:36.677",
+    "updatedAt": "2026-04-30 21:36:55.261",
+    "documentTypes": [
+      "employee_performance_evaluation"
+    ]
+  },
+  {
+    "id": "frk_ct_69e918e8cc289b978f31a12a",
+    "name": "Data Minimization, Encryption, and Pseudonymization",
+    "description": "Limit personal data collected to what is necessary for the processing purpose. Encrypt personal data in transit and at rest, and pseudonymize or anonymize personal data wherever feasible.",
+    "createdAt": "2026-04-22 18:52:24.037",
+    "updatedAt": "2026-04-22 18:52:24.037",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e94e68c0fb15ee98d0",
+    "name": "Personal Data Breach Response Procedure",
+    "description": "Maintain and test an incident response procedure that detects, assesses, and documents personal data breaches, notifies the relevant supervisory authority within 72 hours, and notifies affected data subjects when the breach is likely to result in high risk to their rights and freedoms.",
+    "createdAt": "2026-04-22 18:52:25.287",
+    "updatedAt": "2026-04-22 18:52:25.287",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e8c57e2f6756c995ca",
+    "name": "Information Security Policy and Awareness Training",
+    "description": "Maintain an internal information security policy covering access control, acceptable use, and personal data handling. Deliver data protection awareness training to personnel at onboarding and at least annually.",
+    "createdAt": "2026-04-22 18:52:24.472",
+    "updatedAt": "2026-04-22 18:52:24.472",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "name": "GDPR Accountability Roles and Representatives",
+    "description": "Designate an owner accountable for GDPR compliance. Where required, appoint a Data Protection Officer and, for controllers or processors established outside the EU, appoint an EU representative. Maintain documented responsibilities and contact details.",
+    "createdAt": "2026-04-22 18:52:25.760",
+    "updatedAt": "2026-04-22 18:52:25.760",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918eaa930d07ea41dd0d0",
+    "name": "Data Processing Agreements with Third Parties",
+    "description": "Execute a written Data Processing Agreement with every processor that handles personal data on behalf of the organization, including the subject matter, duration, purpose, type of personal data, obligations of the processor, sub-processor rules, and data return or deletion at end of service.",
+    "createdAt": "2026-04-22 18:52:26.128",
+    "updatedAt": "2026-04-22 18:52:26.128",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918eb724c553d2e5749ea",
+    "name": "Data Subject Rights Request Workflow",
+    "description": "Provide a documented, accessible workflow for data subjects to exercise their rights of access, rectification, erasure, restriction, portability, and objection. Verify identity, respond within one month (extendable by two months where justified), and log each request and its outcome.",
+    "createdAt": "2026-04-22 18:52:26.576",
+    "updatedAt": "2026-04-22 18:52:26.576",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918eb8f6e80605d3fa3e5",
+    "name": "Automated Decision-Making Safeguards",
+    "description": "Identify processing activities involving solely automated decision-making (including profiling) with legal or similarly significant effects. Provide data subjects with meaningful information about the logic, the right to human intervention, to express their point of view, and to contest the decision.",
+    "createdAt": "2026-04-22 18:52:26.922",
+    "updatedAt": "2026-04-22 18:52:26.922",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dac2ff1cd0bfe0c8614",
+    "name": "AI Organizational Context",
+    "description": "Determine and maintain a record of external and internal issues relevant to the organization's purpose that affect its ability to achieve the intended outcomes of the AI management system (AIMS), including the role of the organization (e.g. AI provider, developer, deployer, user, subject).",
+    "createdAt": "2026-04-23 21:22:52.179",
+    "updatedAt": "2026-04-23 21:22:52.179",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dad9910710084d184a2",
+    "name": "AI Interested Parties",
+    "description": "Identify interested parties relevant to the AIMS, their needs and expectations, and determine which of those requirements will be addressed through the AI management system.",
+    "createdAt": "2026-04-23 21:22:53.084",
+    "updatedAt": "2026-04-23 21:22:53.084",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8daea335821ba4148123",
+    "name": "AIMS Scope Definition",
+    "description": "Define and document the boundaries and applicability of the AI management system, considering external/internal issues, interested-party requirements, organizational activities, and the role of the organization in the AI lifecycle.",
+    "createdAt": "2026-04-23 21:22:53.937",
+    "updatedAt": "2026-04-23 21:22:53.937",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8daf133ebd28ca732b9d",
+    "name": "AI Management System Establishment",
+    "description": "Establish, implement, maintain and continually improve an AI management system, including the processes needed and their interactions, in accordance with ISO/IEC 42001.",
+    "createdAt": "2026-04-23 21:22:54.821",
+    "updatedAt": "2026-04-23 21:22:54.821",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db0b7f88f1ce0079240",
+    "name": "AI Leadership Commitment",
+    "description": "Top management demonstrates leadership and commitment to the AIMS by ensuring AI policy and objectives are established, AIMS requirements are integrated into business processes, resources are available, and the effectiveness of the AIMS is communicated.",
+    "createdAt": "2026-04-23 21:22:55.746",
+    "updatedAt": "2026-04-23 21:22:55.746",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db16a12eecb3f3a5ecb",
+    "name": "AI Policy",
+    "description": "Establish, approve, communicate, and make available a documented AI policy that is appropriate to the organization's purpose, provides a framework for AI objectives, and includes commitments to satisfy applicable requirements and continually improve the AIMS.",
+    "createdAt": "2026-04-23 21:22:56.581",
+    "updatedAt": "2026-04-23 21:22:56.581",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db2c7ed1af765c5981d",
+    "name": "AI Policy Alignment with Other Organizational Policies",
+    "description": "Ensure the AI policy is aligned with and complements related organizational policies (e.g. information security, privacy, quality, risk management, ethics) and that conflicts are identified and resolved.",
+    "createdAt": "2026-04-23 21:22:57.841",
+    "updatedAt": "2026-04-23 21:22:57.841",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db3571415b8485b6976",
+    "name": "AI Policy Review",
+    "description": "Review the AI policy at planned intervals and when significant changes occur to ensure its continuing suitability, adequacy and effectiveness, and update it as required.",
+    "createdAt": "2026-04-23 21:22:58.691",
+    "updatedAt": "2026-04-23 21:22:58.691",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db4a22bb4f0e4c649e1",
+    "name": "AI Organizational Roles, Responsibilities and Authorities",
+    "description": "Assign, document and communicate responsibilities and authorities for roles relevant to the AIMS, ensuring accountability for AI policy conformance, AIMS performance reporting, and AI system outcomes.",
+    "createdAt": "2026-04-23 21:22:59.530",
+    "updatedAt": "2026-04-23 21:22:59.530",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db5182a7a6a4ad28ce1",
+    "name": "AI Concern Reporting",
+    "description": "Establish and operate a mechanism enabling personnel and external parties to report concerns about the organization's AI systems (including ethical, legal, safety and societal concerns) without fear of reprisal, with defined triage and response procedures.",
+    "createdAt": "2026-04-23 21:23:00.996",
+    "updatedAt": "2026-04-23 21:23:00.996",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db62ab22968f85f85f6",
+    "name": "AI Risk and Opportunity Actions",
+    "description": "Determine risks and opportunities that need to be addressed to give assurance the AIMS can achieve its intended outcomes, prevent undesired effects, and drive improvement; plan actions to address them and integrate them into AIMS processes.",
+    "createdAt": "2026-04-23 21:23:01.768",
+    "updatedAt": "2026-04-23 21:23:01.768",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db77c8dd4b36c9ac007",
+    "name": "AI Risk Assessment",
+    "description": "Establish and maintain an AI risk assessment process (criteria, identification, analysis, evaluation) specific to AI systems, and retain documented information of its results. Perform AI risk assessments at planned intervals and when significant changes occur.",
+    "createdAt": "2026-04-23 21:23:02.585",
+    "updatedAt": "2026-04-23 21:23:02.585",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db865093703fdf71fc7",
+    "name": "AI Risk Treatment",
+    "description": "Define and implement an AI risk treatment process to select treatment options, determine controls, produce a Statement of Applicability, and formulate an AI risk treatment plan. Implement the treatment plan and retain documented information of the results.",
+    "createdAt": "2026-04-23 21:23:03.753",
+    "updatedAt": "2026-04-23 21:23:03.753",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8db92daf193f6aba0348",
+    "name": "AI System Impact Assessment Process",
+    "description": "Establish and maintain a documented process to assess the potential consequences for individuals, groups and society of the development, provision or use of AI systems, covering intended and reasonably foreseeable misuse scenarios.",
+    "createdAt": "2026-04-23 21:23:05.149",
+    "updatedAt": "2026-04-23 21:23:05.149",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dbbf19cd6ba156e97bd",
+    "name": "AI System Impact Assessment Documentation",
+    "description": "Document the results of each AI system impact assessment and retain the records in accordance with the documented information requirements of the AIMS; make results available to relevant interested parties as appropriate.",
+    "createdAt": "2026-04-23 21:23:07.233",
+    "updatedAt": "2026-04-23 21:23:07.233",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dbccf28e8a000ba1934",
+    "name": "Assessing AI System Impact on Individuals and Groups",
+    "description": "Assess potential impacts of AI systems on individuals and groups of individuals, including fairness, discrimination, human rights, health, safety and wellbeing, and incorporate results into design, deployment and operational decisions.",
+    "createdAt": "2026-04-23 21:23:08.072",
+    "updatedAt": "2026-04-23 21:23:08.072",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd6097d1766ac51e294",
+    "name": "AI Data Provenance",
+    "description": "Record and maintain the provenance of data used in AI systems (source, transformations, lineage, handling history) to support reproducibility, accountability and impact assessment.",
+    "createdAt": "2026-04-23 21:23:34.319",
+    "updatedAt": "2026-04-23 21:23:34.319",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dbdbd2ce5e539a326fa",
+    "name": "Assessing Societal Impacts of AI Systems",
+    "description": "Assess potential societal impacts of AI systems (including economic, environmental, cultural and democratic impacts) and consider mitigations in the design, deployment and operation of the system.",
+    "createdAt": "2026-04-23 21:23:08.850",
+    "updatedAt": "2026-04-23 21:23:08.850",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dbe99f14797e50f9685",
+    "name": "AI Objectives and Planning",
+    "description": "Establish measurable AI objectives at relevant functions and levels, consistent with the AI policy. Plan how they will be achieved: what will be done, what resources, who is responsible, when completed, and how results evaluated.",
+    "createdAt": "2026-04-23 21:23:09.905",
+    "updatedAt": "2026-04-23 21:23:09.905",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dbfb341d9b1021c8897",
+    "name": "AI Change Planning",
+    "description": "Plan changes to the AIMS in a controlled manner, considering purpose, potential consequences, integrity, resources and allocation of responsibilities, before changes are implemented.",
+    "createdAt": "2026-04-23 21:23:10.790",
+    "updatedAt": "2026-04-23 21:23:10.790",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc048654718cfb1d12c",
+    "name": "AI Resources",
+    "description": "Determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the AIMS, including people, infrastructure, data, computing, tooling and budget.",
+    "createdAt": "2026-04-23 21:23:11.621",
+    "updatedAt": "2026-04-23 21:23:11.621",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc1f55bd5e338716f16",
+    "name": "AI Resource Documentation",
+    "description": "Document the resources used for AI systems (data, tooling, system/computing resources, human resources) including their intended use, owner, sensitivity and lifecycle, and maintain the documentation up to date.",
+    "createdAt": "2026-04-23 21:23:12.671",
+    "updatedAt": "2026-04-23 21:23:12.671",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc2e0fd4e97481baafd",
+    "name": "AI Data Resources",
+    "description": "Identify, inventory and manage data resources used for AI systems (training, validation, testing, operational inputs), including ownership, classification, access, retention and intended use.",
+    "createdAt": "2026-04-23 21:23:13.659",
+    "updatedAt": "2026-04-23 21:23:13.659",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc3a37b3f833dc7d6f3",
+    "name": "AI Tooling Resources",
+    "description": "Identify and manage tooling resources used across the AI lifecycle (frameworks, libraries, model registries, MLOps platforms), including versioning, approved-use policy and security review.",
+    "createdAt": "2026-04-23 21:23:14.591",
+    "updatedAt": "2026-04-23 21:23:14.591",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc4c401188497d417c2",
+    "name": "AI System and Computing Resources",
+    "description": "Identify and manage system and computing resources supporting AI systems (compute, storage, networking, accelerators), including capacity planning, environmental isolation and secure configuration.",
+    "createdAt": "2026-04-23 21:23:15.623",
+    "updatedAt": "2026-04-23 21:23:15.623",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc5682f9f3146944252",
+    "name": "AI Human Resources",
+    "description": "Document the human resources and competencies needed to develop, deploy, operate, maintain and oversee AI systems, including role profiles, training expectations and human oversight responsibilities.",
+    "createdAt": "2026-04-23 21:23:16.571",
+    "updatedAt": "2026-04-23 21:23:16.571",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc6f10b53075c3beacb",
+    "name": "AI Competence",
+    "description": "Determine competence required for AI-related roles, ensure personnel are competent on the basis of appropriate education, training or experience, take actions to close competence gaps, and retain evidence of competence.",
+    "createdAt": "2026-04-23 21:23:17.543",
+    "updatedAt": "2026-04-23 21:23:17.543",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc667172a41022fcf27",
+    "name": "AI Awareness",
+    "description": "Ensure persons doing work under the organization's control are aware of the AI policy, their contribution to AIMS effectiveness, implications of non-conformance, and the potential impacts of AI systems they develop, deploy or use.",
+    "createdAt": "2026-04-23 21:23:18.443",
+    "updatedAt": "2026-04-23 21:23:18.443",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc718a407d992cda795",
+    "name": "AI Communication",
+    "description": "Determine internal and external communications relevant to the AIMS, including what, when, with whom, how and by whom communications take place, covering AI system behavior, incidents, and stakeholder information.",
+    "createdAt": "2026-04-23 21:23:19.450",
+    "updatedAt": "2026-04-23 21:23:19.450",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dc8ec4ced8e76b114c0",
+    "name": "AIMS Documented Information",
+    "description": "Establish and control the documented information required by ISO/IEC 42001 and determined by the organization as necessary for AIMS effectiveness, including creation, update, identification, review, approval, access and retention.",
+    "createdAt": "2026-04-23 21:23:20.391",
+    "updatedAt": "2026-04-23 21:23:20.391",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dcaa9b51a2b1e5f2abd",
+    "name": "AI Operational Planning and Control",
+    "description": "Plan, implement and control the processes needed to meet AIMS requirements and to implement the actions determined in Clause 6, including criteria, documented information and control of changes and outsourced processes.",
+    "createdAt": "2026-04-23 21:23:22.151",
+    "updatedAt": "2026-04-23 21:23:22.151",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dcb210958cb72f499f2",
+    "name": "Responsible AI Development Objectives",
+    "description": "Establish objectives for the responsible development of AI systems (e.g. fairness, reliability, safety, security, privacy, transparency, explainability, accountability, environmental impact) and ensure development activities are directed to meet them.",
+    "createdAt": "2026-04-23 21:23:23.066",
+    "updatedAt": "2026-04-23 21:23:23.066",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dccd7c01c6d2503448b",
+    "name": "Trustworthy AI Design and Development Processes",
+    "description": "Define and apply processes for the trustworthy design and development of AI systems that translate the organization's responsible-development objectives into concrete design, engineering and review activities.",
+    "createdAt": "2026-04-23 21:23:24.060",
+    "updatedAt": "2026-04-23 21:23:24.060",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dcd4cffcf9dd949ca02",
+    "name": "AI System Requirements and Specification",
+    "description": "Define, document and approve requirements and specifications for AI systems, including intended purpose, performance, safety, security, privacy, fairness, transparency, human oversight and applicable regulatory requirements.",
+    "createdAt": "2026-04-23 21:23:24.936",
+    "updatedAt": "2026-04-23 21:23:24.936",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dcef8ff3c2ed55ea14a",
+    "name": "AI System Design and Development Documentation",
+    "description": "Document the design and development of AI systems (data, architecture, training procedures, parameters, evaluation, known limitations) sufficient to enable assessment, reproduction and ongoing oversight.",
+    "createdAt": "2026-04-23 21:23:25.908",
+    "updatedAt": "2026-04-23 21:23:25.908",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dcfcba021703a55bf97",
+    "name": "AI System Verification and Validation",
+    "description": "Define and apply verification and validation measures for AI systems (functional testing, performance, robustness, fairness, safety, security, privacy) and criteria for acceptance before deployment and after significant changes.",
+    "createdAt": "2026-04-23 21:23:26.814",
+    "updatedAt": "2026-04-23 21:23:26.814",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd0de2f746bb95acd4b",
+    "name": "AI System Deployment",
+    "description": "Control the deployment of AI systems, including release criteria, staged rollout, approvals, rollback procedures, and readiness of operational and monitoring controls before go-live.",
+    "createdAt": "2026-04-23 21:23:27.765",
+    "updatedAt": "2026-04-23 21:23:27.765",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd148f84ea6656bce7d",
+    "name": "AI System Operation and Monitoring",
+    "description": "Operate and monitor AI systems in production for performance, drift, reliability, safety, security and ethical outcomes; define metrics, thresholds, alerting and response procedures.",
+    "createdAt": "2026-04-23 21:23:28.747",
+    "updatedAt": "2026-04-23 21:23:28.747",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd28d9b23fd806840e7",
+    "name": "AI System Technical Documentation",
+    "description": "Produce and maintain technical documentation for each AI system (intended use, capabilities, limitations, training/evaluation data, risk information) appropriate to support interested parties and regulators.",
+    "createdAt": "2026-04-23 21:23:29.776",
+    "updatedAt": "2026-04-23 21:23:29.776",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd38d7945cd54758b49",
+    "name": "AI System Event Logging",
+    "description": "Record event logs generated by AI systems (inputs, outputs, decisions, user interactions, system events) with sufficient integrity, retention and access control to support monitoring, incident response and accountability.",
+    "createdAt": "2026-04-23 21:23:30.669",
+    "updatedAt": "2026-04-23 21:23:30.669",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd44d3b368f85df728c",
+    "name": "Data for AI Development and Enhancement",
+    "description": "Define requirements and controls for data used to develop and enhance AI systems, including suitability for purpose, representativeness, access, versioning and change management.",
+    "createdAt": "2026-04-23 21:23:31.574",
+    "updatedAt": "2026-04-23 21:23:31.574",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd5a750b30e2eb69d18",
+    "name": "AI Data Acquisition",
+    "description": "Define and apply controls for acquiring data used in AI systems, including lawful basis, contractual rights, licensing, ethical sourcing, consent where required, and documentation of acquisition criteria.",
+    "createdAt": "2026-04-23 21:23:32.528",
+    "updatedAt": "2026-04-23 21:23:32.528",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd54053dfd453b9dc4a",
+    "name": "AI Data Quality",
+    "description": "Define and maintain data-quality requirements for AI systems (accuracy, completeness, consistency, timeliness, relevance, bias), and perform periodic data-quality assessments with remediation.",
+    "createdAt": "2026-04-23 21:23:33.454",
+    "updatedAt": "2026-04-23 21:23:33.454",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd7f551ad7a56706b46",
+    "name": "AI Data Preparation",
+    "description": "Document and control data preparation activities (cleaning, labeling, annotation, transformation, augmentation, splitting) including rationale, tooling, reviewers and acceptance criteria.",
+    "createdAt": "2026-04-23 21:23:35.182",
+    "updatedAt": "2026-04-23 21:23:35.182",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd8aa91ceac379fa2c3",
+    "name": "AI System Documentation and Information for Users",
+    "description": "Provide users of AI systems with the information needed to use the system appropriately, including intended purpose, capabilities, limitations, data requirements, human-oversight responsibilities and known risks.",
+    "createdAt": "2026-04-23 21:23:36.161",
+    "updatedAt": "2026-04-23 21:23:36.161",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dd9462f30b929260abf",
+    "name": "AI External Reporting",
+    "description": "Define and operate processes for external reporting relating to AI systems (regulators, customers, the public) including triggering conditions, content, approval and distribution channels.",
+    "createdAt": "2026-04-23 21:23:36.996",
+    "updatedAt": "2026-04-23 21:23:36.996",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dda97d0010af0cf826d",
+    "name": "AI Incident Communication",
+    "description": "Define and operate a process for communicating AI system incidents to affected interested parties (internal stakeholders, users, subjects, suppliers, authorities) in a timely and appropriate manner.",
+    "createdAt": "2026-04-23 21:23:37.843",
+    "updatedAt": "2026-04-23 21:23:37.843",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8ddbb737f1f09bbcd82e",
+    "name": "Information for Interested Parties",
+    "description": "Determine and provide relevant information about AI systems to interested parties (including data subjects and affected communities) commensurate with their role and the potential impact of the system.",
+    "createdAt": "2026-04-23 21:23:38.808",
+    "updatedAt": "2026-04-23 21:23:38.808",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8ddce361e7f7eb0fc2b9",
+    "name": "Responsible AI Use Processes",
+    "description": "Establish processes for the responsible use of AI systems within the organization, including acceptable-use guidance, human-oversight requirements, escalation paths and periodic review.",
+    "createdAt": "2026-04-23 21:23:39.820",
+    "updatedAt": "2026-04-23 21:23:39.820",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dddda00d3522c538085",
+    "name": "Responsible AI Use Objectives",
+    "description": "Define and communicate objectives for the responsible use of AI systems (e.g. accountability, transparency, human oversight, harm prevention) and measure progress against them.",
+    "createdAt": "2026-04-23 21:23:40.793",
+    "updatedAt": "2026-04-23 21:23:40.793",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8dde7453dbed221162e8",
+    "name": "Intended Use of AI System",
+    "description": "Determine, document and communicate the intended use of each AI system and the conditions of such use; take measures to prevent and respond to reasonably foreseeable misuse.",
+    "createdAt": "2026-04-23 21:23:41.657",
+    "updatedAt": "2026-04-23 21:23:41.657",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8ddf8ba2e517ab4a366d",
+    "name": "AI Third-Party Responsibility Allocation",
+    "description": "Identify and document roles and responsibilities among the organization, suppliers, partners and customers across the AI lifecycle, including obligations relating to impact assessment, monitoring and incident handling.",
+    "createdAt": "2026-04-23 21:23:42.517",
+    "updatedAt": "2026-04-23 21:23:42.517",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8ddf2226651c7382d81c",
+    "name": "AI Suppliers",
+    "description": "Define and apply criteria and controls for AI-related suppliers (model, data, tooling, service providers), including due diligence, contractual obligations, monitoring and offboarding.",
+    "createdAt": "2026-04-23 21:23:43.415",
+    "updatedAt": "2026-04-23 21:23:43.415",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de02be9da8bf00ad0aa",
+    "name": "AI Customers",
+    "description": "Provide customers with the information and mechanisms needed for the responsible use of AI systems, including intended use, limitations, required human oversight, and channels for feedback and incident reporting.",
+    "createdAt": "2026-04-23 21:23:44.268",
+    "updatedAt": "2026-04-23 21:23:44.268",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de1bd41309fdbe08e20",
+    "name": "AI Performance Monitoring, Measurement, Analysis and Evaluation",
+    "description": "Determine what needs monitoring and measurement for the AIMS and for individual AI systems, methods, when performed, when analyzed/evaluated, and retain evidence of the results.",
+    "createdAt": "2026-04-23 21:23:45.072",
+    "updatedAt": "2026-04-23 21:23:45.072",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de2d97d1f09cc61b896",
+    "name": "AI Internal Audit",
+    "description": "Plan, establish, implement and maintain an internal audit program for the AIMS, including frequency, methods, responsibilities, criteria and scope; conduct audits, report results and retain evidence.",
+    "createdAt": "2026-04-23 21:23:45.909",
+    "updatedAt": "2026-04-23 21:23:45.909",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de302274112e7ccc264",
+    "name": "AI Management Review",
+    "description": "Top management reviews the AIMS at planned intervals, considering the required inputs (status of actions, changes, performance, risks, opportunities, improvement), and produces outputs on decisions and improvements.",
+    "createdAt": "2026-04-23 21:23:47.180",
+    "updatedAt": "2026-04-23 21:23:47.180",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de5cc73e611573e6db4",
+    "name": "AI Continual Improvement",
+    "description": "Continually improve the suitability, adequacy and effectiveness of the AIMS, including the AI policy, objectives, risk treatments and controls, based on audit results, monitoring, review and lessons learned.",
+    "createdAt": "2026-04-23 21:23:48.839",
+    "updatedAt": "2026-04-23 21:23:48.839",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69ea8de6018b6b80d862c906",
+    "name": "AI Nonconformity and Corrective Action",
+    "description": "When a nonconformity occurs (including from an AI incident), react, evaluate the need for action to eliminate the cause, implement corrective actions, review effectiveness and update the AIMS as needed.",
+    "createdAt": "2026-04-23 21:23:49.838",
+    "updatedAt": "2026-04-23 21:23:49.838",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69e918e9be6da6eba7d0ea4e",
+    "name": "Data Protection Impact Assessment Process",
+    "description": "Maintain a documented DPIA methodology with criteria for when an assessment is required (e.g., high-risk processing, new technologies, systematic monitoring). Retain DPIA records and consult the supervisory authority when residual risk remains high.",
+    "createdAt": "2026-04-22 18:52:24.847",
+    "updatedAt": "2026-04-23 23:20:37.875",
+    "documentTypes": [
+      "risk_committee_meeting",
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_69e918e6d72a45b4f933a112",
+    "name": "Data Inventory and Mapping",
+    "description": "Maintain a documented inventory of personal data processed by the organization, including data categories, sources, purposes, legal basis, recipients, retention periods, and who has access to each data set. Review at least annually and on material changes to processing activities.",
+    "createdAt": "2026-04-22 18:52:22.361",
+    "updatedAt": "2026-04-23 23:22:07.864",
+    "documentTypes": [
+      "access_request",
+      "rbac_matrix"
+    ]
+  },
+  {
+    "id": "frk_ct_69eb876ea13506b36fd63a3e",
+    "name": "HIPAA Security Program Governance",
+    "description": "Establish and maintain the organization's HIPAA security program, including general security standards, security official designation, policy documentation, and retention requirements.",
+    "createdAt": "2026-04-24 15:08:29.644",
+    "updatedAt": "2026-04-24 15:08:29.644",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "name": "Risk Analysis & Management",
+    "description": "Conduct risk analysis, implement risk management measures sufficient to reduce risks to a reasonable level, and periodically evaluate security controls.",
+    "createdAt": "2026-04-24 15:08:30.167",
+    "updatedAt": "2026-04-24 15:08:30.167",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb876f6362393759ecd351",
+    "name": "Workforce Security & Sanctions",
+    "description": "Authorize, supervise, and manage workforce access to ePHI including clearance procedures, termination, and sanctions for non-compliance.",
+    "createdAt": "2026-04-24 15:08:30.533",
+    "updatedAt": "2026-04-24 15:08:30.533",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb876f3270ed0b11233ece",
+    "name": "Security Awareness & Training",
+    "description": "Implement a security awareness and training program including periodic security reminders, protection from malicious software, login monitoring, and password management.",
+    "createdAt": "2026-04-24 15:08:31.066",
+    "updatedAt": "2026-04-24 15:08:31.066",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb87703649e5234a56d529",
+    "name": "Business Associate Management",
+    "description": "Establish and maintain written agreements (BAAs) with business associates and subcontractors that create, receive, maintain, or transmit ePHI, ensuring satisfactory assurances of compliance.",
+    "createdAt": "2026-04-24 15:08:31.949",
+    "updatedAt": "2026-04-24 15:08:31.949",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb877091d96bcaeae40219",
+    "name": "Physical Facility Security",
+    "description": "Implement policies and procedures to limit physical access to electronic information systems and the facilities in which they are housed, including contingency operations, facility security plans, access controls, and maintenance records.",
+    "createdAt": "2026-04-24 15:08:32.455",
+    "updatedAt": "2026-04-24 15:08:32.455",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb87717ae82d509fb927ed",
+    "name": "Device & Media Controls",
+    "description": "Implement policies and procedures governing the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, including disposal, re-use, accountability, and data backup.",
+    "createdAt": "2026-04-24 15:08:32.904",
+    "updatedAt": "2026-04-24 15:08:32.904",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69eb87701093fde54e1169dc",
+    "name": "Contingency Plan Operations",
+    "description": "Establish and test procedures for responding to emergencies or failures that damage systems containing ePHI, including emergency mode operation, testing, and criticality analysis.",
+    "createdAt": "2026-04-24 15:08:31.504",
+    "updatedAt": "2026-04-24 15:18:01.227",
+    "documentTypes": [
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_69efd5a32e52c113f97254db",
+    "name": "CCPA-Compliant Privacy Policy",
+    "description": "Maintain and publish a privacy policy that discloses categories of personal information collected, sources, business or commercial purposes, categories of recipients, consumer rights under CCPA/CPRA, the methods to exercise those rights, and contact information for privacy inquiries. Review and update at least every 12 months.",
+    "createdAt": "2026-04-27 21:31:15.380",
+    "updatedAt": "2026-04-27 21:31:15.380",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5aac8f24094878ff701",
+    "name": "Right to Opt-Out of Sale or Sharing",
+    "description": "Establish a process to honor consumer opt-out requests for the sale or sharing of personal information, including support for the Global Privacy Control (GPC) browser signal.",
+    "createdAt": "2026-04-27 21:31:22.134",
+    "updatedAt": "2026-04-27 21:31:22.134",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5ad9dcc82739178f525",
+    "name": "Right to Non-Discrimination",
+    "description": "Prohibit discrimination against consumers who exercise their CCPA/CPRA rights, including denial of goods/services, charging different prices, or providing a different level of quality, except where the difference is reasonably related to the value provided by the consumer's data.",
+    "createdAt": "2026-04-27 21:31:24.810",
+    "updatedAt": "2026-04-27 21:31:24.810",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5a87004249e7b6e62af",
+    "name": "Right to Delete Process",
+    "description": "Establish a process to receive, verify, and fulfill consumer requests to delete personal information, including communicating deletion requests to service providers and contractors. Document any statutory exceptions relied on for retention.",
+    "createdAt": "2026-04-27 21:31:19.952",
+    "updatedAt": "2026-04-27 21:57:22.639",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5a6e66d4c6c92fdd3df",
+    "name": "Right to Know Process",
+    "description": "Establish a process for receiving and responding to consumer requests for the categories and specific pieces of personal information collected, sources, business purposes, and third parties with whom information is shared. Respond within 45 days, with one 45-day extension as permitted.",
+    "createdAt": "2026-04-27 21:31:17.813",
+    "updatedAt": "2026-04-27 21:57:21.470",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5b1e6f19c87845f5939",
+    "name": "Right to Correct Process",
+    "description": "Establish a process for consumers to request correction of inaccurate personal information, verifying the request and using commercially reasonable efforts to correct the data and notify service providers as required by the CPRA.",
+    "createdAt": "2026-04-27 21:31:28.990",
+    "updatedAt": "2026-04-27 21:31:28.990",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5b3cdfebf7ee46a5cf7",
+    "name": "Right to Limit Use of Sensitive Personal Information",
+    "description": "Provide consumers a clear method (e.g., \"Limit the Use of My Sensitive Personal Information\" link) to restrict the use and disclosure of sensitive personal information to purposes permitted by the CPRA.",
+    "createdAt": "2026-04-27 21:31:30.657",
+    "updatedAt": "2026-04-27 21:31:30.657",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5c84ccf6f3f5bbe29bd",
+    "name": "CCPA Privacy Training Program",
+    "description": "Provide annual training to all employees handling personal information or consumer rights requests on CCPA/CPRA requirements, internal procedures for processing requests, and how to direct consumers to exercise their rights.",
+    "createdAt": "2026-04-27 21:31:51.784",
+    "updatedAt": "2026-04-27 21:31:51.784",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5cb8d9092bd71665722",
+    "name": "Service Provider and Contractor Agreements",
+    "description": "Maintain written contracts with all service providers, contractors, and third parties processing personal information that include CCPA/CPRA-required terms: limited business purpose, prohibition on selling/sharing, cooperation with consumer rights requests, and confidentiality obligations.",
+    "createdAt": "2026-04-27 21:31:55.110",
+    "updatedAt": "2026-04-27 21:31:55.110",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5cd34220c6db57b2710",
+    "name": "Consumer Request Records Retention",
+    "description": "Maintain records of all consumer requests received under the CCPA/CPRA and the business's responses for at least 24 months, including the date of receipt, nature of the request, manner in which it was responded to, and the date of response.",
+    "createdAt": "2026-04-27 21:31:56.814",
+    "updatedAt": "2026-04-27 21:31:56.814",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5ce50b1ede13c3848f2",
+    "name": "\"Do Not Sell or Share My Personal Information\" Link",
+    "description": "Provide a clear and conspicuous \"Do Not Sell or Share My Personal Information\" link on the homepage and any page collecting personal information that allows consumers to opt out of the sale or sharing of their personal information without requiring account creation.",
+    "createdAt": "2026-04-27 21:31:58.305",
+    "updatedAt": "2026-04-27 21:31:58.305",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5d1c0499ab2c136b759",
+    "name": "Minor Consent Management",
+    "description": "Before selling or sharing personal information of consumers known to be under 16, obtain affirmative opt-in consent. For consumers under 13, obtain verifiable parental consent in compliance with COPPA and CCPA/CPRA.",
+    "createdAt": "2026-04-27 21:32:00.557",
+    "updatedAt": "2026-04-27 21:32:00.557",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5e12d61c6019d213f60",
+    "name": "Notice at Collection",
+    "description": "Provide a CCPA-compliant Notice at Collection at or before the point of collection, listing the categories of personal information and sensitive personal information collected, the purposes of use, retention periods, and whether the information is sold or shared.",
+    "createdAt": "2026-04-27 21:32:17.049",
+    "updatedAt": "2026-04-27 21:32:17.049",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5e71ad52c5ab2ec069e",
+    "name": "Notice of Financial Incentive",
+    "description": "If the business offers a financial incentive or price/service difference in exchange for personal information, publish a Notice of Financial Incentive that explains the material terms, the method to opt in and withdraw, and a good-faith estimate of the value of the consumer's data.",
+    "createdAt": "2026-04-27 21:32:22.978",
+    "updatedAt": "2026-04-27 21:32:22.978",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "name": "Prominent Privacy Policy Display",
+    "description": "Display a clear, conspicuous link to the privacy policy on the website homepage footer and within mobile applications, ensuring it is accessible from every page that collects personal information.",
+    "createdAt": "2026-04-27 21:32:29.896",
+    "updatedAt": "2026-04-27 21:32:29.896",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5e906d5418ee6b5dc6a",
+    "name": "Data Breach Notification Process",
+    "description": "Maintain a documented breach response and notification process that meets California's data breach notification requirements (Cal. Civ. Code § 1798.82) for unauthorized acquisition of personal information, including timely consumer notification and any required Attorney General notification.",
+    "createdAt": "2026-04-27 21:32:24.934",
+    "updatedAt": "2026-04-27 21:49:53.331",
+    "documentTypes": [
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_69efd5d2b0758b1e1c1b6d87",
+    "name": "Periodic CCPA Compliance Audit",
+    "description": "Conduct documented audits of CCPA/CPRA compliance at least annually, covering disclosures, request handling, training, vendor contracts, and security controls. Track regulatory changes and update compliance measures accordingly.",
+    "createdAt": "2026-04-27 21:32:02.371",
+    "updatedAt": "2026-04-27 21:49:57.931",
+    "documentTypes": [
+      "risk_committee_meeting",
+      "meeting"
+    ]
+  },
+  {
+    "id": "frk_ct_69efd5c9acbf83b0a500050e",
+    "name": "Reasonable Security Safeguards for Personal Information",
+    "description": "Implement and maintain reasonable technical and organizational security safeguards (e.g., access controls, encryption in transit and at rest, logging, vulnerability management) appropriate to the nature of the personal information processed, in order to protect against unauthorized access, destruction, use, modification, or disclosure.",
+    "createdAt": "2026-04-27 21:31:53.365",
+    "updatedAt": "2026-04-27 21:49:55.673",
+    "documentTypes": [
+      "penetration_test",
+      "rbac_matrix"
+    ]
+  },
+  {
+    "id": "frk_ct_69efd5c63e9c6fc1f8bec055",
+    "name": "Consumer Identity Verification Procedure",
+    "description": "Implement reasonable, risk-based identity verification procedures for consumer rights requests, matching the level of verification to the sensitivity of the data involved. Prevent fraudulent or unauthorized access to personal information.",
+    "createdAt": "2026-04-27 21:31:49.977",
+    "updatedAt": "2026-04-27 21:57:25.018",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5a163fc3dcd87372ccc",
+    "name": "Personal Information Inventory and Data Flow Mapping",
+    "description": "Maintain an up-to-date inventory of all categories of personal information the business collects, stores, processes, sells, or shares. Classify data by sensitivity, identify sources and recipients, and map data flows across systems and third parties.",
+    "createdAt": "2026-04-27 21:31:13.217",
+    "updatedAt": "2026-04-27 21:49:59.459",
+    "documentTypes": [
+      "infrastructure_inventory"
+    ]
+  },
+  {
+    "id": "frk_ct_69f3d976c53fd192b48e6236",
+    "name": "Privacy Officer Designation",
+    "description": "Formally designate one or more individuals accountable for the organization's PIPEDA compliance, document the role and responsibilities, and publish the privacy officer's name and contact details so they can be made known on request.",
+    "createdAt": "2026-04-30 22:36:38.301",
+    "updatedAt": "2026-04-30 22:36:38.301",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9793720eec4d4945150",
+    "name": "Third-Party Data Processing Agreements",
+    "description": "Use written contracts or other binding means to ensure third parties processing personal information on the organization's behalf provide a comparable level of privacy protection. Verify implementation through due diligence and periodic review.",
+    "createdAt": "2026-04-30 22:36:41.204",
+    "updatedAt": "2026-04-30 22:36:41.204",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69efd5e395082fabf04e53b7",
+    "name": "Authorized Agent Process",
+    "description": "Establish a process to accept, verify, and respond to consumer rights requests submitted by an authorized agent on the consumer's behalf, including written authorization or power-of-attorney verification as permitted by the CCPA/CPRA.",
+    "createdAt": "2026-04-27 21:32:18.953",
+    "updatedAt": "2026-04-27 21:57:23.968",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9781dacd8da2864fd17",
+    "name": "Privacy Awareness and Training Program",
+    "description": "Deliver mandatory privacy training to all staff who handle personal information, covering the organization's privacy policies, the 10 Fair Information Principles, and individual responsibilities. Track completion and refresh annually.",
+    "createdAt": "2026-04-30 22:36:40.156",
+    "updatedAt": "2026-04-30 22:36:40.156",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d97a7b80d8564339ffc5",
+    "name": "Documentation of Collection Purposes",
+    "description": "Maintain a written record of every purpose for which personal information is collected, including the specific data elements involved and the legal/business basis. Update the record whenever purposes change or are added.",
+    "createdAt": "2026-04-30 22:36:42.181",
+    "updatedAt": "2026-04-30 23:49:15.788",
+    "documentTypes": [
+      "infrastructure_inventory"
+    ]
+  },
+  {
+    "id": "frk_ct_69f3d97b66301a97f6b8e4a3",
+    "name": "Notification of Purposes at Collection",
+    "description": "Communicate the purposes for collecting personal information to individuals at or before the time of collection, in plain language, through standardized written notices and trained verbal scripts. Re-notify before any new use or disclosure.",
+    "createdAt": "2026-04-30 22:36:43.064",
+    "updatedAt": "2026-04-30 22:36:43.064",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d97c03fd8213c05dbbde",
+    "name": "Consent Management Procedure",
+    "description": "Define and operate a procedure for obtaining and recording knowledge and consent for the collection, use, and disclosure of personal information. Match the form of consent (express vs. implied) to the sensitivity of the information and the reasonable expectations of the individual.",
+    "createdAt": "2026-04-30 22:36:44.103",
+    "updatedAt": "2026-04-30 22:36:44.103",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d97d7c0f6c1d629e8fbf",
+    "name": "Consent Withdrawal Mechanism",
+    "description": "Provide individuals with a clear, accessible way to withdraw consent at any time, subject to legal or contractual restrictions, and inform them of the consequences. Honor withdrawal requests within a defined timeframe and update downstream systems accordingly.",
+    "createdAt": "2026-04-30 22:36:45.325",
+    "updatedAt": "2026-04-30 22:36:45.325",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d97fab711de81e99e786",
+    "name": "Express Consent for Sensitive Information",
+    "description": "Require express, opt-in consent before collecting, using, or disclosing sensitive personal information (e.g. medical, financial, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, sex life or sexual orientation).",
+    "createdAt": "2026-04-30 22:36:46.705",
+    "updatedAt": "2026-04-30 22:36:46.705",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9808d78f354f8f804b4",
+    "name": "Data Minimization Standard",
+    "description": "Restrict the type and amount of personal information collected to what is strictly necessary for the identified purposes. Document mandatory vs. optional fields on every collection point and review collection forms periodically to remove unnecessary fields.",
+    "createdAt": "2026-04-30 22:36:47.690",
+    "updatedAt": "2026-04-30 22:36:47.690",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d981cefe4efa0efe0847",
+    "name": "Fair and Lawful Collection Procedure",
+    "description": "Collect personal information only by fair and lawful means, never through deception about purposes or consent. Apply heightened controls to high-risk identifiers (e.g. Social Insurance Number) so they are collected only where legally required.",
+    "createdAt": "2026-04-30 22:36:48.716",
+    "updatedAt": "2026-04-30 22:36:48.716",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98163541c15c34554c0",
+    "name": "Use and Disclosure Limitation",
+    "description": "Use and disclose personal information only for the purposes for which it was collected, except with fresh consent or as required by law. Document any new use or disclosure together with its legal basis or consent record before processing begins.",
+    "createdAt": "2026-04-30 22:36:49.496",
+    "updatedAt": "2026-04-30 22:36:49.496",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d982f21bf2e86c1ef98d",
+    "name": "Data Retention Schedule",
+    "description": "Maintain a documented retention schedule with minimum and maximum retention periods for each category of personal information, aligned to the original collection purpose. Retain information used in decisions about an individual long enough for them to access it.",
+    "createdAt": "2026-04-30 22:36:50.318",
+    "updatedAt": "2026-04-30 22:36:50.318",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d983dce2e00263034481",
+    "name": "Secure Data Disposal and Anonymization",
+    "description": "Destroy, erase, or irreversibly anonymize personal information once it is no longer needed, using methods that prevent unauthorized recovery. Maintain disposal records and apply equivalent controls to information held by contractors.",
+    "createdAt": "2026-04-30 22:36:51.145",
+    "updatedAt": "2026-04-30 22:36:51.145",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9846258471679ba5a28",
+    "name": "Data Accuracy Policy",
+    "description": "Establish a policy that defines accuracy, completeness, and currency requirements for each category of personal information based on its use, including the source of the information, the dates of collection and update, and the procedure for individuals to challenge accuracy.",
+    "createdAt": "2026-04-30 22:36:52.016",
+    "updatedAt": "2026-04-30 22:36:52.016",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9854a029af0a24299a3",
+    "name": "Periodic Accuracy Review and Audit",
+    "description": "Conduct periodic reviews or audits of personal information used on an ongoing basis to confirm it remains accurate, complete, and up-to-date for its identified purposes, and propagate amendments to third parties that received the original data.",
+    "createdAt": "2026-04-30 22:36:52.923",
+    "updatedAt": "2026-04-30 22:36:52.923",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d9864551468e007fc4d8",
+    "name": "Information Security Policy",
+    "description": "Maintain an information security policy that defines security objectives, roles, and minimum control requirements for personal information across all formats and locations, with safeguards calibrated to the sensitivity of the data.",
+    "createdAt": "2026-04-30 22:36:53.909",
+    "updatedAt": "2026-04-30 22:36:53.909",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d987482f9da8d882e592",
+    "name": "Physical Safeguards",
+    "description": "Apply physical security measures to areas where personal information is stored or processed, including locked cabinets, restricted-access offices, secured premises, alarms, and clean-desk practices for paper records.",
+    "createdAt": "2026-04-30 22:36:54.736",
+    "updatedAt": "2026-04-30 22:36:54.736",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98a95c7623e660bf33d",
+    "name": "Public Privacy Policy Publication",
+    "description": "Publish a privacy policy that is readily available and written in plain language, covering the privacy officer's contact details, how to access personal information, what categories of information are held and their general use, and any disclosures to related organizations.",
+    "createdAt": "2026-04-30 22:36:58.165",
+    "updatedAt": "2026-04-30 22:36:58.165",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98b12951c79a1a1cf36",
+    "name": "Privacy Information Materials",
+    "description": "Develop and distribute supplementary privacy materials (brochures, web notices, in-product disclosures) so that individuals who do not use one specific channel can still obtain information about the organization's policies and practices, including any tracking technologies used online.",
+    "createdAt": "2026-04-30 22:36:59.041",
+    "updatedAt": "2026-04-30 22:36:59.041",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98c52d9000ac36cc791",
+    "name": "Individual Access Request Procedure",
+    "description": "Operate a documented procedure for receiving written access requests, helping individuals prepare them, retrieving the requested information, and responding within 30 days at minimal or no cost. Provide an account of how the information has been or will be used and the third parties to which it has been disclosed.",
+    "createdAt": "2026-04-30 22:36:59.904",
+    "updatedAt": "2026-04-30 22:36:59.904",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98d61c5a3ef65a23e20",
+    "name": "Identity Verification for Access Requests",
+    "description": "Verify the identity of individuals submitting access requests using a method proportionate to the sensitivity of the data, requesting only the minimum information necessary to authenticate the requester.",
+    "createdAt": "2026-04-30 22:37:00.849",
+    "updatedAt": "2026-04-30 22:37:00.849",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98e0758e358b1f71b49",
+    "name": "Information Amendment and Refusal Procedure",
+    "description": "Allow individuals to challenge the accuracy and completeness of their personal information; amend records when the challenge is substantiated and propagate the amendment to third parties. When refusing access, respond in writing with reasons, applicable PIPEDA exceptions, and recourse — and retain the information long enough for the individual to exhaust recourse.",
+    "createdAt": "2026-04-30 22:37:01.777",
+    "updatedAt": "2026-04-30 22:37:01.777",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98f897fe2984e8163e5",
+    "name": "Privacy Complaint Procedure",
+    "description": "Provide an easily accessible, simple-to-use procedure for individuals to challenge the organization's compliance with PIPEDA. Publicize how to complain, acknowledge complaints promptly, and inform complainants of avenues of recourse including the Office of the Privacy Commissioner of Canada.",
+    "createdAt": "2026-04-30 22:37:02.629",
+    "updatedAt": "2026-04-30 22:37:02.629",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98fd53148ecfa29efa0",
+    "name": "Complaint Investigation and Remediation",
+    "description": "Investigate every privacy complaint without delay, assigned to a competent and impartial reviewer. Where the complaint is justified, take corrective action — including amending policies, practices, or affected records — notify the complainant of the outcome, and record findings to drive systemic improvements.",
+    "createdAt": "2026-04-30 22:37:03.483",
+    "updatedAt": "2026-04-30 22:37:03.483",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d977f853eaee5ff05fe7",
+    "name": "Privacy Policies and Procedures Framework",
+    "description": "Maintain a documented privacy management framework that addresses each of the 10 Fair Information Principles, defines roles for privacy governance, and is reviewed and updated on a regular cadence.",
+    "createdAt": "2026-04-30 22:36:39.241",
+    "updatedAt": "2026-04-30 23:49:15.194",
+    "documentTypes": [
+      "risk_committee_meeting",
+      "meeting"
+    ]
+  },
+  {
+    "id": "frk_ct_69f3d988421e37ecdc514fc0",
+    "name": "Technical Safeguards",
+    "description": "Implement technical safeguards proportionate to data sensitivity — including identification, authentication, role-based access controls, encryption at rest and in transit, secure transmission channels, firewalls, audit logging, and timely patching.",
+    "createdAt": "2026-04-30 22:36:55.517",
+    "updatedAt": "2026-04-30 23:49:18.673",
+    "documentTypes": [
+      "rbac_matrix",
+      "penetration_test",
+      "network_diagram",
+      "infrastructure_inventory"
+    ]
+  },
+  {
+    "id": "frk_ct_69f3d9891d140c7d3b7d542c",
+    "name": "Information Security Breach Response",
+    "description": "Maintain a breach response procedure covering detection, containment, root-cause investigation, individual notification (where required), reporting to the Office of the Privacy Commissioner of Canada, and post-incident remediation.",
+    "createdAt": "2026-04-30 22:36:57.260",
+    "updatedAt": "2026-04-30 23:49:20.790",
+    "documentTypes": [
+      "tabletop_exercise"
+    ]
+  },
+  {
+    "id": "frk_ct_69f897d2abcbb2cff15807ac",
+    "name": "Data Encryption",
+    "description": "Implement data encryption both at rest and in transit for all PHI",
+    "createdAt": "2026-05-04 12:57:53.896",
+    "updatedAt": "2026-05-04 12:57:53.896",
+    "documentTypes": []
+  },
+  {
+    "id": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "name": "Administrative Safeguards",
+    "description": "Apply administrative safeguards including need-to-know access authorization, security clearances proportionate to sensitivity, confidentiality agreements, ongoing employee awareness, monitoring and audits, and formal procedures for telework and working outside the office.",
+    "createdAt": "2026-04-30 22:36:56.336",
+    "updatedAt": "2026-04-30 23:49:20.160",
+    "documentTypes": [
+      "employee_performance_evaluation",
+      "rbac_matrix"
+    ]
   }
-]
\ No newline at end of file
+]
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json b/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
index 0d624e4b5d..1158b7a0a1 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorFramework.json
@@ -26,24 +26,6 @@
     "updatedAt": "2025-05-14 19:20:44.920",
     "visible": false
   },
-  {
-    "id": "frk_683f3102f9ae801df35d47b4",
-    "name": "Test",
-    "description": "Test",
-    "version": "1.0.0",
-    "createdAt": "2025-06-03 17:29:37.982",
-    "updatedAt": "2025-06-03 17:30:09.651",
-    "visible": false
-  },
-  {
-    "id": "frk_683f31582b71fc8d9253ad89",
-    "name": "Test2",
-    "description": "Test2",
-    "version": "1.0.0",
-    "createdAt": "2025-06-03 17:31:04.290",
-    "updatedAt": "2025-06-03 17:31:07.399",
-    "visible": false
-  },
   {
     "id": "frk_681ebae2f29f0ab08eb802ec",
     "name": "SOC 2",
@@ -53,15 +35,6 @@
     "updatedAt": "2025-06-04 19:22:37.620",
     "visible": false
   },
-  {
-    "id": "frk_683f377429b8408d1c85f9bd",
-    "name": "SOC 2",
-    "description": "SOC 2 Type I & II",
-    "version": "1",
-    "createdAt": "2025-06-03 17:57:07.496",
-    "updatedAt": "2025-06-04 21:53:53.548",
-    "visible": true
-  },
   {
     "id": "frk_681ecc34e85064efdbb76993",
     "name": "ISO 27001",
@@ -89,6 +62,24 @@
     "updatedAt": "2025-09-01 16:51:38.334",
     "visible": true
   },
+  {
+    "id": "frk_69d7e513446cc6e0376edf60",
+    "name": "SOC 2 Type 1",
+    "description": "SOC 2 Type 1 - Verify your security controls for a point-in-time",
+    "version": "1.0.0",
+    "createdAt": "2026-04-09 17:42:42.625",
+    "updatedAt": "2026-04-09 17:42:42.625",
+    "visible": false
+  },
+  {
+    "id": "frk_683f377429b8408d1c85f9bd",
+    "name": "SOC 2",
+    "description": "SOC 2 Type I & II",
+    "version": "1",
+    "createdAt": "2025-06-03 17:57:07.496",
+    "updatedAt": "2026-04-09 20:08:16.014",
+    "visible": true
+  },
   {
     "id": "frk_681ef4bb8eeb2b60d2d9d187",
     "name": "PCI v0",
@@ -125,6 +116,15 @@
     "updatedAt": "2025-09-22 11:10:57.835",
     "visible": false
   },
+  {
+    "id": "frk_69dcfb280b550e7ee231f312",
+    "name": "PCI DSS Level 1",
+    "description": "Level 1 On-Site Assessment (ROC)",
+    "version": "1.0.0",
+    "createdAt": "2026-04-13 14:18:15.949",
+    "updatedAt": "2026-04-13 21:12:52.530",
+    "visible": true
+  },
   {
     "id": "frk_68e135d0212b3b6cd39ceb94",
     "name": "NEN 7510",
@@ -134,6 +134,33 @@
     "updatedAt": "2025-10-07 20:22:47.176",
     "visible": true
   },
+  {
+    "id": "frk_69efd433584ba436ae00d413",
+    "name": "CCPA",
+    "description": "California Consumer Privacy Act",
+    "version": "1.0.0",
+    "createdAt": "2026-04-27 21:25:07.381",
+    "updatedAt": "2026-04-28 14:21:21.191",
+    "visible": true
+  },
+  {
+    "id": "frk_69e9187a649152cdc715f1ad",
+    "name": "GDPR (Test)",
+    "description": "Test framework derived from the gdpr.eu checklist. Not for production compliance use.",
+    "version": "1.0.0",
+    "createdAt": "2026-04-22 18:50:33.852",
+    "updatedAt": "2026-04-22 20:20:30.197",
+    "visible": false
+  },
+  {
+    "id": "frk_69eb9ca15a99e0ad3107b033",
+    "name": "Cloud Cybersecurity Controls",
+    "description": "National Cybersecurity Authority ",
+    "version": "1.0.0",
+    "createdAt": "2026-04-24 16:38:57.256",
+    "updatedAt": "2026-04-24 16:39:18.628",
+    "visible": false
+  },
   {
     "id": "frk_6924c5bf34ae90945076508e",
     "name": "NIST 800-53",
@@ -151,5 +178,32 @@
     "createdAt": "2025-11-19 20:30:44.681",
     "updatedAt": "2025-11-24 21:22:25.364",
     "visible": true
+  },
+  {
+    "id": "frk_69bd4011a22723c759ca8e46",
+    "name": "PCI Level 1",
+    "description": "PCI Level 1 On-Site Assessment ",
+    "version": "1.0.0",
+    "createdAt": "2026-03-20 12:39:44.973",
+    "updatedAt": "2026-03-20 12:39:44.973",
+    "visible": false
+  },
+  {
+    "id": "frk_69bd93a9a68c82ba0998008d",
+    "name": "SOC 2 v2",
+    "description": "March 2026",
+    "version": "1.0.0",
+    "createdAt": "2026-03-20 18:36:24.991",
+    "updatedAt": "2026-03-20 18:36:24.991",
+    "visible": false
+  },
+  {
+    "id": "frk_69f3d7821751ec330608f200",
+    "name": "PIPEDA",
+    "description": "Personal Information Protection and Electronic Documents Act ",
+    "version": "1.0.0",
+    "createdAt": "2026-04-30 22:28:17.577",
+    "updatedAt": "2026-05-01 00:14:14.759",
+    "visible": false
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
index e9a12f317e..02926456f3 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorPolicyTemplate.json
@@ -5,39 +5,39 @@
     "description": "Approves secure VPN or zero-trust methods, sets endpoint hardening and mobile controls, and logs and reviews remote sessions.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Secure connectivity for off-site work while protecting {{DATA}} for {{COMPANY}} on personal and remote devices that access {{CRITICAL}} in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All remote network connections and any personally owned devices used for company activities. Applies to {{LOCATION}} staff and contractors using {{DEVICES}} to reach {{CRITICAL}} workloads.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align to SOC 2 Security; extend to Confidentiality where applicable to data-in-transit and endpoint protection.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is accessed or stored, apply Security Rule technical safeguards: access control, audit controls, integrity, and transmission security.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Approved Remote Access Methods", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use VPN or zero-trust proxy with MFA for administrative or data-sensitive access to {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SSH only with key-based authentication; prohibit direct RDP/SSH from the public internet.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable remote access on systems where it is not required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict remote access from outside {{GEO}} unless explicitly approved; use VPN while traveling.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Avoid split tunneling when accessing {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce MFA on all remote admin access; restrict inbound management ports; manage changes to remote-access configs through change control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt all remote sessions handling ePHI and avoid split tunneling when accessing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Endpoint Security Requirements", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{DEVICES}} must run a supported OS, be fully patched, and have disk encryption enabled.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Install company-approved endpoint protection; auto-lock after 15 minutes idle.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only managed {{DEVICES}} may access {{CRITICAL}} or store {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require device posture checks where supported before granting remote access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce device encryption and auto-lock for any endpoint that can access ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Mobile/BYOD Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Register BYOD devices; enforce PIN/biometric, encryption, and remote-wipe capability.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Company email and data stored in a managed app or container where feasible.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove company data and access immediately upon contract end or device loss.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require enrollment prior to access; record enrollment and removal events.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Prohibit backups of ePHI to personal cloud accounts; ensure remote wipe of ePHI when access is terminated.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Monitoring & Session Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log VPN and privileged remote sessions; retain logs for at least 90 days in {{GEO}} storage.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Auto-disconnect inactive VPN sessions after 12 hours or shorter if supported.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review remote-access logs monthly for anomalies, including access from outside {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on excessive authentication failures and unusual geolocation; sample log reviews monthly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit logs for ePHI access via remote sessions and retain per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample confirms 100% of remote devices meet patch/encryption policy; VPN logs reviewed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For teams over {{EMPLOYEES}} employees, expand the quarterly sample size and include a check of access to {{CRITICAL}} by {{DEVICES}}.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary allowance for an unsupported device requires management approval and a remediation timeline. Note any added risk to {{DATA}} and compensating controls before granting access.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Non-compliant devices are blocked from the network until remediated; repeat violations are escalated to HR/management.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evaluate new secure-access technologies and refine BYOD requirements annually, considering {{INDUSTRY}} needs and changes to {{GEO}}.", "type": "text"}]}],
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Secure connectivity for off-site work while protecting {{DATA}} for {{COMPANY}} on personal and remote devices that access {{CRITICAL}} in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All remote network connections and any personally owned devices used for company activities. Applies to {{LOCATION}} staff and contractors using {{DEVICES}} to reach {{CRITICAL}} workloads.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align to SOC 2 Security; extend to Confidentiality where applicable to data-in-transit and endpoint protection.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is accessed or stored, apply Security Rule technical safeguards: access control, audit controls, integrity, and transmission security.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply remote-access controls to any session that can reach personal information held by {{COMPANY}}, in accordance with Principle 7 of PIPEDA Schedule 1.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Approved Remote Access Methods", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use VPN or zero-trust proxy with MFA for administrative or data-sensitive access to {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SSH only with key-based authentication; prohibit direct RDP/SSH from the public internet.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable remote access on systems where it is not required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict remote access from outside {{GEO}} unless explicitly approved; use VPN while traveling.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Avoid split tunneling when accessing {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce MFA on all remote admin access; restrict inbound management ports; manage changes to remote-access configs through change control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt all remote sessions handling ePHI and avoid split tunneling when accessing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt all remote sessions handling personal information; restrict remote access to managed {{DEVICES}} where the volume or sensitivity warrants it.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Endpoint Security Requirements", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{DEVICES}} must run a supported OS, be fully patched, and have disk encryption enabled.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Install company-approved endpoint protection; auto-lock after 15 minutes idle.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only managed {{DEVICES}} may access {{CRITICAL}} or store {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require device posture checks where supported before granting remote access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce device encryption and auto-lock for any endpoint that can access ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Enforce device encryption and auto-lock for endpoints that can access personal information; verify posture before granting access.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Mobile/BYOD Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Register BYOD devices; enforce PIN/biometric, encryption, and remote-wipe capability.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Company email and data stored in a managed app or container where feasible.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove company data and access immediately upon contract end or device loss.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require enrollment prior to access; record enrollment and removal events.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Prohibit backups of ePHI to personal cloud accounts; ensure remote wipe of ePHI when access is terminated.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Prohibit backups of personal information to personal cloud accounts; ensure remote wipe of personal information on the {{LOCATION}} workforce's devices when access is terminated.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Monitoring & Session Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log VPN and privileged remote sessions; retain logs for at least 90 days in {{GEO}} storage.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Auto-disconnect inactive VPN sessions after 12 hours or shorter if supported.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review remote-access logs monthly for anomalies, including access from outside {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on excessive authentication failures and unusual geolocation; sample log reviews monthly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit logs for ePHI access via remote sessions and retain per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Maintain audit logs for remote access to personal information for at least 24 months; alert on anomalous geolocation when accessing sensitive personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample confirms 100% of remote devices meet patch/encryption policy; VPN logs reviewed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For teams over {{EMPLOYEES}} employees, expand the quarterly sample size and include a check of access to {{CRITICAL}} by {{DEVICES}}.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary allowance for an unsupported device requires management approval and a remediation timeline. Note any added risk to {{DATA}} and compensating controls before granting access.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Non-compliant devices are blocked from the network until remediated; repeat violations are escalated to HR/management.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evaluate new secure-access technologies and refine BYOD requirements annually, considering {{INDUSTRY}} needs and changes to {{GEO}}.", "type": "text"}]}]},
     "createdAt": "2025-06-27 07:04:11.567",
-    "updatedAt": "2025-08-19 18:23:48.629"
+    "updatedAt": "2026-04-30 23:21:57.740"
   },
   {
-    "id": "frk_pt_685e453cad89de25e5aebf4a",
-    "name": "Acceptable Use & Workstation Security",
-    "description": "Sets responsible use rules, enforces endpoint encryption, patching, auto-lock, and restricts personal storage of company data.",
+    "id": "frk_pt_685e3f7b4ebcb27b60c51434",
+    "name": "Information Security & Privacy Governance",
+    "description": "Assigns clear ownership and management accountability for security and privacy, keeps policies current, and measures compliance through regular reviews.",
     "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define responsible use of company systems and secure configuration of endpoints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All users and devices accessing company networks or data.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Acceptable Use Rules", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use company assets for authorized business activities; limited personal use allowed if it doesn’t create risk.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit illegal, harassing, or copyright-infringing activities.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Workstation Configuration & Updates", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enable full-disk encryption, host firewall, and automatic OS patches.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Auto-lock after 10 minutes idle and require password/PIN to resume.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Internet, Email & Messaging", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users must not forward company data to personal email.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use approved messaging tools for business discussions.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Removable Media & Printing", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect printed sensitive docs immediately; shred when done.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Personal Devices & Local Storage", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "BYOD must meet endpoint-security requirements (PIN, encryption, patching) and register with IT.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store company data only in approved, encrypted containers or apps.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly workstation audit checks encryption, lock settings, and patch status.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary deviation (e.g., lab testing) requires documented approval and time limit.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Policy breaches result in access suspension until remediation; severe cases escalate to HR.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update rules with new collaboration tools and emerging endpoint threats.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:16:12.366",
-    "updatedAt": "2025-08-19 18:24:37.446"
+    "department": "admin",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define clear ownership for security and privacy at {{COMPANY}} and ensure decisions are documented.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "This policy also establishes the framework for. information security in accordance with ", "type": "text"}, {"text": "NEN 7510 - Information Security in Healthcare", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", ensuring the confidentiality, integrity, and availability (CIA) of health and personal information processed by {{COMPANY}}", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personnel, contractors, information systems, SaaS/IaaS services hosted in {{CRITICAL}}, and company-managed {{DEVICES}}. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, assign ownership, and retain artifacts for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, document responsibilities under the Security Rule and retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Designate a Privacy Officer accountable for PIPEDA Schedule 1 compliance and document their authority across all personal information held by {{COMPANY}}, including data transferred to processors operating outside Canada.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where health or patient information (personal data within the meaning of the GDPR/AVG) is processed, document responsibilities, ensure secure handling, and maintain records of processing in accordance with Dutch healthcare regulations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Governance Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Designate a Security & Privacy Owner (SPO) and a documented backup. Ensure coverage across {{LOCATION}} time zones.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record names in the Comp AI platform.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-confirm role assignments at least annually and after role changes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document the SPO’s scope, authority, and reporting line; keep a dated record of annual role reconfirmation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Name a Security Official responsible for developing and implementing policies (164.308(a)(2)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Publish the Privacy Officer's name and contact details and confirm them on request. The Privacy Officer is the named point of contact for the Office of the Privacy Commissioner of Canada (OPC).{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Assign accountability for implementing and maintaining NEN 7510 controls, including risk management, access security, training, and compliance with Dutch legal obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Management Accountability", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SPO presents a concise security status during scheduled management reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "For teams over {{EMPLOYEES}} employees, hold reviews at least quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Senior management signs an annual statement acknowledging ultimate responsibility for security and privacy.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allocate at least one measurable security improvement task per sprint or work cycle, prioritized to protect {{DATA}} in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record management reviews, decisions, and assigned actions with due dates in Comp AI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure management oversight of Security Rule activities and document sanctions, if applied, per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Review compliance with each of the 10 Fair Information Principles at least annually; record decisions, corrective actions, and assigned owners in the privacy programme record.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Conduct annual management reviews that address the outcomes of risk assessments, incidents, and improvement actions required by NEN 7510. Risk registers, relevant metrics, and mitigation decisions must be recorded and tracked to completion.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store all policies in Comp AI; the SPO verifies access and link integrity annually. Note storage and retention locations in {{GEO}} where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain version control with change logs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Merge or retire overlapping policies to keep each document brief.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track effective dates and owners; preserve prior versions for audit sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain policy documents and revisions for 6 years (164.316(b)(2)(i)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Maintain governance over policies that address each of the 10 Fair Information Principles; retain prior versions for at least 24 months to support access requests and OPC inquiries.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all NEN 7519-relevant documents (policies, risk assessments, incident records, and management reviews) are retained for the defined retention period and remain traceable for internal and external audits.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "New personnel read this policy set and electronically acknowledge before receiving system access to {{CRITICAL}} from {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Distribute security awareness training annually, tailored to {{INDUSTRY}} risks and the handling of {{DATA}}; record completion for the {{LOCATION}} workforce.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track completion status and follow up on overdue training within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access (164.308(a)(5)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Include the 10 Fair Information Principles, the Privacy Officer's role, and the access-request and complaint procedures in the awareness curriculum for staff who handle personal information.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Deliver role-based awareness and training covering information security in healthcare, including protection of patient data, secure system use, and staff responsibilities under NEN 7510. Reassess training needs annually and after significant changes in technology or regulation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual check that policies exist, the SPO and backup are documented, annual sign-off is filed, and the awareness log is current for the {{EMPLOYEES}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain compliance with the ", "type": "text"}, {"text": "General Data Protection Regulation (GDPR/AVG)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", the ", "type": "text"}, {"text": "Dutch Medical Treatment Contracts Act (WGBO)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", and the ", "type": "text"}, {"text": "NEN 7510 suite", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", including ", "type": "text"}, {"text": "NEN7512", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (secure data transmission) and ", "type": "text"}, {"text": "NEN 7513", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (logging and audit trail requirements).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document deviations in a “Security-Decisions” log with reason and expiry, including any residual risk to {{DATA}} and compensating controls in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing logs or overdue actions are corrected within two weeks or escalated at the next management review.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Audit and incident lessons feed into the next scheduled policy refresh. Update roles and training focus when {{GEO}} or {{INDUSTRY}} obligations change.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 06:51:38.574",
+    "updatedAt": "2026-04-30 23:21:41.599"
   },
   {
-    "id": "frk_pt_685e46557bc14fbddea6468a",
-    "name": "Information Sharing & Transfer",
-    "description": "Restricts data transfers to approved encrypted channels, enforces NDAs and minimisation, records international safeguards, and audits transfer logs.",
+    "id": "frk_pt_685e405054f7c35d89ccccf2",
+    "name": "Policy Management & Exception Handling",
+    "description": "Inventories every policy, enforces version control and annual reviews, and documents, time-boxes, and sunsets any approved exceptions.",
     "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure data moves securely between systems, parties, and jurisdictions, preserving confidentiality and integrity.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All electronic and physical transfers of organisational or customer information.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Approved Transfer Methods", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use TLS-protected channels (HTTPS, SFTP, VPN) or end-to-end encrypted messaging.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt physical media; use tracked courier services.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "External Sharing & NDAs", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm recipient identity and need-to-know.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Execute NDA or contract before sharing Confidential or Restricted data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Share via least-privilege, time-bound links; disable after purpose met.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Minimisation & Redaction", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Share only necessary data fields; mask or anonymise where feasible.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove test or debug data from production extracts.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "International Transfers & Safeguards", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal data leaving its origin region, apply recognised safeguards (e.g., Standard Contractual Clauses).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain record of transfer bases in privacy processing log.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Logging & Audit Trail", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log outbound transfers of Restricted data: date, sender, recipient, content summary, method.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain logs for at least one year.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample of transfer logs shows 100 % encrypted channels and valid agreements.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "One-off unencrypted transfer allowed only for low-sensitivity data with management approval.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unauthorised or insecure transfers raise incident response; notify affected parties if required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add automated redaction and secure-send tools; update safeguards with legal changes.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:20:53.290",
-    "updatedAt": "2025-08-19 18:24:50.023"
+    "department": "admin",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure all governance, security, and privacy policies are current, traceable, and that any deviations are formally approved, time-boxed, and documented for {{COMPANY}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All organizational policies and standards, all personnel, and all systems governed by those documents. Applies to the {{LOCATION}} workforce and systems hosted in {{CRITICAL}}; store records in {{GEO}} where residency applies.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain policy ownership, version history, review notes, and exception records for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain Security Rule policies and any related exceptions for 6 years; ensure exceptions do not weaken safeguards for ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain privacy policy versions, exceptions, and review evidence for at least 24 months; ensure exceptions do not weaken safeguards required to protect personal information under PIPEDA.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Inventory & Ownership", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a master list of active policies, each with a named owner.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store the inventory in a shared repository accessible to all personnel, hosted in {{CRITICAL}} and retained per {{GEO}} requirements.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include effective date and next review date in the inventory; map each policy to relevant controls where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Identify HIPAA-relevant policies in the inventory and link to BAAs or procedures that reference them.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Identify privacy-relevant policies in the inventory and map each to the 10 Fair Information Principles they support.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Version Control & Distribution", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep policies under version control with commit history in Comp AI.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include a version number and last-review date in each document.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify personnel of major updates within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve prior versions and change logs for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain historical versions and acknowledgements for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Where a policy update changes how personal information is collected, used, disclosed, or retained, update the public privacy notice within 30 days and propagate changes to affected processors.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scheduled Review Cycle", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Owners review their policies at least once every 12 months and record “Reviewed – no change” or revisions in the change log.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Time reviews to precede planned audits.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record reviewer and date; align timing with audit windows.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Confirm HIPAA-related policies reflect current safeguards and regulatory updates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Confirm that each privacy policy reflects current OPC guidance and that retention, access, and complaint procedures remain accurate.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exception Request Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any employee may request an exception by submitting: scope, justification, risk, compensating controls, and proposed expiry.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The policy owner and senior management jointly approve or reject within ten business days; assess residual risk to {{DATA}} and impacts to systems in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Link exceptions to the Risk Register and relevant controls; ensure expiries are time-boxed.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Assess impact on ePHI; exceptions must not bypass minimum necessary, access controls, or transmission security.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Assess any exception's impact on personal information; exceptions cannot bypass consent, access-request, breach-notification, or retention obligations under PIPEDA.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exception Register & Sunset", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record all approved exceptions in an Exception Register with owner and expiry date; host in {{CRITICAL}} and retain per {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the register monthly; close or renew any item reaching expiry.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track renewals and closures; keep evidence of monthly reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document HIPAA-related exceptions and closures; retain for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Document privacy-related exceptions and their closure; retain for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Inventory exists; ≥ 90% of policies show review within 12 months; no exceptions past expiry. For teams over {{EMPLOYEES}} employees, expand monthly sampling of exceptions.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Handled via the “Exception Request Process” and logged in the Exception Register, including residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing reviews or unmanaged exceptions are escalated to senior management and corrected within 30 days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate audit findings and user feedback at the next scheduled review; update inventory fields or workflows when {{CRITICAL}} or {{GEO}} obligations change.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 06:55:11.688",
+    "updatedAt": "2026-04-30 23:21:42.717"
   },
   {
-    "id": "frk_pt_685e40d46e7b1123022bf3e8",
-    "name": "Data Classification & Handling",
-    "description": "Uses a four-tier classification scheme to label data and prescribes access, encryption, sharing, and disposal rules for each level.",
+    "id": "frk_pt_685e410082a807a0274b4531",
+    "name": "Privacy & Data-Subject Rights",
+    "description": "Ensures personal data is processed on a lawful basis, keeps users informed, and fulfils data-subject requests within required timelines.",
     "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect information proportionately by assigning sensitivity levels and prescribing handling requirements for {{COMPANY}}. Emphasis on {{DATA}} processed in {{CRITICAL}} and stored or retained in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All data created, received, processed, or stored by the organisation, regardless of medium or location. Applies to the {{LOCATION}} workforce and any {{DEVICES}} that access {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain a documented scheme; ensure labelling, storage, access, transmission, and disposal practices align to Security and Confidentiality criteria; retain artefacts for the Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, apply the Minimum Necessary standard and Security Rule safeguards for access control, audit controls, integrity, transmission security, and device/media handling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Classification Scheme", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Adopt four levels: Public, Internal, Confidential, Restricted.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define examples and default level (Internal) in a quick-reference guide, reflecting {{INDUSTRY}} data types and {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure classification drives access control, encryption, monitoring, and retention requirements across {{CRITICAL}} and backups in {{GEO}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Treat ePHI as Restricted unless formally de-identified per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Labelling & Identification", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Label documents and data stores at creation using headers, metadata tags, or clear folder names.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use automated tagging where supported; otherwise manual labels are required for Confidential and Restricted data.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep labels consistent across repositories and automate propagation where feasible in {{CRITICAL}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Mark repositories containing ePHI; prevent removal of labels during export.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Access & Storage Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Grant access on a least-privilege basis aligned to classification level.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt Confidential and Restricted data at rest in {{CRITICAL}} and in backups stored in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log administrative access to Restricted data.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review access rights on a defined cadence and protect encryption keys.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit logging for ePHI access; restrict admin access and review regularly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Transmission & Sharing Rules", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use encrypted channels (for example TLS, SFTP) for Confidential or Restricted data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit public-cloud file links without access control when data is above Internal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "External sharing of Restricted data requires management approval and an NDA or contract.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Disable insecure protocols and enforce MFA for privileged transfers.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI in transit and use Business Associate Agreements where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Retention & Disposal Alignment", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply retention periods from the Data Retention Policy to each classification, considering {{GEO}} obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Destroy media holding Confidential or Restricted data using secure wipe or certified shredding.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure destruction is logged and, where used, certificates of destruction are filed.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Follow Device and Media Controls for ePHI and maintain documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample confirms correct labels, encryption, and access rights; ≥ 95% accuracy target. Scale the sample size proportionally for teams over {{EMPLOYEES}} employees.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Must document risk and compensating controls; senior management approval required. Note any residual risk to {{DATA}} and how it is mitigated in {{CRITICAL}} or through {{DEVICES}} controls.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Mislabelled or mishandled data triggers incident response and mandatory refresher training.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update examples and tooling as new {{INDUSTRY}} data types or regulations emerge, including changes affecting {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:57:24.052",
-    "updatedAt": "2025-08-19 18:25:02.649"
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure personal data ({{DATA}}) is processed lawfully and transparently at {{COMPANY}}, and that individuals can exercise their privacy rights across services running in {{CRITICAL}} and jurisdictions in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personal data relating to customers, end-users, employees, contractors, or any identifiable individuals. Applies to the {{LOCATION}} workforce, systems hosted in {{CRITICAL}}, and managed {{DEVICES}} that process {{DATA}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align practices with Security and Confidentiality criteria; retain artefacts (records of processing, notices, DSR logs) for the full Type 2 period plus 12 months; treat relevant vendors as subservice organisations where appropriate.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, apply the HIPAA Privacy Rule (uses/disclosures, minimum necessary, Notice of Privacy Practices) and individual rights (access, amendment, accounting, restrictions, confidential communications). Retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Cover individuals' rights under PIPEDA: access (Principle 9), correction (Principle 6), and challenging compliance (Principle 10). Respond to written access requests within 30 days at minimal or no cost.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Lawful Basis & Data Minimisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify and record a lawful basis (for example contract, consent, legitimate interest) for each processing activity.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect only data necessary for the stated purpose; review forms and APIs annually to remove unused fields, reflecting {{INDUSTRY}} practices and any {{GEO}} limits.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure lawful-basis records link to data classification, retention period, and controls.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply minimum necessary; for uses/disclosures beyond TPO, obtain written authorisation or rely on another permitted basis; validate BAA coverage for Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Identify the documented purpose under PIPEDA Principle 2 for each processing activity; align consent and use with the privacy notice.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Transparency & Privacy Notice", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain an up-to-date public Privacy Notice describing categories of {{DATA}}, purposes, sharing, retention, rights, and international transfers (including outside {{GEO}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update the notice within 30 days of any significant change in processing.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep dated copies of prior notices and evidence of publication.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where applicable, maintain and furnish a Notice of Privacy Practices and update it upon material changes.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Maintain the PIPEDA Privacy Notice and update it within 30 days of any material change to collection, use, disclosure, or retention practices.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Data-Subject Request (DSR) Workflow", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide a visible channel (for example a privacy email or web form) for access, correction, deletion, or portability requests.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify requester identity and respond within applicable legal timelines in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log each request, decision, and completion date in a DSR log; restrict access.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect the DSR log, restrict access, and retain for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Process HIPAA individual-rights requests (access, amendment, accounting, restrictions, confidential communications) within HIPAA timelines; document decisions.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Process PIPEDA access requests within 30 days; provide an account of use and disclosure; identify third-party recipients as specifically as possible. Where access is refused, cite the specific Section 9 exception in writing and inform the individual of the right to complain to the OPC.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Consent & Preference Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain explicit consent where required; store timestamp and method.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Offer easy withdrawal via self-service or support request; propagate changes across systems in {{CRITICAL}} within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Propagate preference changes across integrated systems; retain consent and revocation records.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track and honour authorisations and revocations for uses/disclosures requiring authorisation; record agreed restrictions and confidential communication requests.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Honor consent withdrawal and propagate the change across {{CRITICAL}} and {{SOFTWARE}} within five business days; inform the individual of any consequences of withdrawal.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Record Keeping & Audit Trail", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a processing-activity record covering data categories, purposes, lawful bases, recipients, transfers, and safeguards (including residency in {{GEO}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain DSR logs and consent records for at least three years (or longer where required).", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve change history for the processing record and DSR log.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain an accounting of disclosures (where required) and retain HIPAA-related records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain access requests, decisions, and amendment evidence for at least 24 months to support OPC inquiries.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review confirms the processing record is current, the Privacy Notice is updated as needed, and DSRs are closed on time. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks of transfers in/out of {{GEO}} and processing in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any deviation (for example extended DSR deadline) is documented with justification and regulatory allowance, including any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missed deadlines or undocumented processing triggers incident response and notification to leadership; corrective action required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate feedback from users, audits, {{INDUSTRY}} updates, and regulatory changes affecting {{GEO}} into processes and the Privacy Notice.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 06:58:08.164",
+    "updatedAt": "2026-04-30 23:21:59.459"
   },
   {
     "id": "frk_pt_685e42a3bbd08ad14de297f0",
@@ -49,16 +49,6 @@
     "createdAt": "2025-06-27 07:05:06.707",
     "updatedAt": "2025-08-19 18:25:14.107"
   },
-  {
-    "id": "frk_pt_685e45c938ad29ad775a2344",
-    "name": "Background Screening & On/Off-boarding",
-    "description": "Screens new hires, provisions least-privilege access, disables accounts and recovers assets at exit, and archives records securely.",
-    "frequency": "yearly",
-    "department": "hr",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify workforce integrity for {{COMPANY}}, grant the right access to {{CRITICAL}} and {{DATA}} at start, and promptly revoke it at end of engagement.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and temporary staff. Applies to the {{LOCATION}} workforce, including remote personnel using {{DEVICES}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain records of screenings, provisioning, and deprovisioning to support auditor sampling during the Type 2 period.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, implement Workforce Security, Workforce Clearance, and Termination Procedures, and retain Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Pre-Employment Background Screening", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct identity verification and right-to-work checks for all hires.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Perform criminal or reference checks proportional to role sensitivity, prioritizing roles with access to {{CRITICAL}} or {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete screening before system access is granted; document outcomes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record screening scope and completion date in the personnel file.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply workforce clearance procedures for roles with ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Provisioning", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manager submits an access request ticket listing required systems and role.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create individual accounts only; no shared credentials.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide security training and policy acknowledgement within the first week, before granting access to {{CRITICAL}} or {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only managed {{DEVICES}} may be used to access {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Grant access based on least privilege and role; record approvals in the ticketing system.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require Security Rule awareness for any role that accesses ePHI prior to granting such access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Exit Procedures", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR or manager notifies IT of termination date at least 24 hours in advance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable accounts and remove access to {{CRITICAL}} by close of last working day; revoke remote access on {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect badges and credentials; schedule exit interview to remind departing staff of confidentiality obligations related to {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Capture disablement timestamps and confirm removal from all groups and SSO apps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply termination procedures for ePHI access, including revoking authentication credentials and remote access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Access Reconciliation & Asset Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Recover all company-owned {{DEVICES}}; verify data wipe before reuse.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Compare recovered asset list against inventory; investigate discrepancies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove access from identity provider groups and cloud services within 24 hours.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Reconcile identity provider groups and tokens; document completion in the off-boarding checklist.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure devices that held ePHI are wiped or sanitized per policy before reassignment.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Record Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store screening results and off-boarding checklists in a secure HR system for seven years or legal minimum; where residency applies, store records in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain provisioning and deprovisioning evidence for at least the audit period plus the organization’s standard buffer.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related workforce documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly audit confirms 100% of terminated accounts are disabled and all assets are returned. For teams over {{EMPLOYEES}} employees, expand the sample size and include checks of {{CRITICAL}} access removal.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any skipped screening step requires executive approval and a documented risk note in the personnel file, including any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing background checks or lagging account disablement is escalated to HR and Security for remediation within five business days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review screening vendors, checklist effectiveness, and timing metrics annually, considering {{INDUSTRY}} requirements and any changes to {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:18:33.152",
-    "updatedAt": "2025-08-19 18:25:31.916"
-  },
   {
     "id": "frk_pt_685e3fc75bd72cd0745dc5d1",
     "name": "Risk Management",
@@ -79,6 +69,16 @@
     "createdAt": "2025-06-27 07:08:04.684",
     "updatedAt": "2025-08-19 18:26:03.456"
   },
+  {
+    "id": "frk_pt_685e462046667f75a50a2c3e",
+    "name": "Vendor & Third-Party Risk",
+    "description": "Inventories vendors, tiers them by data impact, conducts due diligence, embeds security clauses in contracts, and monitors attestations and incidents.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Use written contracts to ensure third parties processing personal information on behalf of {{COMPANY}} provide a comparable level of privacy protection. Maintain accountability for personal information transferred to vendors regardless of where they operate in {{GEO}}.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Third parties that process or host {{DATA}} for {{COMPANY}} must demonstrate equivalent security controls, preferably NEN 7510 or ISO 27001 certification. Establish data processing agreements and periodically review supplier compliance.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Tag vendors that process personal information; record whether the data leaves Canada and the safeguards applied to those cross-border transfers.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Confirm the vendor can support {{COMPANY}}'s obligations: access-request fulfilment within 30 days, breach notification, and compliance with the 10 Fair Information Principles.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require contractual commitments to: limit processing to documented purposes, return or securely destroy personal information on termination, notify {{COMPANY}} of any privacy breach without undue delay, and submit to {{COMPANY}}'s direction on access requests.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Re-confirm annually that processors continue to provide comparable privacy protection; track any changes to data location or sub-processor lists.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}On termination, obtain certified return or secure destruction of personal information held by the vendor, and update the Personal Information Register.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:19:59.742",
+    "updatedAt": "2026-04-30 23:21:44.840"
+  },
   {
     "id": "frk_pt_685e42c38c3267d391674ce3",
     "name": "Change & Release Management",
@@ -89,16 +89,6 @@
     "createdAt": "2025-06-27 07:05:38.952",
     "updatedAt": "2025-08-19 18:26:37.094"
   },
-  {
-    "id": "frk_pt_685e405054f7c35d89ccccf2",
-    "name": "Policy Management & Exception Handling",
-    "description": "Inventories every policy, enforces version control and annual reviews, and documents, time-boxes, and sunsets any approved exceptions.",
-    "frequency": "yearly",
-    "department": "admin",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure all governance, security, and privacy policies are current, traceable, and that any deviations are formally approved, time-boxed, and documented for {{COMPANY}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All organizational policies and standards, all personnel, and all systems governed by those documents. Applies to the {{LOCATION}} workforce and systems hosted in {{CRITICAL}}; store records in {{GEO}} where residency applies.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain policy ownership, version history, review notes, and exception records for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain Security Rule policies and any related exceptions for 6 years; ensure exceptions do not weaken safeguards for ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Inventory & Ownership", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a master list of active policies, each with a named owner.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store the inventory in a shared repository accessible to all personnel, hosted in {{CRITICAL}} and retained per {{GEO}} requirements.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include effective date and next review date in the inventory; map each policy to relevant controls where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Identify HIPAA-relevant policies in the inventory and link to BAAs or procedures that reference them.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Version Control & Distribution", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep policies under version control with commit history in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include a version number and last-review date in each document.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify personnel of major updates within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve prior versions and change logs for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain historical versions and acknowledgements for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scheduled Review Cycle", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Owners review their policies at least once every 12 months and record “Reviewed – no change” or revisions in the change log.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Time reviews to precede planned audits.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record reviewer and date; align timing with audit windows.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Confirm HIPAA-related policies reflect current safeguards and regulatory updates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exception Request Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any employee may request an exception by submitting: scope, justification, risk, compensating controls, and proposed expiry.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The policy owner and senior management jointly approve or reject within ten business days; assess residual risk to {{DATA}} and impacts to systems in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Link exceptions to the Risk Register and relevant controls; ensure expiries are time-boxed.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Assess impact on ePHI; exceptions must not bypass minimum necessary, access controls, or transmission security.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exception Register & Sunset", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record all approved exceptions in an Exception Register with owner and expiry date; host in {{CRITICAL}} and retain per {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the register monthly; close or renew any item reaching expiry.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track renewals and closures; keep evidence of monthly reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document HIPAA-related exceptions and closures; retain for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Inventory exists; ≥ 90% of policies show review within 12 months; no exceptions past expiry. For teams over {{EMPLOYEES}} employees, expand monthly sampling of exceptions.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Handled via the “Exception Request Process” and logged in the Exception Register, including residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing reviews or unmanaged exceptions are escalated to senior management and corrected within 30 days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate audit findings and user feedback at the next scheduled review; update inventory fields or workflows when {{CRITICAL}} or {{GEO}} obligations change.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:55:11.688",
-    "updatedAt": "2025-08-19 18:26:51.406"
-  },
   {
     "id": "frk_pt_685e4319a5bb1d2d411975e6",
     "name": "Secure Software Development Lifecycle ",
@@ -110,24 +100,14 @@
     "updatedAt": "2025-08-19 18:27:08.892"
   },
   {
-    "id": "frk_pt_685e45f736049f188c3439b4",
-    "name": "Sanctions & Disciplinary",
-    "description": "Applies a progressive, documented disciplinary framework for security or privacy violations, ensuring fair process and consistent sanctions.",
-    "frequency": "yearly",
-    "department": "hr",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Outline fair, consistent consequences for security or privacy violations at {{COMPANY}} while safeguarding access to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All workforce members, regardless of role or contract type. Applies to the {{LOCATION}} workforce, including personnel using {{DEVICES}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain a documented sanctions process, apply it consistently, and retain records for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain and enforce a sanctions policy for workforce members who fail to comply with security or privacy policies; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Disciplinary Framework", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply progressive discipline: coaching → written warning → suspension → termination, unless severity dictates immediate action.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Align severity with impact. Data breach, harassment, or unlawful acts may bypass lower steps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Consider intent, prior history, and potential risk to customers or the organisation.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Demonstrate consistent application across similar cases; link outcomes to policy and code of conduct.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Reference the HIPAA sanctions policy for violations involving ePHI or Privacy Rule requirements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Investigation & Due Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR and Security jointly investigate alleged violations; gather logs, interviews, and evidence (including access/log records from {{CRITICAL}} and managed {{DEVICES}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve evidence integrity and confidentiality; limit access to need-to-know.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Offer the accused an opportunity to provide explanation before decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record investigation steps, decision rationale, and approvals for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy and Security Officers when ePHI or HIPAA rights may be affected; avoid retaliation against good-faith reporters.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Sanction Levels", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Minor: verbal coaching and retraining.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Moderate: written warning plus remedial actions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Major: suspension, revocation of access to {{CRITICAL}}, removal of privileges to handle {{DATA}}, potential termination and legal referral.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Map remedial actions to control improvements or additional training.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply role-appropriate retraining where HIPAA requirements were breached.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Documentation & Appeals", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "File investigation report and final action in the personnel record; restrict access and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide an appeal channel to senior leadership within five business days of sanction notice.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain final decision, appeal outcome, and corrective actions with dates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain sanction documentation and related HIPAA records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "HR Integration & Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR maintains a sanctions log for trend analysis.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate a concise sanctions policy summary in annual awareness training, with examples relevant to {{INDUSTRY}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review trends quarterly and feed lessons into training and process updates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Highlight examples tied to ePHI mishandling and required safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review of the sanctions log confirms consistency and closure of corrective actions. For teams over {{EMPLOYEES}} employees, expand sampling and include checks that access to {{CRITICAL}}/{{DATA}} was revoked when required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Executive leadership may vary sanctions only with documented rationale, including residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to follow this process prompts an HR-led review and policy refresher; corrective actions are assigned and tracked to closure.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Adjust the framework based on case analytics, audit findings, and legal or regulatory changes, including {{INDUSTRY}} developments and obligations affecting {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:19:19.425",
-    "updatedAt": "2025-08-19 18:27:27.779"
-  },
-  {
-    "id": "frk_pt_685e410082a807a0274b4531",
-    "name": "Privacy & Data-Subject Rights",
-    "description": "Ensures personal data is processed on a lawful basis, keeps users informed, and fulfils data-subject requests within required timelines.",
+    "id": "frk_pt_685e46557bc14fbddea6468a",
+    "name": "Information Sharing & Transfer",
+    "description": "Restricts data transfers to approved encrypted channels, enforces NDAs and minimisation, records international safeguards, and audits transfer logs.",
     "frequency": "yearly",
-    "department": "gov",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure personal data ({{DATA}}) is processed lawfully and transparently at {{COMPANY}}, and that individuals can exercise their privacy rights across services running in {{CRITICAL}} and jurisdictions in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personal data relating to customers, end-users, employees, contractors, or any identifiable individuals. Applies to the {{LOCATION}} workforce, systems hosted in {{CRITICAL}}, and managed {{DEVICES}} that process {{DATA}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align practices with Security and Confidentiality criteria; retain artefacts (records of processing, notices, DSR logs) for the full Type 2 period plus 12 months; treat relevant vendors as subservice organisations where appropriate.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, apply the HIPAA Privacy Rule (uses/disclosures, minimum necessary, Notice of Privacy Practices) and individual rights (access, amendment, accounting, restrictions, confidential communications). Retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Lawful Basis & Data Minimisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify and record a lawful basis (for example contract, consent, legitimate interest) for each processing activity.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect only data necessary for the stated purpose; review forms and APIs annually to remove unused fields, reflecting {{INDUSTRY}} practices and any {{GEO}} limits.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure lawful-basis records link to data classification, retention period, and controls.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply minimum necessary; for uses/disclosures beyond TPO, obtain written authorisation or rely on another permitted basis; validate BAA coverage for Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Transparency & Privacy Notice", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain an up-to-date public Privacy Notice describing categories of {{DATA}}, purposes, sharing, retention, rights, and international transfers (including outside {{GEO}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update the notice within 30 days of any significant change in processing.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep dated copies of prior notices and evidence of publication.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where applicable, maintain and furnish a Notice of Privacy Practices and update it upon material changes.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Data-Subject Request (DSR) Workflow", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide a visible channel (for example a privacy email or web form) for access, correction, deletion, or portability requests.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify requester identity and respond within applicable legal timelines in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log each request, decision, and completion date in a DSR log; restrict access.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect the DSR log, restrict access, and retain for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Process HIPAA individual-rights requests (access, amendment, accounting, restrictions, confidential communications) within HIPAA timelines; document decisions.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Consent & Preference Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain explicit consent where required; store timestamp and method.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Offer easy withdrawal via self-service or support request; propagate changes across systems in {{CRITICAL}} within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Propagate preference changes across integrated systems; retain consent and revocation records.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track and honour authorisations and revocations for uses/disclosures requiring authorisation; record agreed restrictions and confidential communication requests.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Record Keeping & Audit Trail", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a processing-activity record covering data categories, purposes, lawful bases, recipients, transfers, and safeguards (including residency in {{GEO}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain DSR logs and consent records for at least three years (or longer where required).", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve change history for the processing record and DSR log.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain an accounting of disclosures (where required) and retain HIPAA-related records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review confirms the processing record is current, the Privacy Notice is updated as needed, and DSRs are closed on time. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks of transfers in/out of {{GEO}} and processing in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any deviation (for example extended DSR deadline) is documented with justification and regulatory allowance, including any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missed deadlines or undocumented processing triggers incident response and notification to leadership; corrective action required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate feedback from users, audits, {{INDUSTRY}} updates, and regulatory changes affecting {{GEO}} into processes and the Privacy Notice.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:58:08.164",
-    "updatedAt": "2025-08-19 18:27:41.229"
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure data moves securely between systems, parties, and jurisdictions, preserving confidentiality and integrity.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All electronic and physical transfers of organisational or customer information.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Cover the use and disclosure of personal information to third parties; ensure each disclosure is consistent with the purpose for which the information was collected, or is supported by fresh consent or a Section 7 PIPEDA exception.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Approved Transfer Methods", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use TLS-protected channels (HTTPS, SFTP, VPN) or end-to-end encrypted messaging.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt physical media; use tracked courier services.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt personal information in transit and document each disclosure (recipient, purpose, basis) in the Personal Information Register.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "External Sharing & NDAs", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm recipient identity and need-to-know.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Execute NDA or contract before sharing Confidential or Restricted data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Share via least-privilege, time-bound links; disable after purpose met.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}For disclosures to processors, require written processing agreements that maintain comparable privacy protection per Principle 1 (Accountability).{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Minimisation & Redaction", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Share only necessary data fields; mask or anonymise where feasible.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove test or debug data from production extracts.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Disclose only the personal information necessary for the recipient's documented purpose; redact or aggregate where the recipient does not need identifiable data.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "International Transfers & Safeguards", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal data leaving its origin region, apply recognised safeguards (e.g., Standard Contractual Clauses).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain record of transfer bases in privacy processing log.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Document any transfer of personal information outside Canada in the privacy notice and the Personal Information Register, including the country of destination and the safeguards applied; remain accountable under PIPEDA regardless of where processing occurs.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Logging & Audit Trail", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log outbound transfers of Restricted data: date, sender, recipient, content summary, method.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain logs for at least one year.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain disclosure records for at least 24 months to support access requests under PIPEDA Section 8 (the right to know to whom personal information has been disclosed).{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample of transfer logs shows 100 % encrypted channels and valid agreements.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "One-off unencrypted transfer allowed only for low-sensitivity data with management approval.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unauthorised or insecure transfers raise incident response; notify affected parties if required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add automated redaction and secure-send tools; update safeguards with legal changes.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:20:53.290",
+    "updatedAt": "2026-04-30 23:24:29.015"
   },
   {
     "id": "frk_pt_685e4010bde64520b9abaf1d",
@@ -140,74 +120,64 @@
     "updatedAt": "2025-09-01 18:25:55.923"
   },
   {
-    "id": "frk_pt_685e462046667f75a50a2c3e",
-    "name": "Vendor & Third-Party Risk",
-    "description": "Inventories vendors, tiers them by data impact, conducts due diligence, embeds security clauses in contracts, and monitors attestations and incidents.",
+    "id": "frk_pt_685e453cad89de25e5aebf4a",
+    "name": "Acceptable Use & Workstation Security",
+    "description": "Sets responsible use rules, enforces endpoint encryption, patching, auto-lock, and restricts personal storage of company data.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Third parties that process or host {{DATA}} for {{COMPANY}} must demonstrate equivalent security controls, preferably NEN 7510 or ISO 27001 certification. Establish data processing agreements and periodically review supplier compliance.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:19:59.742",
-    "updatedAt": "2025-10-05 01:57:26.869"
-  },
-  {
-    "id": "frk_pt_685e3f7b4ebcb27b60c51434",
-    "name": "Information Security & Privacy Governance",
-    "description": "Assigns clear ownership and management accountability for security and privacy, keeps policies current, and measures compliance through regular reviews.",
-    "frequency": "yearly",
-    "department": "admin",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define clear ownership for security and privacy at {{COMPANY}} and ensure decisions are documented.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "This policy also establishes the framework for. information security in accordance with ", "type": "text"}, {"text": "NEN 7510 - Information Security in Healthcare", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", ensuring the confidentiality, integrity, and availability (CIA) of health and personal information processed by {{COMPANY}}", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personnel, contractors, information systems, SaaS/IaaS services hosted in {{CRITICAL}}, and company-managed {{DEVICES}}. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain governance to identify applicable requirements, assign ownership, and retain artifacts for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, document responsibilities under the Security Rule and retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where health or patient information (personal data within the meaning of the GDPR/AVG) is processed, document responsibilities, ensure secure handling, and maintain records of processing in accordance with Dutch healthcare regulations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Governance Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Designate a Security & Privacy Owner (SPO) and a documented backup. Ensure coverage across {{LOCATION}} time zones.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record names in the Comp AI platform.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-confirm role assignments at least annually and after role changes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document the SPO’s scope, authority, and reporting line; keep a dated record of annual role reconfirmation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Name a Security Official responsible for developing and implementing policies (164.308(a)(2)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Assign accountability for implementing and maintaining NEN 7510 controls, including risk management, access security, training, and compliance with Dutch legal obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Management Accountability", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "SPO presents a concise security status during scheduled management reviews.", "type": "text"}, {"type": "hardBreak"}, {"text": "For teams over {{EMPLOYEES}} employees, hold reviews at least quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Senior management signs an annual statement acknowledging ultimate responsibility for security and privacy.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allocate at least one measurable security improvement task per sprint or work cycle, prioritized to protect {{DATA}} in {{CRITICAL}} and stored in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record management reviews, decisions, and assigned actions with due dates in Comp AI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure management oversight of Security Rule activities and document sanctions, if applied, per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Conduct annual management reviews that address the outcomes of risk assessments, incidents, and improvement actions required by NEN 7510. Risk registers, relevant metrics, and mitigation decisions must be recorded and tracked to completion.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store all policies in Comp AI; the SPO verifies access and link integrity annually. Note storage and retention locations in {{GEO}} where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain version control with change logs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Merge or retire overlapping policies to keep each document brief.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track effective dates and owners; preserve prior versions for audit sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain policy documents and revisions for 6 years (164.316(b)(2)(i)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all NEN 7519-relevant documents (policies, risk assessments, incident records, and management reviews) are retained for the defined retention period and remain traceable for internal and external audits.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "New personnel read this policy set and electronically acknowledge before receiving system access to {{CRITICAL}} from {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Distribute security awareness training annually, tailored to {{INDUSTRY}} risks and the handling of {{DATA}}; record completion for the {{LOCATION}} workforce.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track completion status and follow up on overdue training within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access (164.308(a)(5)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Deliver role-based awareness and training covering information security in healthcare, including protection of patient data, secure system use, and staff responsibilities under NEN 7510. Reassess training needs annually and after significant changes in technology or regulation.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual check that policies exist, the SPO and backup are documented, annual sign-off is filed, and the awareness log is current for the {{EMPLOYEES}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain compliance with the ", "type": "text"}, {"text": "General Data Protection Regulation (GDPR/AVG)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", the ", "type": "text"}, {"text": "Dutch Medical Treatment Contracts Act (WGBO)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", and the ", "type": "text"}, {"text": "NEN 7510 suite", "type": "text", "marks": [{"type": "bold"}]}, {"text": ", including ", "type": "text"}, {"text": "NEN7512", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (secure data transmission) and ", "type": "text"}, {"text": "NEN 7513", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (logging and audit trail requirements).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document deviations in a “Security-Decisions” log with reason and expiry, including any residual risk to {{DATA}} and compensating controls in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing logs or overdue actions are corrected within two weeks or escalated at the next management review.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Audit and incident lessons feed into the next scheduled policy refresh. Update roles and training focus when {{GEO}} or {{INDUSTRY}} obligations change.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:51:38.574",
-    "updatedAt": "2025-10-05 01:48:08.435"
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define responsible use of company systems and secure configuration of endpoints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All users and devices accessing company networks or data.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Cover the handling of personal information on workstations and removable media; require staff to follow {{COMPANY}}'s privacy policies when accessing or processing personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Acceptable Use Rules", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use company assets for authorized business activities; limited personal use allowed if it doesn’t create risk.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit illegal, harassing, or copyright-infringing activities.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Prohibit collection, use, or disclosure of personal information for purposes not documented in the Personal Information Register; report any incident involving personal information to the Privacy Officer.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Workstation Configuration & Updates", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enable full-disk encryption, host firewall, and automatic OS patches.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Auto-lock after 10 minutes idle and require password/PIN to resume.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt all workstations that may hold personal information; auto-lock after a brief period of inactivity.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Internet, Email & Messaging", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users must not forward company data to personal email.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use approved messaging tools for business discussions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt outbound communications containing personal information; verify the recipient before sending sensitive personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Removable Media & Printing", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect printed sensitive docs immediately; shred when done.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Restrict storage of personal information on removable media; require encryption and secure destruction. Retrieve printed personal information promptly to avoid unauthorized disclosure.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Personal Devices & Local Storage", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "BYOD must meet endpoint-security requirements (PIN, encryption, patching) and register with IT.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store company data only in approved, encrypted containers or apps.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Prohibit local storage of personal information on personal devices unless approved and managed under the BYOD policy; require remote-wipe capability.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly workstation audit checks encryption, lock settings, and patch status.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary deviation (e.g., lab testing) requires documented approval and time limit.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Policy breaches result in access suspension until remediation; severe cases escalate to HR.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text", "marks": [{"type": "bold"}]}, {"text": "​", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update rules with new collaboration tools and emerging endpoint threats.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:16:12.366",
+    "updatedAt": "2026-05-01 00:00:07.272"
   },
   {
-    "id": "frk_pt_685e458a49e1eff0af54e3d2",
-    "name": "Security & Privacy Awareness Training",
-    "description": "Delivers onboarding and annual refresher training, role-based modules, simulated phishing, and tracks completion metrics.",
+    "id": "frk_pt_685e45c938ad29ad775a2344",
+    "name": "Background Screening & On/Off-boarding",
+    "description": "Screens new hires, provisions least-privilege access, disables accounts and recovers assets at exit, and archives records securely.",
     "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Equip personnel at {{COMPANY}} to recognize and respond to security and privacy risks, with emphasis on protecting {{DATA}} accessed via {{CRITICAL}} and handled on {{DEVICES}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and third-party staff with system access. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain training governance and artifacts to support auditor sampling for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security training for New Hires and at least once every 12 months.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Curriculum", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Core topics: data classification, phishing, password/MFA, incident reporting, privacy basics related to {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include scenarios relevant to {{INDUSTRY}} and usage of {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include content aligned to in-scope Trust Services Criteria.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Cover minimum necessary, ePHI handling, and reporting obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Training includes awareness of ", "type": "text"}, {"text": "threats and vulnerabilities that may impact the security of cardholder data (CHD) and sensitive authentication data (SAD)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ". This includes, but is not limited to: phishing, spear-phishing, business email compromise, social engineering (phone, chat, in-person pretexting), malware delivery vectors, and insider threats.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete baseline training within the first week of access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sign electronic acknowledgement; system access to {{CRITICAL}} or {{DATA}} is suspended until completed.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record completion date and acknowledgement in HR/LMS.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure workforce with ePHI access completes Security Rule training before ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "The awareness training program will be ", "type": "text"}, {"text": "reviewed at least annually", "type": "text", "marks": [{"type": "bold"}]}, {"text": " and updated as needed to address emerging threats, vulnerabilities, or changes in PCI DSS or {{INDUSTRY}} regulations. Updates will be logged, version-controlled, and communicated to employees using multiple channels (e.g., LMS, email, intranet).", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing & Role-Based Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide refresher micro-modules or lunch-and-learns at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deliver specialised modules for engineers (secure coding), support (PII/{{DATA}} handling), and other roles as needed in {{LOCATION}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track overdue items and follow up within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide periodic updates relevant to systems processing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Security reminders and education will be delivered via multiple communication methods such as classroom sessions, online training, email bulletins, posters, intranet content, and phishing simulation platforms. All personnel must ", "type": "text"}, {"text": "acknowledge at least once every 12 months", "type": "text", "marks": [{"type": "bold"}]}, {"text": " that they have read and understood {{COMPANY}}’s Information Security Policy and associated procedures. Electronic signatures or LMS acknowledgments are acceptable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Phishing & Social-Engineering Exercises", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct simulated phishing tests quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users who fall for a phish complete remedial training within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Report aggregate outcomes to management and incorporate lessons into content.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Emphasise verification of identity and secure communication when ePHI may be involved.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Records & Metrics", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track completion in an HR or LMS system; retain logs three years and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report completion rate and phishing-failure rate to management quarterly.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve sampling evidence (rosters, timestamps, content versions).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related training records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "≥ 95% training completion before due date; phishing failure rate trending downward. For teams over {{EMPLOYEES}} employees, expand sampling and target coaching for repeat failures.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Short-term deferral allowed for leave of absence; complete training within two weeks of return.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access restrictions or HR action for repeated failures or missed deadlines.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revise curriculum based on incident trends, employee feedback, threat landscape changes, {{INDUSTRY}} developments, and {{GEO}} obligations.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:17:30.077",
-    "updatedAt": "2025-09-10 19:43:20.239"
+    "department": "hr",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify workforce integrity for {{COMPANY}}, grant the right access to {{CRITICAL}} and {{DATA}} at start, and promptly revoke it at end of engagement.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and temporary staff. Applies to the {{LOCATION}} workforce, including remote personnel using {{DEVICES}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain records of screenings, provisioning, and deprovisioning to support auditor sampling during the Type 2 period.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, implement Workforce Security, Workforce Clearance, and Termination Procedures, and retain Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply screening, onboarding, and off-boarding controls to staff who will have access to personal information; align role authorization to the purposes documented in the Personal Information Register.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Pre-Employment Background Screening", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct identity verification and right-to-work checks for all hires.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Perform criminal or reference checks proportional to role sensitivity, prioritizing roles with access to {{CRITICAL}} or {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete screening before system access is granted; document outcomes.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record screening scope and completion date in the personnel file.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply workforce clearance procedures for roles with ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply screening commensurate with the sensitivity of the personal information the role will access; document the basis for screening decisions.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Provisioning", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manager submits an access request ticket listing required systems and role.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create individual accounts only; no shared credentials.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide security training and policy acknowledgement within the first week, before granting access to {{CRITICAL}} or {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only managed {{DEVICES}} may be used to access {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Grant access based on least privilege and role; record approvals in the ticketing system.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require Security Rule awareness for any role that accesses ePHI prior to granting such access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require completion of privacy training (covering the 10 Fair Information Principles) before granting access to personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Exit Procedures", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR or manager notifies IT of termination date at least 24 hours in advance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable accounts and remove access to {{CRITICAL}} by close of last working day; revoke remote access on {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect badges and credentials; schedule exit interview to remind departing staff of confidentiality obligations related to {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Capture disablement timestamps and confirm removal from all groups and SSO apps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply termination procedures for ePHI access, including revoking authentication credentials and remote access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Revoke access to personal information immediately on termination; recover any personal information held on personal or assigned devices.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Access Reconciliation & Asset Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Recover all company-owned {{DEVICES}}; verify data wipe before reuse.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Compare recovered asset list against inventory; investigate discrepancies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove access from identity provider groups and cloud services within 24 hours.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Reconcile identity provider groups and tokens; document completion in the off-boarding checklist.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure devices that held ePHI are wiped or sanitized per policy before reassignment.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Confirm sanitization of devices that may hold personal information before reassignment; document the chain of custody.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Record Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store screening results and off-boarding checklists in a secure HR system for seven years or legal minimum; where residency applies, store records in {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain provisioning and deprovisioning evidence for at least the audit period plus the organization’s standard buffer.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related workforce documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain provisioning and deprovisioning records for personnel with personal information access for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly audit confirms 100% of terminated accounts are disabled and all assets are returned. For teams over {{EMPLOYEES}} employees, expand the sample size and include checks of {{CRITICAL}} access removal.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any skipped screening step requires executive approval and a documented risk note in the personnel file, including any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing background checks or lagging account disablement is escalated to HR and Security for remediation within five business days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review screening vendors, checklist effectiveness, and timing metrics annually, considering {{INDUSTRY}} requirements and any changes to {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:18:33.152",
+    "updatedAt": "2026-04-30 23:21:55.975"
   },
   {
-    "id": "frk_pt_685e4508d8c0d14ae873e644",
-    "name": "Physical Security & Environmental",
-    "description": "Controls facility and server-room access, manages visitors, safeguards against fire, flood, or climate risks, and audits logs and walk-throughs.",
+    "id": "frk_pt_685e45f736049f188c3439b4",
+    "name": "Sanctions & Disciplinary",
+    "description": "Applies a progressive, documented disciplinary framework for security or privacy violations, ensuring fair process and consistent sanctions.",
     "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect {{COMPANY}} personnel, equipment, and information from unauthorized physical access or environmental damage.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{LOCATION}} and any site hosting {{COMPANY}} assets.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Align to SOC 2 Trust Services Criteria in scope for the audit (Security at minimum; add Availability/Confidentiality if applicable). Treat building/data-centre operators as relevant subservice organizations. ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Applies where ePHI is created, received, maintained, or transmitted (including subcontractors of Business Associates). ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Facility Access Control", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All controlled doors use badges or keys; disable badges immediately at termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Segregate secure areas (for example, server/network closets) with locked doors; limit keys to authorized staff only.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep doors closed; prevent tailgating and prohibit propping doors open.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review of badge/key lists to reconfirm access need.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain access-control records and document quarterly access reviews during the Type 2 period.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain facility access procedures for areas where ePHI may be present.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Visitor Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require sign-in, government-issued ID check, and a visible visitor badge.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Host escorts visitor at all times.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain visitor logs for at least 12 months.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Spot-check visitor logs against host approvals as part of periodic reviews.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict visitor access to any area where ePHI may be visible or discussed.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Environmental Protections", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain HVAC within manufacturer-recommended temperature and humidity; continuous monitoring for server areas.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide smoke detection and automatic fire suppression for server rooms, or use fire-rated cabinets where suppression is unavailable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide UPS for critical equipment and test at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Elevate equipment or install leak sensors in flood-prone areas.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain maintenance and test records (for example HVAC/UPS) to support Availability when in scope.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link facility and environmental events with contingency and emergency-mode operations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Equipment Protection & Disposal", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lock server racks; use cable locks for laptops in shared/co-working spaces.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain asset inventory with physical location and owner.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sanitize or destroy storage media prior to disposal or reuse using NIST SP 800-88 methods; record disposal event and, where applicable, obtain a certificate of destruction.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Satisfies Device and Media Controls: disposal, media reuse, accountability.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Physical Security Monitoring & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review access-control and (where deployed) CCTV logs monthly for anomalies; investigate and record outcomes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct an annual walk-through to verify door states, signage, camera coverage, alarms, leak sensors, and rack locks.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record incidents such as tailgating or propped-open doors and track corrective actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain review artifacts for at least the full Type 2 period plus 12 months.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain Security Rule documentation for 6 years.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access controls in use at 100% of controlled doors; monthly log reviews completed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of visitors signed in, badged, and escorted; logs retained 12 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual environmental tests (for example UPS) and annual physical walk-through completed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of media disposal or reuse events recorded with NIST SP 800-88 method.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary use of an unsecured space requires manager approval, an end date, and compensating controls (for example lockable cabinet).", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tailgating, propped-open doors, missing visitor badges, or unlogged visitors are recorded as incidents; corrective action within one week.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enhance controls based on incident trends, audit findings, and facility changes; review this policy at least annually.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:15:20.007",
-    "updatedAt": "2025-08-19 18:23:15.448"
+    "department": "hr",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Outline fair, consistent consequences for security or privacy violations at {{COMPANY}} while safeguarding access to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All workforce members, regardless of role or contract type. Applies to the {{LOCATION}} workforce, including personnel using {{DEVICES}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain a documented sanctions process, apply it consistently, and retain records for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain and enforce a sanctions policy for workforce members who fail to comply with security or privacy policies; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply consistent sanctions to staff who breach {{COMPANY}}'s privacy policies or PIPEDA obligations; retain sanction records for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Disciplinary Framework", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply progressive discipline: coaching → written warning → suspension → termination, unless severity dictates immediate action.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Align severity with impact. Data breach, harassment, or unlawful acts may bypass lower steps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Consider intent, prior history, and potential risk to customers or the organisation.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Demonstrate consistent application across similar cases; link outcomes to policy and code of conduct.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Reference the HIPAA sanctions policy for violations involving ePHI or Privacy Rule requirements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Reference {{COMPANY}}'s privacy policies and the 10 Fair Information Principles as the basis for sanctions related to personal information mishandling.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Investigation & Due Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR and Security jointly investigate alleged violations; gather logs, interviews, and evidence (including access/log records from {{CRITICAL}} and managed {{DEVICES}}).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve evidence integrity and confidentiality; limit access to need-to-know.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Offer the accused an opportunity to provide explanation before decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record investigation steps, decision rationale, and approvals for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy and Security Officers when ePHI or HIPAA rights may be affected; avoid retaliation against good-faith reporters.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Engage the Privacy Officer when an investigation may involve personal information; avoid retaliation against good-faith reporters of privacy concerns.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Sanction Levels", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Minor: verbal coaching and retraining.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Moderate: written warning plus remedial actions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Major: suspension, revocation of access to {{CRITICAL}}, removal of privileges to handle {{DATA}}, potential termination and legal referral.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Map remedial actions to control improvements or additional training.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply role-appropriate retraining where HIPAA requirements were breached.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Calibrate sanctions to the sensitivity of the personal information involved and the impact on individuals.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Documentation & Appeals", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "File investigation report and final action in the personnel record; restrict access and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide an appeal channel to senior leadership within five business days of sanction notice.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain final decision, appeal outcome, and corrective actions with dates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain sanction documentation and related HIPAA records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain final decision, appeal outcome, and corrective actions for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "HR Integration & Awareness", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "HR maintains a sanctions log for trend analysis.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate a concise sanctions policy summary in annual awareness training, with examples relevant to {{INDUSTRY}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review trends quarterly and feed lessons into training and process updates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Highlight examples tied to ePHI mishandling and required safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Include examples tied to personal information mishandling in awareness materials; refresh after every substantiated privacy complaint.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review of the sanctions log confirms consistency and closure of corrective actions. For teams over {{EMPLOYEES}} employees, expand sampling and include checks that access to {{CRITICAL}}/{{DATA}} was revoked when required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Executive leadership may vary sanctions only with documented rationale, including residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to follow this process prompts an HR-led review and policy refresher; corrective actions are assigned and tracked to closure.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Adjust the framework based on case analytics, audit findings, and legal or regulatory changes, including {{INDUSTRY}} developments and obligations affecting {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:19:19.425",
+    "updatedAt": "2026-04-30 23:21:56.836"
   },
   {
-    "id": "frk_pt_685e4177d5da489e7c5e1b1b",
-    "name": "Encryption & Crypto Controls",
-    "description": "Mandates strong encryption for data in transit and at rest, governs key generation, storage, rotation, and audits for weak configurations.",
+    "id": "frk_pt_685e40d46e7b1123022bf3e8",
+    "name": "Data Classification & Handling",
+    "description": "Uses a four-tier classification scheme to label data and prescribes access, encryption, sharing, and disposal rules for each level.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect the confidentiality and integrity of {{DATA}} at {{COMPANY}} with strong, well-managed cryptography across services in {{CRITICAL}} and jurisdictions in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All systems, applications, databases, backups, and communications handling sensitive or confidential {{DATA}}. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access keys or configure crypto on production systems in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain encryption configuration baselines, certificate inventories, key inventories, rotation records, and access logs for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For ePHI, apply Security Rule safeguards for transmission security, integrity, access control, and device/media handling. Retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Encryption in Transit", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enforce TLS 1.2+ for web, APIs, email relay, and admin channels to and from {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable weak ciphers and protocols; enable HSTS where supported.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer mutual TLS (mTLS) or equivalent for service-to-service traffic handling Restricted {{DATA}}; avoid split tunnelling when accessing sensitive {{DATA}} across {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document cipher suites and minimum protocol versions; monitor for downgrade or plaintext paths.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI in transit; avoid split tunnelling while accessing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Encryption at Rest", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enable provider-level encryption for cloud storage, volumes, and managed databases in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require full-disk encryption on {{DEVICES}} (including removable drives).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure encrypted backups and snapshots inherit key policies; record storage residency in {{GEO}} where applicable.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect encryption keys and configuration from unauthorised change; log key usage.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI at rest where feasible and document the decision and safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Key Generation & Storage", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Generate keys using approved crypto libraries or cloud KMS in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store keys in a managed vault or KMS; never hard-code keys in source control.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Limit vault access to least-privilege service roles; enable detailed auditing and store logs per {{GEO}} requirements.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep key lifecycle records (creation, distribution, use, rotation, retirement) and alert on unusual access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Restrict and audit access to keys protecting ePHI repositories.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Key Rotation & Retirement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rotate platform and database master keys at least annually or upon suspected compromise.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revoke and destroy retired keys; document rotation events, impacted assets, and validation that old keys cannot decrypt new data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update dependent secrets and configurations as part of the rotation change.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record approvals and evidence of rotation; preserve artefacts for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure timely rotation for keys protecting ePHI and update risk analysis if a compromise is suspected.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly scan verifies 100% TLS coverage and encryption-at-rest flags; vault audit shows no orphaned keys. For teams over {{EMPLOYEES}} employees, expand sampling to include random checks of services in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any legacy system lacking encryption must be isolated and tracked with a mitigation plan, noting any {{GEO}} residency constraints and residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Plaintext storage or transmission of sensitive {{DATA}} triggers immediate incident response and remediation.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review algorithms and configurations annually; upgrade when industry guidance deprecates current standards, and reflect {{INDUSTRY}} or {{GEO}} changes where relevant.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:00:06.600",
-    "updatedAt": "2025-08-19 18:27:59.049"
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect information proportionately by assigning sensitivity levels and prescribing handling requirements for {{COMPANY}}. Emphasis on {{DATA}} processed in {{CRITICAL}} and stored or retained in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All data created, received, processed, or stored by the organisation, regardless of medium or location. Applies to the {{LOCATION}} workforce and any {{DEVICES}} that access {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain a documented scheme; ensure labelling, storage, access, transmission, and disposal practices align to Security and Confidentiality criteria; retain artefacts for the Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Where ePHI is involved, apply the Minimum Necessary standard and Security Rule safeguards for access control, audit controls, integrity, transmission security, and device/media handling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply data classification to personal information categories in the Personal Information Register; ensure handling rules meet the safeguards required by Principle 7 of PIPEDA Schedule 1.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Classification Scheme", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Adopt four levels: Public, Internal, Confidential, Restricted.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define examples and default level (Internal) in a quick-reference guide, reflecting {{INDUSTRY}} data types and {{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure classification drives access control, encryption, monitoring, and retention requirements across {{CRITICAL}} and backups in {{GEO}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Treat ePHI as Restricted unless formally de-identified per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Treat personal information as Confidential at minimum; classify sensitive personal information (health, financial, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, sex life or sexual orientation) as Restricted.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Labelling & Identification", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Label documents and data stores at creation using headers, metadata tags, or clear folder names.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use automated tagging where supported; otherwise manual labels are required for Confidential and Restricted data.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep labels consistent across repositories and automate propagation where feasible in {{CRITICAL}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Mark repositories containing ePHI; prevent removal of labels during export.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Mark repositories holding sensitive personal information; preserve labels through export and replication across {{CRITICAL}}.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Access & Storage Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Grant access on a least-privilege basis aligned to classification level.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt Confidential and Restricted data at rest in {{CRITICAL}} and in backups stored in {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log administrative access to Restricted data.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review access rights on a defined cadence and protect encryption keys.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit logging for ePHI access; restrict admin access and review regularly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Limit access to personal information to staff who need it for the purposes documented in the Personal Information Register; record any cross-border storage in the register.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Transmission & Sharing Rules", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use encrypted channels (for example TLS, SFTP) for Confidential or Restricted data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit public-cloud file links without access control when data is above Internal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "External sharing of Restricted data requires management approval and an NDA or contract.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Disable insecure protocols and enforce MFA for privileged transfers.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI in transit and use Business Associate Agreements where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt personal information in transit; document each disclosure to a third party in the Personal Information Register and confirm contractual coverage.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Retention & Disposal Alignment", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply retention periods from the Data Retention Policy to each classification, considering {{GEO}} obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Destroy media holding Confidential or Restricted data using secure wipe or certified shredding.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure destruction is logged and, where used, certificates of destruction are filed.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Follow Device and Media Controls for ePHI and maintain documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Align retention to the documented purpose; destroy or anonymize personal information once the purpose is fulfilled, retaining disposal evidence for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sample confirms correct labels, encryption, and access rights; ≥ 95% accuracy target. Scale the sample size proportionally for teams over {{EMPLOYEES}} employees.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Must document risk and compensating controls; senior management approval required. Note any residual risk to {{DATA}} and how it is mitigated in {{CRITICAL}} or through {{DEVICES}} controls.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Mislabelled or mishandled data triggers incident response and mandatory refresher training.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update examples and tooling as new {{INDUSTRY}} data types or regulations emerge, including changes affecting {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 06:57:24.052",
+    "updatedAt": "2026-05-01 00:01:07.724"
   },
   {
-    "id": "frk_pt_685e414029124c24387beff0",
-    "name": "Retention & Secure Disposal",
-    "description": "Sets record-specific retention periods, runs periodic purge reviews, and requires cryptographic or physical destruction of outdated data.",
+    "id": "frk_pt_685e458a49e1eff0af54e3d2",
+    "name": "Security & Privacy Awareness Training",
+    "description": "Delivers onboarding and annual refresher training, role-based modules, simulated phishing, and tracks completion metrics.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep {{DATA}} only as long as needed and dispose of it so it cannot be recovered by unauthorized parties at {{COMPANY}}, including data stored in {{CRITICAL}} and subject to {{GEO}} residency.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All electronic and physical records, backups, and media created or held by the organization. Applies to the {{LOCATION}} workforce, systems in {{CRITICAL}}, and managed {{DEVICES}} that store or cache {{DATA}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain the retention schedule, review records, and disposal logs for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For ePHI, apply the HIPAA Security Rule Device and Media Controls and retain required documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Retention Schedule", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a table listing record types, retention period, owner, and primary storage (e.g., repository in {{CRITICAL}}) with {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the schedule at least annually and when new {{INDUSTRY}} data types arise.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure each record type references its storage location and protection requirements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Map ePHI record types to required retention periods and safeguard expectations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Periodic Data Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Owners run an automated or manual review at least quarterly to identify data beyond its retention period in {{CRITICAL}}, collaboration repositories, and on managed {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Records flagged for deletion are queued for disposal within 30 days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Log review dates and outcomes; track queued deletions to completion.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Verify reviews include systems and media that may contain ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Secure Disposal Methods", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Electronic data: use secure-wipe utilities or crypto-erasure by destroying keys; confirm for cloud stores in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical media: use cross-cut shredding or a certified destruction vendor.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document each disposal event with date, data category, method, and location; store records in {{GEO}} where required.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store certificates or logs of destruction where used and restrict access to disposal records.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply Device and Media Controls for ePHI, including sanitisation and accountability.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Backup & Archive Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply the same retention timelines to backups and archives.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt backups; verify they age out on schedule or are re-encrypted when keys rotate; note backup residency in {{GEO}} and storage in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Periodically test backup expiry and restoration; protect keys and access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure backup processes for ePHI maintain required safeguards during storage and restoration.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly check shows ≤ 5% of records past retention and disposal logs are complete. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks across {{CRITICAL}} and managed {{DEVICES}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Legal hold or contract may override the schedule; document the reason and review date, including any impact on {{DATA}} residency in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Over-retained or improperly disposed records are escalated to senior management and remediated within 30 days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update the schedule and tooling after audits, incidents, or regulatory change, reflecting {{INDUSTRY}} requirements and any updates to {{GEO}} obligations.", "type": "text"}]}],
-    "createdAt": "2025-06-27 06:59:11.886",
-    "updatedAt": "2025-08-19 18:28:10.629"
+    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Equip personnel at {{COMPANY}} to recognize and respond to security and privacy risks, with emphasis on protecting {{DATA}} accessed via {{CRITICAL}} and handled on {{DEVICES}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees, contractors, interns, and third-party staff with system access. Applies to the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain training governance and artifacts to support auditor sampling for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security Rule awareness and periodic updates for workforce with ePHI access; retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide Security training for New Hires and at least once every 12 months.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Curriculum", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Core topics: data classification, phishing, password/MFA, incident reporting, privacy basics related to {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include scenarios relevant to {{INDUSTRY}} and usage of {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include content aligned to in-scope Trust Services Criteria.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Cover minimum necessary, ePHI handling, and reporting obligations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Training includes awareness of ", "type": "text"}, {"text": "threats and vulnerabilities that may impact the security of cardholder data (CHD) and sensitive authentication data (SAD)", "type": "text", "marks": [{"type": "bold"}]}, {"text": ". This includes, but is not limited to: phishing, spear-phishing, business email compromise, social engineering (phone, chat, in-person pretexting), malware delivery vectors, and insider threats.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Onboarding Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Complete baseline training within the first week of access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sign electronic acknowledgement; system access to {{CRITICAL}} or {{DATA}} is suspended until completed.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record completion date and acknowledgement in HR/LMS.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure workforce with ePHI access completes Security Rule training before ePHI access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "The awareness training program will be ", "type": "text"}, {"text": "reviewed at least annually", "type": "text", "marks": [{"type": "bold"}]}, {"text": " and updated as needed to address emerging threats, vulnerabilities, or changes in PCI DSS or {{INDUSTRY}} regulations. Updates will be logged, version-controlled, and communicated to employees using multiple channels (e.g., LMS, email, intranet).", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing & Role-Based Training", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide refresher micro-modules or lunch-and-learns at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deliver specialised modules for engineers (secure coding), support (PII/{{DATA}} handling), and other roles as needed in {{LOCATION}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track overdue items and follow up within defined timelines.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Provide periodic updates relevant to systems processing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pci}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Security reminders and education will be delivered via multiple communication methods such as classroom sessions, online training, email bulletins, posters, intranet content, and phishing simulation platforms. All personnel must ", "type": "text"}, {"text": "acknowledge at least once every 12 months", "type": "text", "marks": [{"type": "bold"}]}, {"text": " that they have read and understood {{COMPANY}}’s Information Security Policy and associated procedures. Electronic signatures or LMS acknowledgments are acceptable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Phishing & Social-Engineering Exercises", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct simulated phishing tests quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Users who fall for a phish complete remedial training within five business days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Report aggregate outcomes to management and incorporate lessons into content.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Emphasise verification of identity and secure communication when ePHI may be involved.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Training Records & Metrics", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track completion in an HR or LMS system; retain logs three years and store in {{GEO}} where residency applies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report completion rate and phishing-failure rate to management quarterly.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve sampling evidence (rosters, timestamps, content versions).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain HIPAA-related training records for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "≥ 95% training completion before due date; phishing failure rate trending downward. For teams over {{EMPLOYEES}} employees, expand sampling and target coaching for repeat failures.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Short-term deferral allowed for leave of absence; complete training within two weeks of return.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access restrictions or HR action for repeated failures or missed deadlines.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revise curriculum based on incident trends, employee feedback, threat landscape changes, {{INDUSTRY}} developments, and {{GEO}} obligations.", "type": "text"}]}],
+    "createdAt": "2025-06-27 07:17:30.077",
+    "updatedAt": "2025-09-10 19:43:20.239"
   },
   {
-    "id": "frk_pt_685e42188e2df1c285cca159",
-    "name": "Access Control & Least Privilege",
-    "description": "Implements a Joiner-Mover-Leaver workflow, role-based access control, quarterly reviews, and strict approval for elevated privileges.",
+    "id": "frk_pt_685e42445c99797321ef051a",
+    "name": "Authentication & Password",
+    "description": "Defines robust password rules, enforces MFA on sensitive systems, secures credential storage, and locks or resets risky accounts.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure users at {{COMPANY}} receive only the minimum access necessary and that access adjusts promptly with role changes, protecting {{DATA}} on workloads in {{CRITICAL}} and across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All workforce accounts, service accounts, and system roles across SaaS, IaaS, and on-prem resources used by the {{LOCATION}} workforce. Only managed {{DEVICES}} may access production resources in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align to logical access controls (authentication, authorization, provisioning/deprovisioning) and retain artifacts for the Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply workforce security and information access management with unique IDs and authentication for systems handling ePHI (164.308(a)(3)-(4), 164.312(a), 164.312(d)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Joiner-Mover-Leaver (JML) Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provision access via ticket with manager approval and defined role.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Modify privileges within 48 hours of role change.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable or delete accounts by end of final workday; collect tokens/keys/badges and revoke access on {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tie SSO/IdP accounts to HR status; block sign-in on termination and immediately remove access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record approvals, timestamps, and completion in the ticket/IdP; no ad-hoc provisioning.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Remove ePHI access immediately on termination; document termination procedures.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Role-Based Access Control (RBAC)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define standard roles per system (e.g., Admin, Power User, Read-Only).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign users to roles or groups; avoid direct entitlements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain role definitions with least-privilege permissions and named owners.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service accounts have an owner, documented purpose, restricted scopes, and no interactive login.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review role definitions at least annually; protect high-risk permissions with MFA.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit ePHI access to the minimum necessary; segregate admin from clinical/support roles where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Privilege Elevation & Approval", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary admin rights require documented business justification and auto-expire ≤ 24 hours.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permanent admin assignments require senior-management approval.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use just-in-time elevation where available; log all elevated actions on systems in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain elevation requests/approvals and session logs for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure elevated sessions on ePHI systems use strong authentication and are auditable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Periodic Access Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "System owners review user lists at least quarterly; remove stale or excessive rights.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reconcile IdP groups, SaaS roles, and resource policies affecting {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document review date, reviewers, findings, and actions; store evidence in {{GEO}} where residency applies.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track findings to closure; verify orphaned accounts and excess privileges are remediated.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include verification of ePHI repository access and logging of adjustments.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review shows ≤ 2% orphaned accounts; all admin rights have an approval record. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks of privileged access to {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Emergency access allowed for a maximum of 8 hours; log reason, scope, and approver, and close in the next review. Note any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unapproved elevated access or dormant accounts > 30 days are escalated to management and remediated within one week.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate review findings to refine role definitions and automate provisioning/deprovisioning, considering {{INDUSTRY}} needs and obligations in {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:02:47.730",
-    "updatedAt": "2025-08-19 18:28:25.062"
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide strong, user-friendly authentication at {{COMPANY}} that resists brute-force and credential-stuffing attacks, protecting access to {{CRITICAL}} and {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All human and service accounts accessing organizational applications, {{DEVICES}}, and infrastructure. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may administer identity systems or production auth settings in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain authentication configurations and audit evidence for the full Type 2 period plus 12 months; treat relevant IdP and SaaS providers as subservice organizations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For systems handling ePHI, apply technical safeguards for access control, authentication, and transmission security and retain documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require unique identification and authentication for any user accessing personal information; retain authentication evidence for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Password Requirements", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Minimum 8 characters or a passphrase; prohibit commonly breached strings.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No forced periodic rotation unless compromise is suspected.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unique password per system; store passwords in an approved password manager.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Do not reuse passwords across work and personal accounts.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce length and reuse rules in IdP/directory policies and document settings.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require unique user identification and person or entity authentication for ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply password requirements that meet or exceed industry baselines for systems holding personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Multi-Factor Authentication (MFA)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enforce MFA for admin accounts, remote access, and any system holding Confidential or Restricted {{DATA}} or running in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer authenticator apps or hardware tokens; SMS only as a fallback.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply step-up MFA for sensitive actions (e.g., policy changes, key access) where supported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track MFA coverage for in-scope systems; remediate gaps promptly and retain evidence.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Use MFA for remote access to ePHI and for privileged accounts on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require MFA for remote access to systems holding personal information and for all privileged accounts.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Credential Storage & Transmission", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Hash user passwords with bcrypt or Argon2 using per-user salt (minimum cost factor 10 for bcrypt).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Transmit login data only over TLS; block plaintext logins to {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Never embed secrets in code repositories; store application secrets in an approved vault or KMS in {{CRITICAL}} with audit logs retained per {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Version-control authentication settings and monitor for plaintext secrets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect authentication credentials for ePHI systems and encrypt any credential exchange.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Protect credentials that grant access to personal information; treat credential compromise on such systems as a privacy incident.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Account Lockout & Recovery", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lock accounts after 5 failed attempts within 15 minutes; auto-unlock after 30 minutes or by admin reset.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify user identity before password reset; issue time-limited reset links.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable inactive accounts per the Access Control policy; remove stale sessions for {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Log lockouts, resets, and administrator actions; review anomalies monthly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure authentication and reset processes preserve the confidentiality of ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Verify identity before resetting credentials on accounts with access to personal information; document the verification.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Service Accounts & Keys", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit interactive login; use least-privilege scopes and short-lived credentials.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rotate credentials at least annually and on suspected compromise; store only in vault/KMS.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log all programmatic auth to {{CRITICAL}} and review for anomalies.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain inventory, owners, and rotation evidence for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Restrict and audit service credentials that can reach ePHI repositories.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Inventory service accounts that can reach personal information repositories; rotate credentials on a documented cadence.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Automated scans ensure MFA is enabled on 100% of target systems; random password audit shows compliance with length policy. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems lacking MFA require documented risk acceptance and compensating controls (e.g., IP allowlist) with an expiry date; note any residual risk to {{DATA}} and {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Weak or reused passwords, plaintext secrets, or disabled MFA trigger immediate reset or access suspension and user retraining.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review emerging passwordless options and adopt stronger methods when widely supported, aligning with {{INDUSTRY}} practices and any obligations affecting {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:03:31.937",
+    "updatedAt": "2026-04-30 23:21:53.162"
   },
   {
     "id": "frk_pt_683d2cbc12b93dc5c8fe3a7d",
@@ -230,14 +200,14 @@
     "updatedAt": "2025-08-19 18:28:48.022"
   },
   {
-    "id": "frk_pt_685e42445c99797321ef051a",
-    "name": "Authentication & Password",
-    "description": "Defines robust password rules, enforces MFA on sensitive systems, secures credential storage, and locks or resets risky accounts.",
+    "id": "frk_pt_685e43997555c7ab39983c21",
+    "name": "Logging, Monitoring & Audit",
+    "description": "Centralises and protects logs, sets real-time alerting for critical events, retains audit trails, and reviews metrics and samples monthly.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide strong, user-friendly authentication at {{COMPANY}} that resists brute-force and credential-stuffing attacks, protecting access to {{CRITICAL}} and {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All human and service accounts accessing organizational applications, {{DEVICES}}, and infrastructure. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may administer identity systems or production auth settings in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain authentication configurations and audit evidence for the full Type 2 period plus 12 months; treat relevant IdP and SaaS providers as subservice organizations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For systems handling ePHI, apply technical safeguards for access control, authentication, and transmission security and retain documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Password Requirements", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Minimum 12 characters or a passphrase; prohibit commonly breached strings.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No forced periodic rotation unless compromise is suspected.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unique password per system; store passwords in an approved password manager.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Do not reuse passwords across work and personal accounts.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enforce length and reuse rules in IdP/directory policies and document settings.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Require unique user identification and person or entity authentication for ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Multi-Factor Authentication (MFA)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enforce MFA for admin accounts, remote access, and any system holding Confidential or Restricted {{DATA}} or running in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer authenticator apps or hardware tokens; SMS only as a fallback.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply step-up MFA for sensitive actions (e.g., policy changes, key access) where supported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track MFA coverage for in-scope systems; remediate gaps promptly and retain evidence.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Use MFA for remote access to ePHI and for privileged accounts on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Credential Storage & Transmission", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Hash user passwords with bcrypt or Argon2 using per-user salt (minimum cost factor 10 for bcrypt).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Transmit login data only over TLS; block plaintext logins to {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Never embed secrets in code repositories; store application secrets in an approved vault or KMS in {{CRITICAL}} with audit logs retained per {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Version-control authentication settings and monitor for plaintext secrets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect authentication credentials for ePHI systems and encrypt any credential exchange.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Account Lockout & Recovery", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lock accounts after 5 failed attempts within 15 minutes; auto-unlock after 30 minutes or by admin reset.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify user identity before password reset; issue time-limited reset links.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable inactive accounts per the Access Control policy; remove stale sessions for {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Log lockouts, resets, and administrator actions; review anomalies monthly.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure authentication and reset processes preserve the confidentiality of ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Service Accounts & Keys", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit interactive login; use least-privilege scopes and short-lived credentials.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rotate credentials at least annually and on suspected compromise; store only in vault/KMS.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log all programmatic auth to {{CRITICAL}} and review for anomalies.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain inventory, owners, and rotation evidence for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Restrict and audit service credentials that can reach ePHI repositories.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Automated scans ensure MFA is enabled on 100% of target systems; random password audit shows compliance with length policy. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems lacking MFA require documented risk acceptance and compensating controls (e.g., IP allowlist) with an expiry date; note any residual risk to {{DATA}} and {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Weak or reused passwords, plaintext secrets, or disabled MFA trigger immediate reset or access suspension and user retraining.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review emerging passwordless options and adopt stronger methods when widely supported, aligning with {{INDUSTRY}} practices and any obligations affecting {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:03:31.937",
-    "updatedAt": "2025-08-19 18:29:18.519"
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide trustworthy evidence for security, troubleshooting, and compliance at {{COMPANY}} by collecting and analysing relevant logs from {{CRITICAL}} systems and services that handle {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Application, system, network, authentication, and cloud-provider logs across all environments. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access central logging tools.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Operate centralised logging and alerting for in-scope systems and retain configurations, alerts, reports, and tickets for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit controls for systems handling ePHI, protect log integrity and access, and retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Operate logging and monitoring for systems holding personal information; retain logs for at least 24 months to support access requests and breach investigations.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Collection & Centralisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Forward logs to a central, access-controlled SIEM or log service hosted in {{CRITICAL}}; archive per {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include timestamp, user, event type, and source IP for security-relevant events.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tag events with environment and application identifiers.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all in-scope systems forward logs; keep forwarding and parser configurations under version control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable and retain audit logs on systems accessing ePHI; restrict who can view ePHI-related logs (managed {{DEVICES}} only).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Forward logs from systems holding personal information to a centralized, access-controlled repository; protect logs from tampering.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Retention & Protection", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain security logs at least 90 days online and 1 year in archive; store archives in {{GEO}} when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict write access to the logging system; prohibit log tampering or deletion.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect archived logs with access controls and integrity checks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store archived logs in access-controlled repositories; preserve integrity for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit records for ePHI systems per policy and retain HIPAA Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain access logs for systems holding personal information for at least 24 months; restrict log access to security and the Privacy Officer.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Real-Time Alerting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create alerts for key events: failed admin logins, privilege escalations, critical errors, and anomalous access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Send alerts to the on-call channel and maintain documented runbooks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Define alert SLAs and escalation paths; track acknowledgement and resolution in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on anomalous access patterns involving ePHI and unsuccessful logins on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Alert on anomalous access to personal information (volume spikes, unusual hours, failed authentication patterns) and on attempts to disable logging.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "All personnel report security or privacy incidents immediately to the SPO. Maintain logs of user access to healthcare systems in accordance with NEN 7513. Conduct incident reviews and feed lessons learned into the continual improvement cycle.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Audit & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review alert metrics and random log samples monthly; include sources tied to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Produce a quarterly audit report summarizing anomalies and actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain review notes, reports, and remediation tickets for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document investigations and outcomes for events affecting ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Review high-risk personal information access events at least monthly; investigate confirmed anomalies under the breach response procedure.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Clock Synchronization", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sync all servers and {{DEVICES}} to a trusted NTP source; alert on drift greater than 5 s.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record NTP configuration and drift monitoring in system baselines.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Maintain accurate timestamps on all systems holding personal information to support access-request timelines and breach forensics.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure timestamps are accurate for ePHI audit trails.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Central platform receives ≥ 95% of target logs; alert queue triaged within SLA. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems unable to forward logs must export daily and upload; document in the asset list, noting any {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging gaps greater than 24 h or unreviewed alerts are escalated to incident response.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add new log sources and refine alert logic based on incident learnings, {{INDUSTRY}} risks, and any residency or transfer changes affecting {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:09:12.690",
+    "updatedAt": "2026-04-30 23:21:54.083"
   },
   {
     "id": "frk_pt_691e4baaef306f1e73d8596b",
@@ -249,16 +219,6 @@
     "createdAt": "2025-11-19 22:58:50.475",
     "updatedAt": "2025-11-24 23:02:34.550"
   },
-  {
-    "id": "frk_pt_685e43e23b78127274355980",
-    "name": "Incident Response & Breach Notification",
-    "description": "Defines detection, triage, containment, communication, legal notification, and post-incident lessons with clear team roles.",
-    "frequency": "yearly",
-    "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure security and privacy incidents are identified, contained, reported, and resolved quickly, and that required notifications are issued on time.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All information assets, personnel, third-party services, and physical locations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain documented procedures, incident tickets, evidence, notifications, and post-incident reviews for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Implement Security Incident Procedures (164.308(a)(6)) and the Breach Notification Rule (45 CFR 164.400–414). Retain HIPAA documentation for 6 years; Business Associates notify Covered Entities without unreasonable delay and no later than 60 days of discovery.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Detection & Reporting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security tools forward real-time alerts to an incident channel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anyone discovering suspicious activity must report to security within one hour.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log every alert or report in the incident tracker with date/time.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure alerting integrates with on-call; track acknowledgement and response times in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Flag incidents involving ePHI and begin breach-risk assessment per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Incident Response Team & Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign Incident Commander, Technical Lead, Communications Lead, and Scribe; publish roster with 24 × 7 contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain runbooks for malware, data breach, DDoS, and cloud compromise scenarios.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep current on-call rosters and role handoffs in the ticket.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy/Security Officers for suspected ePHI incidents and coordinate with affected Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Containment & Eradication", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Isolate affected systems within 30 minutes of confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Capture forensics where feasible; patch, clean, or rebuild before re-connect.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document actions and timestamps in the tracker.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve logs and evidence; record containment start/stop and recovery steps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit access to ePHI during containment; document safeguards applied.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Breach Notification & Communications", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify management immediately for incidents involving personal or regulated data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Draft customer/regulator notices within applicable legal timeframes (for example, GDPR 72 hours to authorities; HIPAA notifications without unreasonable delay and no later than 60 days).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Route all external statements through Communications Lead and legal counsel.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Archive notifications, approvals, and distribution lists with the incident record.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Perform breach-risk assessment, determine reportability, and document notifications to individuals, HHS, and (if applicable) media.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Post-Incident Review & Lessons Learned", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a root-cause post-mortem within 10 business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record corrective actions, owners, and due dates; track to closure.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Attach the post-incident review and remediation evidence to the ticket; verify control improvements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Update risk analysis and any affected procedures that impact ePHI safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track mean time to detect (MTTD), mean time to contain (MTTC), and breach-notification deadlines; review quarterly.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process deviations allowed only if required to protect life, safety, or critical systems; document afterward.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unreported or mishandled incidents escalate to executive review and may trigger disciplinary action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update runbooks and tooling after each post-mortem or external audit finding.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:10:25.721",
-    "updatedAt": "2025-08-19 18:29:33.133"
-  },
   {
     "id": "frk_pt_691e4bbbdf8825258102dae6",
     "name": "Document Control Procedure",
@@ -270,14 +230,34 @@
     "updatedAt": "2025-11-24 23:05:42.576"
   },
   {
-    "id": "frk_pt_685e43997555c7ab39983c21",
-    "name": "Logging, Monitoring & Audit",
-    "description": "Centralises and protects logs, sets real-time alerting for critical events, retains audit trails, and reviews metrics and samples monthly.",
+    "id": "frk_pt_685e43e23b78127274355980",
+    "name": "Incident Response & Breach Notification",
+    "description": "Defines detection, triage, containment, communication, legal notification, and post-incident lessons with clear team roles.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide trustworthy evidence for security, troubleshooting, and compliance at {{COMPANY}} by collecting and analysing relevant logs from {{CRITICAL}} systems and services that handle {{DATA}} across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Application, system, network, authentication, and cloud-provider logs across all environments. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access central logging tools.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Operate centralised logging and alerting for in-scope systems and retain configurations, alerts, reports, and tickets for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable audit controls for systems handling ePHI, protect log integrity and access, and retain required HIPAA documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Collection & Centralisation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Forward logs to a central, access-controlled SIEM or log service hosted in {{CRITICAL}}; archive per {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include timestamp, user, event type, and source IP for security-relevant events.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tag events with environment and application identifiers.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure all in-scope systems forward logs; keep forwarding and parser configurations under version control.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Enable and retain audit logs on systems accessing ePHI; restrict who can view ePHI-related logs (managed {{DEVICES}} only).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Log Retention & Protection", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain security logs at least 90 days online and 1 year in archive; store archives in {{GEO}} when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict write access to the logging system; prohibit log tampering or deletion.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect archived logs with access controls and integrity checks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store archived logs in access-controlled repositories; preserve integrity for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain audit records for ePHI systems per policy and retain HIPAA Security Rule documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Real-Time Alerting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Create alerts for key events: failed admin logins, privilege escalations, critical errors, and anomalous access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Send alerts to the on-call channel and maintain documented runbooks.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Define alert SLAs and escalation paths; track acknowledgement and resolution in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Alert on anomalous access patterns involving ePHI and unsuccessful logins on ePHI systems.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if nen7510}}", "type": "text"}, {"type": "hardBreak"}, {"text": "All personnel report security or privacy incidents immediately to the SPO. Maintain logs of user access to healthcare systems in accordance with NEN 7513. Conduct incident reviews and feed lessons learned into the continual improvement cycle.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Audit & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review alert metrics and random log samples monthly; include sources tied to {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Produce a quarterly audit report summarizing anomalies and actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain review notes, reports, and remediation tickets for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document investigations and outcomes for events affecting ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Clock Synchronization", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sync all servers and {{DEVICES}} to a trusted NTP source; alert on drift greater than 5 s.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record NTP configuration and drift monitoring in system baselines.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure timestamps are accurate for ePHI audit trails.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Central platform receives ≥ 95% of target logs; alert queue triaged within SLA. For teams over {{EMPLOYEES}} employees, expand quarterly sampling across {{CRITICAL}} tiers.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Systems unable to forward logs must export daily and upload; document in the asset list, noting any {{GEO}} constraints.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging gaps greater than 24 h or unreviewed alerts are escalated to incident response.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add new log sources and refine alert logic based on incident learnings, {{INDUSTRY}} risks, and any residency or transfer changes affecting {{GEO}}.", "type": "text"}]}],
-    "createdAt": "2025-06-27 07:09:12.690",
-    "updatedAt": "2025-10-05 01:55:26.246"
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure security and privacy incidents are identified, contained, reported, and resolved quickly, and that required notifications are issued on time.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All information assets, personnel, third-party services, and physical locations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain documented procedures, incident tickets, evidence, notifications, and post-incident reviews for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Implement Security Incident Procedures (164.308(a)(6)) and the Breach Notification Rule (45 CFR 164.400–414). Retain HIPAA documentation for 6 years; Business Associates notify Covered Entities without unreasonable delay and no later than 60 days of discovery.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply this policy to any incident involving personal information held by {{COMPANY}}; meet PIPEDA breach-of-security-safeguards obligations including reporting to the OPC and notifying affected individuals where there is a real risk of significant harm (RROSH).{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Detection & Reporting", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security tools forward real-time alerts to an incident channel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anyone discovering suspicious activity must report to security within one hour.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log every alert or report in the incident tracker with date/time.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure alerting integrates with on-call; track acknowledgement and response times in tickets.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Flag incidents involving ePHI and begin breach-risk assessment per policy.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Flag incidents involving personal information and begin a Real Risk of Significant Harm (RROSH) assessment per Section 10.1 of PIPEDA.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Incident Response Team & Roles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign Incident Commander, Technical Lead, Communications Lead, and Scribe; publish roster with 24 × 7 contacts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain runbooks for malware, data breach, DDoS, and cloud compromise scenarios.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep current on-call rosters and role handoffs in the ticket.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Engage Privacy/Security Officers for suspected ePHI incidents and coordinate with affected Business Associates.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Engage the Privacy Officer at the start of any suspected privacy incident; coordinate with affected processors operating in {{CRITICAL}} or across {{GEO}}.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Containment & Eradication", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Isolate affected systems within 30 minutes of confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Capture forensics where feasible; patch, clean, or rebuild before re-connect.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document actions and timestamps in the tracker.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Preserve logs and evidence; record containment start/stop and recovery steps.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit access to ePHI during containment; document safeguards applied.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Limit access to affected personal information during containment and document the safeguards applied.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Breach Notification & Communications", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify management immediately for incidents involving personal or regulated data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Draft customer/regulator notices within applicable legal timeframes (for example, GDPR 72 hours to authorities; HIPAA notifications without unreasonable delay and no later than 60 days).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Route all external statements through Communications Lead and legal counsel.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Archive notifications, approvals, and distribution lists with the incident record.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Perform breach-risk assessment, determine reportability, and document notifications to individuals, HHS, and (if applicable) media.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Where the RROSH threshold is met, notify the affected individuals as soon as feasible and report to the OPC in the prescribed form. Notify any organization or government institution that may be able to reduce the risk of harm. Maintain a breach record for at least 24 months in line with PIPEDA's record-keeping requirement.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Post-Incident Review & Lessons Learned", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a root-cause post-mortem within 10 business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record corrective actions, owners, and due dates; track to closure.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Attach the post-incident review and remediation evidence to the ticket; verify control improvements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Update risk analysis and any affected procedures that impact ePHI safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Update the Personal Information Register, privacy notice, and affected control documentation; report aggregate breach metrics to leadership annually.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track mean time to detect (MTTD), mean time to contain (MTTC), and breach-notification deadlines; review quarterly.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process deviations allowed only if required to protect life, safety, or critical systems; document afterward.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unreported or mishandled incidents escalate to executive review and may trigger disciplinary action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update runbooks and tooling after each post-mortem or external audit finding.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:10:25.721",
+    "updatedAt": "2026-04-30 23:21:58.607"
+  },
+  {
+    "id": "frk_pt_685e4177d5da489e7c5e1b1b",
+    "name": "Encryption & Crypto Controls",
+    "description": "Mandates strong encryption for data in transit and at rest, governs key generation, storage, rotation, and audits for weak configurations.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect the confidentiality and integrity of {{DATA}} at {{COMPANY}} with strong, well-managed cryptography across services in {{CRITICAL}} and jurisdictions in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All systems, applications, databases, backups, and communications handling sensitive or confidential {{DATA}}. Applies to the {{LOCATION}} workforce; only managed {{DEVICES}} may access keys or configure crypto on production systems in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Maintain encryption configuration baselines, certificate inventories, key inventories, rotation records, and access logs for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For ePHI, apply Security Rule safeguards for transmission security, integrity, access control, and device/media handling. Retain related documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply encryption commensurate with the sensitivity of personal information; document encryption decisions and any residual risk.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Encryption in Transit", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enforce TLS 1.2+ for web, APIs, email relay, and admin channels to and from {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable weak ciphers and protocols; enable HSTS where supported.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer mutual TLS (mTLS) or equivalent for service-to-service traffic handling Restricted {{DATA}}; avoid split tunnelling when accessing sensitive {{DATA}} across {{GEO}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Document cipher suites and minimum protocol versions; monitor for downgrade or plaintext paths.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI in transit; avoid split tunnelling while accessing ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt personal information in transit, including transfers to processors and across borders; document the controls protecting cross-border transfers.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Encryption at Rest", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enable provider-level encryption for cloud storage, volumes, and managed databases in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require full-disk encryption on {{DEVICES}} (including removable drives).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure encrypted backups and snapshots inherit key policies; record storage residency in {{GEO}} where applicable.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect encryption keys and configuration from unauthorised change; log key usage.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Encrypt ePHI at rest where feasible and document the decision and safeguards.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt sensitive personal information at rest in {{CRITICAL}}; document compensating controls where encryption is not feasible.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Key Generation & Storage", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Generate keys using approved crypto libraries or cloud KMS in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store keys in a managed vault or KMS; never hard-code keys in source control.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Limit vault access to least-privilege service roles; enable detailed auditing and store logs per {{GEO}} requirements.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Keep key lifecycle records (creation, distribution, use, rotation, retirement) and alert on unusual access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Restrict and audit access to keys protecting ePHI repositories.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Restrict and audit access to keys protecting personal information; revoke key access promptly on role change.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Key Rotation & Retirement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rotate platform and database master keys at least annually or upon suspected compromise.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Revoke and destroy retired keys; document rotation events, impacted assets, and validation that old keys cannot decrypt new data.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update dependent secrets and configurations as part of the rotation change.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record approvals and evidence of rotation; preserve artefacts for auditor sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure timely rotation for keys protecting ePHI and update risk analysis if a compromise is suspected.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Rotate keys protecting personal information on a documented schedule; treat compromise of a key protecting personal information as a privacy incident.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly scan verifies 100% TLS coverage and encryption-at-rest flags; vault audit shows no orphaned keys. For teams over {{EMPLOYEES}} employees, expand sampling to include random checks of services in {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any legacy system lacking encryption must be isolated and tracked with a mitigation plan, noting any {{GEO}} residency constraints and residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Plaintext storage or transmission of sensitive {{DATA}} triggers immediate incident response and remediation.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review algorithms and configurations annually; upgrade when industry guidance deprecates current standards, and reflect {{INDUSTRY}} or {{GEO}} changes where relevant.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:00:06.600",
+    "updatedAt": "2026-04-30 23:24:59.718"
+  },
+  {
+    "id": "frk_pt_68e3f39e77b0a823add09bf5",
+    "name": "Code of Business Conduct",
+    "description": "The Code of Business Conduct outlines the ethical standards and professional behaviors expected of all employees. It serves as a guide to ensure integrity, compliance, and responsibility in all business activities and interactions.",
+    "frequency": "yearly",
+    "department": "hr",
+    "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Set clear expectations for ethical behavior, professionalism, and compliance across all {{COMPANY}} activities.", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect trust with customers, partners, regulators, and one another while upholding {{INDUSTRY}} standards.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Applies to all {{COMPANY}} employees, contractors, and third parties operating on behalf of {{COMPANY}} in {{GEO}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Covers conduct, data protection, decision-making, and use of company systems and resources.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Our Principles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Act with integrity", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Be honest, fair, and transparent in all interactions with customers, partners, regulators, and colleagues.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect trust", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safeguard all customer PII, financial records, property data, credit-bureau information, and compliance documentation.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer first", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure that decisions improve the accuracy, speed, and fairness of lending and service outcomes—not just short-term performance.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Comply with the law", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Follow applicable financial-services, data-protection, anti-bribery, anti-money-laundering, competition, and employment laws.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Speaking up about ethical or compliance concerns is encouraged and protected from retaliation.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Professional Conduct", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respect and inclusion", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Harassment, discrimination, or bullying of any kind is strictly prohibited—promote an inclusive and respectful workplace.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conflicts of interest", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disclose any outside employment, investments, family relationships, or gifts that could influence business decisions.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Fair dealing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Never misrepresent {{COMPANY}} or competitors, or engage in unfair or deceptive business practices.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communications and social media", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only authorized representatives may speak publicly on behalf of {{COMPANY}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Never disclose confidential or customer information in public or social-media channels.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Protection & Security", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access control", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use company-managed accounts with SSO and MFA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply least-privilege access and review access quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Shared or generic accounts are prohibited.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Device security", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Devices must enable disk encryption, auto-lock, strong passcodes, and current OS/patches.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Install company MDM/endpoint protection when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store customer data only in approved, encrypted applications; never on local drives unless explicitly authorized and encrypted.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data handling", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect only the minimum data required for business needs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify and label sensitive data appropriately.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use anonymized or synthetic data for development and testing whenever possible.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incident response", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Immediately report any suspected data loss, breach, or unauthorized access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The Security Lead coordinates containment, notification, and post-incident review per regulatory requirements.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retention and deletion", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain data only as long as legally or contractually required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Securely delete data when no longer needed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respond promptly to data-subject requests (access, correction, deletion).", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Reporting Concerns", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Raise ethical or conduct concerns with your manager or compliance contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anonymous reporting options are available upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation will occur for good-faith reports or participation in investigations.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Violations may result in access restrictions, disciplinary action (including termination), and, where required, reporting to regulatory authorities.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This Code is reviewed at least annually; all updates will be communicated in writing.", "type": "text"}]}]}]}],
+    "createdAt": "2025-10-06 16:51:41.945",
+    "updatedAt": "2025-10-06 17:09:34.333"
   },
   {
     "id": "frk_pt_68cc576eab0b1748940253fa",
@@ -285,9 +265,9 @@
     "description": "The AI Policy Control Framework establishes principles, roles, and processes to ensure the responsible development, use, and oversight of AI systems, aligning them with organizational policies, regulatory obligations, and ethical standards.",
     "frequency": "yearly",
     "department": "it",
-    "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The purpose of this policy is to establish a consistent governance framework for the responsible development, deployment, and use of Artificial Intelligence (AI) systems. It ensures that AI is aligned with the organization’s strategic objectives, complies with applicable laws and standards, and upholds ethical principles such as fairness, accountability, transparency, and respect for individual and societal impacts.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This policy applies to all employees, contractors, partners, and third parties who are involved in the design, acquisition, development, deployment, monitoring, or use of AI systems on behalf of the organization. It covers AI systems developed in-house, procured from vendors, or integrated into existing business processes, and extends across the entire AI system life cycle, from design and training data acquisition through deployment, monitoring, maintenance, and decommissioning.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "1. ", "type": "text"}, {"text": "AI Governance & Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.2.2, A.2.3, A.2.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documented overarching AI policy (objectives, principles, scope of AI use, governance framework).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Alignment with existing policies (security, privacy, compliance, risk).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Formal review cycle (annual + ad hoc).", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "2. ", "type": "text"}, {"text": "AI Roles, Responsibility & Accountability", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Governance Roles & Committees", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.3.2)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign AI roles: AI Owner, AI Risk Officer, Model Developers, AI Ethics/Review Committee.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clear accountability for AI lifecycle stages.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Concern Reporting & Whistleblowing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Extension of ", "type": "text"}, {"text": "Sanctions & Disciplinary", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Awareness Training", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safe channels for employees to report AI-related risks, ethical concerns, or unintended harms.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Part of training & awareness modules.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "3. ", "type": "text"}, {"text": "AI Resources & Competency", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Resource Management", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.4.2–A.4.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document ", "type": "text"}, {"text": "data, tooling, compute, and human resources", "type": "text", "marks": [{"type": "bold"}]}, {"text": " relevant to AI.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain inventory of AI system dependencies/frameworks (TensorFlow, PyTorch, APIs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "competency requirements", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (skills/training) for AI staff.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "4. ", "type": "text"}, {"text": "AI Risk & Impact Assessments", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Risk & Impact Assessment Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.5.2–A.5.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process for assessing individual, societal, and organizational impacts of AI systems.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain findings as part of enterprise ", "type": "text"}, {"text": "risk register", "type": "text", "marks": [{"type": "bold"}]}, {"text": ".", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Required for new AI systems, major updates, and periodic reviews.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "5. ", "type": "text"}, {"text": "AI Lifecycle Management", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Development & Design Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Secure SDLC", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Change & Release Management", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "responsible AI objectives", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (fairness, transparency, explainability, robustness).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lifecycle processes: design → development → validation → deployment → monitoring → decommissioning.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verification & validation of AI models (bias, accuracy, robustness testing).", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Deployment & Operations", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Logging, Monitoring & Audit", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Incident Response", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Model performance monitoring, drift detection, bias monitoring.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Event logging for AI actions/decisions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rollback/retraining protocols.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI System Documentation", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.6.2.7)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documentation prepared for stakeholders: purpose, design, limitations, and risks.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tailored for regulators, customers, users.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "6. ", "type": "text"}, {"text": "AI Data Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Data Governance Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.7.2–A.7.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data requirements defined: quality, provenance, preparation, retention, lawful basis.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Dataset acquisition vetting (bias, representativeness, licensing).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Continuous validation of dataset integrity & relevance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Links to ", "type": "text"}, {"text": "Data Classification & Handling", "type": "text", "marks": [{"type": "italic"}]}, {"text": " and ", "type": "text"}, {"text": "Privacy & Data Subject Rights", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "7. ", "type": "text"}, {"text": "AI Transparency & Stakeholder Communications", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Transparency & Communications", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.8.2–A.8.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "User-facing documentation: explanation of AI system purpose, limitations, intended use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Stakeholder reporting: regulatory disclosures, public summaries, accountability dashboards.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI incident communication: tailored protocols for affected users & regulatory bodies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Channels for external stakeholders to report adverse impacts.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "8. ", "type": "text"}, {"text": "Responsible Use of AI", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Responsible AI Use Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.9.2–A.9.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define acceptable vs prohibited AI uses (alignment with ethics principles).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Establish “intended use” framework tied to AI model documentation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct user education on ethical/responsible AI use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Embed into ", "type": "text"}, {"text": "Acceptable Use Policy (AUP)", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "9. ", "type": "text"}, {"text": "Third-Party AI Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Third-Party Processor", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI-specific clauses in contracts (responsible AI dev/use, explainability, performance guarantees).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require supplier AI transparency (model cards/evaluation reports).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI accountability mapping: shared responsibilities between org ↔ vendor ↔ customer.", "type": "text"}]}]}]}]}]}],
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The purpose of this policy is to establish a consistent governance framework for the responsible development, deployment, and use of Artificial Intelligence (AI) systems. It ensures that AI is aligned with the organization’s strategic objectives, complies with applicable laws and standards, and upholds ethical principles such as fairness, accountability, transparency, and respect for individual and societal impacts.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This policy applies to all employees, contractors, partners, and third parties who are involved in the design, acquisition, development, deployment, monitoring, or use of AI systems on behalf of the organization. It covers AI systems developed in-house, procured from vendors, or integrated into existing business processes, and extends across the entire AI system life cycle, from design and training data acquisition through deployment, monitoring, maintenance, and decommissioning.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "1. ", "type": "text"}, {"text": "AI Governance & Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.2.2, A.2.3, A.2.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documented overarching AI policy (objectives, principles, scope of AI use, governance framework).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Alignment with existing policies (security, privacy, compliance, risk).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Formal review cycle (annual + ad hoc).", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "2. ", "type": "text"}, {"text": "AI Roles, Responsibility & Accountability", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Governance Roles & Committees", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.3.2)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign AI roles: AI Owner, AI Risk Officer, Model Developers, AI Ethics/Review Committee.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clear accountability for AI lifecycle stages.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Concern Reporting & Whistleblowing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Extension of ", "type": "text"}, {"text": "Sanctions & Disciplinary", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Awareness Training", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safe channels for employees to report AI-related risks, ethical concerns, or unintended harms.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Part of training & awareness modules.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "3. ", "type": "text"}, {"text": "AI Resources & Competency", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Resource Management", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.4.2–A.4.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document ", "type": "text"}, {"text": "data, tooling, compute, and human resources", "type": "text", "marks": [{"type": "bold"}]}, {"text": " relevant to AI.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain inventory of AI system dependencies/frameworks (TensorFlow, PyTorch, APIs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "competency requirements", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (skills/training) for AI staff.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "4. ", "type": "text"}, {"text": "AI Risk & Impact Assessments", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Risk & Impact Assessment Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.5.2–A.5.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process for assessing individual, societal, and organizational impacts of AI systems.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain findings as part of enterprise ", "type": "text"}, {"text": "risk register", "type": "text", "marks": [{"type": "bold"}]}, {"text": ".", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Required for new AI systems, major updates, and periodic reviews.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "5. ", "type": "text"}, {"text": "AI Lifecycle Management", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Development & Design Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Secure SDLC", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Change & Release Management", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define ", "type": "text"}, {"text": "responsible AI objectives", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (fairness, transparency, explainability, robustness).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lifecycle processes: design → development → validation → deployment → monitoring → decommissioning.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verification & validation of AI models (bias, accuracy, robustness testing).", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Deployment & Operations", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Logging, Monitoring & Audit", "type": "text", "marks": [{"type": "italic"}]}, {"text": " + ", "type": "text"}, {"text": "Incident Response", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Model performance monitoring, drift detection, bias monitoring.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Event logging for AI actions/decisions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Rollback/retraining protocols.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI System Documentation", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.6.2.7)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Documentation prepared for stakeholders: purpose, design, limitations, and risks.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tailored for regulators, customers, users.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "6. ", "type": "text"}, {"text": "AI Data Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Data Governance Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.7.2–A.7.6)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data requirements defined: quality, provenance, preparation, retention, lawful basis.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Dataset acquisition vetting (bias, representativeness, licensing).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Continuous validation of dataset integrity & relevance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Links to ", "type": "text"}, {"text": "Data Classification & Handling", "type": "text", "marks": [{"type": "italic"}]}, {"text": " and ", "type": "text"}, {"text": "Privacy & Data Subject Rights", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "7. ", "type": "text"}, {"text": "AI Transparency & Stakeholder Communications", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Transparency & Communications", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.8.2–A.8.5)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "User-facing documentation: explanation of AI system purpose, limitations, intended use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Stakeholder reporting: regulatory disclosures, public summaries, accountability dashboards.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI incident communication: tailored protocols for affected users & regulatory bodies.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Channels for external stakeholders to report adverse impacts.", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "8. ", "type": "text"}, {"text": "Responsible Use of AI", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Responsible AI Use Policy", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (NEW – Covers A.9.2–A.9.4)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define acceptable vs prohibited AI uses (alignment with ethics principles).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Establish “intended use” framework tied to AI model documentation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct user education on ethical/responsible AI use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Embed into ", "type": "text"}, {"text": "Acceptable Use Policy (AUP)", "type": "text", "marks": [{"type": "italic"}]}, {"text": ".", "type": "text"}]}]}]}]}]}, {"type": "horizontalRule"}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "9. ", "type": "text"}, {"text": "Third-Party AI Governance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "bold"}]}, {"text": " (Expansion of ", "type": "text"}, {"text": "Vendor & Third-Party Risk", "type": "text", "marks": [{"type": "italic"}]}, {"text": ", ", "type": "text"}, {"text": "Third-Party Processor", "type": "text", "marks": [{"type": "italic"}]}, {"text": ")", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI-specific clauses in contracts (responsible AI dev/use, explainability, performance guarantees).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require supplier AI transparency (model cards/evaluation reports).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "AI accountability mapping: shared responsibilities between org ↔ vendor ↔ customer.", "type": "text"}]}]}]}]}]}]},
     "createdAt": "2025-09-18 19:03:10.246",
-    "updatedAt": "2025-09-18 19:06:12.956"
+    "updatedAt": "2026-04-25 19:34:58.394"
   },
   {
     "id": "frk_pt_68bb155d6b8eaafd14904188",
@@ -295,19 +275,19 @@
     "description": "Ensures all third-party vendors adhere to sign GDPR Data Processing Agreements",
     "frequency": "yearly",
     "department": "admin",
-    "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}],
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage risks from suppliers that access {{COMPANY}} data or impact operations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All SaaS, cloud, consulting, and data-processing vendors.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy aligns to SOC 2 Trust Services Criteria, at minimum Security (Common Criteria). Name any optional criteria in scope (Availability, Confidentiality, Processing Integrity, Privacy).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Clarify that the policy covers vendors and any vendors that act as “subservice organizations” to your system as defined in SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Use written contracts to ensure third parties processing personal information on behalf of {{COMPANY}} provide a comparable level of privacy protection. Maintain accountability for personal information transferred to vendors regardless of where they operate in {{GEO}}.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors that create, receive, maintain, or transmit PHI, including subcontractors of Business Associates. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State that the policy applies to all vendors (processors) that process personal data of EU/EEA data subjects on behalf of {{COMPANY}}, including subprocessors and the designated EU Representative (if applicable). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Vendor Inventory & Tiering", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain central list of active vendors with owner and contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tier vendors by risk", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical = Business cannot run without it", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "High = handles customer or Restricted data", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium = internal tools", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Low = no data access", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Flag which vendors are subservice organizations in your SOC 2 report and record whether you use the carve-out or inclusive method for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link each vendor entry to the service commitments and system requirements they support in your SOC 2 system description). ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Tag vendors that process personal information; record whether the data leaves Canada and the safeguards applied to those cross-border transfers.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each vendor’s HIPAA role: Business Associate, Subcontractor BA, or neither.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track whether PHI is stored, processed, or transmitted, where it resides, and whether data are de-identified or a limited data set. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a list of all vendors that process personal data, including:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Type of personal data processed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lawful basis for processing", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether vendor acts as processor, subprocessor, or EU Representative", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Location of processing (EU/EEA or third country with transfer mechanism)", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track Data Processing Agreements (DPAs) with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Security Due Diligence", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Critical/High-risk: obtain SOC 2/ISO 27001 report or complete security questionnaire before contract.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Medium-risk: basic questionnaire or public security statement review.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record findings and approval decision.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prefer SOC 2 Type 2. Record report type, period covered, criteria in scope, auditor opinion, exceptions, relevant subservice organizations, and whether carve-out or inclusive.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain a bridge (gap) letter when the SOC 2 period does not cover the present date. Note that a bridge letter is a management assertion, not auditor-attested.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Extract the vendor’s Complementary User Entity Controls (CUECs). Map each CUEC to your internal controls and keep evidence that you operate them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "If no SOC 2 is available, collect alternate assurance (for example ISO 27001 certificate with SoA, pen test summary, security questionnaire) and record a risk-based acceptance with compensating controls and a timeline to obtain SOC 2. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Confirm the vendor can support {{COMPANY}}'s obligations: access-request fulfilment within 30 days, breach notification, and compliance with the 10 Fair Information Principles.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Add a HIPAA checklist for Critical and High vendors that handle PHI:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence of a HIPAA Security Rule risk analysis and risk management plan.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Administrative safeguards: workforce training, sanction policy, access authorization, termination, contingency planning and backups, periodic evaluations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical safeguards: facility access controls, device and media controls, secure disposal.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Technical safeguards: unique IDs, access controls, audit controls, integrity controls, transmission security, authentication.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Logging: the vendor must maintain and retain system activity logs for ePHI and provide extracts on request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data minimization: confirm “minimum necessary” access design and role-based access . ", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For Critical and High vendors that process personal data:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify GDPR-compliant DPA is signed before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm vendor provides appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assess cross-border data transfers and ensure valid transfer mechanism (e.g., SCCs, adequacy decision).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record evidence of review and approval.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contractual Safeguards", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include confidentiality, breach-notification, right-to-audit, and data-return clauses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For personal-data processors, execute a data-processing agreement.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require vendors in Critical or High tiers to provide a current SOC 2 Type 2 report annually and a bridge letter for any period not covered.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Include obligations to notify you of material control changes, new subprocessors, or security incidents, and to cooperate with your incident investigations. Tie this to your service commitments and system requirements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve right-to-audit or, at minimum, right to obtain independent assurance (SOC report or equivalent) and remediation evidence for noted exceptions. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}} ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require contractual commitments to: limit processing to documented purposes, return or securely destroy personal information on termination, notify {{COMPANY}} of any privacy breach without undue delay, and submit to {{COMPANY}}'s direction on access requests.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The BAA must at minimum require the BA to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use and disclose PHI only as permitted by the BAA and HIPAA; apply minimum necessary.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement the HIPAA Security Rule safeguards and ensure subcontractors sign equivalent BAAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Report any security incident or breach without unreasonable delay and set an internal time box (for example, within 5 calendar days) with content requirements for the notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make PHI available to support individual rights: access within 30 days, amendment, and accounting of disclosures within 60 days; incorporate amendments as directed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make internal practices, books, and records relating to PHI available to HHS upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or destroy PHI at termination and stop all uses; if infeasible, extend protections and limit uses.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permit termination for material breach of the BAA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale of PHI and marketing uses without proper authorization, and prohibit re-identification of de-identified data unless expressly permitted. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The DPA must at minimum require the processor to:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Process personal data only on documented instructions from {{COMPANY}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implement appropriate technical and organizational measures (TOMs).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure confidentiality and train personnel.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain prior written authorization for subprocessors and flow down equivalent obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist {{COMPANY}} in fulfilling data subject rights requests (access, rectification, erasure, portability, restriction, objection).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assist with security, breach notification, and DPIAs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Return or securely delete personal data at contract termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Make available all information necessary to demonstrate compliance and allow audits.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify {{COMPANY}} without undue delay of any personal data breach.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Ongoing Monitoring", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Critical/High-risk vendors’ attestations or questionnaires annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track security-breach news; initiate assessment if incident reported.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Cadence: Critical reviewed at least semiannually; High at least annually. Re-review after any material change, incident, ownership or hosting change, scope change to Restricted data, or SLA breach.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track remediation of exceptions noted in the vendor’s SOC 2 and verify you operate their CUECs each period.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When using the carve-out method, monitor the vendor’s subservice organizations where they could affect your commitments. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Re-confirm annually that processors continue to provide comparable privacy protection; track any changes to data location or sub-processor lists.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require BA to notify you without unreasonable delay (internal target within 5 days) and include the incident description, PHI types, number of affected individuals, timeframes, mitigation, and corrective actions. You will handle regulatory filings and individual notices per HIPAA timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review BAAs annually and after material changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-obtain evidence of HIPAA risk analysis updates, contingency plan tests, and access review results.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures and OCR settlements affecting the vendor. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review DPAs for all processors at least annually. Maintain a review log with:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor name", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date DPA signed", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Date of last review", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Next review due", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monitor vendor breach disclosures, regulatory actions, and changes in subprocessors or transfer mechanisms. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Off-boarding & Data Return", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On contract end, ensure vendor deletes or returns data; obtain written confirmation.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remove integrations and access tokens within 48 h.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or written deletion confirmation and link it to the off-boarding ticket. Verify all accounts, API keys, and OAuth tokens are revoked, and keep timestamps as evidence. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}On termination, obtain certified return or secure destruction of personal information held by the vendor, and update the Personal Information Register.{{/if}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction for all media containing PHI or confirm secure return. Capture timelines and format. Retrieve or request final audit logs that may be needed for accounting of disclosures.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm termination of all BA subcontractors that handled your PHI. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require certificate of destruction or confirmation of secure deletion of all personal data, unless retention is required by law. Capture timelines and format. Confirm termination of all subprocessors handling {{COMPANY}}’s personal data. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 1, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100 % High-risk vendors have up-to-date due-diligence evidence; inventory reconciled quarterly.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of Critical and High vendors have a current SOC 2 Type 2 review or approved alternate assurance with a time-bound plan, plus bridge letters covering any gaps.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of CUECs from Critical and High vendors are mapped and evidenced as operated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of subservice organizations show method recorded (carve-out or inclusive) and monitoring documented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Evidence is retained for at least the full SOC 2 Type 2 period and 12 months beyond. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA and Subcontractor BA vendors have an executed BAA before PHI exchange.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors have a current HIPAA risk analysis and risk management plan on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors provide breach reporting within the internal time box.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of BA vendors documented with PHI data map and minimum-necessary justification. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if gdpr}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors processing personal data have a signed GDPR-compliant DPA on file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of DPAs are reviewed at least annually and logged with next review date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of cross-border transfers have a documented lawful transfer mechanism.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of vendors provide breach reporting without undue delay. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Urgent onboarding without full diligence allowed only with executive sign-off and action plan.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow emergency onboarding only with Security approval, a short-term risk acceptance, compensating controls, and a plan to obtain SOC 2 or equivalent assurance within a defined time box. ", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missing evidence or expired contracts flagged to procurement and Security for immediate action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Streamline questionnaire, add automation, and refine tiering criteria annually.", "type": "text"}]}]},
     "createdAt": "2025-09-05 16:52:44.802",
-    "updatedAt": "2025-09-05 17:17:12.446"
+    "updatedAt": "2026-04-30 23:21:45.896"
   },
   {
-    "id": "frk_pt_68e3f39e77b0a823add09bf5",
-    "name": "Code of Business Conduct",
-    "description": "The Code of Business Conduct outlines the ethical standards and professional behaviors expected of all employees. It serves as a guide to ensure integrity, compliance, and responsibility in all business activities and interactions.",
+    "id": "frk_pt_685e414029124c24387beff0",
+    "name": "Retention & Secure Disposal",
+    "description": "Sets record-specific retention periods, runs periodic purge reviews, and requires cryptographic or physical destruction of outdated data.",
     "frequency": "yearly",
-    "department": "hr",
-    "content": [{"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Set clear expectations for ethical behavior, professionalism, and compliance across all {{COMPANY}} activities.", "type": "text"}, {"type": "hardBreak"}, {"text": "Protect trust with customers, partners, regulators, and one another while upholding {{INDUSTRY}} standards.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Applies to all {{COMPANY}} employees, contractors, and third parties operating on behalf of {{COMPANY}} in {{GEO}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Covers conduct, data protection, decision-making, and use of company systems and resources.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Our Principles", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Act with integrity", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Be honest, fair, and transparent in all interactions with customers, partners, regulators, and colleagues.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect trust", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Safeguard all customer PII, financial records, property data, credit-bureau information, and compliance documentation.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer first", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure that decisions improve the accuracy, speed, and fairness of lending and service outcomes—not just short-term performance.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Comply with the law", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Follow applicable financial-services, data-protection, anti-bribery, anti-money-laundering, competition, and employment laws.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Speaking up about ethical or compliance concerns is encouraged and protected from retaliation.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Professional Conduct", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respect and inclusion", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Harassment, discrimination, or bullying of any kind is strictly prohibited—promote an inclusive and respectful workplace.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conflicts of interest", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disclose any outside employment, investments, family relationships, or gifts that could influence business decisions.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Fair dealing", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Never misrepresent {{COMPANY}} or competitors, or engage in unfair or deceptive business practices.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communications and social media", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Only authorized representatives may speak publicly on behalf of {{COMPANY}}.", "type": "text"}, {"type": "hardBreak"}, {"text": "Never disclose confidential or customer information in public or social-media channels.", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Protection & Security", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access control", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use company-managed accounts with SSO and MFA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply least-privilege access and review access quarterly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Shared or generic accounts are prohibited.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Device security", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Devices must enable disk encryption, auto-lock, strong passcodes, and current OS/patches.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Install company MDM/endpoint protection when required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Store customer data only in approved, encrypted applications; never on local drives unless explicitly authorized and encrypted.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data handling", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Collect only the minimum data required for business needs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify and label sensitive data appropriately.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use anonymized or synthetic data for development and testing whenever possible.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incident response", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Immediately report any suspected data loss, breach, or unauthorized access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The Security Lead coordinates containment, notification, and post-incident review per regulatory requirements.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retention and deletion", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain data only as long as legally or contractually required.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Securely delete data when no longer needed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respond promptly to data-subject requests (access, correction, deletion).", "type": "text"}]}]}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Reporting Concerns", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Raise ethical or conduct concerns with your manager or compliance contact.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Anonymous reporting options are available upon request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "No retaliation will occur for good-faith reports or participation in investigations.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Violations may result in access restrictions, disciplinary action (including termination), and, where required, reporting to regulatory authorities.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "This Code is reviewed at least annually; all updates will be communicated in writing.", "type": "text"}]}]}]}],
-    "createdAt": "2025-10-06 16:51:41.945",
-    "updatedAt": "2025-10-06 17:09:34.333"
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep {{DATA}} only as long as needed and dispose of it so it cannot be recovered by unauthorized parties at {{COMPANY}}, including data stored in {{CRITICAL}} and subject to {{GEO}} residency.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All electronic and physical records, backups, and media created or held by the organization. Applies to the {{LOCATION}} workforce, systems in {{CRITICAL}}, and managed {{DEVICES}} that store or cache {{DATA}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain the retention schedule, review records, and disposal logs for the full Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "For ePHI, apply the HIPAA Security Rule Device and Media Controls and retain required documentation for 6 years.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain personal information only as long as necessary to fulfill the purposes documented in the Personal Information Register; retain information used to make decisions about an individual long enough for the individual to access it under PIPEDA Section 8.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Retention Schedule", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a table listing record types, retention period, owner, and primary storage (e.g., repository in {{CRITICAL}}) with {{GEO}} residency where applicable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review the schedule at least annually and when new {{INDUSTRY}} data types arise.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure each record type references its storage location and protection requirements.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Map ePHI record types to required retention periods and safeguard expectations.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Map each personal information category to a minimum and maximum retention period; align with the documented collection purpose under Principle 5.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Periodic Data Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Owners run an automated or manual review at least quarterly to identify data beyond its retention period in {{CRITICAL}}, collaboration repositories, and on managed {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Records flagged for deletion are queued for disposal within 30 days.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Log review dates and outcomes; track queued deletions to completion.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Verify reviews include systems and media that may contain ePHI.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Identify personal information no longer required and queue it for destruction or anonymization; document outcomes for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Secure Disposal Methods", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Electronic data: use secure-wipe utilities or crypto-erasure by destroying keys; confirm for cloud stores in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Physical media: use cross-cut shredding or a certified destruction vendor.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document each disposal event with date, data category, method, and location; store records in {{GEO}} where required.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Store certificates or logs of destruction where used and restrict access to disposal records.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply Device and Media Controls for ePHI, including sanitisation and accountability.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply destruction methods that prevent recovery of personal information; obtain certificates of destruction from contractors handling disposal.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Backup & Archive Controls", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Apply the same retention timelines to backups and archives.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt backups; verify they age out on schedule or are re-encrypted when keys rotate; note backup residency in {{GEO}} and storage in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Periodically test backup expiry and restoration; protect keys and access.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure backup processes for ePHI maintain required safeguards during storage and restoration.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply the same safeguards to personal information held in backups as in production; document the backup retention period in the Personal Information Register.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly check shows ≤ 5% of records past retention and disposal logs are complete. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks across {{CRITICAL}} and managed {{DEVICES}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Legal hold or contract may override the schedule; document the reason and review date, including any impact on {{DATA}} residency in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Over-retained or improperly disposed records are escalated to senior management and remediated within 30 days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update the schedule and tooling after audits, incidents, or regulatory change, reflecting {{INDUSTRY}} requirements and any updates to {{GEO}} obligations.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 06:59:11.886",
+    "updatedAt": "2026-04-30 23:21:48.511"
   },
   {
     "id": "frk_pt_691e4b93beca9362759c4cbe",
@@ -349,6 +329,26 @@
     "createdAt": "2025-11-19 22:57:21.987",
     "updatedAt": "2025-11-24 23:04:45.954"
   },
+  {
+    "id": "frk_pt_685e4508d8c0d14ae873e644",
+    "name": "Physical Security & Environmental",
+    "description": "Controls facility and server-room access, manages visitors, safeguards against fire, flood, or climate risks, and audits logs and walk-throughs.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Protect {{COMPANY}} personnel, equipment, and information from unauthorized physical access or environmental damage.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{LOCATION}} and any site hosting {{COMPANY}} assets.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Align to SOC 2 Trust Services Criteria in scope for the audit (Security at minimum; add Availability/Confidentiality if applicable). Treat building/data-centre operators as relevant subservice organizations. ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply physical safeguards to areas where personal information is stored or processed, regardless of format (paper, electronic, removable media), per Principle 7 of PIPEDA Schedule 1.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Applies where ePHI is created, received, maintained, or transmitted (including subcontractors of Business Associates). ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Facility Access Control", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All controlled doors use badges or keys; disable badges immediately at termination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Segregate secure areas (for example, server/network closets) with locked doors; limit keys to authorized staff only.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep doors closed; prevent tailgating and prohibit propping doors open.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review of badge/key lists to reconfirm access need.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain access-control records and document quarterly access reviews during the Type 2 period.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Restrict access to areas housing personal information to authorized staff; log physical access to areas storing sensitive personal information.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain facility access procedures for areas where ePHI may be present.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Visitor Management", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require sign-in, government-issued ID check, and a visible visitor badge.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Host escorts visitor at all times.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain visitor logs for at least 12 months.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Spot-check visitor logs against host approvals as part of periodic reviews.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Escort visitors in areas where personal information is processed; record visitor access for at least one year.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict visitor access to any area where ePHI may be visible or discussed.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Environmental Protections", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain HVAC within manufacturer-recommended temperature and humidity; continuous monitoring for server areas.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide smoke detection and automatic fire suppression for server rooms, or use fire-rated cabinets where suppression is unavailable.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide UPS for critical equipment and test at least annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Elevate equipment or install leak sensors in flood-prone areas.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain maintenance and test records (for example HVAC/UPS) to support Availability when in scope.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Protect personal information from environmental loss (fire, flood, power loss) commensurate with sensitivity; document recovery procedures.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Link facility and environmental events with contingency and emergency-mode operations.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Equipment Protection & Disposal", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Lock server racks; use cable locks for laptops in shared/co-working spaces.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain asset inventory with physical location and owner.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Sanitize or destroy storage media prior to disposal or reuse using NIST SP 800-88 methods; record disposal event and, where applicable, obtain a certificate of destruction.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Sanitize storage media holding personal information before reassignment or disposal; retain destruction certificates for at least 24 months.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Satisfies Device and Media Controls: disposal, media reuse, accountability.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Physical Security Monitoring & Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review access-control and (where deployed) CCTV logs monthly for anomalies; investigate and record outcomes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct an annual walk-through to verify door states, signage, camera coverage, alarms, leak sensors, and rack locks.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record incidents such as tailgating or propped-open doors and track corrective actions.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain review artifacts for at least the full Type 2 period plus 12 months.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Review physical safeguards annually for areas housing personal information; document corrective actions.{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain Security Rule documentation for 6 years.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access controls in use at 100% of controlled doors; monthly log reviews completed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of visitors signed in, badged, and escorted; logs retained 12 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual environmental tests (for example UPS) and annual physical walk-through completed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "100% of media disposal or reuse events recorded with NIST SP 800-88 method.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary use of an unsecured space requires manager approval, an end date, and compensating controls (for example lockable cabinet).", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tailgating, propped-open doors, missing visitor badges, or unlogged visitors are recorded as incidents; corrective action within one week.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enhance controls based on incident trends, audit findings, and facility changes; review this policy at least annually.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:15:20.007",
+    "updatedAt": "2026-04-30 23:21:50.266"
+  },
+  {
+    "id": "frk_pt_685e42188e2df1c285cca159",
+    "name": "Access Control & Least Privilege",
+    "description": "Implements a Joiner-Mover-Leaver workflow, role-based access control, quarterly reviews, and strict approval for elevated privileges.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure users at {{COMPANY}} receive only the minimum access necessary and that access adjusts promptly with role changes, protecting {{DATA}} on workloads in {{CRITICAL}} and across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All workforce accounts, service accounts, and system roles across SaaS, IaaS, and on-prem resources used by the {{LOCATION}} workforce. Only managed {{DEVICES}} may access production resources in {{CRITICAL}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Align to logical access controls (authentication, authorization, provisioning/deprovisioning) and retain artifacts for the Type 2 period plus 12 months.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Apply workforce security and information access management with unique IDs and authentication for systems handling ePHI (164.308(a)(3)-(4), 164.312(a), 164.312(d)).", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Restrict access to personal information to the minimum necessary for the purposes documented in the Personal Information Register, in accordance with Principle 7 of PIPEDA Schedule 1.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Joiner-Mover-Leaver (JML) Process", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provision access via ticket with manager approval and defined role.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Modify privileges within 48 hours of role change.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Disable or delete accounts by end of final workday; collect tokens/keys/badges and revoke access on {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tie SSO/IdP accounts to HR status; block sign-in on termination and immediately remove access to {{CRITICAL}}/{{DATA}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Record approvals, timestamps, and completion in the ticket/IdP; no ad-hoc provisioning.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Remove ePHI access immediately on termination; document termination procedures.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Adjust access to personal information promptly on role change; revoke access on termination within one business day.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Role-Based Access Control (RBAC)", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define standard roles per system (e.g., Admin, Power User, Read-Only).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign users to roles or groups; avoid direct entitlements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain role definitions with least-privilege permissions and named owners.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service accounts have an owner, documented purpose, restricted scopes, and no interactive login.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Review role definitions at least annually; protect high-risk permissions with MFA.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Limit ePHI access to the minimum necessary; segregate admin from clinical/support roles where applicable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Define roles based on the purpose for which personal information is processed; segregate duties between collection, use, and disclosure where the volume or sensitivity warrants it.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Privilege Elevation & Approval", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Temporary admin rights require documented business justification and auto-expire ≤ 24 hours.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Permanent admin assignments require senior-management approval.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use just-in-time elevation where available; log all elevated actions on systems in {{CRITICAL}}.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Retain elevation requests/approvals and session logs for sampling.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Ensure elevated sessions on ePHI systems use strong authentication and are auditable.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Require documented approval and time-bound elevation for access to sensitive personal information; log elevation events.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Periodic Access Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "System owners review user lists at least quarterly; remove stale or excessive rights.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reconcile IdP groups, SaaS roles, and resource policies affecting {{CRITICAL}} and {{DATA}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document review date, reviewers, findings, and actions; store evidence in {{GEO}} where residency applies.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if soc2}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Track findings to closure; verify orphaned accounts and excess privileges are remediated.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if hipaa}}", "type": "text"}, {"type": "hardBreak"}, {"text": "Include verification of ePHI repository access and logging of adjustments.", "type": "text"}, {"type": "hardBreak"}, {"text": "{{/if}}", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Review access to personal information at least annually; close any access not aligned to a documented purpose and record the outcome.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review shows ≤ 2% orphaned accounts; all admin rights have an approval record. For teams over {{EMPLOYEES}} employees, expand sampling and include random checks of privileged access to {{CRITICAL}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Emergency access allowed for a maximum of 8 hours; log reason, scope, and approver, and close in the next review. Note any residual risk to {{DATA}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Unapproved elevated access or dormant accounts > 30 days are escalated to management and remediated within one week.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate review findings to refine role definitions and automate provisioning/deprovisioning, considering {{INDUSTRY}} needs and obligations in {{GEO}}.", "type": "text"}]}]},
+    "createdAt": "2025-06-27 07:02:47.730",
+    "updatedAt": "2026-04-30 23:21:51.182"
+  },
   {
     "id": "frk_pt_6944560ec419232763bbac2c",
     "name": "Service Provider Acknowledgement",
@@ -359,6 +359,116 @@
     "createdAt": "2025-12-18 19:29:17.533",
     "updatedAt": "2025-12-18 19:31:04.846"
   },
+  {
+    "id": "frk_pt_69f3de9f7e48fbcc7752a946",
+    "name": "PIPEDA Privacy Notice Policy",
+    "description": "Defines the content, publication, and update process for the public-facing PIPEDA privacy notice provided at or before collection of personal information — supporting Principles 2, 3, 4, and 8.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure that individuals interacting with {{COMPANY}} ({{COMPANYINFO}}) are informed about the personal information ({{DATA}}) being collected, why it is being collected, how it will be used and disclosed, and how they can exercise their rights under the Personal Information Protection and Electronic Documents Act (PIPEDA).", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The public-facing PIPEDA privacy notice published by {{COMPANY}} on its websites, mobile apps, contracts, and any other interface where personal information is collected. Applies to the {{LOCATION}} workforce and processors operating in {{CRITICAL}} and across {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Required Content", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identity and contact details of {{COMPANY}} and the designated Privacy Officer accountable for PIPEDA compliance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Categories of {{DATA}} collected, sources, and the purposes for which they are collected, used, and disclosed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Categories of recipients (including service providers and processors in {{CRITICAL}}) with which {{DATA}} is shared.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Whether {{DATA}} is transferred outside Canada and the safeguards applied to those transfers.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retention periods for each category and the criteria used to determine them.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The rights individuals have under PIPEDA, including access, correction, and challenging compliance.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "The procedure for submitting access requests and complaints, and the consequences of withholding consent.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "A statement on how {{COMPANY}} obtains consent (express vs. implied) and how it can be withdrawn.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Notification at Collection", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide the privacy notice or a meaningful link to it at or before every collection point, including web forms, account creation, in-person collection, and indirect collection by {{SOFTWARE}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Train employees who collect personal information by phone or in person to explain purposes using approved scripts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where notification at the time of collection is impracticable, notify the individual before the personal information is used or disclosed.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Updates & Versioning", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update the privacy notice within 30 days of any material change to collection, use, disclosure, or retention practices.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a public version history with the effective date of each version, and retain prior versions for at least seven years.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-notify affected individuals where the change is material to existing relationships.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain dated copies of every published version, evidence of publication, and the change log.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain training records for staff who deliver verbal collection notices.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly content review confirms that all collection points reference the current notice and that no purposes are processed beyond those described.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any temporary deviation (for example, emergency public-health collection without prior notice) requires documented authorization and post-collection notification as soon as practicable.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identified gaps trigger immediate notice update and review of any data collected during the gap.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Incorporate guidance from the Office of the Privacy Commissioner of Canada (OPC) and {{INDUSTRY}} norms into each annual revision.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:39.443",
+    "updatedAt": "2026-04-30 22:58:39.832"
+  },
+  {
+    "id": "frk_pt_69efd9cfa8d70d31297f025e",
+    "name": "Children's and Minors' Data Policy",
+    "description": "Governs collection, use, sale, and sharing of personal information of minors. Requires affirmative opt-in consent for sale or sharing of personal information of consumers under 16, and verifiable parental consent for those under 13.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define how {{COMPANY}} ({{COMPANYINFO}}) collects, uses, sells, and shares the personal information of minors under California's CCPA/CPRA, ensuring that consumers under 16 are protected by additional consent requirements and that consumers under 13 receive verifiable parental consent before any sale or sharing of their personal information.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All {{DATA}} that may belong to a California consumer under the age of 16, regardless of where the data is collected, processed in {{CRITICAL}}, or stored across {{GEO}}. Applies to all employees, contractors, and service providers acting on behalf of {{COMPANY}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Age Determination", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} does not knowingly sell or share the personal information of consumers under 16 without affirmative authorization (\"opt-in to sale\").", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where age is unknown, services or features that may attract minors will apply default protections (no sale or sharing) until age is established.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Age signals captured via {{SOFTWARE}} (e.g. account profile, consent prompts) are treated as the source of truth and re-evaluated on material profile changes.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Consumers Aged 13 to 15 — Affirmative Opt-In", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain the consumer's own affirmative, informed opt-in before selling or sharing their personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Present the opt-in in plain language describing what data is sold or shared, with whom, and for what purpose.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Default to \"no sale, no sharing\" until the opt-in is captured and recorded.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Consumers Under 13 — Verifiable Parental Consent", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Obtain verifiable parental consent (consistent with COPPA-aligned methods) before selling or sharing personal information of any consumer under 13.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Acceptable verification methods include signed consent form, government-ID verification, payment-method verification, or another method reasonably calculated in light of available technology.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain the parental consent record alongside the child's account or processing record.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Withdrawing Consent and Opt-Out", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide a clear method for the minor (13–15) or parent/guardian (under 13) to withdraw consent or opt out of sale or sharing at any time.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Honor withdrawal within 15 business days and propagate the change to all relevant downstream service providers and contractors.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Recordkeeping", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain records of consent (affirmative opt-in or parental consent), withdrawal, and verification method for at least 24 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Records are stored in {{CRITICAL}} and are retrievable for audits, regulator inquiries, and consumer rights requests.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Service Providers and Third Parties", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service providers, contractors, and downstream third parties processing minors' personal information must contractually agree to the same age-gating, consent, and opt-out obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Selling or sharing minors' personal information with parties not bound by these terms is prohibited.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — owns this policy, monitors regulatory updates, and approves consent flow changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering and Product — implement age gating, consent capture, withdrawal flows, and downstream propagation in {{SOFTWARE}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer Support — handle consent withdrawal and parental requests using documented procedures.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Violations may result in disciplinary action up to termination, contract termination for service providers, and legal action where required. Suspected non-compliance must be reported to the Privacy Officer immediately.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually by the Privacy Officer and updated upon material change in {{COMPANY}}'s product, processing activities, or applicable law.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:49:02.939",
+    "updatedAt": "2026-04-27 23:03:46.219"
+  },
+  {
+    "id": "frk_pt_69f3dea01f1406bc00bc3d92",
+    "name": "PIPEDA Consent Management Policy",
+    "description": "Defines how the organization obtains, records, and manages knowledge and consent for the collection, use, and disclosure of personal information under PIPEDA, including consent withdrawal and express consent for sensitive information — supporting Principle 3.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Establish the standard by which {{COMPANY}} ({{COMPANYINFO}}) obtains meaningful consent from individuals for the collection, use, and disclosure of their personal information ({{DATA}}), in line with PIPEDA Schedule 1, Principle 3.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All collection, use, and disclosure of personal information by {{COMPANY}}, including data processed by {{SOFTWARE}} and stored in {{CRITICAL}}, regardless of whether the individual is a customer, prospect, employee, or contractor in {{GEO}} or {{LOCATION}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Forms of Consent", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Default to express, opt-in consent at the point of collection, recorded with timestamp, method, and the version of the privacy notice presented.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Implied consent is acceptable only where the information is non-sensitive, the use is consistent with the reasonable expectations of the individual, and the use is clearly described in the privacy notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Express, opt-in consent is required for sensitive personal information, including health information, financial account information, biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, and information about sex life or sexual orientation.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Knowledge Requirement", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "State the purposes for which consent is sought clearly, specifically, and in plain language so the individual can reasonably understand how the information will be used and disclosed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Train staff who interact with individuals to explain purposes consistently and to direct them to the privacy notice for further detail.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Conditions on Consent", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} must not require, as a condition of providing a product or service, consent to collection, use, or disclosure beyond what is necessary to fulfill the explicitly specified and legitimate purposes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Consent must not be obtained through deception, misleading statements, pre-checked boxes for non-essential collection, or by burying material terms.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Withdrawal of Consent", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide a clear, accessible mechanism for individuals to withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On receipt of a withdrawal request, inform the individual of the consequences (for example, service degradation), confirm the request in writing, and propagate the change across {{CRITICAL}} and {{SOFTWARE}} within five business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a withdrawal log including request date, propagation date, and any consequence communicated.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "New Purposes", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any new purpose not identified at the time of original collection requires fresh consent before the new use begins, or reliance on a documented PIPEDA Section 7 exception.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document the basis for the new processing in the Personal Information Register and retain evidence of fresh consent.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain consent records, withdrawal records, and the consent text presented for a minimum of seven years following the most recent processing event.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict access to the consent log to the privacy officer and approved auditors.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly sampling of consent records validates timestamp, method, scope, and propagation of withdrawals.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Section 7 statutory exceptions (for example, legal investigation, or emergency to life or health) must be invoked in writing by the privacy officer with documented basis.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any processing without valid consent or a documented exception is treated as a privacy incident.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate findings from complaints, OPC guidance, and {{INDUSTRY}} consent norms into each annual review.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:40.240",
+    "updatedAt": "2026-04-30 22:58:40.619"
+  },
+  {
+    "id": "frk_pt_69efd9c4a9d86fd3bdc08de1",
+    "name": "Information Security Policy",
+    "description": "Establishes the technical and organizational security safeguards (access control, encryption, logging, vulnerability management, secure development) used to protect personal information against unauthorized access, destruction, modification, or disclosure.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Establish the technical and organizational safeguards {{COMPANY}} ({{COMPANYINFO}}) uses to protect {{DATA}} against unauthorized access, destruction, modification, or disclosure, in line with the CCPA/CPRA \"reasonable security\" standard.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All systems, services, and {{DEVICES}} used by the {{LOCATION}} workforce of {{EMPLOYEES}} to access or process personal information, including infrastructure in {{CRITICAL}} and data stored across {{GEO}}.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Apply security safeguards to all personal information held by {{COMPANY}}, calibrated to its sensitivity, in accordance with Principle 7 of PIPEDA Schedule 1. Coverage includes physical, organizational, and technological safeguards across {{CRITICAL}} and {{DEVICES}}.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Access Control", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Enforce least-privilege access; access to personal information is granted on a documented business need.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require SSO and MFA for all {{SOFTWARE}} that handles personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review user access at least quarterly; revoke access within one business day of role change or termination.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Restrict access to personal information to staff who need it for documented purposes; revoke access promptly on role change or termination.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Encryption", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt personal information in transit using TLS 1.2 or higher.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypt personal information at rest in {{CRITICAL}} using industry-standard algorithms (e.g. AES-256).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Manage cryptographic keys with rotation, separation of duties, and audit logging.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Encrypt sensitive personal information at rest and in transit; document the safeguards applied to personal information transferred outside Canada.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Logging and Monitoring", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Centralize security-relevant logs from {{CRITICAL}} and {{SOFTWARE}}; retain at least 12 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Alert on anomalous authentication, privilege escalation, and data access events.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Maintain access logs for systems holding personal information for at least 24 months to support access requests, breach investigations, and OPC inquiries.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Vulnerability and Patch Management", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Run continuous vulnerability scanning across {{CRITICAL}} and {{DEVICES}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remediate critical vulnerabilities within 14 days, high within 30 days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct an external penetration test at least annually and after material architectural change.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Secure Development", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require code review and automated security testing (SAST/SCA) on all changes that touch personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Separate production from non-production data; never use real personal information in development or test environments without controls.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Endpoint Security", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All managed {{DEVICES}} must run full-disk encryption, endpoint protection, automatic patching, and screen lock.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Personal information must not be stored on personal/unmanaged endpoints.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Enforce encryption and remote-wipe on {{DEVICES}} that may hold personal information; prohibit unencrypted local storage on personal devices.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security Lead — owns this policy and the security control roadmap.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "IT — operates identity, endpoint, and patching programs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering — implements encryption, secure development, and infrastructure hardening.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Violations may result in disciplinary action up to termination, contract termination for service providers, and may be reported to regulators where required.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually and after any material change in {{COMPANY}}'s technology stack, threat landscape, or applicable law.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:52.467",
+    "updatedAt": "2026-04-30 23:21:49.394"
+  },
+  {
+    "id": "frk_pt_69efd9bf92ab808ec559b766",
+    "name": "Data Retention and Disposal Policy",
+    "description": "Defines retention periods for personal information by category, secure disposal procedures, and recordkeeping requirements for consumer requests (minimum 24 months under CCPA/CPRA).",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define how long {{COMPANY}} ({{COMPANYINFO}}) retains {{DATA}} and how it is securely disposed of, ensuring compliance with the CCPA/CPRA, applicable {{INDUSTRY}} obligations, and {{COMPANY}}'s contractual commitments.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personal information processed by {{COMPANY}} in {{CRITICAL}} or stored in {{GEO}}, including production systems, backups, archives, and copies held by service providers and contractors.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Retention Principle", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain personal information only for as long as necessary to fulfill the disclosed purpose, comply with legal obligations, resolve disputes, or enforce agreements.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define and document a retention period for each category of personal information; do not collect data without an associated retention period.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Retention by Category", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer account records — duration of the account plus the period required by tax/contract law.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Billing and payment records — at least 7 years (or as required by tax law).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Marketing data — until opt-out or 2 years of inactivity, whichever is shorter.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Application and security logs — 12 months minimum, longer where required by contract or regulation.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Consumer Request Records", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain records of CCPA/CPRA consumer rights requests and {{COMPANY}}'s responses for at least 24 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Records must capture date of receipt, request type, verification method, response, and date of response.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Backups and Archives", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Backup retention is documented separately from primary retention. Personal information deleted in production is purged from backups by the next full backup cycle, or remains in cold storage with no read access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Archived data must be tagged with its retention category to support automated disposal.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Secure Disposal", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Electronic media — cryptographic erasure or NIST 800-88 wipe.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Paper records — cross-cut shredding or certified destruction service.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Destruction must be logged with date, method, and responsible party.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Service Provider Coordination", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service providers and contractors must apply equivalent retention and disposal controls. Termination of a vendor engagement triggers return or certified destruction of all personal information held on {{COMPANY}}'s behalf.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — owns retention schedule and reviews annually.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering — implements automated retention and deletion in {{CRITICAL}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor Manager — confirms service-provider retention obligations during onboarding and at contract renewal.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to follow retention or disposal requirements may result in disciplinary action, contract termination for vendors, and corrective action up to formal incident handling.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually and after any material change in regulatory, contractual, or business retention requirements.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:46.540",
+    "updatedAt": "2026-04-27 23:14:12.855"
+  },
+  {
+    "id": "frk_pt_69f3dea1ba102e2350be4f9b",
+    "name": "PIPEDA Data Accuracy Policy",
+    "description": "Defines accuracy, completeness, and currency standards for personal information, the procedure for individuals to challenge accuracy, and propagation of corrections to third parties — supporting Principle 6.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure that personal information ({{DATA}}) held by {{COMPANY}} ({{COMPANYINFO}}) is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used, in line with PIPEDA Schedule 1, Principle 6.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personal information used to make decisions about individuals or shared with third parties, including data processed by {{SOFTWARE}} and stored in {{CRITICAL}}, across {{GEO}} and the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Accuracy Standards by Use", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Categorize each data element by use (decision-making, analytics, contact-only) and define the level of accuracy and currency required for each.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Routinely update only where necessary for the identified purpose; avoid unnecessary updating that itself creates risk.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For data used to make decisions affecting an individual (for example, service eligibility), require positive confirmation of accuracy before the decision is taken.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Source & Update Tracking", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Record the source of each personal information element and the date it was last collected, verified, or updated.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where information is collected from a third party, retain the date and channel of that collection.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Amendment Procedure", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide individuals a clear channel to challenge the accuracy or completeness of their personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On receipt of a substantiated challenge, amend the record without undue delay; where unable to amend, record the disagreement as a note on the record.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communicate amendments to third parties to whom the original (incorrect) information was disclosed within 30 days of the amendment.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Periodic Verification", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a documented accuracy review at least annually for high-impact data sets (for example, customer profiles used for billing, employee records used for compensation).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where an automated source of truth exists in {{SOFTWARE}}, document the synchronization frequency.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain accuracy challenges, decisions, and amendment evidence for at least seven years.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep evidence of downstream propagation to third-party recipients.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Annual accuracy review confirms sampling rate and corrective action; KPI tracks median time from challenge to amendment.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where amendment would conflict with another legal obligation (for example, tax or anti-money-laundering retention), document the conflict and the residual risk.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Repeated unresolved challenges trigger root-cause review and process change.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use access-request and complaint trends to identify accuracy hotspots and adjust the verification cadence.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:41.031",
+    "updatedAt": "2026-04-30 22:58:41.395"
+  },
+  {
+    "id": "frk_pt_69efd9c800ed19d26d6175f4",
+    "name": "Incident Response and Breach Notification Policy",
+    "description": "Defines the process for identifying, containing, investigating, and notifying affected consumers and regulators of data breaches in compliance with California Civil Code § 1798.82 and CCPA/CPRA obligations.",
+    "frequency": "yearly",
+    "department": "it",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define how {{COMPANY}} ({{COMPANYINFO}}) detects, contains, investigates, and notifies affected consumers and regulators of personal information security incidents, in compliance with California Civil Code § 1798.82 and the CCPA/CPRA.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any actual or suspected unauthorized access, acquisition, use, modification, destruction, or disclosure of {{DATA}} processed in {{CRITICAL}} or stored across {{GEO}}. Applies to incidents detected by {{COMPANY}} or reported by service providers, contractors, or third parties.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Detection and Reporting", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Employees and contractors must report any suspected incident to the Security Lead immediately, using the designated channel in {{SOFTWARE}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service providers and contractors must notify {{COMPANY}} of any incident affecting personal information without unreasonable delay and no later than 48 hours after discovery.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Triage and Containment", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Severity (S1–S4) and containment objectives are assigned within the first response window.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Preserve evidence (logs, system snapshots, chat transcripts) before remediating wherever possible.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Investigation", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Determine root cause, scope of personal information impacted, and time window of exposure.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document findings, decisions, and remediation actions in a single incident record.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Consumer Notification", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "When unauthorized acquisition of personal information is confirmed, notify affected California residents in the most expedient time possible and without unreasonable delay (Cal. Civ. Code § 1798.82).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notice content must include the categories of personal information involved, what happened, what {{COMPANY}} is doing in response, and what consumers can do to protect themselves.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Regulator Notification", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where notification is required to more than 500 California residents, submit the notice to the California Attorney General as required by law. Coordinate with Legal on any additional notifications under {{INDUSTRY}} regulations or contractual obligations.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Post-Incident Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct a blameless post-incident review within 10 business days of containment.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track corrective actions to closure and update controls, training, and runbooks accordingly.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Tabletop Exercises", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Run an annual tabletop exercise based on a personal information breach scenario; capture lessons learned and feed them into the IR playbook.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security Lead — Incident Commander; owns the response process.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — leads consumer notification scope and language.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Legal — owns regulator notifications and external counsel coordination.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering / IT — execute containment, eradication, and recovery.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to report or follow IR procedures may result in disciplinary action up to termination, vendor contract termination, and is itself a reportable compliance event.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually and after every material incident or significant change in {{COMPANY}}'s architecture or service portfolio.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:55.629",
+    "updatedAt": "2026-04-27 23:14:15.543"
+  },
+  {
+    "id": "frk_pt_69efd9ca0c5691e9ec1b1241",
+    "name": "Vendor and Third-Party Management Policy",
+    "description": "Governs due diligence, contracting, and ongoing oversight of service providers, contractors, and third parties that process personal information on the business's behalf, including required CCPA/CPRA contract terms.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Govern how {{COMPANY}} ({{COMPANYINFO}}) selects, contracts with, and oversees service providers, contractors, and third parties that process {{DATA}} on its behalf, ensuring they meet the requirements of the CCPA/CPRA.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any external party {{COMPANY}} engages that may receive, store, transmit, or otherwise process personal information, including hosting in {{CRITICAL}}, {{SOFTWARE}} integrations, and processors located in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Classification", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Classify each third party as Service Provider, Contractor, or Third Party under the CCPA/CPRA.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Selling or sharing personal information with a Third Party requires consumer notice and opt-out support.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Due Diligence", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Conduct privacy and security due diligence proportional to the sensitivity and volume of personal information involved (questionnaire, certifications, audit reports).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document residual risks and any compensating controls before signing.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Contract Requirements", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Limit use of personal information to the specified business purpose.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibit sale or sharing outside of {{COMPANY}}'s instructions, and prohibit combining personal information with other sources for unrelated use.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require cooperation with consumer rights requests (Know, Delete, Correct, Opt-Out, Limit) within {{COMPANY}}'s response timelines.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require equivalent technical and organizational safeguards, breach notification within 48 hours, and audit/inspection rights.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require deletion or return of personal information at end of engagement.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Sub-Processors", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Service Providers must obtain prior approval before engaging sub-processors that will access personal information and must flow down equivalent terms in their sub-processor agreements.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Ongoing Oversight", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reassess vendors annually based on risk tier, including review of certifications, breach history, and material changes in service.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a current vendor inventory tracking data shared, classification, contract status, and risk rating.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Termination", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "On termination, confirm in writing that the vendor has returned or securely destroyed all personal information, including copies in backups.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor Manager — owns lifecycle, due diligence, and reassessment.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — approves CCPA/CPRA contract terms and any new sub-processors.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Security Lead — reviews technical safeguards and breach handling.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Business Owner — accountable for vendor performance and remediation.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engaging a vendor without required diligence or contract terms is a policy violation; existing engagements found out of compliance must be remediated or terminated.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually and on material change in regulatory or contractual requirements affecting {{COMPANY}}.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:57.624",
+    "updatedAt": "2026-04-27 23:14:17.039"
+  },
+  {
+    "id": "frk_pt_69efd9cd0541d8cdb4cae9d1",
+    "name": "Data Classification and Inventory Policy",
+    "description": "Defines how personal information categories (including sensitive personal information) are identified, classified, inventoried, and tracked across systems and data flows.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define how {{COMPANY}} ({{COMPANYINFO}}) identifies, classifies, and inventories the personal information it processes, supporting accurate disclosures, consumer rights handling, and security controls under the CCPA/CPRA.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All {{DATA}} collected, used, sold, shared, stored, or transmitted by {{COMPANY}}, regardless of where it lives — including {{CRITICAL}}, {{SOFTWARE}}, and storage in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Classification Tiers", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Public — information intended for public disclosure (e.g. marketing site).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Internal — non-public business information not subject to special handling.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confidential — personal information and other data requiring access controls and encryption.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restricted — sensitive personal information (CPRA), payment card data, government IDs, health, biometrics.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "CCPA Personal Information Categories", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track each category collected (Identifiers, Customer Records, Protected Classifications, Commercial, Internet Activity, Geolocation, Sensory, Professional, Education, Inferences, Sensitive Personal Information).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For each category, document sources, business purposes, recipients, retention period, and whether it is sold or shared.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Inventory Maintenance", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a single, authoritative personal information inventory in {{SOFTWARE}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Re-validate the inventory at least annually and on any material change in product, processing, or vendor.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Data Flow Mapping", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Map how personal information flows between {{COMPANY}}, its workforce, {{CRITICAL}}, and external parties — including transfers to {{GEO}}.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tie each data flow to its associated lawful basis or business purpose, and to the receiving service provider, contractor, or third party.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Handling Requirements", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confidential and Restricted data must be encrypted in transit and at rest, access-controlled, and logged.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restricted (sensitive personal information) requires additional handling: minimization, separate access, and restricted use unless the consumer has explicitly authorized otherwise.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Public and Internal data follow {{COMPANY}}'s standard handling rules.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — owns classification scheme and inventory accuracy.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Data Stewards (per system) — keep their system's data inventory up to date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering — implements technical handling controls per classification tier.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Mishandling of classified data — including failure to apply the correct handling controls — is a policy violation and is investigated under the IR process.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually and on any material change in {{COMPANY}}'s product, customer base, or applicable law.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:49:00.955",
+    "updatedAt": "2026-04-27 23:14:20.041"
+  },
+  {
+    "id": "frk_pt_69efd9b6276adc8d2eb7844c",
+    "name": "Consumer Rights Request Policy",
+    "description": "Internal policy governing how the business receives, verifies, processes, and responds to consumer rights requests under the CCPA/CPRA, including timelines, escalation, and authorized agent handling.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Define how {{COMPANY}} ({{COMPANYINFO}}) intakes, verifies, processes, and responds to consumer rights requests under the CCPA/CPRA, ensuring timely and consistent handling across the business.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All employees and contractors of {{COMPANY}} who handle, route, or fulfill consumer rights requests touching {{DATA}} processed in {{CRITICAL}} or stored in {{GEO}}.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Intake Channels", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide at least two designated channels (web form and email) for consumers to submit rights requests.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Route all incoming requests into a single tracked queue managed in {{SOFTWARE}} and acknowledge receipt within 10 business days.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Identity Verification", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Use risk-based verification: lower bar for non-sensitive Right to Know, higher bar for Right to Delete or sensitive personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Match data points the consumer provides to data already on file. Never use new sensitive data solely for verification beyond what is necessary.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Authorized Agents", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Require written authorization signed by the consumer (or proof of power of attorney) before acting on an agent-submitted request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify the agent's identity and may directly verify the consumer where reasonable.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Right Handling", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Know — return categories and specific pieces of personal information for the prior 12 months (or longer if requested where data is available).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Delete — delete personal information from production, backups (per retention rules), and propagate to service providers and contractors.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Correct — correct inaccurate personal information using commercially reasonable efforts.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Opt-Out — disable sale/sharing flags and propagate to ad-tech and analytics partners; honor GPC signals.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Limit — restrict the use of sensitive personal information to permitted business purposes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document any statutory exemption used to deny or partially fulfill a request.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Response Timelines", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Acknowledge receipt within 10 business days.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Substantively respond within 45 calendar days, with one 45-day extension where reasonably necessary and the consumer is notified.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Non-Discrimination", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} does not discriminate against consumers who exercise their CCPA/CPRA rights. Differential pricing or service tiers are permitted only where reasonably related to the value of the data.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — owns the program, monitors SLA performance, and approves exceptions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer Support — first responder; performs intake and verification.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering — builds and maintains automated fulfillment paths and audit logs.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Legal — handles edge-case denials, exemptions, and regulator-facing communication.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to follow this policy may result in disciplinary action up to termination, contract termination for service providers, and reportable compliance findings.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed at least annually by the Privacy Officer; updated upon material change in law, intake channels, or fulfillment systems.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:38.357",
+    "updatedAt": "2026-04-27 23:16:53.315"
+  },
+  {
+    "id": "frk_pt_69efd9ae049ec9c862a64982",
+    "name": "Privacy Policy",
+    "description": "External-facing privacy policy describing categories of personal information collected, sources, business and commercial purposes, recipients, retention, consumer rights under CCPA/CPRA, methods to exercise them, and contact information.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Introduction", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} ({{COMPANYINFO}}) respects your privacy and is committed to handling personal information in accordance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have under California law.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Information We Collect", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Depending on how you interact with {{COMPANY}}, we may collect the following categories of {{DATA}}:", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identifiers (e.g. name, email, account ID, IP address).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer records (e.g. billing address, payment information).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Commercial information (e.g. products purchased, usage history).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Internet or network activity (e.g. browsing on our site, interactions with our services).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Geolocation, professional or employment-related information, and inferences drawn from the above.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "We collect this information directly from you, automatically through your use of our services, and from third-party sources such as service providers and partners.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "How We Use Personal Information", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Providing, maintaining, and improving our products and services.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Processing transactions, billing, and fulfilling contractual obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communicating with you, including service notices and support.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Securing our services, preventing fraud, and complying with legal obligations.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Analytics, product research, and marketing consistent with applicable law.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "How We Share Personal Information", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "We may disclose personal information to service providers and contractors that support our operations (e.g. hosting in {{CRITICAL}}, analytics, payment processing) under contracts that restrict their use of the data. We may also share information with affiliates, with your direction, or where required by law.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Sale or Sharing of Personal Information", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} discloses the categories of personal information sold or shared in the past 12 months in this policy. You can opt out at any time using the \"Do Not Sell or Share My Personal Information\" link on our site, or by submitting a request through the channels below. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Sensitive Personal Information", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "We use any sensitive personal information we collect only for the purposes permitted by the CPRA. You may request that we limit the use and disclosure of your sensitive personal information at any time using the \"Limit the Use of My Sensitive Personal Information\" link.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Retention", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are defined in {{COMPANY}}'s Data Retention and Disposal Policy.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Your CCPA / CPRA Rights", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Know — request the categories and specific pieces of personal information we have collected, sources, purposes, and recipients.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Delete — request deletion of personal information we have collected, subject to legal exceptions.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Correct — request correction of inaccurate personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Opt-Out — opt out of the sale or sharing of your personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Limit — restrict the use of sensitive personal information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Right to Non-Discrimination — exercise these rights without discrimination in price, quality, or service.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "How to Submit a Request", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Submit a rights request through the dedicated form on our website or by emailing the address in the Contact section below. We may need to verify your identity before fulfilling your request. We will respond within 45 days, with one 45-day extension as permitted by law.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Authorized Agents", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "You may use an authorized agent to submit a request on your behalf. We will require written authorization from you and may need to verify the agent's identity directly.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Minors", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "We do not knowingly sell or share personal information of consumers under 16 without affirmative opt-in. For consumers under 13, verifiable parental consent is required. See our Children's and Minors' Data Policy for details.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Changes to This Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{COMPANY}} reviews and updates this Privacy Policy at least annually and upon any material change in our processing activities or applicable law. The effective date of the latest version is shown at the top of this page.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Contact Us", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Questions about this Privacy Policy or your rights under the CCPA/CPRA can be directed to {{COMPANY}}'s Privacy Officer through the contact channels listed on our website.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:29.829",
+    "updatedAt": "2026-04-27 23:23:22.355"
+  },
   {
     "id": "frk_pt_6944570c25631cd097be8119",
     "name": "Network Security",
@@ -368,5 +478,45 @@
     "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "To ensure {{COMPANY}}'s network is configured to prevent unauthorized access and protect Cardholder Data (CHD).", "type": "text"}, {"type": "hardBreak"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Firewall & Network Controls", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Default Deny:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All inbound and outbound traffic must be blocked (\"Deny All\") unless explicitly allowed by a documented business need.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "DMZ Implementation:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Web servers facing the internet must reside in a DMZ (Demilitarized Zone). They must never communicate directly with the database; they must use an intermediary application layer.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Prohibited Direct Access:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Direct public access to the Cardholder Data Environment (CDE) is strictly forbidden.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Review Frequency:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Firewall and Security Group rules must be reviewed every ", "type": "text"}, {"text": "6 months", "type": "text", "marks": [{"type": "bold"}]}, {"text": " to remove unused or unsafe rules.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "System Configuration Standards", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Vendor Defaults:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All vendor-supplied default passwords (e.g., \"admin/admin\") must be changed ", "type": "text"}, {"text": "before", "type": "text", "marks": [{"type": "italic"}]}, {"text": " any system is installed on the network.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "System Hardening:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All servers must be configured according to industry-standard benchmarks (e.g., CIS Benchmarks). Unnecessary services, ports, and scripts must be disabled.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "One Function Per Server:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Servers in the CDE must have a primary function (e.g., Web Server OR Database, not both on the same machine) to isolate risk.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Remote Access", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Encrypted Management:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Non-console administrative access (SSH, RDP) must be encrypted using strong cryptography (SSHv2, TLS 1.2+). Telnet and standard HTTP management interfaces are forbidden.", "type": "text"}]}]}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Remote Work:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access from outside the corporate network requires Multi-Factor Authentication (MFA) and a secure VPN.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Documentation", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Network Diagrams:", "type": "text", "marks": [{"type": "bold"}]}, {"text": " ", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "A current network diagram showing all connections to/from the CDE must be maintained and updated upon any significant network change.", "type": "text"}]}]}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}}],
     "createdAt": "2025-12-18 19:33:31.814",
     "updatedAt": "2025-12-18 19:35:31.566"
+  },
+  {
+    "id": "frk_pt_69f3de9fefdbd94ed82d7fb0",
+    "name": "PIPEDA Personal Information Inventory & Purpose Register Policy",
+    "description": "Maintains a register of every category of personal information collected, the documented purpose for each, and the retention period — supporting PIPEDA Principles 2, 4, and 5.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document the categories of personal information that {{COMPANY}} ({{COMPANYINFO}}) collects across {{CRITICAL}} and {{DEVICES}}, the specific purposes for each, and the basis on which the information is collected — so that {{COMPANY}} can demonstrate compliance with the Identifying Purposes principle of PIPEDA Schedule 1.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All personal information ({{DATA}}) collected from customers, prospects, end users, employees, and contractors — whether collected directly, from third parties, or generated by {{SOFTWARE}} — and processed in {{GEO}} or by the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Personal Information Inventory", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a Personal Information Register cataloguing every category of {{DATA}}, including data elements, source, system of record in {{CRITICAL}}, and {{SOFTWARE}} processors.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Refresh the register at least quarterly and whenever a new collection point or data sharing arrangement is introduced.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Tag each entry with the originating business unit and the responsible system owner.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose Documentation", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For each entry, record the specific purpose(s) for which the information is collected, used, and disclosed, in plain language.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Distinguish primary purposes (necessary for service delivery) from secondary purposes (e.g. analytics, marketing) and mark each accordingly.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify the data elements that are mandatory for each purpose vs. optional.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "New Purpose Review", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any new purpose for an existing data category requires documented review by the privacy officer before processing begins.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where the new purpose was not identified at collection, obtain fresh consent or rely on a documented PIPEDA Section 7 exception.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update public notices and downstream consent records within 30 days of approval.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain the register, prior versions, and decision logs for new-purpose reviews for a minimum of seven years.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Keep evidence linking each register entry to its retention schedule and disposal method.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Quarterly review confirms the register is current, every entry has a documented purpose, and no purposes are in active use without an entry.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Any deviation (for example, emergency use of data outside the register) requires written justification by the privacy officer and post-hoc reconciliation within 10 business days.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Undocumented collection or processing triggers privacy incident response and corrective action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate findings from access requests, complaints, OPC guidance, and {{INDUSTRY}} norms into the register and review cadence.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:38.505",
+    "updatedAt": "2026-04-30 22:58:39.000"
+  },
+  {
+    "id": "frk_pt_69f3dea2fcbd4cc5934aacfa",
+    "name": "PIPEDA Access Request Policy",
+    "description": "Establishes the procedure for receiving, verifying, fulfilling, and responding to written access requests under PIPEDA — including identity verification, 30-day response, refusal handling, amendments, and propagation to third parties — supporting Principle 9.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Allow individuals to exercise their right under PIPEDA to be informed of the existence, use, and disclosure of their personal information ({{DATA}}) held by {{COMPANY}} ({{COMPANYINFO}}), and to access and challenge that information, in accordance with PIPEDA Schedule 1, Principle 9 and Section 8 of the Act.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All written access requests received by {{COMPANY}} from individuals (or their authorized representatives) regarding personal information held in {{CRITICAL}} or processed by {{SOFTWARE}}, regardless of where in {{GEO}} the individual resides.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Receiving Requests", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Publish at least one channel for submitting access requests (privacy email, web form, or postal address) in the privacy notice.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide reasonable assistance to individuals preparing a request, including helping them identify the categories of {{DATA}} they wish to access.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Log every request on receipt with date, requester, channel, and assigned handler.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Identity Verification", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Verify identity using a method proportionate to the sensitivity of the requested information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Request only the minimum information necessary to authenticate; do not require government-issued identifiers as a default.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "For requests submitted by an authorized representative, require evidence of authorization.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Response Timelines", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respond no later than 30 days after receipt of the request.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where a 30-day response is not possible, notify the individual in writing within the original 30-day period of an extension of up to 30 additional days, with reasons consistent with PIPEDA Section 8(4).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide the response in a generally understandable format, with explanations of any abbreviations or codes.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Fees", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Respond at minimal or no cost to the individual.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where a cost is unavoidable (for example, extensive copying or conversion to alternative format), inform the individual of the approximate cost in advance and obtain consent before proceeding.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Content of the Response", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Confirm whether {{COMPANY}} holds personal information about the individual.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide an account of how the information has been or is being used.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Identify, as specifically as possible, the third parties to whom the information has been disclosed; where a list is unavailable, provide the categories of organizations that may have received the information.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Indicate the source of the information where this can be determined.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Refusal & Recourse", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where access is refused under a PIPEDA Section 9 exception (for example, solicitor-client privilege or third-party information), notify the individual in writing with the reason, the specific exception relied on, and the recourse available, including the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC).", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain the information that is the subject of the request long enough for the individual to exhaust any recourse.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Amendment", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where the individual demonstrates that information is inaccurate or incomplete, amend it as appropriate.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where amendment is not made, record the disagreement in the file.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Communicate the amendment, where appropriate, to third parties having access to the information in question.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain the access request log, identity verification artefacts, and response correspondence for a minimum of seven years.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Restrict access to access-request files to the privacy officer and the assigned handler.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly KPI tracks median response time, percentage responded within 30 days, and refusal rate.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Section 9 statutory exceptions are documented in each instance with supporting analysis.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Missed 30-day deadlines trigger escalation to the privacy officer and root-cause review.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate findings from access requests, complaints, and OPC findings into the procedure each annual cycle.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:41.814",
+    "updatedAt": "2026-04-30 22:58:42.245"
+  },
+  {
+    "id": "frk_pt_69f3dea3d44e30408069e513",
+    "name": "PIPEDA Privacy Complaint Policy",
+    "description": "Establishes how the organization receives, investigates, and resolves complaints about its compliance with PIPEDA, including escalation to the Office of the Privacy Commissioner of Canada — supporting Principle 10.",
+    "frequency": "yearly",
+    "department": "gov",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide individuals with a simple, accessible procedure to challenge {{COMPANY}}'s ({{COMPANYINFO}}) compliance with PIPEDA, and ensure that complaints are investigated thoroughly and acted on promptly, in accordance with PIPEDA Schedule 1, Principle 10.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All privacy-related complaints, inquiries, and concerns received by {{COMPANY}} regarding the collection, use, disclosure, retention, accuracy, safeguarding, or accessibility of personal information ({{DATA}}), including complaints about processors operating in {{CRITICAL}} or about the {{LOCATION}} workforce.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Complaint Channels", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Publish a privacy complaint channel (privacy email, web form, postal address) in the privacy notice and on the {{COMPANY}} website.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Accept complaints in writing or verbally; for verbal complaints, transcribe and confirm in writing with the complainant.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Acknowledge receipt of every complaint within five business days.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Investigation Procedure", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Assign each complaint to a competent and impartial reviewer reporting to the privacy officer.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Investigate every complaint without undue delay, gathering documents, interviewing relevant staff, and reviewing logs and records as needed.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Document findings, root causes, and any corrective action taken.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Outcome & Notification", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Notify the complainant in writing of the outcome, the reasoning, and the corrective action (if any) taken.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where the complaint is found justified, take appropriate measures, including amending policies and practices, correcting individual records, retraining staff, or terminating non-compliant processing.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Where the complaint is not upheld, inform the complainant of the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) and provide the OPC's contact details.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Records & Retention", "type": "text"}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Maintain a complaint register including date received, nature, parties, status, outcome, and resolution date.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Retain complaint files for a minimum of seven years.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Provide aggregate complaint metrics to executive leadership at least annually.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy Compliance", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Compliance Measurement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Monthly KPI tracks median time to acknowledge, investigate, and resolve complaints; quarterly review of complaint themes drives systemic improvements.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Exceptions", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "None; all privacy complaints must be acknowledged and investigated.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Non-Compliance", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to acknowledge or investigate within timelines triggers escalation to executive leadership and corrective action.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Continual Improvement", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Integrate complaint trends, OPC findings, and {{INDUSTRY}} guidance into the annual review of all privacy policies and controls.", "type": "text"}]}]},
+    "createdAt": "2026-04-30 22:58:42.727",
+    "updatedAt": "2026-04-30 22:58:43.243"
+  },
+  {
+    "id": "frk_pt_69efd9cb30f8a9ef5e517812",
+    "name": "Privacy Awareness and Training Policy",
+    "description": "Requires annual privacy training for all employees handling personal information or consumer rights requests, including CCPA/CPRA requirements, internal request-handling procedures, and recordkeeping of training completion.",
+    "frequency": "yearly",
+    "department": "hr",
+    "content": {"type": "doc", "content": [{"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Purpose", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Ensure {{COMPANY}} ({{COMPANYINFO}}) staff who handle personal information understand their CCPA/CPRA responsibilities and the internal procedures used to honor consumer rights.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Scope", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All {{EMPLOYEES}} and contractors of {{COMPANY}} working in a {{LOCATION}} setting who access {{DATA}} or interact with consumer rights requests.", "type": "text"}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Cover the 10 Fair Information Principles (PIPEDA Schedule 1), the Privacy Officer's role, and the access-request and complaint procedures for all staff who collect, use, or disclose personal information.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Policy", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "New Hire Training", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "All new hires complete privacy and security awareness training within 30 days of start date, including a CCPA/CPRA module.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Access to systems containing personal information is contingent on training completion.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Annual Refresh", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Deliver annual refresh training covering: consumer rights, identity verification, response timelines, recordkeeping, and recognizing/reporting incidents.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Update content to reflect regulatory changes, internal procedure updates, and lessons from incidents or audits.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Refresh covers updates to PIPEDA, OPC guidance, and any changes to {{COMPANY}}'s privacy notice or consent practices.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Role-Based Training", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Customer Support — request intake, identity verification, escalation paths.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Engineering — privacy-by-design, secure handling of personal information, responding to delete/correct requests.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Marketing / Sales — opt-out signals, sale/share definitions, and ad-tech configuration.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Provide enhanced training for staff who handle access requests, consent collection, complaint intake, or sensitive personal information (health, financial, biometric).{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 3, "textAlign": null}, "content": [{"text": "Recordkeeping", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Track training completion in {{SOFTWARE}} and retain completion records for at least 24 months.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Send reminders to overdue staff; escalate non-completion to the manager and Privacy Officer.", "type": "text"}]}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "{{#if pipeda}}Retain training records for at least 24 months to support OPC inquiries.{{/if}}", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Roles and Responsibilities", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "bulletList", "content": [{"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Privacy Officer — defines curriculum and approves changes.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "People / HR — administers training delivery and tracks completion.", "type": "text"}]}]}, {"type": "listItem", "content": [{"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Managers — ensure their teams complete training on time.", "type": "text"}]}]}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Enforcement", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Failure to complete required training is a policy violation and may result in temporary suspension of system access until completed.", "type": "text"}]}, {"type": "heading", "attrs": {"level": 2, "textAlign": null}, "content": [{"text": "Review", "type": "text", "marks": [{"type": "bold"}]}]}, {"type": "paragraph", "attrs": {"textAlign": null}, "content": [{"text": "Reviewed annually by the Privacy Officer in coordination with People / HR; updated whenever regulatory or process changes warrant new content.", "type": "text"}]}]},
+    "createdAt": "2026-04-27 21:48:59.113",
+    "updatedAt": "2026-04-30 23:21:43.640"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json b/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
index 9492f51630..9f43dfcaa9 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorRequirement.json
@@ -8,15 +8,6 @@
     "createdAt": "2025-06-03 23:22:15.695",
     "updatedAt": "2025-06-04 21:41:09.189"
   },
-  {
-    "id": "frk_rq_681ed417c678d6e4a72ecc21",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "People Controls ",
-    "description": "Disciplinary process",
-    "identifier": "A.6.4",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-06 05:19:59.448"
-  },
   {
     "id": "frk_rq_681ec1a899a2a887571df4aa",
     "frameworkId": "frk_681ebae2f29f0ab08eb802ec",
@@ -278,15 +269,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_681ed173c4617d8242804d37",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "Organizational Controls",
-    "description": "Information security roles and responsibilities",
-    "identifier": "A.5.2",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-06 05:50:47.803"
-  },
   {
     "id": "frk_rq_681ec1c23827a73da573301b",
     "frameworkId": "frk_681ebae2f29f0ab08eb802ec",
@@ -324,103 +306,22 @@
     "updatedAt": "2025-05-14 19:20:44.920"
   },
   {
-    "id": "frk_rq_681ecca11f8e93d33110f582",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "4.1 Context of the organization",
-    "description": "Understanding the organization and its context",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681eccda0b0048baacc8384f",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "4.2 Context of the organization",
-    "description": "Needs & expectations of interested parties",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681eccf8ea16a6a8c71b2043",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "4.3 Context of the organization",
-    "description": "Determining the scope of the ISMS",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecea78867657c2a877498",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "4.4 Context of the Organization",
-    "description": "Information security management system (establish, implement, maintain, and continually improve)",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecec3bacaf5ec71310399",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "5.1 Leadership",
-    "description": "Leadership and commitment",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681eced25693b9ef01953cda",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "5.2 Leadership",
-    "description": "Information-security policy",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecee267499cb4e89dd597",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "5.3 Leadership",
-    "description": "Organizational roles, responsibilities, and authorities",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecf02da21ed278b8719a3",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "6.1.2 Planning",
-    "description": "Information-security risk assessment",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecef18eb5fc1de4b36922",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "6.1.1 Planning",
-    "description": "Actions to address risks and opportunities – General",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ecf0edd81451c5d7f942e",
+    "id": "frk_rq_681ed173c4617d8242804d37",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "6.1.3 Planning",
-    "description": "Information-security risk treatment",
-    "identifier": "",
+    "name": "A.5.2 Organizational Controls",
+    "description": "Information security roles and responsibilities",
+    "identifier": "A.5.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:29.581"
   },
   {
-    "id": "frk_rq_681ed058cb46f0ca43f4ac04",
+    "id": "frk_rq_681ed417c678d6e4a72ecc21",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "7.1 Support",
-    "description": "Resources",
-    "identifier": "",
+    "name": "A.6.4 People Controls ",
+    "description": "Disciplinary process",
+    "identifier": "A.6.4",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:29.986"
   },
   {
     "id": "frk_rq_681ec056ca6c6a446a9592b5",
@@ -612,967 +513,949 @@
     "updatedAt": "2025-05-14 19:20:44.920"
   },
   {
-    "id": "frk_rq_681ed06702eb40f21d9c3280",
+    "id": "frk_rq_681ecf0edd81451c5d7f942e",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "7.2 Support ",
-    "description": "Competence",
-    "identifier": "",
+    "name": "6.1.3 Planning",
+    "description": "Information-security risk treatment",
+    "identifier": "6.1.3 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:10.746"
   },
   {
-    "id": "frk_rq_681ed079b20c266ed3bcae4e",
+    "id": "frk_rq_681ecea78867657c2a877498",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "7.3 Support",
-    "description": "Awareness",
-    "identifier": "",
+    "name": "4.4 Context of the Organization",
+    "description": "Information security management system (establish, implement, maintain, and continually improve)",
+    "identifier": "4.4 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.884"
   },
   {
-    "id": "frk_rq_681ed083826218fefed135f7",
+    "id": "frk_rq_681ecec3bacaf5ec71310399",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "7.4 Support",
-    "description": "Communication",
-    "identifier": "",
+    "name": "5.1 Leadership",
+    "description": "Leadership and commitment",
+    "identifier": "5.1 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:29.283"
   },
   {
-    "id": "frk_rq_681ed09f0d780a205029c6f8",
+    "id": "frk_rq_681ecef18eb5fc1de4b36922",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "7.5.1 Support",
-    "description": "Documented information – General",
-    "identifier": "",
+    "name": "6.1.1 Planning",
+    "description": "Actions to address risks and opportunities – General",
+    "identifier": "6.1.1 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:10.871"
+  },
+  {
+    "id": "frk_rq_681eced25693b9ef01953cda",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "5.2 Leadership",
+    "description": "Information-security policy",
+    "identifier": "5.2 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:29.455"
+  },
+  {
+    "id": "frk_rq_681ecf02da21ed278b8719a3",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "6.1.2 Planning",
+    "description": "Information-security risk assessment",
+    "identifier": "6.1.2 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:10.995"
   },
   {
     "id": "frk_rq_681ed0aa105e90005119af94",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "7.5.2 Support",
     "description": "Documented information – Creating and updating",
-    "identifier": "",
+    "identifier": "7.5.2 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:11.194"
+  },
+  {
+    "id": "frk_rq_681ed09f0d780a205029c6f8",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "7.5.1 Support",
+    "description": "Documented information – General",
+    "identifier": "7.5.1 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:11.323"
+  },
+  {
+    "id": "frk_rq_681ed06702eb40f21d9c3280",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "7.2 Support ",
+    "description": "Competence",
+    "identifier": "7.2 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:12.075"
+  },
+  {
+    "id": "frk_rq_681ed058cb46f0ca43f4ac04",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "7.1 Support",
+    "description": "Resources",
+    "identifier": "7.1 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:11.909"
+  },
+  {
+    "id": "frk_rq_681ed079b20c266ed3bcae4e",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "7.3 Support",
+    "description": "Awareness",
+    "identifier": "7.3 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:11.782"
+  },
+  {
+    "id": "frk_rq_681ed083826218fefed135f7",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "7.4 Support",
+    "description": "Communication",
+    "identifier": "7.4",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:11.590"
   },
   {
     "id": "frk_rq_681ed0bfb77656558d34e07c",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "7.5.3 Support",
     "description": "Documented information – Control of documented information",
-    "identifier": "",
+    "identifier": "7.5.3 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:11.453"
+  },
+  {
+    "id": "frk_rq_681ed0f93b445441d7092481",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "8.3 Operation",
+    "description": "Information security risk treatment (operational)",
+    "identifier": "8.3",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 14:59:48.552"
   },
   {
     "id": "frk_rq_681ed0d7a55af6c0b644188b",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "8.1 Operation",
     "description": "Operational planning and control",
-    "identifier": "",
+    "identifier": "8.1",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:48.680"
   },
   {
     "id": "frk_rq_681ed0e87f1d7e373d990d48",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "8.2 Operation",
     "description": "Information security risk assessment (operational)",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed0f93b445441d7092481",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "8.3 Operation",
-    "description": "Information security risk treatment (operational)",
-    "identifier": "",
+    "identifier": "8.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:48.795"
   },
   {
     "id": "frk_rq_681ed1090eab65d82db8ba3e",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "9.1.1 Performance",
     "description": "Evaluation Monitoring, measurement, analysis and evaluation – General",
-    "identifier": "",
+    "identifier": "9.1.1",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:48.960"
   },
   {
     "id": "frk_rq_681ed11ec29b25b1192e96f6",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "9.1.2 Performance ",
+    "name": "9.1.2 Performance",
     "description": "Evaluation Evaluation of compliance",
-    "identifier": "",
+    "identifier": "9.1.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.088"
   },
   {
     "id": "frk_rq_681ed1295a639db1210e9237",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "9.2 Performance",
     "description": "Evaluation Internal audit",
-    "identifier": "",
+    "identifier": "9.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.227"
+  },
+  {
+    "id": "frk_rq_681ed1525f18dab66c1a2203",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": " 10.2 Improvement ",
+    "description": "Continual improvement",
+    "identifier": "10.2",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:28.941"
   },
   {
     "id": "frk_rq_681ed13272f6276ce54c2e23",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "9.3 Performance",
     "description": "Evaluation Management review",
-    "identifier": "",
+    "identifier": "9.3",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.431"
   },
   {
-    "id": "frk_rq_681ed1433a712ae09dc7633b",
+    "id": "frk_rq_681ed2170cb1b15f842b6f6d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "10.1 Improvement ",
-    "description": "Nonconformity and corrective action",
-    "identifier": "",
+    "name": "A.5.11 Organizational Controls ",
+    "description": "Return of assets",
+    "identifier": "A.5.11",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.659"
   },
   {
-    "id": "frk_rq_681ed1525f18dab66c1a2203",
+    "id": "frk_rq_681ed2229fa221e338501d51",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "10.2 Improvement ",
-    "description": "Continual improvement",
-    "identifier": "",
+    "name": "A.5.12 Organizational Controls",
+    "description": "Classification of information",
+    "identifier": "A.5.12 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.779"
   },
   {
-    "id": "frk_rq_681ed16583aa68b76c80917a",
+    "id": "frk_rq_681ed2314f568a3e5c3f1fbf",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.1 Organizational Controls ",
-    "description": "Policies for information security",
-    "identifier": "",
+    "name": "A.5.13 Organizational Controls",
+    "description": "Labelling of information",
+    "identifier": "A.5.13 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:49.999"
   },
   {
-    "id": "frk_rq_681ed1946de8b1beb5d5b987",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.4 Organizational Controls",
-    "description": "Management responsibilities",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed17f36423e887ec130f6",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "Organizational Controls",
-    "description": "Segregation of duties",
-    "identifier": "A.5.3",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-06 05:51:55.783"
-  },
-  {
-    "id": "frk_rq_681ed1ac19e3e7e1aef48517",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.5 Organizational Controls ",
-    "description": "Contact with authorities",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed1d5f29a33fa8735d51c",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.6 Organizational Controls",
-    "description": "Contact with special interest groups",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed1e1ad96b7f5e1659cab",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.7 Organizational Controls",
-    "description": "Threat intelligence",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed1f09741eeebee147fcb",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.8 Organizational Controls",
-    "description": "Information security in project management",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed1fe624cd14c34876ee8",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.9 Organizational Controls ",
-    "description": "Inventory of information and other associated assets",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed20a3f7335dd1ec64b6c",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.10 Organizational Controls",
-    "description": "Acceptable use of information and other associated assets",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed2170cb1b15f842b6f6d",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.11 Organizational Controls ",
-    "description": "Return of assets",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed2229fa221e338501d51",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.12 Organizational Controls",
-    "description": "Classification of information",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed2314f568a3e5c3f1fbf",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.13 Organizational Controls",
-    "description": "Labelling of information",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed23c61c97af7967b50c2",
+    "id": "frk_rq_681ed23c61c97af7967b50c2",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.14 Organizational Controls",
     "description": "Information transfer",
-    "identifier": "",
+    "identifier": "A.5.14",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:50.099"
   },
   {
     "id": "frk_rq_681ed24aa0809f09c4d22256",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.15 Organizational Controls",
     "description": "Access control",
-    "identifier": "",
+    "identifier": "A.5.15 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:50.215"
   },
   {
     "id": "frk_rq_681ed261918bb47df6590dac",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.16 Organizational Controls",
     "description": "Identity management",
-    "identifier": "",
+    "identifier": "A.5.16",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:50.343"
   },
   {
     "id": "frk_rq_681ed277348377c5b5f81649",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.17 Organizational Controls",
     "description": "Authentication information",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed2893326942f0ac88d81",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.18 Organizational Controls",
-    "description": "Access rights",
-    "identifier": "",
+    "identifier": "A.5.17",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed29613b703c7f368ffdc",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.19 Organizational Controls ",
-    "description": "Information security in supplier relationships",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 14:59:50.527"
   },
   {
     "id": "frk_rq_681ed2a8bda2e236fbc46492",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.20 Organizational Controls ",
     "description": "Addressing information security within supplier agreements\r\n",
-    "identifier": "",
+    "identifier": "A.5.20",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:30.313"
   },
   {
     "id": "frk_rq_681ed2be08112d94334bd319",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.21 Organizational Controls",
     "description": "Managing information security in the ICT supply chain",
-    "identifier": "",
+    "identifier": "A.5.21 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:30.509"
   },
   {
     "id": "frk_rq_681ed2c844494f7d1b01fa45",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.22 Organizational Controls",
     "description": "Monitoring, review and change management of supplier services",
-    "identifier": "",
+    "identifier": "A.5.22",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:30.654"
   },
   {
     "id": "frk_rq_681ed2e32d00654588c5103f",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.23 Organizational Controls",
     "description": "Information security for use of cloud services",
-    "identifier": "",
+    "identifier": "A.5.23",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:30.776"
   },
   {
     "id": "frk_rq_681ed2f378d4fbe2e39f5f76",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.24 Organizational Controls",
     "description": "Information security incident management responsibilities and procedures",
-    "identifier": "",
+    "identifier": "A.5.24 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.001"
+  },
+  {
+    "id": "frk_rq_681ed2893326942f0ac88d81",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.18 Organizational Controls",
+    "description": "Access rights",
+    "identifier": "A.5.18",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:29.807"
   },
   {
     "id": "frk_rq_681ed30003a95e3808397d6d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.25 Organizational Controls",
     "description": "Assessment and decision on information security events",
-    "identifier": "",
+    "identifier": "A.5.25",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.140"
   },
   {
     "id": "frk_rq_681ed3455f6b6695283a7c72",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.26 Organizational Controls ",
     "description": "Response to information security incidents",
-    "identifier": "",
+    "identifier": "A.5.26 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.351"
   },
   {
     "id": "frk_rq_681ed35d6330398a089100c1",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.27 Organizational Controls",
     "description": "Learning from information security incidents",
-    "identifier": "",
+    "identifier": "A.5.27",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.560"
   },
   {
     "id": "frk_rq_681ed36f9d1446b067a4990d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.28 Organizational Controls ",
     "description": "Collection of evidence",
-    "identifier": "",
+    "identifier": "A.5.28",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.721"
   },
   {
     "id": "frk_rq_681ed37df872af70c5430e7f",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.29 Organizational Controls ",
     "description": "Information security during disruption",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed38c0abdd2731880fa6e",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.5.30 Organizational Controls",
-    "description": "ICT readiness for business continuity",
-    "identifier": "",
+    "identifier": "A.5.29",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:31.881"
   },
   {
     "id": "frk_rq_681ed39e1c2f759d433992a7",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.31 Organizational Controls ",
     "description": "Legal, statutory, regulatory and contractual requirements",
-    "identifier": "",
+    "identifier": "A.5.31 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:32.270"
   },
   {
     "id": "frk_rq_681ed3ad17d5f7844774977a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.32 Organizational Controls",
     "description": "Intellectual property rights",
-    "identifier": "",
+    "identifier": "A.5.32",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:32.418"
   },
   {
     "id": "frk_rq_681ed3b87e88e0a249c2098a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.33 Organizational Controls",
     "description": "Protection of records",
-    "identifier": "",
+    "identifier": "A.5.33 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:32.627"
   },
   {
     "id": "frk_rq_681ed3c23adb2d4461dc09da",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.34 Organizational Controls",
     "description": "Privacy and protection of personally identifiable information (PII)",
-    "identifier": "",
+    "identifier": "A.5.34",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:32.764"
   },
   {
     "id": "frk_rq_681ed3d0342b5d531935cd62",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.35 Organizational Controls ",
     "description": "Independent review of information security",
-    "identifier": "",
+    "identifier": "A.5.35 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:32.900"
   },
   {
     "id": "frk_rq_681ed3dc1663fa62052ef548",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.36 Organizational Controls",
     "description": "Compliance with policies, rules and standards for information security",
-    "identifier": "",
+    "identifier": "A.5.36",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:33.101"
   },
   {
     "id": "frk_rq_681ed3e78e9b73cb6b279906",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.5.37 Organizational Controls ",
     "description": "Documented operating procedures",
-    "identifier": "",
+    "identifier": "A.5.37",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:33.241"
+  },
+  {
+    "id": "frk_rq_681ed1946de8b1beb5d5b987",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.4 Organizational Controls",
+    "description": "Management responsibilities",
+    "identifier": "A.5.4",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:33.378"
+  },
+  {
+    "id": "frk_rq_681ed1ac19e3e7e1aef48517",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.5 Organizational Controls ",
+    "description": "Contact with authorities",
+    "identifier": "A.5.5 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:33.630"
+  },
+  {
+    "id": "frk_rq_681ed1d5f29a33fa8735d51c",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.6 Organizational Controls",
+    "description": "Contact with special interest groups",
+    "identifier": "\t A.5.6 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:33.774"
+  },
+  {
+    "id": "frk_rq_681ed1e1ad96b7f5e1659cab",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.7 Organizational Controls",
+    "description": "Threat intelligence",
+    "identifier": "A.5.7",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:33.924"
+  },
+  {
+    "id": "frk_rq_681ed1f09741eeebee147fcb",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.8 Organizational Controls",
+    "description": "Information security in project management",
+    "identifier": "A.5.8",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:34.142"
+  },
+  {
+    "id": "frk_rq_681ed1fe624cd14c34876ee8",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.9 Organizational Controls ",
+    "description": "Inventory of information and other associated assets",
+    "identifier": "A.5.9 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:34.302"
   },
   {
     "id": "frk_rq_681ed3f78f28fba67dedc302",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.1 People Controls",
     "description": "Screening",
-    "identifier": "",
+    "identifier": "A.6.1 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:34.434"
   },
   {
     "id": "frk_rq_681ed40ec3b505552b76ce5f",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.3 People Controls",
     "description": "Information security awareness, education and training",
-    "identifier": "",
+    "identifier": "A.6.3 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:24.893"
   },
   {
     "id": "frk_rq_681ed423b43ec990bbd5f3b5",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.5 People Controls ",
     "description": "Responsibilities after termination or change of employment",
-    "identifier": "",
+    "identifier": "A.6.5",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:24.978"
   },
   {
     "id": "frk_rq_681ed4316c72a80ff5d1fdc6",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.6 People Controls ",
     "description": "Confidentiality or nondisclosure agreements",
-    "identifier": "",
+    "identifier": "A.6.6 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.046"
   },
   {
     "id": "frk_rq_681ed43f84399c54accb82b9",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.7 People Controls",
     "description": "Remote working",
-    "identifier": "",
+    "identifier": "A.6.7 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.121"
   },
   {
     "id": "frk_rq_681ed448a7cfe00afd2b0a19",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.6.8 People Controls",
     "description": "Information security event reporting",
-    "identifier": "",
+    "identifier": "A.6.8",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.229"
   },
   {
     "id": "frk_rq_681ed45b92c3b3f329d3858f",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.7.1 Physical Controls",
     "description": "Physical security perimeters",
-    "identifier": "",
+    "identifier": "A.7.1",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.751"
   },
   {
-    "id": "frk_rq_681ed46ff23ef8614d7f3042",
+    "id": "frk_rq_681ed16583aa68b76c80917a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.2 Physical Controls",
-    "description": "Physical entry",
-    "identifier": "",
+    "name": "A.5.1 Organizational Controls ",
+    "description": "Policies for information security",
+    "identifier": "A.5.1 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:30.198"
   },
   {
-    "id": "frk_rq_681ed47bac3dee3588290b04",
+    "id": "frk_rq_681ed17f36423e887ec130f6",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.3 Physical Controls",
-    "description": "Securing offices, rooms and facilities",
-    "identifier": "",
+    "name": "A.5.3 Organizational Controls",
+    "description": "Segregation of duties",
+    "identifier": "A.5.3",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:29.689"
   },
   {
-    "id": "frk_rq_681ed48f152068a490f317ac",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.4 Physical Controls",
-    "description": "Physical security monitoring",
+    "id": "frk_rq_681ef765ac1d9ef5ccf5d716",
+    "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
+    "name": "1.4.1 Network connections between trusted and untrusted networks are controlled.",
+    "description": "1.4.1 NSCs are implemented between trusted and untrusted networks.\r\n",
     "identifier": "",
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
   {
-    "id": "frk_rq_681ed61f357c7bf776300aa7",
+    "id": "frk_rq_681ed6afecd253fe6c3c060a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.5 Physical Controls",
-    "description": "Protecting against physical and environmental threats",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed62a1ad145f4554d4068",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.6 Physical Controls",
-    "description": "Working in secure areas",
-    "identifier": "",
+    "name": "A.8.3 Technological Controls",
+    "description": "Information access restriction",
+    "identifier": "A.8.3 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:12.562"
   },
   {
-    "id": "frk_rq_681ed6347b1e6eea717482ca",
+    "id": "frk_rq_681ed6c7eee985561d1f4d9b",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.7 Physical Controls",
-    "description": "Clear desk and clear screen",
-    "identifier": "",
+    "name": "A.8.5 Technological Controls ",
+    "description": "Secure authentication",
+    "identifier": "A.8.5 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:13.083"
   },
   {
-    "id": "frk_rq_681ed6497c1e390fe89f0dfa",
+    "id": "frk_rq_681ed6dc2a941d8ed887fa01",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.8 Physical Controls",
-    "description": "Equipment siting and protection",
-    "identifier": "",
+    "name": "A.8.7 Technological Controls ",
+    "description": "Protection against malware\r\n",
+    "identifier": "A.8.7",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:12.855"
   },
   {
-    "id": "frk_rq_681ed651d81e6c51934134bc",
+    "id": "frk_rq_681ed6eab8348ae42e9622d2",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.9 Physical Controls",
-    "description": "Security of assets off-premises",
-    "identifier": "",
+    "name": "A.8.8 Technological Controls",
+    "description": "Management of technical vulnerabilities",
+    "identifier": "A.8.8",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:12.464"
   },
   {
-    "id": "frk_rq_681ed65bb490440ea4f3b552",
+    "id": "frk_rq_681ed6d277a609269207598d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.10 Physical Controls",
-    "description": "Storage media",
-    "identifier": "",
+    "name": "A.8.6 Technological Controls ",
+    "description": "Capacity management",
+    "identifier": "A.8.6",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:12.763"
   },
   {
     "id": "frk_rq_681ed663b850258024b0b236",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.7.11 Physical Controls",
     "description": "Supporting utilities",
-    "identifier": "",
+    "identifier": "A.7.11 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.382"
   },
   {
-    "id": "frk_rq_681ed66d77af963d9763adeb",
+    "id": "frk_rq_681ed74124bbe51a72d0c154",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.12 Physical Controls",
-    "description": "Cabling security",
-    "identifier": "",
+    "name": "A.8.17 Technological Controls",
+    "description": "Clock synchronization",
+    "identifier": "A.8.17",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.970"
   },
   {
-    "id": "frk_rq_681ed6761e8f45c900e60be3",
+    "id": "frk_rq_681ed80ab572359972e06ace",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.7.13 Physical Controls",
-    "description": "Equipment maintenance",
-    "identifier": "",
+    "name": "A.8.32 Technological Controls",
+    "description": "Change management",
+    "identifier": "A.8.32",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.488"
   },
   {
     "id": "frk_rq_681ed686b626f985dac54c52",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.7.14 Physical Controls ",
     "description": " Secure disposal or reuse of equipment",
-    "identifier": "",
+    "identifier": "A.7.14 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed69ce5f84cf315240f7a",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.1 Technological Controls",
-    "description": "User endpoint devices",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681ed6a5d1683d54c08f7084",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.2 Technological Controls",
-    "description": "Privileged access rights",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.596"
   },
   {
-    "id": "frk_rq_681ed6afecd253fe6c3c060a",
+    "id": "frk_rq_681ed7ce83ab2029a9dc414c",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.3 Technological Controls",
-    "description": "Information access restriction",
-    "identifier": "",
+    "name": "A.8.28 Technological Controls",
+    "description": "Secure coding",
+    "identifier": "A.8.28",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.121"
   },
   {
-    "id": "frk_rq_681ed6ba79910ff5b9c7d76f",
+    "id": "frk_rq_681ed47bac3dee3588290b04",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.4 Technological Controls",
-    "description": "Access to source code",
-    "identifier": "",
+    "name": "A.7.3 Physical Controls",
+    "description": "Securing offices, rooms and facilities",
+    "identifier": "A.7.3",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.884"
   },
   {
-    "id": "frk_rq_681ed6c7eee985561d1f4d9b",
+    "id": "frk_rq_681ed813388d3297b3ed3e73",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.5 Technological Controls ",
-    "description": "Secure authentication",
-    "identifier": "",
+    "name": "A.8.33 Technological Controls",
+    "description": "Test information",
+    "identifier": "A.8.33",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.548"
   },
   {
-    "id": "frk_rq_681ed6d277a609269207598d",
+    "id": "frk_rq_681ed6a5d1683d54c08f7084",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.6 Technological Controls ",
-    "description": "Capacity management",
-    "identifier": "",
+    "name": "A.8.2 Technological Controls",
+    "description": "Privileged access rights",
+    "identifier": "A.8.2 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.233"
   },
   {
-    "id": "frk_rq_681ed6dc2a941d8ed887fa01",
+    "id": "frk_rq_681ed6347b1e6eea717482ca",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.7 Technological Controls ",
-    "description": "Protection against malware\r\n",
-    "identifier": "",
+    "name": "A.7.7 Physical Controls",
+    "description": "Clear desk and clear screen",
+    "identifier": "A.7.7",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.167"
   },
   {
-    "id": "frk_rq_681ed6eab8348ae42e9622d2",
+    "id": "frk_rq_681ed6497c1e390fe89f0dfa",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.8 Technological Controls",
-    "description": "Management of technical vulnerabilities",
-    "identifier": "",
+    "name": "A.7.8 Physical Controls",
+    "description": "Equipment siting and protection",
+    "identifier": "A.7.8",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.284"
   },
   {
-    "id": "frk_rq_681ed6f360678a6cf25345b2",
+    "id": "frk_rq_681ed651d81e6c51934134bc",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.9 Technological Controls",
-    "description": "Configuration management",
-    "identifier": "",
+    "name": "A.7.9 Physical Controls",
+    "description": "Security of assets off-premises",
+    "identifier": "A.7.9 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.356"
   },
   {
-    "id": "frk_rq_681ed6fbb7447647d630bfac",
+    "id": "frk_rq_681ed6ba79910ff5b9c7d76f",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.10 Technological Controls",
-    "description": "Information deletion",
-    "identifier": "",
+    "name": "A.8.4 Technological Controls",
+    "description": "Access to source code",
+    "identifier": "A.8.4 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-23 14:43:12.356"
   },
   {
     "id": "frk_rq_681ed70245119fe4e1943d4a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.8.11 Technological Controls",
     "description": "Data masking",
-    "identifier": "",
+    "identifier": "A.8.11",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.488"
   },
   {
-    "id": "frk_rq_681ed70cd5e3fc570dd75770",
+    "id": "frk_rq_681ed7901ab04aa5a1d27890",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.12 Technological Controls",
-    "description": "Data leakage prevention",
-    "identifier": "",
+    "name": "A.8.24 Technological Controls",
+    "description": "Use of cryptography",
+    "identifier": "A.8.24 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.880"
   },
   {
     "id": "frk_rq_681ed713c378baffc34d25f5",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.8.13 Technological Controls",
     "description": "Information backup",
-    "identifier": "",
+    "identifier": "A.8.13",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.626"
   },
   {
-    "id": "frk_rq_681ed71f9deddd61109308dd",
+    "id": "frk_rq_681ed7e50f718eb161dd5605",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.14 Technological Controls",
-    "description": "Redundancy of information-processing facilities",
-    "identifier": "",
+    "name": "A.8.31 Technological Controls",
+    "description": "Separation of development, test and production environments",
+    "identifier": "A.8.31 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.435"
   },
   {
     "id": "frk_rq_681ed7326db82252ea6faa67",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
     "name": "A.8.15 Technological Controls ",
     "description": "Logging",
-    "identifier": "",
+    "identifier": "A.8.15",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.845"
   },
   {
-    "id": "frk_rq_681ed739dc6d14f4ad5d95d2",
+    "id": "frk_rq_681ed7b407395dfc68ff955d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.16 Technological Controls",
-    "description": "Monitoring activities",
-    "identifier": "",
+    "name": "A.8.26 Technological Controls",
+    "description": "Application security requirements",
+    "identifier": "A.8.26 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.009"
   },
   {
-    "id": "frk_rq_681ed74124bbe51a72d0c154",
+    "id": "frk_rq_681ed65bb490440ea4f3b552",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.17 Technological Controls",
-    "description": "Clock synchronization",
-    "identifier": "",
+    "name": "A.7.10 Physical Controls",
+    "description": "Storage media",
+    "identifier": "A.7.10",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.309"
   },
   {
-    "id": "frk_rq_681ed748dab9fd6d58f20964",
+    "id": "frk_rq_681ed66d77af963d9763adeb",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.18 Technological Controls",
-    "description": "Use of privileged utility programs",
-    "identifier": "",
+    "name": "A.7.12 Physical Controls",
+    "description": "Cabling security",
+    "identifier": "A.7.12",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.451"
   },
   {
-    "id": "frk_rq_681ed7532959ec62c8ae815c",
+    "id": "frk_rq_681ed6761e8f45c900e60be3",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.19 Technological Controls ",
-    "description": "Installation of software on operational systems",
-    "identifier": "",
+    "name": "A.7.13 Physical Controls",
+    "description": "Equipment maintenance",
+    "identifier": "A.7.13",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.520"
   },
   {
-    "id": "frk_rq_681ed76e19cca49a6ac49bf8",
+    "id": "frk_rq_681ed69ce5f84cf315240f7a",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.20 Technological Controls",
-    "description": "Networks security",
-    "identifier": "",
+    "name": "A.8.1 Technological Controls",
+    "description": "User endpoint devices",
+    "identifier": "A.8.1",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.469"
   },
   {
-    "id": "frk_rq_681ed7794b363009725bab5b",
+    "id": "frk_rq_681ed46ff23ef8614d7f3042",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.21 Technological Controls",
-    "description": "Security of network services",
-    "identifier": "",
+    "name": "A.7.2 Physical Controls",
+    "description": "Physical entry",
+    "identifier": "A.7.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.815"
   },
   {
-    "id": "frk_rq_681ed781b79f824466be5394",
+    "id": "frk_rq_681ed48f152068a490f317ac",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.22 Technological Controls",
-    "description": "Segregation of networks",
-    "identifier": "",
+    "name": "A.7.4 Physical Controls",
+    "description": "Physical security monitoring",
+    "identifier": "A.7.4 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:25.953"
   },
   {
-    "id": "frk_rq_681ed789b359f075b12e20c0",
+    "id": "frk_rq_681ed62a1ad145f4554d4068",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.23 Technological Controls",
-    "description": "Web filtering",
-    "identifier": "",
+    "name": "A.7.6 Physical Controls",
+    "description": "Working in secure areas",
+    "identifier": "A.7.6 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.087"
   },
   {
-    "id": "frk_rq_681ed7901ab04aa5a1d27890",
+    "id": "frk_rq_681ed6fbb7447647d630bfac",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.24 Technological Controls",
-    "description": "Use of cryptography",
-    "identifier": "",
+    "name": "A.8.10 Technological Controls",
+    "description": "Information deletion",
+    "identifier": "A.8.10",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.422"
   },
   {
-    "id": "frk_rq_681ed799ca7b40e2d8ed55ba",
+    "id": "frk_rq_681ed70cd5e3fc570dd75770",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.25 Technological Controls",
-    "description": "Secure development life cycle",
-    "identifier": "",
+    "name": "A.8.12 Technological Controls",
+    "description": "Data leakage prevention",
+    "identifier": "A.8.12",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.557"
   },
   {
-    "id": "frk_rq_681ed7b407395dfc68ff955d",
+    "id": "frk_rq_681ed71f9deddd61109308dd",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.26 Technological Controls",
-    "description": "Application security requirements",
-    "identifier": "",
+    "name": "A.8.14 Technological Controls",
+    "description": "Redundancy of information-processing facilities",
+    "identifier": "A.8.14",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.784"
   },
   {
-    "id": "frk_rq_681ed7c75e421b346480e046",
+    "id": "frk_rq_681ed739dc6d14f4ad5d95d2",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.27 Technological Controls",
-    "description": "Secure system architecture and engineering principles",
-    "identifier": "",
+    "name": "A.8.16 Technological Controls",
+    "description": "Monitoring activities",
+    "identifier": "A.8.16 ",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:26.910"
   },
   {
-    "id": "frk_rq_681ed7ce83ab2029a9dc414c",
+    "id": "frk_rq_681ed748dab9fd6d58f20964",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.28 Technological Controls",
-    "description": "Secure coding",
-    "identifier": "",
+    "name": "A.8.18 Technological Controls",
+    "description": "Use of privileged utility programs",
+    "identifier": "A.8.18",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.305"
   },
   {
-    "id": "frk_rq_681ed7d719388daff946a68d",
+    "id": "frk_rq_681ed76e19cca49a6ac49bf8",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.29 Technological Controls",
-    "description": "Security testing in development and acceptance",
-    "identifier": "",
+    "name": "A.8.20 Technological Controls",
+    "description": "Networks security",
+    "identifier": "A.8.20",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.539"
   },
   {
-    "id": "frk_rq_681ed7de305465fe226fc39d",
+    "id": "frk_rq_681ed781b79f824466be5394",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.30 Technological Controls",
-    "description": "Outsourced development",
-    "identifier": "",
+    "name": "A.8.22 Technological Controls",
+    "description": "Segregation of networks",
+    "identifier": "A.8.22",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.673"
   },
   {
-    "id": "frk_rq_681ef765ac1d9ef5ccf5d716",
-    "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
-    "name": "1.4.1 Network connections between trusted and untrusted networks are controlled.",
-    "description": "1.4.1 NSCs are implemented between trusted and untrusted networks.\r\n",
-    "identifier": "",
+    "id": "frk_rq_681ed789b359f075b12e20c0",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.8.23 Technological Controls",
+    "description": "Web filtering",
+    "identifier": "A.8.23",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:27.823"
   },
   {
-    "id": "frk_rq_681ed4019aa553be924ee291",
+    "id": "frk_rq_681ed799ca7b40e2d8ed55ba",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "People Controls",
-    "description": "Terms and conditions of employment",
-    "identifier": "A.6.2",
+    "name": "A.8.25 Technological Controls",
+    "description": "Secure development life cycle",
+    "identifier": "A.8.25",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-06 05:52:24.793"
+    "updatedAt": "2026-04-20 15:04:27.950"
   },
   {
-    "id": "frk_rq_681ed7e50f718eb161dd5605",
+    "id": "frk_rq_681ed7c75e421b346480e046",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.31 Technological Controls",
-    "description": "Separation of development, test and production environments",
-    "identifier": "",
+    "name": "A.8.27 Technological Controls",
+    "description": "Secure system architecture and engineering principles",
+    "identifier": "A.8.27",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.063"
   },
   {
-    "id": "frk_rq_681ed80ab572359972e06ace",
+    "id": "frk_rq_681ed7d719388daff946a68d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.32 Technological Controls",
-    "description": "Change management",
-    "identifier": "",
+    "name": "A.8.29 Technological Controls",
+    "description": "Security testing in development and acceptance",
+    "identifier": "A.8.29",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.173"
   },
   {
-    "id": "frk_rq_681ed813388d3297b3ed3e73",
+    "id": "frk_rq_681ed7de305465fe226fc39d",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.33 Technological Controls",
-    "description": "Test information",
-    "identifier": "",
+    "name": "A.8.30 Technological Controls",
+    "description": "Outsourced development",
+    "identifier": "A.8.30",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:28.372"
   },
   {
-    "id": "frk_rq_681ed81d5e01d43ada52ffae",
+    "id": "frk_rq_681ed4019aa553be924ee291",
     "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "A.8.34 Technological Controls ",
-    "description": "Protection of information systems during audit and testing",
-    "identifier": "",
+    "name": "A.6.2 People Controls",
+    "description": "Terms and conditions of employment",
+    "identifier": "A.6.2",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-20 15:04:29.796"
   },
   {
     "id": "frk_rq_681edd9def88a866a327ad94",
@@ -1853,15 +1736,6 @@
     "createdAt": "2025-06-03 23:24:37.378",
     "updatedAt": "2025-06-04 21:44:53.687"
   },
-  {
-    "id": "frk_rq_681fe258330b292af74be717",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "General Rules",
-    "description": "General requirements\r\n\r\nEnsure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.",
-    "identifier": "164.306(a.1)",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-09 01:25:18.647"
-  },
   {
     "id": "frk_rq_681ef78d507099efe7aff812",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -1934,6 +1808,15 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
+  {
+    "id": "frk_rq_681fe258330b292af74be717",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.306(a.1) General Rules",
+    "description": "General requirements\r\n\r\nEnsure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.",
+    "identifier": "164.306(a.1)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:59:00.986"
+  },
   {
     "id": "frk_rq_681ef8f0554e8fe0b3598167",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -2213,15 +2096,6 @@
     "createdAt": "2025-06-03 23:27:11.134",
     "updatedAt": "2025-06-04 21:49:08.151"
   },
-  {
-    "id": "frk_rq_681fe28e3e639ff197fed198",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "General Rules",
-    "description": "General requirements\r\n\r\nProtect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.",
-    "identifier": "164.306(a.3) ",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-09 01:25:28.675"
-  },
   {
     "id": "frk_rq_681f8ef5d93571d7cecb629b",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -2312,6 +2186,15 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
+  {
+    "id": "frk_rq_681fe28e3e639ff197fed198",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.306(a.3) General Rules",
+    "description": "General requirements\r\n\r\nProtect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.",
+    "identifier": "164.306(a.3)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:59.950"
+  },
   {
     "id": "frk_rq_681f9154f48ff5cf10d36b3d",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -2429,15 +2312,6 @@
     "createdAt": "2025-06-03 23:28:15.428",
     "updatedAt": "2025-06-04 21:50:49.364"
   },
-  {
-    "id": "frk_rq_681fe27650feb9e1decf9b8e",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "General Rules",
-    "description": "General requirements\r\n\r\nProtect against any reasonably anticipated threats or hazards to the security or integrity of such information.",
-    "identifier": "164.306(a.2) ",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-09 01:25:41.971"
-  },
   {
     "id": "frk_rq_681f9413f598932f058b541d",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -2636,15 +2510,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_681fe79871e99458f760abba",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.308(a.6.i) Administrative safeguards",
-    "description": "Standard: Security incident procedures.  Implement policies and procedures to address security incidents.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
   {
     "id": "frk_rq_681f97339b56ff96c517d061",
     "frameworkId": "frk_681ef4bb8eeb2b60d2d9d187",
@@ -3311,15 +3176,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_681fe2c0b70c40a7af7538c1",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.306(a.4) General Rules",
-    "description": "General requirements\r\n\r\nEnsure compliance with this subpart by its workforce.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
   {
     "id": "frk_rq_68201502a79c88a0e564e122",
     "frameworkId": "frk_6820090a1653380dd386c5eb",
@@ -4171,603 +4027,540 @@
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(b.1) General Rules",
     "description": "Flexibility of approach\r\n\r\nCovered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.",
-    "identifier": "",
+    "identifier": "164.306(b.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:29.005"
   },
   {
     "id": "frk_rq_681fe3516e9d623341576827",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(b.2) General Rules",
     "description": "Flexibility of approach.\r\n\r\nIn deciding which security measures to use, a covered entity or business associate must take into account the following factors:\r\n\r\n(i) The size, complexity, and capabilities of the covered entity or business associate.\r\n\r\n(ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities.\r\n\r\n(iii) The costs of security measures.\r\n\r\n(iv) The probability and criticality of potential risks to electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.306(b.2)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:29.432"
   },
   {
     "id": "frk_rq_681fe373eec04bb563a58ebc",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(c) General Rules",
     "description": "Standards.  \r\n\r\nA covered entity or business associate must comply with the applicable standards as provided in this section and in §§ 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.306(c)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:29.853"
   },
   {
     "id": "frk_rq_681fe3bfba9f2b5679d07384",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(d.1) General Rules",
     "description": "Implementation specifications\r\n\r\nImplementation specifications are required or addressable. If an implementation specification is required, the word “Required” appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word “Addressable” appears in parentheses after the title of the implementation specification",
-    "identifier": "",
+    "identifier": "164.306(d.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:30.533"
   },
   {
     "id": "frk_rq_681fe3e05e9443385b5f512a",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(d.2) General Rules",
     "description": "Implementation specifications\r\n\r\nWhen a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fe40489876e2fe301c757",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.306(d.3) General Rules",
-    "description": "Implementation specifications\r\n\r\nWhen a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes addressable implementation specifications, a covered entity or business associate must—\r\n\r\n(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and\r\n\r\n(ii) As applicable to the covered entity or business associate—\r\n\r\n(A) Implement the implementation specification if reasonable and appropriate; or\r\n\r\n(B) If implementing the implementation specification is not reasonable and appropriate—\r\n\r\n$(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and\r\n\r\n$(2) Implement an equivalent alternative measure if reasonable and appropriate.",
-    "identifier": "",
+    "identifier": "164.306(d.2)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:30.986"
   },
   {
     "id": "frk_rq_681fe413d1788e6d2a2e0e70",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.306(e) General Rules",
     "description": "Maintenance.  \r\n\r\nA covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with § 164.316(b)(2)(iii).",
-    "identifier": "",
+    "identifier": "164.306(e)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:31.808"
   },
   {
     "id": "frk_rq_681fe4f2409a61f406391e27",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.1.i) Administrative safeguards",
     "description": "Standard: Security management process.  Implement policies and procedures to prevent, detect, contain, and correct security violations.",
-    "identifier": "",
+    "identifier": "164.308(a.1.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:32.244"
   },
   {
     "id": "frk_rq_681fe50a602bee19cc6c58de",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.1.ii.A) Administrative safeguards",
     "description": "Risk analysis (Required).  \r\n\r\nConduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.",
-    "identifier": "",
+    "identifier": "164.308(a.1.ii.A)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:32.600"
   },
   {
     "id": "frk_rq_681fe525546b5f5cbaa4caba",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.1.ii.B) Administrative safeguards",
     "description": "Risk management (Required).  \r\n\r\nImplement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).",
-    "identifier": "",
+    "identifier": "164.308(a.1.ii.B)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:33.000"
   },
   {
     "id": "frk_rq_681fe539da6767ccaa42fd4f",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.1.ii.C) Administrative safeguards",
     "description": "Sanction policy (Required).  \r\n\r\nApply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.",
-    "identifier": "",
+    "identifier": "164.308(a.1.ii.C)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:33.359"
   },
   {
     "id": "frk_rq_681fe5585124a63c27427588",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.1.ii.D) Administrative safeguards",
     "description": "Information system activity review (Required).  \r\n\r\nImplement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.",
-    "identifier": "",
+    "identifier": "164.308(a.1.ii.D)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:33.719"
   },
   {
     "id": "frk_rq_681fe569c808990634c7168b",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.2) Administrative safeguards",
     "description": "Standard: Assigned security responsibility.  Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.",
-    "identifier": "",
+    "identifier": "164.308(a.2)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:34.151"
   },
   {
     "id": "frk_rq_681fe58b5d73fb1379508c93",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.3.i) Administrative safeguards",
     "description": "Standard: Workforce security.  Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.308(a.3.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:34.565"
   },
   {
     "id": "frk_rq_681fe5b24ae8db1cf3743db7",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.3.ii.A) Administrative safeguards",
     "description": "Implementation specifications:\r\n\r\nAuthorization and/or supervision (Addressable).  \r\n\r\nImplement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.",
-    "identifier": "",
+    "identifier": "164.308(a.3.ii.A)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:34.927"
   },
   {
     "id": "frk_rq_681fe614fa8f4da199b1ab38",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.3.ii.B) Administrative safeguards",
     "description": "Workforce clearance procedure (Addressable).  \r\n\r\nImplement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.",
-    "identifier": "",
+    "identifier": "164.308(a.3.ii.B)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:35.311"
   },
   {
     "id": "frk_rq_681fe62d157ad538df0ac0b7",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.3.ii.C) Administrative safeguards",
     "description": "Termination procedures (Addressable). \r\n\r\nImplement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fe75f468516745997ca4f",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.308(a.5.ii.D) Administrative safeguards",
-    "description": "Password management (Addressable).  \r\n\r\nProcedures for creating, changing, and safeguarding passwords.",
-    "identifier": "",
+    "identifier": "164.308(a.3.ii.C)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:35.896"
   },
   {
     "id": "frk_rq_681fe6440866ea8f5cc73562",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.4.i) Administrative safeguards",
     "description": "Standard: Information access management.  Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.",
-    "identifier": "",
+    "identifier": "164.308(a.4.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:36.283"
   },
   {
     "id": "frk_rq_681fe694c60456dba73c3560",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.4.ii.A) Administrative safeguards",
     "description": "Isolating health care clearinghouse functions (Required).  \r\n\r\nIf a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.",
-    "identifier": "",
+    "identifier": "164.308(a.4.ii.A)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:36.726"
   },
   {
     "id": "frk_rq_681fe6aaee3cfefbf52d714e",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.4.ii.B) Administrative safeguards",
     "description": "Access authorization (Addressable). \r\n\r\nImplement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.",
-    "identifier": "",
+    "identifier": "164.308(a.4.ii.B)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:37.112"
   },
   {
     "id": "frk_rq_681fe6bfe73e1970fc679d5d",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.4.ii.C) Administrative safeguards",
     "description": "Access establishment and modification (Addressable).  \r\n\r\nImplement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.",
-    "identifier": "",
+    "identifier": "164.308(a.4.ii.C)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:37.755"
   },
   {
     "id": "frk_rq_681fe6d4eca9ce895d67b372",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.5.i) Administrative safeguards",
     "description": "Standard: Security awareness and training.  Implement a security awareness and training program for all members of its workforce (including management).",
-    "identifier": "",
+    "identifier": "164.308(a.5.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:38.232"
   },
   {
     "id": "frk_rq_681fe6e799239e3a7cbe2dec",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.5.ii.A) Administrative safeguards",
     "description": "Security reminders (Addressable).  \r\n\r\nPeriodic security updates.",
-    "identifier": "",
+    "identifier": "164.308(a.5.ii.A)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:38.661"
   },
   {
-    "id": "frk_rq_681fe7022814f2d467948e70",
+    "id": "frk_rq_681fe75f468516745997ca4f",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.308(a.5.ii.B) Administrative safeguards",
-    "description": "Protection from malicious software (Addressable).  \r\n\r\nProcedures for guarding against, detecting, and reporting malicious software.",
-    "identifier": "",
+    "name": "164.308(a.5.ii.D) Administrative safeguards",
+    "description": "Password management (Addressable).  \r\n\r\nProcedures for creating, changing, and safeguarding passwords.",
+    "identifier": "164.308(a.5.ii.D)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:39.860"
   },
   {
     "id": "frk_rq_681fe74bab9fd5739de31a2c",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.5.ii.C) Administrative safeguards",
     "description": "Log-in monitoring (Addressable).\r\n\r\n Procedures for monitoring log-in attempts and reporting discrepancies.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fe7b3f5e3ea69698e52e2",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.308(a.6.ii) Administrative safeguards",
-    "description": "Implementation specification: Response and reporting (Required).  \r\n\r\nIdentify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.",
-    "identifier": "",
+    "identifier": "164.308(a.5.ii.C)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:39.402"
   },
   {
     "id": "frk_rq_681fe7e322489db98e7f3c1d",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.i) Administrative safeguards",
     "description": "Standard: Contingency plan.  Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.308(a.7.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:41.021"
   },
   {
     "id": "frk_rq_681fe7f6eb651bd238597fff",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.ii.A) Administrative safeguards",
     "description": "Data backup plan (Required).  \r\n\r\nEstablish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.308(a.7.ii.A)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:41.443"
   },
   {
     "id": "frk_rq_681fe82f9caaf24857c1aabc",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.ii.B) Administrative safeguards",
     "description": "Disaster recovery plan (Required).  \r\n\r\nEstablish (and implement as needed) procedures to restore any loss of data.",
-    "identifier": "",
+    "identifier": "164.308(a.7.ii.B)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:41.795"
   },
   {
     "id": "frk_rq_681fe841094784b88791952e",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.ii.c) Administrative safeguards",
     "description": "Emergency mode operation plan (Required).  \r\n\r\nEstablish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.",
-    "identifier": "",
+    "identifier": "164.308(a.7.ii.c)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:42.239"
   },
   {
     "id": "frk_rq_681fe8577f4153ab83dbedf2",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.ii.D) Administrative safeguards",
     "description": "Testing and revision procedures (Addressable).  \r\n\r\nImplement procedures for periodic testing and revision of contingency plans.",
-    "identifier": "",
+    "identifier": "164.308(a.7.ii.D)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:42.599"
   },
   {
     "id": "frk_rq_681fe8697bff206f287d79cb",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.7.ii.E) Administrative safeguards",
     "description": "Applications and data criticality analysis (Addressable).  \r\n\r\nAssess the relative criticality of specific applications and data in support of other contingency plan components.",
-    "identifier": "",
+    "identifier": "164.308(a.7.ii.E)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:43.002"
   },
   {
     "id": "frk_rq_681fe87de28c10ea32f74832",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(a.8) Administrative safeguards",
     "description": "Standard: Evaluation.  Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.",
-    "identifier": "",
+    "identifier": "164.308(a.8)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:43.354"
   },
   {
     "id": "frk_rq_681fe89fa3aa895de49e995e",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(b.1) Administrative safeguards",
     "description": "Business associate contracts and other arrangements.  A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.",
-    "identifier": "",
+    "identifier": "164.308(b.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:43.770"
   },
   {
     "id": "frk_rq_681fe8aa3d80a91789ce36c6",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(b.2) Administrative safeguards",
     "description": "A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with § 164.314(a), that the subcontractor will appropriately safeguard the information.",
-    "identifier": "",
+    "identifier": "164.308(b.2)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:44.132"
   },
   {
     "id": "frk_rq_681fe8b819b58da63cf250ac",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.308(b.3) Administrative safeguards",
     "description": "Implementation specifications: Written contract or other arrangement (Required).  Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of § 164.314(a).",
-    "identifier": "",
+    "identifier": "164.308(b.3)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:44.534"
   },
   {
     "id": "frk_rq_681fe90ba7477425a75f2993",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(a.1) Physical Safeguards",
     "description": "Standard: Facility access controls.  Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.",
-    "identifier": "",
+    "identifier": "164.310(a.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:44.892"
   },
   {
     "id": "frk_rq_681fe9465c707c6339b9b335",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(a.2.iii) Physical Safeguards",
     "description": "Access control and validation procedures (Addressable).  \r\n\r\nImplement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.",
-    "identifier": "",
+    "identifier": "164.310(a.2.iii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:45.231"
   },
   {
     "id": "frk_rq_681fe936fa81524e6aeca7c5",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(a.2.ii) Physical Safeguards",
     "description": "Facility security plan (Addressable). \r\n\r\nImplement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.",
-    "identifier": "",
+    "identifier": "164.310(a.2.ii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:45.624"
   },
   {
     "id": "frk_rq_681fe924a5f99c526e7a2e01",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(a.2.i) Physical Safeguards",
     "description": "Contingency operations (Addressable).  \r\n\r\nEstablish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.",
-    "identifier": "",
+    "identifier": "164.310(a.2.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:45.950"
   },
   {
     "id": "frk_rq_681fe96d757fb6b5c75cdf76",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(a.2.iv) Physical Safeguards",
     "description": "Maintenance records (Addressable).\r\n\r\nImplement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).",
-    "identifier": "",
+    "identifier": "164.310(a.2.iv)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:46.306"
   },
   {
     "id": "frk_rq_681fe9fd7f224842eb9fe789",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(b) Physical Safeguards",
     "description": "Standard: Workstation use.  Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.310(b)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:46.731"
   },
   {
     "id": "frk_rq_681fea0bfcdec41171d7a60c",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(c) Physical Safeguards",
     "description": "Standard: Workstation security.  Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.",
-    "identifier": "",
+    "identifier": "164.310(c)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:47.162"
   },
   {
-    "id": "frk_rq_681fea1b35a991691d685345",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.310(d.1) Physical Safeguards",
-    "description": "Standard: Device and media controls.  Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.",
+    "id": "frk_rq_6820152ff0073eb0c67d97bf",
+    "frameworkId": "frk_6820090a1653380dd386c5eb",
+    "name": "GV.RM-01 Risk Management Strategy",
+    "description": "Risk-management objectives are established and agreed to by organizational stakeholders",
     "identifier": "",
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
   {
-    "id": "frk_rq_681fea2c2d9331380c8b215f",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.310(d.1.i) Physical Safeguards",
-    "description": "Disposal (Required).  \r\n\r\nImplement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_6820152ff0073eb0c67d97bf",
-    "frameworkId": "frk_6820090a1653380dd386c5eb",
-    "name": "GV.RM-01 Risk Management Strategy",
-    "description": "Risk-management objectives are established and agreed to by organizational stakeholders",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fea39308dba0a946b8ec8",
+    "id": "frk_rq_681fea39308dba0a946b8ec8",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(d.1.ii) Physical Safeguards",
     "description": "Media re-use (Required).  \r\n\r\nImplement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.",
-    "identifier": "",
+    "identifier": "164.310(d.1.ii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:48.031"
   },
   {
-    "id": "frk_rq_681fea4735996fcd17f711bb",
+    "id": "frk_rq_681fea2c2d9331380c8b215f",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.310(d.1.iii) Physical Safeguards",
-    "description": "Accountability (Addressable).  \r\n\r\nMaintain a record of the movements of hardware and electronic media and any person responsible therefore",
-    "identifier": "",
+    "name": "164.310(d.1.i) Physical Safeguards",
+    "description": "Disposal (Required).  \r\n\r\nImplement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.",
+    "identifier": "164.310(d.1.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:48.413"
   },
   {
     "id": "frk_rq_681fea57826a6f30eba2db5c",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.310(d.1.iv) Physical Safeguards",
     "description": "Data backup and storage (Addressable).  \r\n\r\nCreate a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.",
-    "identifier": "",
+    "identifier": "164.310(d.1.iv)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:48.824"
   },
   {
     "id": "frk_rq_681fea884bc3d8ebe8856b10",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(a.1) Technical Safeguards",
     "description": "Standard: Access control.  Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).",
-    "identifier": "",
+    "identifier": "164.312(a.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:49.619"
   },
   {
-    "id": "frk_rq_681feaa7f3753839388472a6",
+    "id": "frk_rq_681feac2b1123600caf4bb93",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.312(a.2.i) Technical Safeguards",
-    "description": "Unique user identification (Required).  \r\n\r\nAssign a unique name and/or number for identifying and tracking user identity.",
-    "identifier": "",
+    "name": "164.312(a.2.iii) Technical Safeguards",
+    "description": "Automatic logoff (Addressable).  \r\n\r\nImplement electronic procedures that terminate an electronic session after a predetermined time of inactivity.",
+    "identifier": "164.312(a.2.iii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:49.955"
   },
   {
     "id": "frk_rq_681feab50d2c7e307828a563",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(a.2.ii) Technical Safeguards",
     "description": "Emergency access procedure (Required).  \r\n\r\nEstablish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.",
-    "identifier": "",
+    "identifier": "164.312(a.2.ii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:50.408"
   },
   {
-    "id": "frk_rq_681feac2b1123600caf4bb93",
+    "id": "frk_rq_681feaa7f3753839388472a6",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.312(a.2.iii) Technical Safeguards",
-    "description": "Automatic logoff (Addressable).  \r\n\r\nImplement electronic procedures that terminate an electronic session after a predetermined time of inactivity.",
-    "identifier": "",
+    "name": "164.312(a.2.i) Technical Safeguards",
+    "description": "Unique user identification (Required).  \r\n\r\nAssign a unique name and/or number for identifying and tracking user identity.",
+    "identifier": "164.312(a.2.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:50.864"
   },
   {
     "id": "frk_rq_681fead4ff2821e8f81aeba4",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(a.2.iv) Technical Safeguards",
     "description": "Encryption and decryption (Addressable).\r\n\r\nImplement a mechanism to encrypt and decrypt electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.312(a.2.iv)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:51.239"
   },
   {
     "id": "frk_rq_681feae44e7169c3144956be",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(b) Technical Safeguards",
     "description": "Standard: Audit controls.  Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.",
-    "identifier": "",
+    "identifier": "164.312(b)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:51.647"
   },
   {
     "id": "frk_rq_681feafc58012fcf85eb9c67",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(c.1) Technical Safeguards",
     "description": "Standard: Integrity.  Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.",
-    "identifier": "",
+    "identifier": "164.312(c.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:51.999"
   },
   {
     "id": "frk_rq_681feb100a4680e507ae3c0b",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(c.2) Technical Safeguards",
     "description": "Implementation specification: Mechanism to authenticate electronic protected health information (Addressable). \r\n\r\nImplement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.",
-    "identifier": "",
+    "identifier": "164.312(c.2)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:52.398"
   },
   {
     "id": "frk_rq_681feb1fd6847a219b5379c4",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(d) Technical Safeguards",
     "description": "Standard: Person or entity authentication.  Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.",
-    "identifier": "",
+    "identifier": "164.312(d)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:52.750"
   },
   {
     "id": "frk_rq_681feb2e8cd16f8cd6887c0f",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(e.1) Technical Safeguards",
     "description": "Standard: Transmission security.  Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681feb3ed01dfe41d1902a2b",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.312(e.2.i) Technical Safeguards",
-    "description": "Integrity controls (Addressable).  Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.",
-    "identifier": "",
+    "identifier": "164.312(e.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:53.113"
   },
   {
     "id": "frk_rq_681feb51b84ba0badd659fe4",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.312(e.2.ii) Technical Safeguards",
     "description": "Encryption (Addressable).  \r\n\r\nImplement a mechanism to encrypt electronic protected health information whenever deemed appropriate.",
-    "identifier": "",
+    "identifier": "164.312(e.2.ii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:53.551"
   },
   {
-    "id": "frk_rq_681febd6a160cdcafacbc30a",
+    "id": "frk_rq_681feb3ed01dfe41d1902a2b",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.314(a.2.i) Organizational requirements.",
-    "description": "Business associate contracts.  The contract must provide that the business associate will:\r\n\r\n(A) Comply with the applicable requirements of this subpart;\r\n\r\n(B) In accordance with § 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and\r\n\r\n(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.",
-    "identifier": "",
+    "name": "164.312(e.2.i) Technical Safeguards",
+    "description": "Integrity controls (Addressable).  Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.",
+    "identifier": "164.312(e.2.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:53.963"
   },
   {
     "id": "frk_rq_681feb8df6c8f41d44a9e287",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.314(a.1) Organizational requirements.",
     "description": "Standard: Business associate contracts or other arrangements.  The contract or other arrangement required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.",
-    "identifier": "",
+    "identifier": "164.314(a.1)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:54.331"
   },
   {
     "id": "frk_rq_681febf659324baa56a6a189",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
     "name": "164.314(a.2.ii) Organizational requirements.",
     "description": "Other arrangements.  The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3).",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fec08c1179a2bfe677069",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.314(a.2.iii) Organizational requirements.",
-    "description": "Business associate contracts with subcontractors.  The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.",
-    "identifier": "",
+    "identifier": "164.314(a.2.ii)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:55.123"
   },
   {
-    "id": "frk_rq_681fec1b32de927d4dbeb093",
+    "id": "frk_rq_681febd6a160cdcafacbc30a",
     "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.314(b.1) Organizational requirements.",
-    "description": "Standard: Requirements for group health plans.  Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to § 164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.",
-    "identifier": "",
+    "name": "164.314(a.2.i) Organizational requirements.",
+    "description": "Business associate contracts.  The contract must provide that the business associate will:\r\n\r\n(A) Comply with the applicable requirements of this subpart;\r\n\r\n(B) In accordance with § 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and\r\n\r\n(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.",
+    "identifier": "164.314(a.2.i)",
     "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
+    "updatedAt": "2026-04-24 14:58:55.543"
   },
   {
     "id": "frk_rq_68201513580cb5ac722431f7",
@@ -4796,60 +4589,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_681fec55c16831a6cd91f592",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.314(b.2) Organizational requirements.",
-    "description": "Implementation specifications (Required). \r\n\r\nThe plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to—\r\n\r\n(i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;\r\n\r\n(ii) Ensure that the adequate separation required by § 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;\r\n\r\n(iii) Ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and\r\n\r\n(iv) Report to the group health plan any security incident of which it becomes aware.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fec804cec43ea81323332",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.316(a) Policies and procedures and documentation requirements.",
-    "description": "Standard: Policies and procedures.  Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fecb74a602ca1480b819a",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.316(b.1) Policies and procedures and documentation requirements.",
-    "description": "i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and\r\n\r\n(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fecdb6b408ef4d3ce8e31",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.316(b.2.ii) Policies and procedures and documentation requirements.",
-    "description": "Availability (Required).  \r\n\r\nMake documentation available to those persons responsible for implementing the procedures to which the documentation pertains.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681fece9f29ff4dafccf7833",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "164.316(b.2.iii) Policies and procedures and documentation requirements.",
-    "description": "Updates (Required).  \r\n\r\nReview documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.",
-    "identifier": "",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-05-14 19:20:44.920"
-  },
-  {
-    "id": "frk_rq_681feccc0a6b9c390f81ccab",
-    "frameworkId": "frk_681fdd150f59a1560a66c89a",
-    "name": "Policies and procedures and documentation requirements.",
-    "description": "Time limit (Required).  \r\n\r\nRetain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.",
-    "identifier": "164.316(b.2.i)",
-    "createdAt": "2025-05-14 19:20:44.920",
-    "updatedAt": "2025-06-09 02:39:22.626"
-  },
   {
     "id": "frk_rq_682015381413ba5fc3abf704",
     "frameworkId": "frk_6820090a1653380dd386c5eb",
@@ -4949,6 +4688,51 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
+  {
+    "id": "frk_rq_681fec804cec43ea81323332",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.316(a) Policies and procedures and documentation requirements.",
+    "description": "Standard: Policies and procedures.  Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.",
+    "identifier": "164.316(a)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:57.368"
+  },
+  {
+    "id": "frk_rq_681fecb74a602ca1480b819a",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.316(b.1) Policies and procedures and documentation requirements.",
+    "description": "i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and\r\n\r\n(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment",
+    "identifier": "164.316(b.1)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:57.888"
+  },
+  {
+    "id": "frk_rq_681fece9f29ff4dafccf7833",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.316(b.2.iii) Policies and procedures and documentation requirements.",
+    "description": "Updates (Required).  \r\n\r\nReview documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.",
+    "identifier": "164.316(b.2.iii)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:58.378"
+  },
+  {
+    "id": "frk_rq_681fecdb6b408ef4d3ce8e31",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.316(b.2.ii) Policies and procedures and documentation requirements.",
+    "description": "Availability (Required).  \r\n\r\nMake documentation available to those persons responsible for implementing the procedures to which the documentation pertains.",
+    "identifier": "164.316(b.2.ii)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:58.926"
+  },
+  {
+    "id": "frk_rq_681feccc0a6b9c390f81ccab",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.316(b.2.i) Policies and procedures and documentation requirements.",
+    "description": "Time limit (Required).  \r\n\r\nRetain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.",
+    "identifier": "164.316(b.2.i)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:59:01.568"
+  },
   {
     "id": "frk_rq_682015a011500bab38429cbb",
     "frameworkId": "frk_6820090a1653380dd386c5eb",
@@ -6011,15 +5795,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_683f316954a237019ca60e26",
-    "frameworkId": "frk_683f3102f9ae801df35d47b4",
-    "name": "CC1",
-    "description": "CC1 SOC 2",
-    "identifier": "CC1",
-    "createdAt": "2025-06-03 17:31:21.379",
-    "updatedAt": "2025-06-03 17:31:21.379"
-  },
   {
     "id": "frk_rq_6820cd0c33c6d0b792d7ad32",
     "frameworkId": "frk_6820c8b318a6d88bf2c4586d",
@@ -6821,15 +6596,6 @@
     "createdAt": "2025-05-14 19:20:44.920",
     "updatedAt": "2025-05-14 19:20:44.920"
   },
-  {
-    "id": "frk_rq_683f3179d3ba9393821ad7a4",
-    "frameworkId": "frk_683f31582b71fc8d9253ad89",
-    "name": "A.1",
-    "description": "A1 ISO 27001",
-    "identifier": "A1",
-    "createdAt": "2025-06-03 17:31:36.578",
-    "updatedAt": "2025-06-03 17:31:36.578"
-  },
   {
     "id": "frk_rq_6820cf48a00e4423470a1c44",
     "frameworkId": "frk_6820c8b318a6d88bf2c4586d",
@@ -7820,24 +7586,6 @@
     "createdAt": "2025-06-03 23:18:27.903",
     "updatedAt": "2025-06-04 21:34:40.204"
   },
-  {
-    "id": "frk_rq_68b59a381860dff55c1ab1aa",
-    "frameworkId": "frk_681ef1952907deb7cb85896d",
-    "name": "GDPR Requirement",
-    "description": "Everything related to GDPR",
-    "identifier": "1",
-    "createdAt": "2025-09-01 13:06:00.288",
-    "updatedAt": "2025-09-01 13:06:00.288"
-  },
-  {
-    "id": "frk_rq_68b59f4c9739efdb63dd807e",
-    "frameworkId": "frk_681ecc34e85064efdbb76993",
-    "name": "ISO Requirement",
-    "description": "Everything ISO",
-    "identifier": "1",
-    "createdAt": "2025-09-01 13:27:39.721",
-    "updatedAt": "2025-09-01 13:27:39.721"
-  },
   {
     "id": "frk_rq_68c1eafed7ef7c22cc3ba9db",
     "frameworkId": "frk_68c1ead24950f84849db81bb",
@@ -8818,5 +8566,3443 @@
     "identifier": "QMS-10.2-01",
     "createdAt": "2025-11-19 20:44:19.831",
     "updatedAt": "2025-11-19 20:44:19.831"
+  },
+  {
+    "id": "frk_rq_69bd96f0dea75329f6d0f12e",
+    "frameworkId": "frk_69bd93a9a68c82ba0998008d",
+    "name": "Test",
+    "description": "sdfs",
+    "identifier": "xx1",
+    "createdAt": "2026-03-20 18:50:23.528",
+    "updatedAt": "2026-03-20 18:50:23.528"
+  },
+  {
+    "id": "frk_rq_69d7e576d8b4cc0f5440725d",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 10: The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including guidelines for acceptable and unacceptable technology usage behaviors with outlined consequences for unacceptable actions. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through structured governance and behavioral standards that ensure proper technology usage and overall organizational conduct to protect customer service delivery",
+    "identifier": "CC5.1",
+    "createdAt": "2026-04-09 17:44:21.645",
+    "updatedAt": "2026-04-09 17:44:21.645"
+  },
+  {
+    "id": "frk_rq_69d7e657b68baf33653627a1",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management maintains segregated responsibilities and duties across the organization to mitigate risks to customer services through systematic oversight, including annual reviews and approvals of company policies, risk assessments, vendor assessments, and organizational structures. The organization conducts periodic evaluations of subservice organizations to ensure customer commitments are met, while the Information Security program undergoes planned reviews to ensure continuing effectiveness. Responsibilities are further segregated through the Information Security Officer's independent oversight of production access controls, supported by continuous monitoring systems that provide program health reporting to stakeholders",
+    "identifier": "CC5.2",
+    "createdAt": "2026-04-09 17:48:07.014",
+    "updatedAt": "2026-04-09 17:48:07.014"
+  },
+  {
+    "id": "frk_rq_69d7e725c3b1c5035b646414",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through structured policy governance, including: making all policies and procedures available to all staff members for reference; establishing procedures for new staff to acknowledge applicable company policies during onboarding; and requiring periodic acknowledgment of applicable company policies by all staff to ensure ongoing awareness and compliance in protecting customer service delivery.",
+    "identifier": "CC5.3",
+    "createdAt": "2026-04-09 17:51:32.703",
+    "updatedAt": "2026-04-09 17:51:32.703"
+  },
+  {
+    "id": "frk_rq_69d7e73978f57e698ba562fb",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies for data classification through physical and logical labeling, and guidelines for information disposal and retention. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through systematic information management and transparency controls, including: generating and reviewing system information to evaluate impacts on internal control functioning; making all policies and procedures available to staff members for reference and compliance; maintaining current service information on the company website for customer accessibility; and implementing data classification and retention procedures to ensure proper information handling that protects customer service delivery and regulatory compliance",
+    "identifier": "CC2.1",
+    "createdAt": "2026-04-09 17:51:52.618",
+    "updatedAt": "2026-04-09 17:51:52.618"
+  },
+  {
+    "id": "frk_rq_69d7e74ab37477b3cb910456",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 14: The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including behavioral standards, acceptable business conduct policies, and Information Security policies that provide guidance on reporting failures, incidents, concerns, and complaints related to organizational services and systems. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through comprehensive personnel governance and awareness programs, including: establishing procedures for new staff to acknowledge applicable company policies and complete security and privacy literacy training during onboarding; requiring periodic policy acknowledgment by all staff; making all policies and procedures available to staff members for reference; and documenting, monitoring, and retaining individual training activities and records to ensure ongoing compliance and competency in protecting customer service delivery.",
+    "identifier": "CC2.2",
+    "createdAt": "2026-04-09 17:52:10.056",
+    "updatedAt": "2026-04-09 17:52:10.056"
+  },
+  {
+    "id": "frk_rq_69e918bbb477e38341c4a83b",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Data Processor Agreements",
+    "description": "Sign a data processing agreement between your organization and any third parties that process personal data on your behalf.",
+    "identifier": "AG-2",
+    "createdAt": "2026-04-22 18:51:39.087",
+    "updatedAt": "2026-04-22 18:51:39.087"
+  },
+  {
+    "id": "frk_rq_69e918bc947251b4d29f2da2",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right of Access",
+    "description": "It's easy for your customers to request and receive all the information you have about them.",
+    "identifier": "PR-1",
+    "createdAt": "2026-04-22 18:51:40.278",
+    "updatedAt": "2026-04-22 18:51:40.278"
+  },
+  {
+    "id": "frk_rq_69e918bd1ad4fdd1d8a45987",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right to Rectification",
+    "description": "It's easy for your customers to correct or update inaccurate or incomplete information.",
+    "identifier": "PR-2",
+    "createdAt": "2026-04-22 18:51:40.718",
+    "updatedAt": "2026-04-22 18:51:40.718"
+  },
+  {
+    "id": "frk_rq_69d7e757ea97d3f6fc14a16f",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 15: The entity communicates with external parties regarding matters affecting the functioning of internal control.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through transparent customer communication controls, including: displaying current information about services on the company website for customer accessibility; and providing customers with information on how to report failures, incidents, concerns, or other complaints related to organizational services and systems to ensure prompt issue resolution and continuous service improvement",
+    "identifier": "CC2.3",
+    "createdAt": "2026-04-09 17:52:23.365",
+    "updatedAt": "2026-04-09 17:52:23.365"
+  },
+  {
+    "id": "frk_rq_69d7e76988750007ab774faf",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through comprehensive governance and oversight mechanisms, including: assigning an Information Security Officer to centrally manage, coordinate, develop, implement, and maintain the enterprise-wide cybersecurity and privacy program; conducting annual reviews and approvals of all company policies, Risk Assessment Reports, Vendor Risk Assessment Reports, and organizational charts for all employees; performing planned interval reviews of the Information Security program including policies, standards, and procedures, or when significant changes occur, to ensure continuing suitability, adequacy, and effectiveness; establishing mechanisms to assign and manage asset ownership responsibilities with common understanding of asset protection requirements; periodically updating and reviewing system inventories as part of installations, removals, and system updates; periodically evaluating all subservice organizations to ensure customer commitments can be met; and implementing continuous monitoring systems to track and report information security program health to stakeholders, ensuring systematic protection of customer service delivery.",
+    "identifier": "CC4.1",
+    "createdAt": "2026-04-09 17:52:40.830",
+    "updatedAt": "2026-04-09 17:52:40.830"
+  },
+  {
+    "id": "frk_rq_69d7e7a53e9ce2aeac1a4738",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including Information Security policies that provide employees with guidance on reporting failures, incidents, concerns, or other complaints related to organizational services and systems. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through systematic program oversight, including: conducting annual reviews and approvals of all company policies; performing planned interval reviews of the Information Security program including policies, standards, and procedures, or when significant changes occur, to ensure their continuing suitability, adequacy, and effectiveness; and implementing continuous monitoring systems to track and report the health of the information security program to the Information Security Officer and other stakeholders, ensuring comprehensive protection of customer service delivery",
+    "identifier": "CC4.2",
+    "createdAt": "2026-04-09 17:53:40.674",
+    "updatedAt": "2026-04-09 17:53:40.674"
+  },
+  {
+    "id": "frk_rq_69d7e7b42dea66c8ad0751ea",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.",
+    "description": "The organization has documented a comprehensive suite of policies and procedures that define expected behavior with regard to the Company, including guidelines for information disposal and retention. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services by enforcing systematic governance oversight, which comprises annual reviews and approvals of all company policies, risk assessment reports (including vendor assessments), and the organizational chart for all employees, as well as planned interval reviews of the Information Security program—covering its policies, standards, and procedures—whenever significant changes occur, thereby ensuring their continuing suitability, adequacy, and effectiveness in protecting and supporting customer service delivery.",
+    "identifier": "CC1.2",
+    "createdAt": "2026-04-09 17:53:55.660",
+    "updatedAt": "2026-04-09 17:53:55.660"
+  },
+  {
+    "id": "frk_rq_69d7e7dc23b7f38d35c92917",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through structured organizational governance, including: maintaining an organizational structure that defines authorities, facilitates information flow, and establishes clear responsibilities; appointing a People Operations Officer to develop personnel-related security strategies; assigning an Information Security Officer to centrally manage the enterprise-wide cybersecurity and privacy program; establishing procedures to communicate staff roles and responsibilities; and implementing mechanisms to assign asset ownership responsibilities with common understanding of protection requirements. Senior Management conducts planned interval reviews of the Information Security program, including policies, standards, and procedures, or when significant changes occur, to ensure continuing suitability, adequacy, and effectiveness in protecting customer services",
+    "identifier": "CC1.3",
+    "createdAt": "2026-04-09 17:54:36.002",
+    "updatedAt": "2026-04-09 17:54:36.002"
+  },
+  {
+    "id": "frk_rq_69d7e7fe5acf93ce81590446",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 4: The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through structured personnel security controls, including established procedures to perform security risk screening of individuals before authorizing access and ensuring that all security-related positions are staffed by qualified individuals with the necessary skill sets to protect customer service delivery",
+    "identifier": "CC1.4",
+    "createdAt": "2026-04-09 17:55:09.571",
+    "updatedAt": "2026-04-09 17:55:09.571"
+  },
+  {
+    "id": "frk_rq_69d7f03a3473f216eee50dc8",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 4: The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through structured personnel security controls, including established procedures to perform security risk screening of individuals before authorizing access and ensuring that all security-related positions are staffed by qualified individuals with the necessary skill sets to protect customer service delivery",
+    "identifier": "CC1.4",
+    "createdAt": "2026-04-09 18:30:18.304",
+    "updatedAt": "2026-04-09 18:30:18.304"
+  },
+  {
+    "id": "frk_rq_69d7ec749fdfe0889e8e1004",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 5: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through comprehensive personnel development and oversight programs, including: providing job-function-relevant information security and privacy training to all staff; requiring new staff to complete security and privacy literacy training during onboarding; establishing procedures for periodic acknowledgment of applicable company policies; conducting periodic evaluations of employees in client serving, IT, Engineering, and Information Security roles regarding their job responsibilities; and documenting, monitoring, and retaining individual training activities and records to ensure ongoing competency and compliance in protecting customer service delivery",
+    "identifier": "CC1.5",
+    "createdAt": "2026-04-09 18:14:12.264",
+    "updatedAt": "2026-04-09 18:14:12.264"
+  },
+  {
+    "id": "frk_rq_69d7ecc2e48e690433555325",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 6: The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.",
+    "description": "The organization performs a formal risk assessment exercise annually, as per documented guidelines and procedures, to identify threats that could impair systems' security commitments and requirements.",
+    "identifier": "CC3.1",
+    "createdAt": "2026-04-09 18:15:29.526",
+    "updatedAt": "2026-04-09 18:15:29.526"
+  },
+  {
+    "id": "frk_rq_69d7f04a624c5b6746879e47",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 5: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through comprehensive personnel development and oversight programs, including: providing job-function-relevant information security and privacy training to all staff; requiring new staff to complete security and privacy literacy training during onboarding; establishing procedures for periodic acknowledgment of applicable company policies; conducting periodic evaluations of employees in client serving, IT, Engineering, and Information Security roles regarding their job responsibilities; and documenting, monitoring, and retaining individual training activities and records to ensure ongoing competency and compliance in protecting customer service delivery",
+    "identifier": "CC1.5",
+    "createdAt": "2026-04-09 18:30:33.815",
+    "updatedAt": "2026-04-09 18:30:33.815"
+  },
+  {
+    "id": "frk_rq_69d7f15174a126ae9318c700",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented guidelines and procedures for formal risk assessment exercises. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through comprehensive annual risk management activities, including: performing formal risk assessment exercises to identify threats that could impair systems' security commitments and requirements; conducting formal vendor risk assessments to identify vendors critical to systems' security commitments; and assessing each identified risk with scoring based on likelihood of occurrence and potential impact on security, availability, and confidentiality of the Company platform, with risks mapped to mitigating factors that address some or all of the identified risk to ensure protection of customer service delivery",
+    "identifier": "CC3.4",
+    "createdAt": "2026-04-09 18:34:56.564",
+    "updatedAt": "2026-04-09 18:34:56.564"
+  },
+  {
+    "id": "frk_rq_69d7f069bba09cd6fde415b4",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented guidelines and procedures for formal risk assessment exercises. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services through systematic risk management practices, including: establishing procedures for new staff to acknowledge applicable company policies during onboarding; performing annual formal risk assessment exercises to identify threats that could impair systems' security commitments and requirements; conducting annual vendor risk assessments to identify vendors critical to systems' security commitments; and assessing each identified risk with scoring based on likelihood of occurrence and potential impact on security, availability, and confidentiality of the Company platform, with risks mapped to mitigating factors that address some or all of the identified risk to protect customer service delivery",
+    "identifier": "CC3.2",
+    "createdAt": "2026-04-09 18:31:05.079",
+    "updatedAt": "2026-04-09 18:31:05.079"
+  },
+  {
+    "id": "frk_rq_69d7f07a5dde9e3489417256",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "COSO Principle 8: The entity considers the potential for fraud in assessing risks to the achievement of objectives.",
+    "description": "The organization considers the potential for fraud when assessing risks. This is an entry in the risk matrix.",
+    "identifier": "CC3.3",
+    "createdAt": "2026-04-09 18:31:22.461",
+    "updatedAt": "2026-04-09 18:31:22.461"
+  },
+  {
+    "id": "frk_rq_69d7f490f8a6458bf15ef544",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "For information requiring explicit consent, the entity communicates the need for such consent, as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity's objectives related to privacy.",
+    "description": "The organization includes Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.",
+    "identifier": "P3.2",
+    "createdAt": "2026-04-09 18:48:48.038",
+    "updatedAt": "2026-04-09 18:48:48.038"
+  },
+  {
+    "id": "frk_rq_69d7f492512cd3853fc1678f",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "For information requiring explicit consent, the entity communicates the need for such consent, as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity's objectives related to privacy.",
+    "description": "The organization maintains an inventory of categories of personal information collected along with its usage, sources and specific purposes for collection as per regulatory requirements (\"Record of Processing Activities\") and reviews it on an annual basis",
+    "identifier": "P3.2",
+    "createdAt": "2026-04-09 18:48:49.933",
+    "updatedAt": "2026-04-09 18:48:49.933"
+  },
+  {
+    "id": "frk_rq_69d7f69f05eb9e749bbbb94b",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "Personal information is collected consistent with the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures providing guidance on Data Protection and Privacy, including a Privacy Policy published on the company website that meets all regulatory requirements and defines staff responsibilities for handling personal data. It maintains a Record of Processing Activities—a comprehensive inventory of the categories of personal information collected, their sources, specific purposes, and usage—which is reviewed annually to ensure ongoing compliance. All forms that collect personal information include Privacy Act statements, either directly on the form or via a separate notice that individuals can retain, thereby ensuring transparency, informed consent, and adherence to regulatory obligations throughout the data lifecycle.",
+    "identifier": "P3.1",
+    "createdAt": "2026-04-09 18:57:35.298",
+    "updatedAt": "2026-04-09 18:57:35.298"
+  },
+  {
+    "id": "frk_rq_69d7f6a079d5fe17bb88ddca",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including Access Control policies and procedures with an accompanying process to register and authorize users for issuing system credentials that grant access to critical systems. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through structured access management controls, including: ensuring logical access provisioning to critical systems requires approval from authorized personnel on an individual need or predefined role basis; and ensuring that logical access is made inaccessible in a timely manner when no longer required due to termination, thereby maintaining systematic protection of customer service delivery through proper access governance and lifecycle management.",
+    "identifier": "CC6.2",
+    "createdAt": "2026-04-09 18:57:36.267",
+    "updatedAt": "2026-04-09 18:57:36.267"
+  },
+  {
+    "id": "frk_rq_69d7f6a1e9853f081604ebb6",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity assesses and manages risks associated with vendors and business partners.",
+    "description": "The organization has established documented policies and procedures that define expected behavior, including vendor and third-party management guidelines instructing staff on how to perform risk assessments, and a risk management framework for identifying, assessing, and mitigating risks to business objectives—fully aligned with the organization’s service commitments and system requirements. Senior Management segregates responsibilities and duties across the organization to ensure effective oversight, including a formal annual vendor risk assessment to identify and address the security-critical suppliers whose performance could impact the delivery of customer services.",
+    "identifier": "CC9.2",
+    "createdAt": "2026-04-09 18:57:37.185",
+    "updatedAt": "2026-04-09 18:57:37.185"
+  },
+  {
+    "id": "frk_rq_69d7f6a2717be78f524ee2d5",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies and procedures to manage changes to its operating environment. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through structured change management controls, including: establishing procedures to govern changes to the operating environment; implementing approval procedures when making changes to the operating environment; and developing, documenting, and maintaining an inventory of organizational infrastructure systems with all necessary information to achieve accountability, thereby maintaining systematic change governance to ensure comprehensive protection of customer service delivery through controlled and documented operational modifications.",
+    "identifier": "CC8.1",
+    "createdAt": "2026-04-09 18:57:38.038",
+    "updatedAt": "2026-04-09 18:57:38.038"
+  },
+  {
+    "id": "frk_rq_69d7f6a36f14aa8d8d69619c",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives.",
+    "description": "The organization has documented policies and procedures that establish guidelines for managing data backups, contingency planning, and disaster recovery, including a data-backup policy accessible to all relevant staff via the company portal, contingency-planning controls to sustain operations, and disaster-recovery procedures for restoring services after a disruption or security incident. The organization regularly backs up all relevant user and system data to meet defined recovery-time and recovery-point objectives, periodically verifies backup integrity, and tests backup media for reliability, thereby ensuring timely restoration of operations and uninterrupted delivery of customer services under adverse conditions.",
+    "identifier": "A1.2",
+    "createdAt": "2026-04-09 18:57:38.980",
+    "updatedAt": "2026-04-09 18:57:38.980"
+  },
+  {
+    "id": "frk_rq_69d7f6a47ba0011b49e504b1",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including Access Control policies and procedures with an accompanying process to register and authorize users for issuing system credentials that grant access to critical systems. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive access management controls, including: ensuring logical access provisioning to critical systems requires approval from authorized personnel on an individual need or predefined role basis; restricting access to production databases and critical systems to only those individuals who require such access to perform their job functions; requiring Senior Management or the Information Security Officer to periodically review and ensure that both general and administrative access to critical systems is restricted to authorized individuals based on job function requirements; and ensuring that logical access is made inaccessible in a timely manner when no longer required due to termination, thereby maintaining systematic protection of customer service delivery through proper access governance, lifecycle management, and ongoing oversight.",
+    "identifier": "CC6.3",
+    "createdAt": "2026-04-09 18:57:39.843",
+    "updatedAt": "2026-04-09 18:57:39.843"
+  },
+  {
+    "id": "frk_rq_69d7f6a532778d48c8050941",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures that establish expected behavior with regard to personal data, including a Privacy Policy published on the company website that meets all regulatory requirements and assigns a Privacy Officer to assess and facilitate compliance. It maintains a Record of Processing Activities—an annually reviewed inventory of the categories of personal information collected, their sources, specific purposes, and usage—and requires all forms that collect personal data to include a Privacy Act statement, either on the form itself or via a separate notice. In accordance with its Privacy Policy, the organization honors all Subject Access Requests promptly and fully, ensuring transparency, accountability, and protection of individual data rights.",
+    "identifier": "P7.1",
+    "createdAt": "2026-04-09 18:57:40.697",
+    "updatedAt": "2026-04-09 18:57:40.697"
+  },
+  {
+    "id": "frk_rq_69d7f6a64f4c35988d6081a6",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity's objectives related to privacy. The entity's basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented.",
+    "description": "The organization maintains an inventory of categories of personal information collected along with its usage, sources and specific purposes for collection as per regulatory requirements (\"Record of Processing Activities\") and reviews it on an annual basis The organization maintains a list of all contractual obligations based on customer contracts. The organization ensures regulatory requirements regarding user consent are met prior to processing personal data",
+    "identifier": "P2.1",
+    "createdAt": "2026-04-09 18:57:41.604",
+    "updatedAt": "2026-04-09 18:57:41.604"
+  },
+  {
+    "id": "frk_rq_69d7f6a7c8eb4a69910f4a26",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity's objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity's objectives related to privacy.",
+    "description": "The organization has a documented Privacy Policy that meets all regulatory requirements and is published on the company’s website. This Policy mandates that all forms collecting personal information include a Privacy Act statement—either directly on the form or via a separate notice for individuals to retain—and requires that subject access requests be honored promptly and in full accordance with the Policy. Moreover, whenever personal data is shared with third-party vendors as part of processing activities, the organization implements appropriate remediation measures—including contractual safeguards, vendor assessments, and incident response procedures—to ensure ongoing protection, transparency, and compliance throughout the data lifecycle.",
+    "identifier": "P5.2",
+    "createdAt": "2026-04-09 18:57:42.555",
+    "updatedAt": "2026-04-09 18:57:42.555"
+  },
+  {
+    "id": "frk_rq_69d7f6a7a26e58ad51f72e4b",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented privacy policies and procedures that establish guidelines for the collection, processing, and protection of personal information. Senior Management appoints a Privacy Officer responsible for assessing and facilitating the organization’s compliance with all applicable privacy regulations. The organization maintains a Record of Processing Activities—a comprehensive inventory of the categories of personal information collected, their sources, usage, and specific purposes—which is reviewed and updated annually to ensure accuracy and regulatory alignment. In accordance with its Privacy Policy, the organization ensures that all Subject Access Requests are honored promptly and fully, thereby safeguarding individual rights and maintaining transparency across its data processing operations.",
+    "identifier": "P6.2",
+    "createdAt": "2026-04-09 18:57:43.427",
+    "updatedAt": "2026-04-09 18:57:43.427"
+  },
+  {
+    "id": "frk_rq_69dcfef2652e248e46a4d10e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Inbound traffic from untrusted to trusted networks is restricted to necessary communications only.",
+    "description": "Inbound firewall rules for untrusted-to-trusted flows; approved inbound services list",
+    "identifier": "1.4.2",
+    "createdAt": "2026-04-13 14:34:25.566",
+    "updatedAt": "2026-04-13 14:34:25.566"
+  },
+  {
+    "id": "frk_rq_69dcfef29d9116e66aa52b2a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-spoofing measures are implemented to detect and block forged source IP addresses.",
+    "description": "uRPF/ingress ACL configuration; IPS anti-spoofing signatures; test evidence",
+    "identifier": "1.4.3",
+    "createdAt": "2026-04-13 14:34:26.480",
+    "updatedAt": "2026-04-13 14:34:26.480"
+  },
+  {
+    "id": "frk_rq_69d7f6a8624c458f2893d407",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures that define guidelines for notifying customers and other stakeholders—specifically addressing PII breaches—in the event of any information security incident. Senior Management appoints a Privacy Officer to assess and facilitate compliance with all relevant privacy regulations. The organization conducts risk assessments of suspected data breaches and, when a breach is deemed significant, notifies all affected parties without unreasonable delay. All security incidents are recorded along with their investigations and the response plans executed, in accordance with the incident reporting and management procedures.",
+    "identifier": "P6.3",
+    "createdAt": "2026-04-09 18:57:44.282",
+    "updatedAt": "2026-04-09 18:57:44.282"
+  },
+  {
+    "id": "frk_rq_69d7f6a9a24e04508e70db9a",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures that establish guidelines for vendor management and personal data protection, requiring an annual formal vendor risk assessment to identify suppliers critical to its security commitments and mandating appropriate remediation measures—such as contractual safeguards and incident response protocols—whenever personal data is shared with third parties. It ensures all regulatory consent requirements are fulfilled before processing personal data and conducts periodic Data Protection Impact Assessments to evaluate and mitigate privacy and regulatory risks across its processing activities, thereby maintaining comprehensive oversight and compliance throughout the data lifecycle.",
+    "identifier": "P6.1",
+    "createdAt": "2026-04-09 18:57:45.132",
+    "updatedAt": "2026-04-09 18:57:45.132"
+  },
+  {
+    "id": "frk_rq_69d7f6aa16228e705a19b376",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's objectives.",
+    "description": "The organization has a documented policy that provides guidance on decommissioning of information assets that contain classified information.",
+    "identifier": "CC6.5",
+    "createdAt": "2026-04-09 18:57:45.981",
+    "updatedAt": "2026-04-09 18:57:45.981"
+  },
+  {
+    "id": "frk_rq_69d7f6ab0ce69e3e2743b723",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies and procedures to establish guidelines for managing technical vulnerabilities, documented guidelines on notifying customers and other stakeholders in case of a breach, and policies for reporting and managing incidents. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive security monitoring, vulnerability management, and incident response controls, including: configuring infrastructure to generate audit events for security-related actions of interest on all critical systems and to review and analyze audit events to detect anomalous or suspicious activity and threats; implementing methods to continuously monitor critical assets to generate capacity alerts ensuring optimal performance, meeting future capacity requirements, and protecting against denial-of-service attacks; identifying vulnerabilities on the Company platform through regular vulnerability scans and annual penetration testing exercises conducted by qualified third-party service providers; tracking all vulnerabilities and remediating them according to defined vulnerability management policies and procedures; performing security and privacy compliance checks on software versions and patches of remote devices prior to establishing internal connections; maintaining records of information security incidents, investigations, and response plan executions; and utilizing continuous monitoring systems to track and report information security program health to stakeholders, thereby maintaining systematic security governance to ensure comprehensive protection of customer service delivery through proactive monitoring, vulnerability management, and incident response capabilities",
+    "identifier": "CC7.3",
+    "createdAt": "2026-04-09 18:57:46.848",
+    "updatedAt": "2026-04-09 18:57:46.848"
+  },
+  {
+    "id": "frk_rq_69d7f6acfbe88ecd7aa205de",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity's objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity's objectives related to privacy.",
+    "description": "The organization has a documented Privacy Policy that meets all regulatory requirements and is published on the company website. This Privacy Policy requires that every form collecting personal information include a Privacy Act statement—either directly on the form or via a separate notice for individuals to retain—and mandates that all subject access requests be honored promptly and in accordance with the Policy, thereby ensuring transparency, informed consent, and full compliance throughout the data lifecycle.",
+    "identifier": "P5.1",
+    "createdAt": "2026-04-09 18:57:47.700",
+    "updatedAt": "2026-04-09 18:57:47.700"
+  },
+  {
+    "id": "frk_rq_69d7f6ad063694ae9c92b3d8",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.",
+    "description": "The organization has documented a comprehensive suite of policies and procedures that define expected behavior with regard to the Company, including behavioral standards, acceptable business conduct, cybersecurity responsibilities, and an Information Security Policy governing the confidentiality, integrity, and availability of its systems. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services by enforcing structured policy governance, which requires new staff to acknowledge applicable policies during onboarding and mandates periodic policy acknowledgment by all personnel to ensure ongoing compliance and awareness. In addition, the organization labels information systems physically and/or logically in accordance with its data classification policy, employs cryptographic mechanisms to encrypt all production databases that store customer data at rest, and ensures that endpoints with access to critical servers or data are encrypted to protect against unauthorized access, thereby integrating controls across people, processes, and technology to safeguard service delivery.",
+    "identifier": "C1.1",
+    "createdAt": "2026-04-09 18:57:48.545",
+    "updatedAt": "2026-04-09 18:57:48.545"
+  },
+  {
+    "id": "frk_rq_69d7f6adeddd2e0c23b6e615",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity identifies, develops, and implements activities to recover from identified security incidents.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies and procedures that establish guidelines for continuing business operations and facilitate the application of contingency planning controls, a documented policy on managing Data Backups made available to all relevant staff, and documented guidelines to manage Disaster Recovery. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive business continuity and disaster recovery controls, including: establishing guidelines and procedures for continuing business operations in case of a disruption or security incident; implementing data backup management policies accessible to relevant staff through the company employee portal; and maintaining disaster recovery guidelines that ensure business operations continuity during disruptive events, thereby maintaining systematic business continuity governance to ensure comprehensive protection and uninterrupted delivery of customer services through proactive contingency planning and recovery capabilities.",
+    "identifier": "CC7.5",
+    "createdAt": "2026-04-09 18:57:49.473",
+    "updatedAt": "2026-04-09 18:57:49.473"
+  },
+  {
+    "id": "frk_rq_69d7f6ae46305678b122956f",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies and procedures that describe how to identify risks to business objectives and how those risks are assessed and mitigated, with objectives incorporating the organization's service commitments and system requirements. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through systematic risk management processes, including: performing annual formal risk assessment exercises according to documented guidelines and procedures to identify threats that could impair systems' security commitments and requirements; assessing each risk and assigning risk scores based on the likelihood of occurrence and potential impact on the security, availability, and confidentiality of the Company platform; and mapping risks to mitigating factors that address some or all of the identified risk, thereby maintaining comprehensive risk governance to ensure systematic protection of customer service delivery through proactive risk identification, assessment, and mitigation capabilities.",
+    "identifier": "CC9.1",
+    "createdAt": "2026-04-09 18:57:50.325",
+    "updatedAt": "2026-04-09 18:57:50.325"
+  },
+  {
+    "id": "frk_rq_69d7f6afc442b0a62cac9590",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity's objectives related to privacy. Corrections and other necessary actions related to identified deficiencies are made or taken in a timely manner.",
+    "description": "The organization maintains a documented Privacy Policy that meets all applicable regulatory requirements and is published on the company website. This Policy mandates that valid user consent be obtained before any personal data processing and clearly informs individuals of their rights. In accordance with both the Policy and regulatory obligations, the organization promptly and fully honors all Subject Access Requests, ensuring transparency, accountability, and respect for individual privacy throughout the data lifecycle.",
+    "identifier": "P8.1",
+    "createdAt": "2026-04-09 18:57:51.188",
+    "updatedAt": "2026-04-09 18:57:51.188"
+  },
+  {
+    "id": "frk_rq_69d7f6b0a7ffde853174b371",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through systematic infrastructure protection and compliance controls, including: ensuring every production host is protected by a firewall with deny-by-default rules leveraging cloud provider security defaults; and implementing measures to perform security and privacy compliance checks on software versions and patches of remote devices prior to establishing internal connections, thereby maintaining comprehensive network security governance to protect customer service delivery through controlled access and validated device compliance.",
+    "identifier": "CC6.8",
+    "createdAt": "2026-04-09 18:57:52.104",
+    "updatedAt": "2026-04-09 18:57:52.104"
+  },
+  {
+    "id": "frk_rq_69d7f6b1f6533b5ebd588a61",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements logical access security measures to protect against threats from sources outside its system boundaries.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including endpoint security policies and procedures, guidelines for communications protections and network security of critical systems, and documented procedures for endpoint security and related controls. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive endpoint and network security controls, including: developing, documenting, and maintaining an inventory of organizational endpoint systems with necessary accountability information; ensuring endpoints with access to critical servers or data are configured to auto-screen-lock after 15 minutes of inactivity and are encrypted to protect from unauthorized access; requiring malware protection software on endpoints accessing critical servers or data; protecting production databases and Secure Shell access to infrastructure entities from public internet access; implementing firewall protection on every production host with deny-by-default rules; performing security and privacy compliance checks on software versions and patches of remote devices prior to establishing internal connections; requiring multifactor authentication for all staff members with access to critical systems; and maintaining systematic endpoint security governance to ensure comprehensive protection of customer service delivery.",
+    "identifier": "CC6.6",
+    "createdAt": "2026-04-09 18:57:52.968",
+    "updatedAt": "2026-04-09 18:57:52.968"
+  },
+  {
+    "id": "frk_rq_69d7f6b2837296fc18c8e05e",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including Access Control policies and procedures for user registration and authorization, physical and environmental security policies, and password and secure login mechanism guidelines made available to all staff members. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive access management controls, including: ensuring production databases and Secure Shell access to infrastructure entities are protected from public internet access; requiring Senior Management or the Information Security Officer to periodically review and ensure that administrative and critical system access is restricted to only those individuals who require such access to perform their job functions; implementing logical access provisioning to critical systems that requires approval from authorized personnel on an individual need or predefined role basis; and utilizing continuous monitoring systems to alert security teams to update access levels of team members whose roles have changed, ensuring systematic protection of customer service delivery through proper access governance",
+    "identifier": "CC6.1",
+    "createdAt": "2026-04-09 18:57:53.812",
+    "updatedAt": "2026-04-09 18:57:53.812"
+  },
+  {
+    "id": "frk_rq_69d7f6b31a628c6d4a1eefca",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity's objectives.",
+    "description": "The organization's software application ensures input values are limited to acceptable ranges. The organization performs physical and/or logical labeling of information systems as per the guidelines documented policy defined for data classification",
+    "identifier": "PI1.2",
+    "createdAt": "2026-04-09 18:57:54.723",
+    "updatedAt": "2026-04-09 18:57:54.723"
+  },
+  {
+    "id": "frk_rq_69d7f6b4cc3364592f0a4b17",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.",
+    "description": "The organization has established procedures for approval when implementing changes to the operating environment.",
+    "identifier": "PI1.3",
+    "createdAt": "2026-04-09 18:57:55.592",
+    "updatedAt": "2026-04-09 18:57:55.592"
+  },
+  {
+    "id": "frk_rq_69e918bb5b30f6ad4823455b",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "EU Representative",
+    "description": "If your organization is outside the EU, appoint a representative within one of the EU member states.",
+    "identifier": "AG-3",
+    "createdAt": "2026-04-22 18:51:39.459",
+    "updatedAt": "2026-04-22 18:51:39.459"
+  },
+  {
+    "id": "frk_rq_69d7f6b4775baf784cba6dc5",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives.",
+    "description": "The organization ensures that logical access provisioning to critical systems requires approval from authorized personnel on an individual need or for a predefined role. Company does application regression testing to validate key processing for the application during the change management process. The organization has established procedures for approval when implementing changes to the operating environment.",
+    "identifier": "PI1.4",
+    "createdAt": "2026-04-09 18:57:56.456",
+    "updatedAt": "2026-04-09 18:57:56.456"
+  },
+  {
+    "id": "frk_rq_69d7f6b5fe119219dd0ddd6d",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.",
+    "description": "The organization has documented policies and procedures to manage Access Control and an accompanying process to register and authorize users for issuing system credentials which grant the ability to access the critical systems. The organization has set up cryptographic mechanisms to encrypt all production database[s] that store customer data at rest.",
+    "identifier": "PI1.5",
+    "createdAt": "2026-04-09 18:57:57.330",
+    "updatedAt": "2026-04-09 18:57:57.330"
+  },
+  {
+    "id": "frk_rq_69d7f6b6749edb51a734d0af",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity limits the use of personal information to the purposes identified in the entity's objectives related to privacy.",
+    "description": "The organization has documented a Privacy Policy and supporting procedures that establish expected behavior with regard to the Company, meet all regulatory requirements, and are published on the company website. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers by maintaining an annually reviewed Record of Processing Activities—an inventory of personal information categories collected, their sources, specific purposes, and usage—ensuring that all forms collecting personal data include a Privacy Act statement either on the form itself or via a separate notice for individuals, and enforcing logical access provisioning to critical systems only upon approval by authorized personnel based on individual need or predefined roles.",
+    "identifier": "P4.1",
+    "createdAt": "2026-04-09 18:57:58.181",
+    "updatedAt": "2026-04-09 18:57:58.181"
+  },
+  {
+    "id": "frk_rq_69d7f6b7b4984a3804a9f169",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.",
+    "description": "The organization has set up methods to continuously monitor critical assets to generate capacity alerts to ensure optimal performance, meet future capacity requirements, and protect against denial-of-service attacks.",
+    "identifier": "A1.1",
+    "createdAt": "2026-04-09 18:57:59.032",
+    "updatedAt": "2026-04-09 18:57:59.032"
+  },
+  {
+    "id": "frk_rq_69d7f6b899f3425ec64a4e78",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including documented policies and procedures to establish guidelines for managing technical vulnerabilities. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive vulnerability management and monitoring controls, including: identifying vulnerabilities on the Company platform through regular vulnerability scan execution; tracking all vulnerabilities and remediating them according to defined vulnerability management policies and procedures; configuring infrastructure to generate audit events for security-related actions of interest on all critical systems and to review and analyze audit events to detect anomalous or suspicious activity and threats; and implementing methods to continuously monitor critical assets to generate capacity alerts ensuring optimal performance, meeting future capacity requirements, and protecting against denial-of-service attacks, thereby maintaining systematic vulnerability and threat management governance to ensure comprehensive protection of customer service delivery through proactive detection, monitoring, and remediation capabilities.",
+    "identifier": "CC7.2",
+    "createdAt": "2026-04-09 18:57:59.965",
+    "updatedAt": "2026-04-09 18:57:59.965"
+  },
+  {
+    "id": "frk_rq_69d7f6b953dac7d535a96861",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident response procedures to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures governing personal data protection, including requirements to obtain user consent prior to any processing and to follow documented vendor management guidelines—complete with staff guidance on performing vendor risk assessments and mandated remediation measures whenever personal data is shared. These procedures also enforce compliance with all regulatory obligations for cross-border data transfers. In the event of suspected data breaches, the organization conducts risk assessments and, for any significant breach, notifies all affected parties without unreasonable delay. Employees are provided with clear Information Security policies and procedures detailing how to report operational failures, security incidents, concerns, or complaints related to the organization’s services or systems, ensuring accountability and ongoing protection of personal data.",
+    "identifier": "P6.5",
+    "createdAt": "2026-04-09 18:58:00.835",
+    "updatedAt": "2026-04-09 18:58:00.835"
+  },
+  {
+    "id": "frk_rq_69d7f6ba36b85d9fcdab3676",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.",
+    "description": "The organization has documented a comprehensive data classification policy requiring physical and logical labeling of all information systems to reflect sensitivity levels, data definitions, and product/service specifications. In support of this policy, its software applications enforce data quality controls by requiring all mandatory fields to be completed before a record can be created or modified, and by validating that input values fall within predefined acceptable ranges, thereby ensuring the accuracy, completeness, and consistency of critical system data.",
+    "identifier": "PI1.1",
+    "createdAt": "2026-04-09 18:58:01.814",
+    "updatedAt": "2026-04-09 18:58:01.814"
+  },
+  {
+    "id": "frk_rq_69d7f6c1d6e942d8365e41fa",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity retains personal information consistent with the entity's objectives related to privacy.",
+    "description": "The organization’s documented Privacy Policy meets all applicable regulatory requirements and is published on the company website. It also maintains a documented policy outlining guidelines for the disposal and retention of information. To ensure accountability and transparency, the organization compiles and annually reviews a Record of Processing Activities—a comprehensive inventory of personal information categories collected, their sources, usage, and specific purposes—and requires that every form collecting personal data include a Privacy Act statement, either directly on the form or via a separate notice that individuals can retain.",
+    "identifier": "P4.2",
+    "createdAt": "2026-04-09 18:58:08.871",
+    "updatedAt": "2026-04-09 18:58:08.871"
+  },
+  {
+    "id": "frk_rq_69d7f6bbdd5d2871cb2e24a5",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy. The entity assesses those parties' compliance on a periodic and as-needed basis and takes corrective action, if necessary.",
+    "description": "The organization has documented policies and procedures governing vendor and third-party management that provide staff with clear guidance on conducting risk assessments and require appropriate remediation measures—such as contractual data protection clauses, security control reviews, and incident response protocols—whenever personal data is shared. These same policies establish procedures to ensure compliance with all regulatory requirements for transferring personal data outside the region in which it was collected, mandating that cross-border data flows be authorized, secured, and monitored in accordance with applicable laws.",
+    "identifier": "P6.4",
+    "createdAt": "2026-04-09 18:58:02.721",
+    "updatedAt": "2026-04-09 18:58:02.721"
+  },
+  {
+    "id": "frk_rq_69d7f6bc7a2c8e4b02b8d04f",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy.",
+    "description": "The organization ensures regulatory requirements regarding user consent are met prior to processing personal data. The organization ensures that Subject Access Requests are being honored in accordance with the Privacy Policy",
+    "identifier": "P6.7",
+    "createdAt": "2026-04-09 18:58:03.652",
+    "updatedAt": "2026-04-09 18:58:03.652"
+  },
+  {
+    "id": "frk_rq_69d7f6bd0c41735bfcf991c9",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity's privacy practices, including changes in the use of personal information, to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented a comprehensive Privacy Policy and supporting procedures that embed privacy-by-design principles into all systems and processes to ensure ongoing compliance with applicable privacy regulations. This Privacy Policy meets all regulatory requirements and is published on the company website. In addition, every form that collects personal information—whether part of a Privacy Act system of records or not—carries a Privacy Act statement, either directly on the form or on a separate notice provided to individuals, thereby ensuring transparency, informed consent, and full regulatory compliance across the data lifecycle.",
+    "identifier": "P1.1",
+    "createdAt": "2026-04-09 18:58:04.502",
+    "updatedAt": "2026-04-09 18:58:04.502"
+  },
+  {
+    "id": "frk_rq_69d7f6bd5f0fd2ee4ae2ddd7",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy.",
+    "description": "The organization has documented policies and procedures that establish expected behavior with regard to the Company, including guidelines for incident detection, reporting, notification, and remediation. Senior Management segregates responsibilities and duties across the organization to mitigate risks to customer services by enforcing comprehensive incident management protocols. All employees receive Information Security policies and procedures detailing how to report operational failures, security incidents, concerns, or complaints related to services or systems. The organization conducts risk assessments of suspected data breaches, maintains a complete record of all security incidents, investigations, and executed response plans in accordance with its policies, and notifies customers and other stakeholders—particularly in the event of PII breaches—without unreasonable delay, thereby ensuring transparent communication and effective resolution.",
+    "identifier": "P6.6",
+    "createdAt": "2026-04-09 18:58:05.372",
+    "updatedAt": "2026-04-09 18:58:05.372"
+  },
+  {
+    "id": "frk_rq_69d7f6beb47525c0472e5a28",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including established policies and procedures with guidelines to be undertaken in response to information security incidents and policies and procedures to report and manage incidents. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive incident management controls, including: maintaining records of information security incidents, their investigations, and the response plans executed in accordance with defined incident reporting and management policies and procedures; and utilizing continuous monitoring systems to track and report the health of the information security program to the Information Security Officer and other stakeholders, thereby maintaining systematic incident response governance to ensure comprehensive protection of customer service delivery through structured incident detection, response, and documentation capabilities",
+    "identifier": "CC7.4",
+    "createdAt": "2026-04-09 18:58:06.253",
+    "updatedAt": "2026-04-09 18:58:06.253"
+  },
+  {
+    "id": "frk_rq_69d7f6bf60aa81ed491d2fbc",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.",
+    "description": "",
+    "identifier": "CC6.4",
+    "createdAt": "2026-04-09 18:58:07.107",
+    "updatedAt": "2026-04-09 18:58:07.107"
+  },
+  {
+    "id": "frk_rq_69d7f6c0c17faabc4e00be1a",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including a documented policy to manage encryption and cryptographic protection controls. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive encryption and data protection controls, including: developing, documenting, and maintaining an inventory of organizational infrastructure systems with necessary accountability information; utilizing standard encryption methods including HTTPS with TLS algorithm to keep transmitted data confidential; implementing cryptographic mechanisms to encrypt all production databases that store customer data at rest; ensuring that endpoints and critical endpoints with access to critical servers or data are encrypted to protect from unauthorized access; and requiring that customer data used in non-production environments receives the same level of protection as the production environment, thereby maintaining systematic encryption governance to ensure comprehensive protection of customer service delivery through cryptographic controls.",
+    "identifier": "CC6.7",
+    "createdAt": "2026-04-09 18:58:08.014",
+    "updatedAt": "2026-04-09 18:58:08.014"
+  },
+  {
+    "id": "frk_rq_69dcfef10367e82c5c60ea24",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "NSCs are implemented between trusted and untrusted networks.",
+    "description": "Firewall/IPS configuration; trust zone documentation; placement diagrams",
+    "identifier": "1.4.1",
+    "createdAt": "2026-04-13 14:34:24.658",
+    "updatedAt": "2026-04-13 14:34:24.658"
+  },
+  {
+    "id": "frk_rq_69dcfef3ab8a1c333b3b3a7f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "System components storing cardholder data are not directly accessible from untrusted networks.",
+    "description": "Segmentation test results; architecture diagram showing CHD storage system placement",
+    "identifier": "1.4.4",
+    "createdAt": "2026-04-13 14:34:27.382",
+    "updatedAt": "2026-04-13 14:34:27.382"
+  },
+  {
+    "id": "frk_rq_69dcfef47bd26dd287a7ad11",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal IP addresses and routing information are not disclosed to untrusted networks.",
+    "description": "NAT configuration; route summarization policy; BGP/OSPF filtering configs",
+    "identifier": "1.4.5",
+    "createdAt": "2026-04-13 14:34:28.286",
+    "updatedAt": "2026-04-13 14:34:28.286"
+  },
+  {
+    "id": "frk_rq_69d7f6c2baae65ae4fa2bfaa",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity securely disposes of personal information to meet the entity's objectives related to privacy.",
+    "description": "The organization maintains a documented Privacy Policy, published on the company website, that meets all regulatory requirements and includes guidelines for the disposal and retention of information. It compiles and annually reviews a Record of Processing Activities—an inventory of the categories of personal information collected, their sources, usage, and specific purposes—and requires that every form collecting personal data include a Privacy Act statement, either on the form itself or via a separate notice for individuals to retain. The organization also ensures that all subject access requests are honored promptly and in accordance with its Privacy Policy, thereby guaranteeing transparency, compliance, and secure handling of personal data throughout its lifecycle.",
+    "identifier": "P4.3",
+    "createdAt": "2026-04-09 18:58:09.722",
+    "updatedAt": "2026-04-09 18:58:09.722"
+  },
+  {
+    "id": "frk_rq_69d7f6c33da8c8699a30e69a",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "The entity tests recovery plan procedures supporting system recovery to meet its objectives.",
+    "description": "The organization has documented policies and procedures establishing guidelines for continuing business operations, contingency planning, and disaster recovery, including regular backups of all relevant user and system data to meet defined recovery-time and recovery-point objectives with periodic verification of backup media reliability and data integrity; comprehensive disaster-recovery guidelines that define roles, responsibilities, and procedures to sustain operations during disruptions or security incidents; and scheduled tests and exercises of the contingency plan to assess its effectiveness and the organization’s readiness to execute recovery processes. Together, these integrated controls ensure that customer-facing services can be restored promptly and reliably following any interruption.",
+    "identifier": "A1.3",
+    "createdAt": "2026-04-09 18:58:10.573",
+    "updatedAt": "2026-04-09 18:58:10.573"
+  },
+  {
+    "id": "frk_rq_69d7f6c4333b851266824b47",
+    "frameworkId": "frk_69d7e513446cc6e0376edf60",
+    "name": "To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.",
+    "description": "The organization has documented a set of policies and procedures that establish expected behavior with regard to the Company, including policies and procedures for vulnerability management. Senior Management segregates responsibilities and duties across the organization to mitigate risks to the services provided to its customers through comprehensive monitoring and threat detection controls, including: implementing methods to continuously monitor critical assets to generate capacity alerts ensuring optimal performance, meeting future capacity requirements, and protecting against denial-of-service attacks; identifying vulnerabilities on the Company platform through regular vulnerability scan execution; configuring infrastructure to generate audit events for security-related actions of interest on all critical systems and to review and analyze audit events to detect anomalous or suspicious activity and threats; and tracking all vulnerabilities with remediation according to defined vulnerability management policies and procedures, thereby maintaining systematic security monitoring governance to ensure comprehensive protection of customer service delivery through proactive threat detection and response capabilities.",
+    "identifier": "CC7.1",
+    "createdAt": "2026-04-09 18:58:11.514",
+    "updatedAt": "2026-04-09 18:58:11.514"
+  },
+  {
+    "id": "frk_rq_69dcfe7d2e55a7bd0d38374e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for managing all components of network security controls (NSCs) are documented, kept current, and operational.",
+    "description": "Network security policy; NSC configuration standards; version history; review sign-offs",
+    "identifier": "1.1.1",
+    "createdAt": "2026-04-13 14:32:28.524",
+    "updatedAt": "2026-04-13 14:32:28.524"
+  },
+  {
+    "id": "frk_rq_69dcfe7e9c17b826488010fc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for performing activities under Requirement 1 are documented, assigned, and understood.",
+    "description": "RACI or responsibility matrix; job descriptions; signed acknowledgment records",
+    "identifier": "1.1.2",
+    "createdAt": "2026-04-13 14:32:29.580",
+    "updatedAt": "2026-04-13 14:32:29.580"
+  },
+  {
+    "id": "frk_rq_69dcfe7fd9e733b180b8ff84",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Configuration standards for NSCs address all applicable security risks.",
+    "description": "NSC configuration standards; approved rule-set templates; risk justification records",
+    "identifier": "1.2.1",
+    "createdAt": "2026-04-13 14:32:30.635",
+    "updatedAt": "2026-04-13 14:32:30.635"
+  },
+  {
+    "id": "frk_rq_69dcfee58e52a2062649dacd",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All permitted services, protocols, and ports are identified, approved, and have a defined business justification.",
+    "description": "Approved services/ports/protocols list; firewall rule justification log; change management tickets",
+    "identifier": "1.2.2",
+    "createdAt": "2026-04-13 14:34:13.247",
+    "updatedAt": "2026-04-13 14:34:13.247"
+  },
+  {
+    "id": "frk_rq_69dcfee61935b50ba3d0a22c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An accurate network diagram showing all CDE connections to other networks is maintained and current.",
+    "description": "Network diagram(s) with date; CDE boundary clearly marked; connection inventory",
+    "identifier": "1.2.3",
+    "createdAt": "2026-04-13 14:34:14.210",
+    "updatedAt": "2026-04-13 14:34:14.210"
+  },
+  {
+    "id": "frk_rq_69dcfee70753501e66c6e02b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An accurate data-flow diagram showing all account data flows across systems and networks is maintained.",
+    "description": "Data-flow diagram with CHD/SAD flows shown; review dates and approvals",
+    "identifier": "1.2.4",
+    "createdAt": "2026-04-13 14:34:15.194",
+    "updatedAt": "2026-04-13 14:34:15.194"
+  },
+  {
+    "id": "frk_rq_69dcfee8e213a935800448c6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All services, protocols, and ports in use are reviewed at least every six months.",
+    "description": "Bi-annual review records; updated approved services list; reviewer sign-offs",
+    "identifier": "1.2.5",
+    "createdAt": "2026-04-13 14:34:16.131",
+    "updatedAt": "2026-04-13 14:34:16.131"
+  },
+  {
+    "id": "frk_rq_69dcfee943bdcd3eef5178b1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Security features are defined and implemented for all insecure services, protocols, or ports in use.",
+    "description": "Insecure protocol register; compensating controls documentation; TLS/SSH version configs",
+    "identifier": "1.2.6",
+    "createdAt": "2026-04-13 14:34:17.059",
+    "updatedAt": "2026-04-13 14:34:17.059"
+  },
+  {
+    "id": "frk_rq_69dcfeea714798633b651170",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "NSC configurations are reviewed at least every six months to confirm they are relevant and effective.",
+    "description": "Bi-annual config review logs; review checklist; approver sign-offs",
+    "identifier": "1.2.7",
+    "createdAt": "2026-04-13 14:34:17.978",
+    "updatedAt": "2026-04-13 14:34:17.978"
+  },
+  {
+    "id": "frk_rq_69dcfeeb2ca10880083b7f82",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "NSC configuration files are protected from unauthorized access and kept consistent with active network configurations.",
+    "description": "Access controls on config files; FIM alerts; change management records comparing backup to live",
+    "identifier": "1.2.8",
+    "createdAt": "2026-04-13 14:34:19.010",
+    "updatedAt": "2026-04-13 14:34:19.010"
+  },
+  {
+    "id": "frk_rq_69dcfeec0b624eb54eb28e89",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Network and data-flow diagrams are kept current, reviewed at least every 12 months or on significant change.",
+    "description": "12-month or on-change review evidence; version history; change-triggered update records",
+    "identifier": "1.2.9",
+    "createdAt": "2026-04-13 14:34:19.935",
+    "updatedAt": "2026-04-13 14:34:19.935"
+  },
+  {
+    "id": "frk_rq_69dcfeedbe961b4ad3875add",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All connections between the CDE and third-party/cloud environments are documented and reviewed.",
+    "description": "Third-party connection register; cloud connectivity documentation; approved connection records",
+    "identifier": "1.2.10",
+    "createdAt": "2026-04-13 14:34:20.949",
+    "updatedAt": "2026-04-13 14:34:20.949"
+  },
+  {
+    "id": "frk_rq_69dcfeeecdf5ed81b9692fa2",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Inbound traffic to the CDE is restricted to only traffic that is necessary.",
+    "description": "Firewall inbound rule-set; deny-all default rule evidence; approved inbound service list",
+    "identifier": "1.3.1",
+    "createdAt": "2026-04-13 14:34:21.866",
+    "updatedAt": "2026-04-13 14:34:21.866"
+  },
+  {
+    "id": "frk_rq_69dcfeef48700ce37f4b36ee",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Outbound traffic from the CDE is restricted to only traffic that is necessary.",
+    "description": "Firewall outbound rule-set; egress filtering policy; approved outbound service list",
+    "identifier": "1.3.2",
+    "createdAt": "2026-04-13 14:34:22.802",
+    "updatedAt": "2026-04-13 14:34:22.802"
+  },
+  {
+    "id": "frk_rq_69dcfef0b5a41febaa878746",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "NSCs are installed between all wireless networks and the CDE.",
+    "description": "Network diagram showing wireless/CDE segmentation; wireless NSC config; segmentation test results",
+    "identifier": "1.3.3",
+    "createdAt": "2026-04-13 14:34:23.714",
+    "updatedAt": "2026-04-13 14:34:23.714"
+  },
+  {
+    "id": "frk_rq_69dcfef554c52d0a4e141e26",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Security controls are implemented on devices that connect to both untrusted networks and the CDE.",
+    "description": "MDM policy; endpoint firewall config; split-tunneling policy; VPN configuration",
+    "identifier": "1.5.1",
+    "createdAt": "2026-04-13 14:34:29.202",
+    "updatedAt": "2026-04-13 14:34:29.202"
+  },
+  {
+    "id": "frk_rq_69dcfef8b4c232559209d742",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Configuration standards are developed, implemented, and kept current for all system components.",
+    "description": "Hardening standards (CIS Benchmarks or equivalent); applicability matrix per OS/platform; version history",
+    "identifier": "2.2.1",
+    "createdAt": "2026-04-13 14:34:31.969",
+    "updatedAt": "2026-04-13 14:34:31.969"
+  },
+  {
+    "id": "frk_rq_69dcfefc580593304a75c2a0",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If insecure services, protocols, or daemons are present, business justification is documented and additional security features are implemented.",
+    "description": "Insecure service register; business justification records; compensating control documentation",
+    "identifier": "2.2.5",
+    "createdAt": "2026-04-13 14:34:35.725",
+    "updatedAt": "2026-04-13 14:34:35.725"
+  },
+  {
+    "id": "frk_rq_69dcff02f9ade221fa118fbb",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Account data storage is minimized via a data retention and disposal policy covering all stored account data.",
+    "description": "Data retention policy; data discovery scan results; disposal records; data minimization guidelines",
+    "identifier": "3.2.1",
+    "createdAt": "2026-04-13 14:34:42.216",
+    "updatedAt": "2026-04-13 14:34:42.216"
+  },
+  {
+    "id": "frk_rq_69dcff035133fef9160ef01e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "SAD (full track data, CVV2, PIN) is not retained after authorization is complete.",
+    "description": "Data discovery scan results showing no SAD post-auth; application data flow documentation; purge logs",
+    "identifier": "3.3.1",
+    "createdAt": "2026-04-13 14:34:43.123",
+    "updatedAt": "2026-04-13 14:34:43.123"
+  },
+  {
+    "id": "frk_rq_69dcff0462ae94b7a97d2d2e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "SAD stored prior to authorization completion is encrypted using strong cryptography.",
+    "description": "Encryption implementation documentation; key management records; application architecture showing pre-auth SAD handling",
+    "identifier": "3.3.2",
+    "createdAt": "2026-04-13 14:34:44.028",
+    "updatedAt": "2026-04-13 14:34:44.028"
+  },
+  {
+    "id": "frk_rq_69dcff06faa8fa63e5c02dfd",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Technical controls prevent copy or relocation of PAN when using remote-access technologies.",
+    "description": "Remote access policy; clipboard restriction config (VDI/DLP); screen capture prevention settings",
+    "identifier": "3.4.2",
+    "createdAt": "2026-04-13 14:34:45.893",
+    "updatedAt": "2026-04-13 14:34:45.893"
+  },
+  {
+    "id": "frk_rq_69dcff0747513fb4a06145e7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "PAN is secured via strong one-way hashes, truncation, index tokens, or strong cryptography wherever it is stored.",
+    "description": "Data protection implementation doc; encryption or tokenization design; key management records",
+    "identifier": "3.5.1",
+    "createdAt": "2026-04-13 14:34:46.811",
+    "updatedAt": "2026-04-13 14:34:46.811"
+  },
+  {
+    "id": "frk_rq_69dcfef6b0e7be6f8e62f448",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for applying secure configurations to all components are documented, current, and in use.",
+    "description": "Configuration hardening policy; secure baseline standards; version history",
+    "identifier": "2.1.1",
+    "createdAt": "2026-04-13 14:34:30.140",
+    "updatedAt": "2026-04-13 14:34:30.140"
+  },
+  {
+    "id": "frk_rq_69dcfef70c971c9098bf6e14",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 2 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "2.1.2",
+    "createdAt": "2026-04-13 14:34:31.041",
+    "updatedAt": "2026-04-13 14:34:31.041"
+  },
+  {
+    "id": "frk_rq_69dcfef9fc8be55124e1ce08",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Vendor default accounts are managed: unused defaults removed or disabled; passwords changed before installation.",
+    "description": "Default account inventory; commissioning checklist; change records confirming default credential changes",
+    "identifier": "2.2.2",
+    "createdAt": "2026-04-13 14:34:32.883",
+    "updatedAt": "2026-04-13 14:34:32.883"
+  },
+  {
+    "id": "frk_rq_69dcfefaf0ce72126bd10d60",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All non-console administrative access is encrypted using strong cryptography.",
+    "description": "SSH/TLS configuration; disabled Telnet/plain HTTP configs; admin access method documentation",
+    "identifier": "2.2.3",
+    "createdAt": "2026-04-13 14:34:33.817",
+    "updatedAt": "2026-04-13 14:34:33.817"
+  },
+  {
+    "id": "frk_rq_69dcfefb1b23d778e3f0f70c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Only necessary services, protocols, daemons, and functions are enabled on system components.",
+    "description": "Baseline OS build spec; enabled services list; port scans of in-scope systems",
+    "identifier": "2.2.4",
+    "createdAt": "2026-04-13 14:34:34.752",
+    "updatedAt": "2026-04-13 14:34:34.752"
+  },
+  {
+    "id": "frk_rq_69dcfefd004ff3cd6e459921",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "System security parameters are configured to prevent misuse.",
+    "description": "System hardening configs; CIS benchmark scan results; SIEM security parameter alerts",
+    "identifier": "2.2.6",
+    "createdAt": "2026-04-13 14:34:36.680",
+    "updatedAt": "2026-04-13 14:34:36.680"
+  },
+  {
+    "id": "frk_rq_69dcfefe7539265b071b130b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All non-console administrative access is encrypted using strong cryptography.",
+    "description": "SSH/HTTPS admin access configs; certificate management records",
+    "identifier": "2.2.7",
+    "createdAt": "2026-04-13 14:34:37.591",
+    "updatedAt": "2026-04-13 14:34:37.591"
+  },
+  {
+    "id": "frk_rq_69dcfeff9f3ac4d37add4ab0",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "For wireless environments connected to or transmitting account data, all wireless vendor defaults are changed at installation.",
+    "description": "Wireless device commissioning checklist; SSID naming; WPA2/3 config; default password change records",
+    "identifier": "2.3.1",
+    "createdAt": "2026-04-13 14:34:38.527",
+    "updatedAt": "2026-04-13 14:34:38.527"
+  },
+  {
+    "id": "frk_rq_69dcfeffce3d8f57d4eadd06",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "For wireless environments connected to the CDE, wireless encryption keys are changed on personnel departure and at least every 12 months.",
+    "description": "Key rotation policy; change records for wireless keys; departure checklist including key rotation",
+    "identifier": "2.3.2",
+    "createdAt": "2026-04-13 14:34:39.420",
+    "updatedAt": "2026-04-13 14:34:39.420"
+  },
+  {
+    "id": "frk_rq_69dcff004d2e6d95f036ac58",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for protecting stored account data are documented, current, and in use.",
+    "description": "Data protection policy; data retention/disposal policy; version history",
+    "identifier": "3.1.1",
+    "createdAt": "2026-04-13 14:34:40.324",
+    "updatedAt": "2026-04-13 14:34:40.324"
+  },
+  {
+    "id": "frk_rq_69dcff01d0e636be71476447",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 3 are documented, assigned, and understood.",
+    "description": "RACI; job descriptions; signed acknowledgments",
+    "identifier": "3.1.2",
+    "createdAt": "2026-04-13 14:34:41.295",
+    "updatedAt": "2026-04-13 14:34:41.295"
+  },
+  {
+    "id": "frk_rq_69dcff05530220c5959ec50c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Full PAN is only displayed to those with a legitimate business need; masking is used otherwise (minimum first 6 / last 4 digits).",
+    "description": "Application screenshots showing PAN masking; display policy; role-based access logs",
+    "identifier": "3.4.1",
+    "createdAt": "2026-04-13 14:34:44.947",
+    "updatedAt": "2026-04-13 14:34:44.947"
+  },
+  {
+    "id": "frk_rq_69dcff084dcf233d1ca149b9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Hashes used to render PAN unreadable are keyed cryptographic hashes (HMAC) of the entire PAN.",
+    "description": "Hash implementation documentation; algorithm specification (HMAC-SHA256 or equivalent)",
+    "identifier": "3.5.1.1",
+    "createdAt": "2026-04-13 14:34:47.744",
+    "updatedAt": "2026-04-13 14:34:47.744"
+  },
+  {
+    "id": "frk_rq_69dcff091f650503a28195a1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If disk-level or partition-level encryption is used to render PAN unreadable, it is only applied to removable electronic media.",
+    "description": "Encryption implementation records; media inventory; OS encryption documentation",
+    "identifier": "3.5.1.2",
+    "createdAt": "2026-04-13 14:34:48.732",
+    "updatedAt": "2026-04-13 14:34:48.732"
+  },
+  {
+    "id": "frk_rq_69dcff0aa9d13acc126b2de8",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If disk-level or partition-level encryption is used, logical access must be managed separately from native OS authentication.",
+    "description": "Access control documentation for encrypted media; separate credential management records",
+    "identifier": "3.5.1.3",
+    "createdAt": "2026-04-13 14:34:49.638",
+    "updatedAt": "2026-04-13 14:34:49.638"
+  },
+  {
+    "id": "frk_rq_69dcff0b6928a6e5169089f5",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Procedures and processes for protecting cryptographic keys used to protect stored account data are documented and implemented.",
+    "description": "Key management policy; key custodian assignment records; key ceremony documentation",
+    "identifier": "3.6.1",
+    "createdAt": "2026-04-13 14:34:50.593",
+    "updatedAt": "2026-04-13 14:34:50.593"
+  },
+  {
+    "id": "frk_rq_69dcff0c1dc0b5e7a8bb40b9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A documented description of the cryptographic architecture is maintained, including all algorithms, protocols, and keys in use.",
+    "description": "Cryptographic inventory / architecture document; algorithm register; key inventory",
+    "identifier": "3.6.1.1",
+    "createdAt": "2026-04-13 14:34:51.525",
+    "updatedAt": "2026-04-13 14:34:51.525"
+  },
+  {
+    "id": "frk_rq_69dcff0c6466103e02fdec19",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Secret and private keys used to protect stored account data are stored in secure forms at all times.",
+    "description": "Key storage implementation records (HSM, encrypted key store); key wrapping documentation",
+    "identifier": "3.6.1.2",
+    "createdAt": "2026-04-13 14:34:52.442",
+    "updatedAt": "2026-04-13 14:34:52.442"
+  },
+  {
+    "id": "frk_rq_69dcff0d6ba2d210146b7e0b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Access to cleartext cryptographic key-encrypting keys is restricted to the fewest custodians necessary.",
+    "description": "Key custodian list; access control records for key-encrypting keys; dual-control evidence",
+    "identifier": "3.6.1.3",
+    "createdAt": "2026-04-13 14:34:53.358",
+    "updatedAt": "2026-04-13 14:34:53.358"
+  },
+  {
+    "id": "frk_rq_69dcff0edfa877f8fd59e4fa",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Cryptographic keys are stored in the fewest possible locations.",
+    "description": "Key location inventory; key storage policy",
+    "identifier": "3.6.1.4",
+    "createdAt": "2026-04-13 14:34:54.320",
+    "updatedAt": "2026-04-13 14:34:54.320"
+  },
+  {
+    "id": "frk_rq_69dcff0ff6667eeb439ac92d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key management policies cover generation of strong cryptographic keys.",
+    "description": "Key generation policy; algorithm and key-length specifications (AES-256, RSA-2048+)",
+    "identifier": "3.7.1",
+    "createdAt": "2026-04-13 14:34:55.302",
+    "updatedAt": "2026-04-13 14:34:55.302"
+  },
+  {
+    "id": "frk_rq_69dcff1079df11c41407d594",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key management policies cover secure distribution of cryptographic keys.",
+    "description": "Key distribution procedure; secure channel documentation (key ceremony, HSM transfer)",
+    "identifier": "3.7.2",
+    "createdAt": "2026-04-13 14:34:56.214",
+    "updatedAt": "2026-04-13 14:34:56.214"
+  },
+  {
+    "id": "frk_rq_69dcff1171ddc363fe1163fd",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key management policies cover secure storage of cryptographic keys.",
+    "description": "Key storage policy; HSM or encrypted key store configuration",
+    "identifier": "3.7.3",
+    "createdAt": "2026-04-13 14:34:57.110",
+    "updatedAt": "2026-04-13 14:34:57.110"
+  },
+  {
+    "id": "frk_rq_69dcff12f1a473ff1c537988",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key management policies cover key changes at the end of each cryptoperiod.",
+    "description": "Cryptoperiod policy; key rotation schedule; rotation completion records",
+    "identifier": "3.7.4",
+    "createdAt": "2026-04-13 14:34:58.028",
+    "updatedAt": "2026-04-13 14:34:58.028"
+  },
+  {
+    "id": "frk_rq_69dcff1303e257a95fbe5049",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key management policies cover retirement or replacement of keys.",
+    "description": "Key retirement procedure; decommission records; key archival policy",
+    "identifier": "3.7.5",
+    "createdAt": "2026-04-13 14:34:58.984",
+    "updatedAt": "2026-04-13 14:34:58.984"
+  },
+  {
+    "id": "frk_rq_69dcff140e07cd3e7afa53e8",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Manual clear-text cryptographic key-management operations are managed using split knowledge and dual control.",
+    "description": "Split knowledge and dual control policy; key ceremony records; custodian sign-off logs",
+    "identifier": "3.7.6",
+    "createdAt": "2026-04-13 14:34:59.926",
+    "updatedAt": "2026-04-13 14:34:59.926"
+  },
+  {
+    "id": "frk_rq_69dcff15b5e8ee31c7093b64",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Unauthorized substitution of cryptographic keys is prevented.",
+    "description": "Key integrity verification procedures; FIM or key attestation records",
+    "identifier": "3.7.7",
+    "createdAt": "2026-04-13 14:35:00.855",
+    "updatedAt": "2026-04-13 14:35:00.855"
+  },
+  {
+    "id": "frk_rq_69dcff1629621152913d7324",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Key custodians formally acknowledge their key-custodian responsibilities.",
+    "description": "Signed key-custodian agreements; training records; acknowledgment logs",
+    "identifier": "3.7.8",
+    "createdAt": "2026-04-13 14:35:01.845",
+    "updatedAt": "2026-04-13 14:35:01.845"
+  },
+  {
+    "id": "frk_rq_69dcff177062f35e09be9e5c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for protecting account data in transit are documented, current, and in use.",
+    "description": "Encryption in transit policy; TLS standards documentation; version history",
+    "identifier": "4.1.1",
+    "createdAt": "2026-04-13 14:35:02.883",
+    "updatedAt": "2026-04-13 14:35:02.883"
+  },
+  {
+    "id": "frk_rq_69dcff1881e1bebb12a5c6eb",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 4 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "4.1.2",
+    "createdAt": "2026-04-13 14:35:03.790",
+    "updatedAt": "2026-04-13 14:35:03.790"
+  },
+  {
+    "id": "frk_rq_69dcff1a165baf0394644b51",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An inventory of all trusted keys and certificates used to protect PAN in transit is maintained.",
+    "description": "Certificate/key inventory with purpose, issuer, expiry, and renewal schedule",
+    "identifier": "4.2.1.1",
+    "createdAt": "2026-04-13 14:35:05.701",
+    "updatedAt": "2026-04-13 14:35:05.701"
+  },
+  {
+    "id": "frk_rq_69dcff1cb3c3a0c1bcf6346b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "PAN is secured with strong cryptography whenever sent via end-user messaging technologies (email, SMS, chat).",
+    "description": "Email DLP policy; secure messaging platform configs; DLP incident records for unencrypted PAN",
+    "identifier": "4.2.2",
+    "createdAt": "2026-04-13 14:35:07.603",
+    "updatedAt": "2026-04-13 14:35:07.603"
+  },
+  {
+    "id": "frk_rq_69dcff1d859fd998bac7948e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for protecting all systems against malware are documented, current, and in use.",
+    "description": "Anti-malware policy; endpoint protection standard; version history",
+    "identifier": "5.1.1",
+    "createdAt": "2026-04-13 14:35:08.529",
+    "updatedAt": "2026-04-13 14:35:08.529"
+  },
+  {
+    "id": "frk_rq_69dcff1d6e8e06f38769eb37",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 5 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "5.1.2",
+    "createdAt": "2026-04-13 14:35:09.474",
+    "updatedAt": "2026-04-13 14:35:09.474"
+  },
+  {
+    "id": "frk_rq_69dcff1f913a3851412e6152",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware solutions detect known types of malware and protect against or address the effects of malware.",
+    "description": "AV/EDR product capabilities documentation; scan logs; quarantine/block records",
+    "identifier": "5.2.2",
+    "createdAt": "2026-04-13 14:35:11.323",
+    "updatedAt": "2026-04-13 14:35:11.323"
+  },
+  {
+    "id": "frk_rq_69dcff20b57ba3362e33b03b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Systems not at risk from malware are evaluated periodically to confirm that the risk assessment remains accurate.",
+    "description": "Low-risk exception records; periodic review schedule; updated risk assessments",
+    "identifier": "5.2.3",
+    "createdAt": "2026-04-13 14:35:12.322",
+    "updatedAt": "2026-04-13 14:35:12.322"
+  },
+  {
+    "id": "frk_rq_69dcff25f930412d8f4a7fdc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware mechanisms cannot be disabled or altered by users.",
+    "description": "Endpoint protection tamper-protection configuration; admin-only access controls; policy enforcement logs",
+    "identifier": "5.3.3",
+    "createdAt": "2026-04-13 14:35:17.151",
+    "updatedAt": "2026-04-13 14:35:17.151"
+  },
+  {
+    "id": "frk_rq_69dcff26e497c0d93bb8b841",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware solution logs are retained and available for review.",
+    "description": "AV/EDR log retention policy; SIEM forwarding configuration; log samples",
+    "identifier": "5.3.4",
+    "createdAt": "2026-04-13 14:35:18.102",
+    "updatedAt": "2026-04-13 14:35:18.102"
+  },
+  {
+    "id": "frk_rq_69dcff276033713e3105e596",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware solution(s) cannot be disabled or altered without documented exceptions with management approval.",
+    "description": "Exception records with management approval; temporary disable logs; reactivation evidence",
+    "identifier": "5.3.5",
+    "createdAt": "2026-04-13 14:35:19.023",
+    "updatedAt": "2026-04-13 14:35:19.023"
+  },
+  {
+    "id": "frk_rq_69dcff2905d5e8bf0f39d088",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for developing and maintaining secure systems and software are documented, current, and in use.",
+    "description": "SDLC policy; secure coding standards; version history",
+    "identifier": "6.1.1",
+    "createdAt": "2026-04-13 14:35:20.866",
+    "updatedAt": "2026-04-13 14:35:20.866"
+  },
+  {
+    "id": "frk_rq_69dcff19a50ef3f4cc515dba",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Strong cryptography is used to safeguard PAN during transmission over open, public networks.",
+    "description": "TLS configuration extracts (nginx/Apache/load balancer); Qualys SSL Labs or equivalent scan results; cipher suite documentation",
+    "identifier": "4.2.1",
+    "createdAt": "2026-04-13 14:35:04.779",
+    "updatedAt": "2026-04-13 14:35:04.779"
+  },
+  {
+    "id": "frk_rq_69dcff1b3c019806a66495aa",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Certificates used for PAN transmission are confirmed as valid and not expired.",
+    "description": "Certificate monitoring tool alerts; current certificate status report; renewal records",
+    "identifier": "4.2.1.2",
+    "createdAt": "2026-04-13 14:35:06.635",
+    "updatedAt": "2026-04-13 14:35:06.635"
+  },
+  {
+    "id": "frk_rq_69dcff1eb2e612067cc06689",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An anti-malware solution is deployed on all system components, except those confirmed as low-risk via periodic evaluation.",
+    "description": "AV/EDR deployment report; system inventory with protection status; exception register with risk evaluations",
+    "identifier": "5.2.1",
+    "createdAt": "2026-04-13 14:35:10.398",
+    "updatedAt": "2026-04-13 14:35:10.398"
+  },
+  {
+    "id": "frk_rq_69dcff2178ae451953e6ccad",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The frequency of periodic evaluations of systems not at risk from malware is defined in the entity's targeted risk analysis.",
+    "description": "Risk analysis document; defined evaluation frequency; approval records",
+    "identifier": "5.2.3.1",
+    "createdAt": "2026-04-13 14:35:13.248",
+    "updatedAt": "2026-04-13 14:35:13.248"
+  },
+  {
+    "id": "frk_rq_69dcff22146c8825df44cba4",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware solution(s) are kept current via automatic updates.",
+    "description": "AV/EDR update configuration; update logs showing recent definition/version updates",
+    "identifier": "5.3.1",
+    "createdAt": "2026-04-13 14:35:14.186",
+    "updatedAt": "2026-04-13 14:35:14.186"
+  },
+  {
+    "id": "frk_rq_69dcff23517e30660b32e82a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Anti-malware solution(s) perform periodic scans and active/real-time scanning.",
+    "description": "Scheduled scan configuration; scan completion logs; real-time protection status",
+    "identifier": "5.3.2",
+    "createdAt": "2026-04-13 14:35:15.109",
+    "updatedAt": "2026-04-13 14:35:15.109"
+  },
+  {
+    "id": "frk_rq_69dcff249c8cac39dc053355",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If periodic malware scans are performed, the frequency is defined in the entity's targeted risk analysis.",
+    "description": "Risk analysis with defined scan frequency; scan schedule documentation; approval records",
+    "identifier": "5.3.2.1",
+    "createdAt": "2026-04-13 14:35:16.127",
+    "updatedAt": "2026-04-13 14:35:16.127"
+  },
+  {
+    "id": "frk_rq_69dcff287f85466efc21f5ef",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and automated mechanisms are in place to detect and protect against phishing attacks.",
+    "description": "Email security gateway config; anti-phishing tool configuration; user awareness training records; phishing simulation results",
+    "identifier": "5.4.1",
+    "createdAt": "2026-04-13 14:35:19.958",
+    "updatedAt": "2026-04-13 14:35:19.958"
+  },
+  {
+    "id": "frk_rq_69dcff2a6b628ffc40d594cb",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 6 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "6.1.2",
+    "createdAt": "2026-04-13 14:35:21.802",
+    "updatedAt": "2026-04-13 14:35:21.802"
+  },
+  {
+    "id": "frk_rq_69dcff2bdb1b55a1c3806a0f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Bespoke and custom software are developed securely by following secure coding guidelines.",
+    "description": "Secure coding standards document referencing OWASP or equivalent; developer training records; code review policy",
+    "identifier": "6.2.1",
+    "createdAt": "2026-04-13 14:35:22.918",
+    "updatedAt": "2026-04-13 14:35:22.918"
+  },
+  {
+    "id": "frk_rq_69dcff2cc3942cb41ecd6889",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Software development personnel working on bespoke/custom software are trained in secure coding techniques at least annually.",
+    "description": "Annual training records; training curriculum; completion certificates",
+    "identifier": "6.2.2",
+    "createdAt": "2026-04-13 14:35:23.854",
+    "updatedAt": "2026-04-13 14:35:23.854"
+  },
+  {
+    "id": "frk_rq_69dcff2de69d0de80dc895c7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Bespoke and custom software is reviewed prior to release to identify and remediate potential vulnerabilities.",
+    "description": "Code review records; SAST/DAST scan results; peer review sign-offs; security gates in CI/CD pipeline",
+    "identifier": "6.2.3",
+    "createdAt": "2026-04-13 14:35:25.378",
+    "updatedAt": "2026-04-13 14:35:25.378"
+  },
+  {
+    "id": "frk_rq_69dcff2e1bf5bf4be8c2b03e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If manual code reviews are performed, code changes are reviewed by someone other than the originating developer.",
+    "description": "Code review records showing reviewer ≠ author; peer review policy; ticketing system evidence",
+    "identifier": "6.2.3.1",
+    "createdAt": "2026-04-13 14:35:26.302",
+    "updatedAt": "2026-04-13 14:35:26.302"
+  },
+  {
+    "id": "frk_rq_69dcff2f9a128163f0f0394e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Software engineering techniques or other methods are defined and in use to prevent or mitigate common software vulnerabilities.",
+    "description": "Secure coding checklist; SAST/DAST tool configuration; OWASP Top 10 coverage; vulnerability management records",
+    "identifier": "6.2.4",
+    "createdAt": "2026-04-13 14:35:27.287",
+    "updatedAt": "2026-04-13 14:35:27.287"
+  },
+  {
+    "id": "frk_rq_69dcff307f0939472c98b0d8",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Security vulnerabilities are identified and managed via a process that includes subscribing to reputable security vulnerability information sources.",
+    "description": "Threat intel subscriptions (NVD, CISA KEV, vendor advisories); vulnerability management policy; patch management records",
+    "identifier": "6.3.1",
+    "createdAt": "2026-04-13 14:35:28.207",
+    "updatedAt": "2026-04-13 14:35:28.207"
+  },
+  {
+    "id": "frk_rq_69dcff313299b5055bf4a37a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An inventory of bespoke and custom software is maintained to facilitate vulnerability and patch management.",
+    "description": "Software inventory with version numbers; SBOM where applicable; update tracking records",
+    "identifier": "6.3.2",
+    "createdAt": "2026-04-13 14:35:29.133",
+    "updatedAt": "2026-04-13 14:35:29.133"
+  },
+  {
+    "id": "frk_rq_69dcff32217541c6335876d7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All system components are protected from known vulnerabilities by installing applicable security patches/updates.",
+    "description": "Patch management policy with SLAs (critical: 1 month per v4.0.1); patch status reports; exception register",
+    "identifier": "6.3.3",
+    "createdAt": "2026-04-13 14:35:30.048",
+    "updatedAt": "2026-04-13 14:35:30.048"
+  },
+  {
+    "id": "frk_rq_69dcff33b8e68177611c33de",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Public-facing web applications are protected against attacks.",
+    "description": "WAF deployment records; WAF policy; penetration test report covering web apps; DAST scan results",
+    "identifier": "6.4.1",
+    "createdAt": "2026-04-13 14:35:30.964",
+    "updatedAt": "2026-04-13 14:35:30.964"
+  },
+  {
+    "id": "frk_rq_69dcff34a4d5d4d838e9354d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An automated technical solution that detects and prevents web-based attacks is deployed for public-facing web applications.",
+    "description": "WAF configuration; rule set; blocking mode configuration; false-positive management records",
+    "identifier": "6.4.2",
+    "createdAt": "2026-04-13 14:35:31.918",
+    "updatedAt": "2026-04-13 14:35:31.918"
+  },
+  {
+    "id": "frk_rq_69dcff35ebe7f0f919be1220",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All payment page scripts loaded and executed in the consumer's browser are managed.",
+    "description": "Payment page script inventory; script authorization records; SRI (subresource integrity) hashes; CSP headers; change management records",
+    "identifier": "6.4.3",
+    "createdAt": "2026-04-13 14:35:32.844",
+    "updatedAt": "2026-04-13 14:35:32.844"
+  },
+  {
+    "id": "frk_rq_69dcff36a0de7399adf64cb1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Changes to system components are made according to a defined change-control process.",
+    "description": "Change management policy; change tickets; CAB records; emergency change procedures",
+    "identifier": "6.5.1",
+    "createdAt": "2026-04-13 14:35:33.820",
+    "updatedAt": "2026-04-13 14:35:33.820"
+  },
+  {
+    "id": "frk_rq_69dcff3772ddda25fa510528",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "After a change, all applicable PCI DSS requirements are confirmed to be in place and newly identified vulnerabilities are addressed.",
+    "description": "Post-change verification checklists; re-test records; security sign-off on changes",
+    "identifier": "6.5.2",
+    "createdAt": "2026-04-13 14:35:34.732",
+    "updatedAt": "2026-04-13 14:35:34.732"
+  },
+  {
+    "id": "frk_rq_69dcff38d92835591f6d33e1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Pre-production environments are separate from production and the separation is enforced with access controls.",
+    "description": "Environment architecture documentation; access control records showing dev/test vs. prod separation",
+    "identifier": "6.5.3",
+    "createdAt": "2026-04-13 14:35:35.682",
+    "updatedAt": "2026-04-13 14:35:35.682"
+  },
+  {
+    "id": "frk_rq_69dcff39f841d3b959277a95",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and functions are separated between production and development/test environments.",
+    "description": "Role assignment records; access control matrix showing separation of duties",
+    "identifier": "6.5.4",
+    "createdAt": "2026-04-13 14:35:36.596",
+    "updatedAt": "2026-04-13 14:35:36.596"
+  },
+  {
+    "id": "frk_rq_69dcff3a4e59825c6b2bf8a4",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Live PANs are not used in pre-production environments except where those environments are within the CDE scope.",
+    "description": "Data masking policy; pre-production data management records; masking tool usage logs",
+    "identifier": "6.5.5",
+    "createdAt": "2026-04-13 14:35:37.506",
+    "updatedAt": "2026-04-13 14:35:37.506"
+  },
+  {
+    "id": "frk_rq_69dcff3a6999fa45c9973ba1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Test data and accounts are removed before production systems become active.",
+    "description": "Production launch checklist requiring removal of test accounts/data; production readiness review records",
+    "identifier": "6.5.6",
+    "createdAt": "2026-04-13 14:35:38.447",
+    "updatedAt": "2026-04-13 14:35:38.447"
+  },
+  {
+    "id": "frk_rq_69dcff3bd6eab0cabf8e5143",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for restricting access to system components and cardholder data are documented, current, and in use.",
+    "description": "Access control policy; business-need-to-know policy; version history",
+    "identifier": "7.1.1",
+    "createdAt": "2026-04-13 14:35:39.424",
+    "updatedAt": "2026-04-13 14:35:39.424"
+  },
+  {
+    "id": "frk_rq_69dcff3f412d52f5b06ca705",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Required privileges are approved by authorized personnel.",
+    "description": "Access request tickets with management approval; provisioning workflow records",
+    "identifier": "7.2.3",
+    "createdAt": "2026-04-13 14:35:43.304",
+    "updatedAt": "2026-04-13 14:35:43.304"
+  },
+  {
+    "id": "frk_rq_69dcff41955f84ea0e563041",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All application and system accounts and related access privileges are assigned and managed per least privilege.",
+    "description": "Service account inventory; access rights per service account; approval records",
+    "identifier": "7.2.5",
+    "createdAt": "2026-04-13 14:35:45.215",
+    "updatedAt": "2026-04-13 14:35:45.215"
+  },
+  {
+    "id": "frk_rq_69dcff42de2711fed58334d5",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All application and system accounts and related access rights are reviewed at least once every six months.",
+    "description": "Semi-annual service account review records; sign-offs; remediation records",
+    "identifier": "7.2.5.1",
+    "createdAt": "2026-04-13 14:35:46.157",
+    "updatedAt": "2026-04-13 14:35:46.157"
+  },
+  {
+    "id": "frk_rq_69dcff43e91cb5685c511c93",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All user access to query repositories of stored cardholder data is restricted to the minimum necessary.",
+    "description": "Database access control records; query access logs; RBAC for database access",
+    "identifier": "7.2.6",
+    "createdAt": "2026-04-13 14:35:47.074",
+    "updatedAt": "2026-04-13 14:35:47.074"
+  },
+  {
+    "id": "frk_rq_69dcff454540cdc67ec5cc55",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All access to system components and cardholder data is assigned and managed via an access control system.",
+    "description": "IAM system documentation; access provisioning workflow; access control system configuration",
+    "identifier": "7.3.1",
+    "createdAt": "2026-04-13 14:35:48.557",
+    "updatedAt": "2026-04-13 14:35:48.557"
+  },
+  {
+    "id": "frk_rq_69dcff4683b09426d28bd353",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The access control system(s) are configured to enforce access control settings after each login request.",
+    "description": "IAM configuration; session control settings; re-authentication settings",
+    "identifier": "7.3.2",
+    "createdAt": "2026-04-13 14:35:49.579",
+    "updatedAt": "2026-04-13 14:35:49.579"
+  },
+  {
+    "id": "frk_rq_69dcff463d117670a150959e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The access control system(s) are set to 'deny all' by default.",
+    "description": "Default-deny configuration evidence; IAM policy documentation; rule precedence documentation",
+    "identifier": "7.3.3",
+    "createdAt": "2026-04-13 14:35:50.486",
+    "updatedAt": "2026-04-13 14:35:50.486"
+  },
+  {
+    "id": "frk_rq_69dcff47dcbb3e7cf896a31f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for identifying and authenticating access are documented, current, and in use.",
+    "description": "Identity and access management policy; authentication standards; version history",
+    "identifier": "8.1.1",
+    "createdAt": "2026-04-13 14:35:51.399",
+    "updatedAt": "2026-04-13 14:35:51.399"
+  },
+  {
+    "id": "frk_rq_69dcff4bb1fdf4c5a72375ce",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Addition, deletion, and modification of user IDs and authentication factors are managed per formal processes.",
+    "description": "User lifecycle management procedure; provisioning/deprovisioning tickets; JML process documentation",
+    "identifier": "8.2.4",
+    "createdAt": "2026-04-13 14:35:55.239",
+    "updatedAt": "2026-04-13 14:35:55.239"
+  },
+  {
+    "id": "frk_rq_69dcff4deaf158a194b31651",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Inactive user accounts are removed or disabled within 90 days.",
+    "description": "Automated inactivity reports; 90-day review and disable records; IAM configuration showing 90-day threshold",
+    "identifier": "8.2.6",
+    "createdAt": "2026-04-13 14:35:57.168",
+    "updatedAt": "2026-04-13 14:35:57.168"
+  },
+  {
+    "id": "frk_rq_69dcff580c8abb1ed5c36b09",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "MFA is implemented for all remote network access originating from outside the entity's network.",
+    "description": "VPN/remote access MFA configuration; remote access policy; authentication logs",
+    "identifier": "8.4.3",
+    "createdAt": "2026-04-13 14:36:08.178",
+    "updatedAt": "2026-04-13 14:36:08.178"
+  },
+  {
+    "id": "frk_rq_69dcff59093f80b6b5f93ede",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "MFA systems are implemented securely to prevent MFA bypass.",
+    "description": "MFA system configuration; replay attack prevention; out-of-band channel configuration; no-bypass configuration",
+    "identifier": "8.5.1",
+    "createdAt": "2026-04-13 14:36:09.252",
+    "updatedAt": "2026-04-13 14:36:09.252"
+  },
+  {
+    "id": "frk_rq_69dcff5a0689e9848805617c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If accounts used by systems or applications can be used for interactive login, they are managed and protected.",
+    "description": "Service account inventory; interactive login restriction policy; service account access logs",
+    "identifier": "8.6.1",
+    "createdAt": "2026-04-13 14:36:10.174",
+    "updatedAt": "2026-04-13 14:36:10.174"
+  },
+  {
+    "id": "frk_rq_69dcff5c4e2e039756c30c04",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Passwords for any application and system accounts are protected against misuse.",
+    "description": "Secrets management policy; vault configuration; rotation schedule for service account credentials",
+    "identifier": "8.6.3",
+    "createdAt": "2026-04-13 14:36:12.106",
+    "updatedAt": "2026-04-13 14:36:12.106"
+  },
+  {
+    "id": "frk_rq_69dcff5e675b23b53711e58a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 9 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "9.1.2",
+    "createdAt": "2026-04-13 14:36:13.938",
+    "updatedAt": "2026-04-13 14:36:13.938"
+  },
+  {
+    "id": "frk_rq_69dcff5fdc280eb94be0039d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Appropriate facility entry controls are in place to limit and monitor physical access to systems in the CDE.",
+    "description": "Access control system logs; badge reader configuration; CCTV records",
+    "identifier": "9.2.1",
+    "createdAt": "2026-04-13 14:36:14.846",
+    "updatedAt": "2026-04-13 14:36:14.846"
+  },
+  {
+    "id": "frk_rq_69dcff60aaa239198fc1a3d0",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Individual physical access to sensitive areas within the CDE is monitored with video cameras or physical access control mechanisms.",
+    "description": "Camera coverage maps; access control log for sensitive areas; retention settings (minimum 3 months)",
+    "identifier": "9.2.1.1",
+    "createdAt": "2026-04-13 14:36:15.781",
+    "updatedAt": "2026-04-13 14:36:15.781"
+  },
+  {
+    "id": "frk_rq_69dcff622b60baca6c5cb4cd",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Physical access to wireless APs, gateways, handheld devices, networking hardware, and telecom lines in the CDE is restricted.",
+    "description": "Physical security inventory for wireless/networking hardware; access restriction evidence (cages, cabinets)",
+    "identifier": "9.2.3",
+    "createdAt": "2026-04-13 14:36:17.622",
+    "updatedAt": "2026-04-13 14:36:17.622"
+  },
+  {
+    "id": "frk_rq_69dcff63a09efbccfe305a95",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Access to consoles in sensitive areas is restricted via locking when not in use.",
+    "description": "Console lock policy; screen lock configuration; physical observation evidence",
+    "identifier": "9.2.4",
+    "createdAt": "2026-04-13 14:36:18.549",
+    "updatedAt": "2026-04-13 14:36:18.549"
+  },
+  {
+    "id": "frk_rq_69dcff66b9c46103ddf77fd9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A visitor log is used to maintain a physical audit trail of visitor access.",
+    "description": "Visitor log (physical or electronic); log retention records (minimum 3 months)",
+    "identifier": "9.3.4",
+    "createdAt": "2026-04-13 14:36:22.342",
+    "updatedAt": "2026-04-13 14:36:22.342"
+  },
+  {
+    "id": "frk_rq_69dcff696445afd56ff3c2e0",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The security of offline media backup locations is reviewed at least annually.",
+    "description": "Annual security review records for off-site locations; review checklist; sign-offs",
+    "identifier": "9.4.1.2",
+    "createdAt": "2026-04-13 14:36:25.228",
+    "updatedAt": "2026-04-13 14:36:25.228"
+  },
+  {
+    "id": "frk_rq_69dcff6b75060bf37b99db11",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Media with cardholder data sent outside the facility is secured.",
+    "description": "Media transport policy; tracked courier/secure transport records; chain of custody documentation",
+    "identifier": "9.4.3",
+    "createdAt": "2026-04-13 14:36:27.156",
+    "updatedAt": "2026-04-13 14:36:27.156"
+  },
+  {
+    "id": "frk_rq_69dcff6cce53eb27962c728d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Management approves all media with cardholder data moved outside the facility.",
+    "description": "Management approval records for media transfers; transport authorization logs",
+    "identifier": "9.4.4",
+    "createdAt": "2026-04-13 14:36:28.102",
+    "updatedAt": "2026-04-13 14:36:28.102"
+  },
+  {
+    "id": "frk_rq_69dcff6f571248c093ade975",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Hard-copy materials with cardholder data are destroyed when no longer needed.",
+    "description": "Hard-copy destruction policy; cross-cut shredder records; secure bin usage; certificate of destruction",
+    "identifier": "9.4.6",
+    "createdAt": "2026-04-13 14:36:30.965",
+    "updatedAt": "2026-04-13 14:36:30.965"
+  },
+  {
+    "id": "frk_rq_69dcff3c7b813604dd33848b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 7 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "7.1.2",
+    "createdAt": "2026-04-13 14:35:40.405",
+    "updatedAt": "2026-04-13 14:35:40.405"
+  },
+  {
+    "id": "frk_rq_69dcff3d7eff2daf7d1eecb6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An access control model is defined and includes granting access based on least privilege and need-to-know.",
+    "description": "Access control model documentation; role definitions; least privilege policy",
+    "identifier": "7.2.1",
+    "createdAt": "2026-04-13 14:35:41.329",
+    "updatedAt": "2026-04-13 14:35:41.329"
+  },
+  {
+    "id": "frk_rq_69dcff3ee7b85cd010d78dcc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Access is assigned to users, including privileged users, based on job classification and function.",
+    "description": "RBAC matrix; user account provisioning records; job function documentation",
+    "identifier": "7.2.2",
+    "createdAt": "2026-04-13 14:35:42.270",
+    "updatedAt": "2026-04-13 14:35:42.270"
+  },
+  {
+    "id": "frk_rq_69dcff408cc7a841ed94e038",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All user accounts and access rights are reviewed at least once every six months.",
+    "description": "Semi-annual user access review records; reviewer sign-offs; remediation records for excess access",
+    "identifier": "7.2.4",
+    "createdAt": "2026-04-13 14:35:44.316",
+    "updatedAt": "2026-04-13 14:35:44.316"
+  },
+  {
+    "id": "frk_rq_69dcff48933a909e70ec59f1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 8 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "8.1.2",
+    "createdAt": "2026-04-13 14:35:52.317",
+    "updatedAt": "2026-04-13 14:35:52.317"
+  },
+  {
+    "id": "frk_rq_69dcff49428742555a80f331",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All users are assigned a unique ID before allowing access to system components or cardholder data.",
+    "description": "User provisioning records; Active Directory/IAM user listing; no-shared-account policy",
+    "identifier": "8.2.1",
+    "createdAt": "2026-04-13 14:35:53.274",
+    "updatedAt": "2026-04-13 14:35:53.274"
+  },
+  {
+    "id": "frk_rq_69dcff4a4a17963ebdb7e8db",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Group, shared, or generic accounts or passwords are only used when necessary and managed per additional controls.",
+    "description": "Shared account policy; shared account inventory; exception register with justification",
+    "identifier": "8.2.2",
+    "createdAt": "2026-04-13 14:35:54.293",
+    "updatedAt": "2026-04-13 14:35:54.293"
+  },
+  {
+    "id": "frk_rq_69dcff4c94051eec2eb36978",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Access for terminated users is immediately revoked.",
+    "description": "Termination procedure; HR-IT notification process; deprovisioning records with timestamps",
+    "identifier": "8.2.5",
+    "createdAt": "2026-04-13 14:35:56.171",
+    "updatedAt": "2026-04-13 14:35:56.171"
+  },
+  {
+    "id": "frk_rq_69dcff4eef4d973db6749aaa",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Accounts used by third parties are managed per Requirement 8 controls.",
+    "description": "Third-party account inventory; third-party access policy; just-in-time access records",
+    "identifier": "8.2.7",
+    "createdAt": "2026-04-13 14:35:58.195",
+    "updatedAt": "2026-04-13 14:35:58.195"
+  },
+  {
+    "id": "frk_rq_69dcff4fcd6918d1cb665e86",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If a user session has been idle for more than 15 minutes, re-authentication is required.",
+    "description": "Session timeout configuration (≤15 minutes); system configuration screenshots",
+    "identifier": "8.2.8",
+    "createdAt": "2026-04-13 14:35:59.263",
+    "updatedAt": "2026-04-13 14:35:59.263"
+  },
+  {
+    "id": "frk_rq_69dcff505832b24179f594da",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All user and admin passwords/passphrases meet a minimum length of at least 12 characters (or 8 if system does not support 12).",
+    "description": "Password policy configuration; AD/IAM password policy settings screenshot",
+    "identifier": "8.3.1",
+    "createdAt": "2026-04-13 14:36:00.203",
+    "updatedAt": "2026-04-13 14:36:00.203"
+  },
+  {
+    "id": "frk_rq_69dcff512f1643822ffc40e9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "User and admin passwords/passphrases are properly secured during transmission and storage.",
+    "description": "Password hashing implementation documentation; TLS for authentication screens; LDAP over TLS config",
+    "identifier": "8.3.2",
+    "createdAt": "2026-04-13 14:36:01.179",
+    "updatedAt": "2026-04-13 14:36:01.179"
+  },
+  {
+    "id": "frk_rq_69dcff5244a445e2083124bb",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Invalid authentication attempts are limited to no more than 10 tries before locking the account.",
+    "description": "Account lockout policy configuration; AD/IAM lockout threshold setting",
+    "identifier": "8.3.4",
+    "createdAt": "2026-04-13 14:36:02.142",
+    "updatedAt": "2026-04-13 14:36:02.142"
+  },
+  {
+    "id": "frk_rq_69dcff53f0d3e72346c35750",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If passwords are used as authentication factors, they meet minimum complexity requirements.",
+    "description": "Password complexity policy configuration; enforcement evidence across all systems",
+    "identifier": "8.3.6",
+    "createdAt": "2026-04-13 14:36:03.189",
+    "updatedAt": "2026-04-13 14:36:03.189"
+  },
+  {
+    "id": "frk_rq_69dcff5459bbc24b82e95346",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Individuals are not allowed to submit a new password the same as any of their last four passwords.",
+    "description": "Password history enforcement (minimum 4 history); IAM policy configuration",
+    "identifier": "8.3.7",
+    "createdAt": "2026-04-13 14:36:04.172",
+    "updatedAt": "2026-04-13 14:36:04.172"
+  },
+  {
+    "id": "frk_rq_69dcff558d7ef3b5791eb24f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If passwords are the only authentication factor for user access, they must be changed at least every 90 days OR the system dynamically assesses account security posture.",
+    "description": "Password expiry policy (≤90 days) OR dynamic assessment configuration; enforcement records",
+    "identifier": "8.3.9",
+    "createdAt": "2026-04-13 14:36:05.133",
+    "updatedAt": "2026-04-13 14:36:05.133"
+  },
+  {
+    "id": "frk_rq_69dcff56d1dc19e437dcc6da",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "MFA is implemented for all non-console access into the CDE for personnel with administrative access.",
+    "description": "MFA configuration for admin access; authentication logs showing MFA enforcement; MFA policy",
+    "identifier": "8.4.1",
+    "createdAt": "2026-04-13 14:36:06.106",
+    "updatedAt": "2026-04-13 14:36:06.106"
+  },
+  {
+    "id": "frk_rq_69dcff57a27eda29d28d1a51",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "MFA is implemented for all access into the CDE.",
+    "description": "MFA configuration for all CDE access; VPN MFA config; authentication logs",
+    "identifier": "8.4.2",
+    "createdAt": "2026-04-13 14:36:07.213",
+    "updatedAt": "2026-04-13 14:36:07.213"
+  },
+  {
+    "id": "frk_rq_69dcff5be046e7444d27c470",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Passwords for application and system accounts that can be used for interactive login are not hard-coded in scripts, applications, or configuration files.",
+    "description": "Code review records; secrets scanning tool results; vault/secrets manager configuration",
+    "identifier": "8.6.2",
+    "createdAt": "2026-04-13 14:36:11.109",
+    "updatedAt": "2026-04-13 14:36:11.109"
+  },
+  {
+    "id": "frk_rq_69dcff5d5419b9e6dd0fecda",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for restricting physical access to cardholder data are documented, current, and in use.",
+    "description": "Physical security policy; facility access procedure; version history",
+    "identifier": "9.1.1",
+    "createdAt": "2026-04-13 14:36:13.036",
+    "updatedAt": "2026-04-13 14:36:13.036"
+  },
+  {
+    "id": "frk_rq_69dcff618eb41f404917d281",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Physical and/or logical controls restrict use of publicly accessible network jacks.",
+    "description": "Network jack policy; 802.1X or port security configuration; physical port lock/cover evidence",
+    "identifier": "9.2.2",
+    "createdAt": "2026-04-13 14:36:16.703",
+    "updatedAt": "2026-04-13 14:36:16.703"
+  },
+  {
+    "id": "frk_rq_69dcff633226b6615536612b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Procedures are implemented for authorizing and managing physical access of personnel to the CDE.",
+    "description": "Personnel access authorization records; access list; access request/approval workflow",
+    "identifier": "9.3.1",
+    "createdAt": "2026-04-13 14:36:19.467",
+    "updatedAt": "2026-04-13 14:36:19.467"
+  },
+  {
+    "id": "frk_rq_69dcff64fea13841683f18bb",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Procedures are implemented for managing visitor access to the CDE.",
+    "description": "Visitor policy; visitor log; visitor badge procedure; escort policy",
+    "identifier": "9.3.2",
+    "createdAt": "2026-04-13 14:36:20.478",
+    "updatedAt": "2026-04-13 14:36:20.478"
+  },
+  {
+    "id": "frk_rq_69dcff65403b9e40cecd10ed",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Visitor badges or identification are surrendered or deactivated before visitors leave the facility.",
+    "description": "Visitor check-out records; badge return procedure; badge deactivation logs",
+    "identifier": "9.3.3",
+    "createdAt": "2026-04-13 14:36:21.384",
+    "updatedAt": "2026-04-13 14:36:21.384"
+  },
+  {
+    "id": "frk_rq_69dcff6707ec7913810857e4",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All media with cardholder data is physically secured.",
+    "description": "Media storage policy; locked storage evidence (cabinet logs); media inventory",
+    "identifier": "9.4.1",
+    "createdAt": "2026-04-13 14:36:23.286",
+    "updatedAt": "2026-04-13 14:36:23.286"
+  },
+  {
+    "id": "frk_rq_69dcff68a147f3de0eea37e4",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Offline media backups with cardholder data are stored in a secure location.",
+    "description": "Offline backup storage policy; off-site storage agreement; facility security assessment",
+    "identifier": "9.4.1.1",
+    "createdAt": "2026-04-13 14:36:24.219",
+    "updatedAt": "2026-04-13 14:36:24.219"
+  },
+  {
+    "id": "frk_rq_69dcff6ad323e7481a2a947b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All media with cardholder data is classified in accordance with the sensitivity of the data.",
+    "description": "Media classification policy; media labeling records; sensitivity classification scheme",
+    "identifier": "9.4.2",
+    "createdAt": "2026-04-13 14:36:26.244",
+    "updatedAt": "2026-04-13 14:36:26.244"
+  },
+  {
+    "id": "frk_rq_69dcff6da2df8cba3c6adc88",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Inventory logs of all electronic media with cardholder data are maintained.",
+    "description": "Electronic media inventory log; periodic inventory review records",
+    "identifier": "9.4.5",
+    "createdAt": "2026-04-13 14:36:29.037",
+    "updatedAt": "2026-04-13 14:36:29.037"
+  },
+  {
+    "id": "frk_rq_69dcff6eebcdcef1b3719bf7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Inventories of electronic media with cardholder data are conducted at least annually.",
+    "description": "Annual media inventory records; date of last inventory; discrepancy resolution records",
+    "identifier": "9.4.5.1",
+    "createdAt": "2026-04-13 14:36:29.972",
+    "updatedAt": "2026-04-13 14:36:29.972"
+  },
+  {
+    "id": "frk_rq_69dcff70db9f49439ea3a578",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Electronic media with cardholder data is destroyed when no longer needed.",
+    "description": "Electronic media destruction policy; degaussing/secure wipe records; certificate of destruction",
+    "identifier": "9.4.7",
+    "createdAt": "2026-04-13 14:36:31.896",
+    "updatedAt": "2026-04-13 14:36:31.896"
+  },
+  {
+    "id": "frk_rq_69dcff718575d135791b7d6e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "POI devices that capture payment card data via direct physical interaction are protected from tampering and unauthorized substitution.",
+    "description": "POI device inventory; device inspection records; anti-tampering policy",
+    "identifier": "9.5.1",
+    "createdAt": "2026-04-13 14:36:32.939",
+    "updatedAt": "2026-04-13 14:36:32.939"
+  },
+  {
+    "id": "frk_rq_69dcff7240318f3d092f02a6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "POI device surfaces are periodically inspected to detect tampering and unauthorized substitution.",
+    "description": "Inspection checklist; periodic inspection records; photo evidence of inspection",
+    "identifier": "9.5.1.1",
+    "createdAt": "2026-04-13 14:36:33.880",
+    "updatedAt": "2026-04-13 14:36:33.880"
+  },
+  {
+    "id": "frk_rq_69dcff73fd64fa5ccce46aa9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Personnel are trained to be aware of attempted tampering or substitution of POI devices.",
+    "description": "Training records covering POI tampering awareness; training curriculum with tampering indicators",
+    "identifier": "9.5.1.2",
+    "createdAt": "2026-04-13 14:36:34.801",
+    "updatedAt": "2026-04-13 14:36:34.801"
+  },
+  {
+    "id": "frk_rq_69dcff7462dbb18b93e55650",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A list of POI devices is maintained, including device make, model, location, and serial or other identifier.",
+    "description": "POI device register with make, model, serial, location; last-update date",
+    "identifier": "9.5.1.3",
+    "createdAt": "2026-04-13 14:36:35.720",
+    "updatedAt": "2026-04-13 14:36:35.720"
+  },
+  {
+    "id": "frk_rq_69dcff75b6b39b136c68f7ef",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for logging and monitoring all access to system components are documented, current, and in use.",
+    "description": "Logging and monitoring policy; log management standard; SIEM documentation; version history",
+    "identifier": "10.1.1",
+    "createdAt": "2026-04-13 14:36:36.655",
+    "updatedAt": "2026-04-13 14:36:36.655"
+  },
+  {
+    "id": "frk_rq_69dcff76e8f6202ef0251616",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 10 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "10.1.2",
+    "createdAt": "2026-04-13 14:36:37.566",
+    "updatedAt": "2026-04-13 14:36:37.566"
+  },
+  {
+    "id": "frk_rq_69dcff76214ca4507aeb9676",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all individual user access to cardholder data.",
+    "description": "SIEM configuration; log samples showing user access to CHD systems; log policy",
+    "identifier": "10.2.1",
+    "createdAt": "2026-04-13 14:36:38.482",
+    "updatedAt": "2026-04-13 14:36:38.482"
+  },
+  {
+    "id": "frk_rq_69dcff770e9408ee767d7d61",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all actions taken by any individual with root or administrative privileges.",
+    "description": "Log samples showing admin/root actions; SIEM alert configuration for privileged actions",
+    "identifier": "10.2.1.1",
+    "createdAt": "2026-04-13 14:36:39.434",
+    "updatedAt": "2026-04-13 14:36:39.434"
+  },
+  {
+    "id": "frk_rq_69dcff78e9f10b1a12834a54",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all access to audit trails.",
+    "description": "Log samples showing audit trail access; SIEM configuration for log-read events",
+    "identifier": "10.2.1.2",
+    "createdAt": "2026-04-13 14:36:40.411",
+    "updatedAt": "2026-04-13 14:36:40.411"
+  },
+  {
+    "id": "frk_rq_69dcff79046ad91bb49f4bc6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all invalid logical access attempts.",
+    "description": "Failed login log samples; SIEM failed authentication events; brute-force detection alerts",
+    "identifier": "10.2.1.3",
+    "createdAt": "2026-04-13 14:36:41.332",
+    "updatedAt": "2026-04-13 14:36:41.332"
+  },
+  {
+    "id": "frk_rq_69dcff7af382be7a8fddd851",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all use of and changes to identification and authentication mechanisms.",
+    "description": "Log samples for account creation, deletion, password changes, privilege escalation",
+    "identifier": "10.2.1.4",
+    "createdAt": "2026-04-13 14:36:42.260",
+    "updatedAt": "2026-04-13 14:36:42.260"
+  },
+  {
+    "id": "frk_rq_69dcff7bca5070a954e4b926",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all changes to and deletions of audit log records.",
+    "description": "Log samples showing log deletion/modification attempts; SIEM integrity alerts",
+    "identifier": "10.2.1.5",
+    "createdAt": "2026-04-13 14:36:43.178",
+    "updatedAt": "2026-04-13 14:36:43.178"
+  },
+  {
+    "id": "frk_rq_69dcff7c6886d812e3bca1a2",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all initialization, stopping, or pausing of audit logging.",
+    "description": "Log samples for audit log service start/stop events; SIEM configuration",
+    "identifier": "10.2.1.6",
+    "createdAt": "2026-04-13 14:36:44.103",
+    "updatedAt": "2026-04-13 14:36:44.103"
+  },
+  {
+    "id": "frk_rq_69dcff7dd59284f830693a8e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture all creation and deletion of system-level objects.",
+    "description": "Log samples for object creation/deletion; SIEM object change events",
+    "identifier": "10.2.1.7",
+    "createdAt": "2026-04-13 14:36:45.016",
+    "updatedAt": "2026-04-13 14:36:45.016"
+  },
+  {
+    "id": "frk_rq_69dcff7e6837c1fdcc088bee",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit logs capture: user ID, event type, date/time, success/failure, origin, and identity/name of affected data/component.",
+    "description": "Log format documentation; sample log records showing all 6 required fields",
+    "identifier": "10.2.2",
+    "createdAt": "2026-04-13 14:36:45.928",
+    "updatedAt": "2026-04-13 14:36:45.928"
+  },
+  {
+    "id": "frk_rq_69dcff7f641df666a0c22817",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Read access to audit log files is limited to those with a job-related need.",
+    "description": "Access controls on log files; RBAC for log access; access review records",
+    "identifier": "10.3.1",
+    "createdAt": "2026-04-13 14:36:46.835",
+    "updatedAt": "2026-04-13 14:36:46.835"
+  },
+  {
+    "id": "frk_rq_69dcff8066ac2874e0cafac8",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit log files are protected from unauthorized modifications by technical controls.",
+    "description": "Log immutability configuration (WORM storage, append-only); FIM on log files; SIEM write protection",
+    "identifier": "10.3.2",
+    "createdAt": "2026-04-13 14:36:47.818",
+    "updatedAt": "2026-04-13 14:36:47.818"
+  },
+  {
+    "id": "frk_rq_69dcff81e3687caf7f1bd030",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit log files, including those for external-facing technologies, are promptly backed up to a secure central log server or SIEM.",
+    "description": "SIEM ingestion configuration; log forwarding config; backup evidence for log data",
+    "identifier": "10.3.3",
+    "createdAt": "2026-04-13 14:36:48.805",
+    "updatedAt": "2026-04-13 14:36:48.805"
+  },
+  {
+    "id": "frk_rq_69dcff824662a071ea30b728",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "File integrity monitoring or change detection mechanisms are used on audit logs.",
+    "description": "FIM configuration covering log files; FIM alert records",
+    "identifier": "10.3.4",
+    "createdAt": "2026-04-13 14:36:49.736",
+    "updatedAt": "2026-04-13 14:36:49.736"
+  },
+  {
+    "id": "frk_rq_69dcff83f48edc965b711dd3",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Automated mechanisms are used to perform audit log reviews.",
+    "description": "SIEM alert rules; automated review schedule; SIEM dashboard",
+    "identifier": "10.4.1",
+    "createdAt": "2026-04-13 14:36:50.655",
+    "updatedAt": "2026-04-13 14:36:50.655"
+  },
+  {
+    "id": "frk_rq_69dcff84eb2f0175af1a5a4a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Automated log review processes cover all defined auditable events.",
+    "description": "SIEM use case list; mapping of use cases to required audit events (per Req 10.2.1)",
+    "identifier": "10.4.1.1",
+    "createdAt": "2026-04-13 14:36:51.571",
+    "updatedAt": "2026-04-13 14:36:51.571"
+  },
+  {
+    "id": "frk_rq_69dcff85c4d2a8dae74164a1",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Logs of all other system components are reviewed periodically.",
+    "description": "Log review schedule; review records for non-automated systems; reviewer sign-offs",
+    "identifier": "10.4.2",
+    "createdAt": "2026-04-13 14:36:52.568",
+    "updatedAt": "2026-04-13 14:36:52.568"
+  },
+  {
+    "id": "frk_rq_69dcff86ca9ca870073fc2d8",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The frequency of periodic log reviews is defined in the entity's targeted risk analysis.",
+    "description": "Targeted risk analysis defining log review frequency; management approval",
+    "identifier": "10.4.2.1",
+    "createdAt": "2026-04-13 14:36:53.505",
+    "updatedAt": "2026-04-13 14:36:53.505"
+  },
+  {
+    "id": "frk_rq_69dcff86a14a58f051949e0b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Exceptions and anomalies identified during log review are addressed.",
+    "description": "Incident/exception tracking records; follow-up evidence; escalation records",
+    "identifier": "10.4.3",
+    "createdAt": "2026-04-13 14:36:54.431",
+    "updatedAt": "2026-04-13 14:36:54.431"
+  },
+  {
+    "id": "frk_rq_69dcff8794897fee8d23e907",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Audit log history is retained for at least 12 months, with at least the most recent three months available for immediate analysis.",
+    "description": "Log retention policy; SIEM or log archive configuration; test retrieval of 3-month and 12-month-old logs",
+    "identifier": "10.5.1",
+    "createdAt": "2026-04-13 14:36:55.370",
+    "updatedAt": "2026-04-13 14:36:55.370"
+  },
+  {
+    "id": "frk_rq_69dcff888d17e2a40c5ade06",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "System clocks and time are synchronized using accepted time-keeping technology.",
+    "description": "NTP configuration on all in-scope systems; NTP server documentation; time synchronization logs",
+    "identifier": "10.6.1",
+    "createdAt": "2026-04-13 14:36:56.301",
+    "updatedAt": "2026-04-13 14:36:56.301"
+  },
+  {
+    "id": "frk_rq_69e918bcf1767ec6050c2ff7",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Data Protection Officer",
+    "description": "Appoint a Data Protection Officer (if necessary).",
+    "identifier": "AG-4",
+    "createdAt": "2026-04-22 18:51:39.837",
+    "updatedAt": "2026-04-22 18:51:39.837"
+  },
+  {
+    "id": "frk_rq_69dcff89e8f8db6da78dca7a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Systems are configured to prevent unauthorized modifications of time.",
+    "description": "NTP ACL configuration; admin-only access to time settings; audit records for time changes",
+    "identifier": "10.6.2",
+    "createdAt": "2026-04-13 14:36:57.230",
+    "updatedAt": "2026-04-13 14:36:57.230"
+  },
+  {
+    "id": "frk_rq_69dcff8a58ad310935d80fad",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Time synchronization settings and data are protected from unauthorized access and tampering.",
+    "description": "NTP authentication configuration; time server access controls; monitoring for time discrepancies",
+    "identifier": "10.6.3",
+    "createdAt": "2026-04-13 14:36:58.236",
+    "updatedAt": "2026-04-13 14:36:58.236"
+  },
+  {
+    "id": "frk_rq_69dcff8b10fa6474b498b5f6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Failures of critical security controls (IDS/IPS, FIM, AV, access controls, audit logging, firewalls) are detected, alerted, and addressed promptly.",
+    "description": "SIEM alert rules for critical control failures; incident/alert records for control failures",
+    "identifier": "10.7.2",
+    "createdAt": "2026-04-13 14:36:59.174",
+    "updatedAt": "2026-04-13 14:36:59.174"
+  },
+  {
+    "id": "frk_rq_69dcff8dccf4c2d977dd9998",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Processes and mechanisms for regularly testing security of systems and networks are documented, current, and in use.",
+    "description": "Security testing policy; penetration testing standard; vulnerability management policy; version history",
+    "identifier": "11.1.1",
+    "createdAt": "2026-04-13 14:37:01.044",
+    "updatedAt": "2026-04-13 14:37:01.044"
+  },
+  {
+    "id": "frk_rq_69dcff936bcdd3953dd57be7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal vulnerability scans are performed by a qualified internal resource or qualified external third party.",
+    "description": "Scanner qualifications; internal resource training/certification; third-party scanner credentials",
+    "identifier": "11.3.1.2",
+    "createdAt": "2026-04-13 14:37:06.916",
+    "updatedAt": "2026-04-13 14:37:06.916"
+  },
+  {
+    "id": "frk_rq_69dcff9833b29ae89c1eb64f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal penetration testing is performed at least annually and after significant changes.",
+    "description": "Annual internal pen test reports; on-change pen test records; testing scope documentation",
+    "identifier": "11.4.2",
+    "createdAt": "2026-04-13 14:37:11.631",
+    "updatedAt": "2026-04-13 14:37:11.631"
+  },
+  {
+    "id": "frk_rq_69dcff9c8daaf57bbf28b8ef",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for multi-tenant service providers: Support customers for external penetration testing. (SP)",
+    "description": "Customer pen test support policy; customer access provision records; evidence of customer test facilitation",
+    "identifier": "11.4.7",
+    "createdAt": "2026-04-13 14:37:16.359",
+    "updatedAt": "2026-04-13 14:37:16.359"
+  },
+  {
+    "id": "frk_rq_69dcff9efe92caf1c8f48290",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A change-detection mechanism (FIM) is deployed to alert personnel to unauthorized modification of critical files.",
+    "description": "FIM tool deployment evidence; critical file baseline; FIM alert records; response procedure",
+    "identifier": "11.5.2",
+    "createdAt": "2026-04-13 14:37:18.291",
+    "updatedAt": "2026-04-13 14:37:18.291"
+  },
+  {
+    "id": "frk_rq_69dcff9f2a32fccc4bdee381",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A change- and tamper-detection mechanism is deployed to alert on unauthorized modifications to HTTP headers and payment page contents.",
+    "description": "Payment page monitoring tool deployment evidence; alert records; scope documentation covering all payment pages",
+    "identifier": "11.6.1",
+    "createdAt": "2026-04-13 14:37:19.236",
+    "updatedAt": "2026-04-13 14:37:19.236"
+  },
+  {
+    "id": "frk_rq_69dcffa0cd7071a70c25eff6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An overall information security policy is established, published, maintained, and disseminated to all relevant personnel and applicable vendors.",
+    "description": "Information security policy document; distribution records; vendor/partner acknowledgment records",
+    "identifier": "12.1.1",
+    "createdAt": "2026-04-13 14:37:20.167",
+    "updatedAt": "2026-04-13 14:37:20.167"
+  },
+  {
+    "id": "frk_rq_69dcffa119474a2d5739cad6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The information security policy is reviewed at least annually and updated when the environment changes.",
+    "description": "Annual review records; version history; change-triggered review records",
+    "identifier": "12.1.2",
+    "createdAt": "2026-04-13 14:37:21.102",
+    "updatedAt": "2026-04-13 14:37:21.102"
+  },
+  {
+    "id": "frk_rq_69dcffa4409aba79cfbb6863",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Acceptable use policies for end-user technologies are documented and implemented.",
+    "description": "Acceptable use policy; signed acknowledgments; technology inventory covered by AUP",
+    "identifier": "12.2.1",
+    "createdAt": "2026-04-13 14:37:24.070",
+    "updatedAt": "2026-04-13 14:37:24.070"
+  },
+  {
+    "id": "frk_rq_69dcffa72b879950a33ff8ff",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "All cryptographic cipher suites and protocols in use are documented and reviewed at least annually.",
+    "description": "Cryptographic inventory; annual review records; cipher suite deprecation tracking",
+    "identifier": "12.3.3",
+    "createdAt": "2026-04-13 14:37:26.940",
+    "updatedAt": "2026-04-13 14:37:26.940"
+  },
+  {
+    "id": "frk_rq_69dcffab5b3ab140e35b2a8f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An inventory of system components that are in scope for PCI DSS is maintained, including a description of function/use for each.",
+    "description": "CDE scope inventory with component type, function, owner, and location",
+    "identifier": "12.5.1",
+    "createdAt": "2026-04-13 14:37:31.029",
+    "updatedAt": "2026-04-13 14:37:31.029"
+  },
+  {
+    "id": "frk_rq_69dcffac9c60c52edbd56fef",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "PCI DSS scope is documented and confirmed at least once every 12 months and upon significant changes.",
+    "description": "Annual scope confirmation documentation; significant-change scope review records; QSA confirmation (if applicable)",
+    "identifier": "12.5.2",
+    "createdAt": "2026-04-13 14:37:31.966",
+    "updatedAt": "2026-04-13 14:37:31.966"
+  },
+  {
+    "id": "frk_rq_69dcffad14c5796fac50382b",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: PCI DSS scope is confirmed at least every six months and upon significant changes. (SP)",
+    "description": "Bi-annual scope confirmation records; sign-offs; on-change scope review records",
+    "identifier": "12.5.2.1",
+    "createdAt": "2026-04-13 14:37:32.969",
+    "updatedAt": "2026-04-13 14:37:32.969"
+  },
+  {
+    "id": "frk_rq_69dcffb0d294a6b409bf2777",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Personnel receive security awareness training upon hire and at least annually.",
+    "description": "New hire training records; annual re-training records; LMS completion reports",
+    "identifier": "12.6.3",
+    "createdAt": "2026-04-13 14:37:35.744",
+    "updatedAt": "2026-04-13 14:37:35.744"
+  },
+  {
+    "id": "frk_rq_69dcffb221021671f9e15650",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Security awareness training includes awareness about the acceptable use of end-user technologies.",
+    "description": "Training content referencing AUP; AUP acknowledgment post-training",
+    "identifier": "12.6.3.2",
+    "createdAt": "2026-04-13 14:37:37.601",
+    "updatedAt": "2026-04-13 14:37:37.601"
+  },
+  {
+    "id": "frk_rq_69dcffb652f1be5f58bda75d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An established process for engaging TPSPs includes proper due diligence prior to engagement.",
+    "description": "TPSP onboarding policy; due diligence questionnaire; pre-engagement security assessment records",
+    "identifier": "12.8.3",
+    "createdAt": "2026-04-13 14:37:41.770",
+    "updatedAt": "2026-04-13 14:37:41.770"
+  },
+  {
+    "id": "frk_rq_69dcffb7c9bb0dab205bcd0f",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A program to monitor TPSPs' PCI DSS compliance status is implemented at least annually.",
+    "description": "Annual TPSP compliance review records; AOC/SAQ collection; compliance register with expiry dates",
+    "identifier": "12.8.4",
+    "createdAt": "2026-04-13 14:37:42.807",
+    "updatedAt": "2026-04-13 14:37:42.807"
+  },
+  {
+    "id": "frk_rq_69dcffb80d9e0ce7eccf5b66",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Information is maintained about which PCI DSS requirements are managed by each TPSP and which are managed by the entity.",
+    "description": "Responsibility matrix per TPSP (shared responsibility matrix); contractual documentation of responsibility split",
+    "identifier": "12.8.5",
+    "createdAt": "2026-04-13 14:37:43.714",
+    "updatedAt": "2026-04-13 14:37:43.714"
+  },
+  {
+    "id": "frk_rq_69dcffb936d930f67bf2acc9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: TPSPs provide written acknowledgment/assurance to customers about PCI DSS requirements they are responsible for. (SP)",
+    "description": "Responsibility acknowledgment letters; AOC shared with customers; contract clauses detailing SP scope",
+    "identifier": "12.9.1",
+    "createdAt": "2026-04-13 14:37:44.685",
+    "updatedAt": "2026-04-13 14:37:44.685"
+  },
+  {
+    "id": "frk_rq_69dcffbbae320285dfd82b59",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An incident response plan exists and is ready to be activated in the event of a system breach.",
+    "description": "Incident response plan (IRP) covering CHD breach scenarios; contact list; escalation procedures; breach notification procedures",
+    "identifier": "12.10.1",
+    "createdAt": "2026-04-13 14:37:46.645",
+    "updatedAt": "2026-04-13 14:37:46.645"
+  },
+  {
+    "id": "frk_rq_69dcffbd079e9609d8754451",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents.",
+    "description": "24/7 on-call roster; escalation contact list; documented on-call procedures",
+    "identifier": "12.10.3",
+    "createdAt": "2026-04-13 14:37:48.560",
+    "updatedAt": "2026-04-13 14:37:48.560"
+  },
+  {
+    "id": "frk_rq_69dcffbd5a29f5ca49f033a2",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Personnel responsible for responding to suspected and confirmed security incidents are appropriately and regularly trained.",
+    "description": "IR team training records; tabletop exercise participation records; IR-specific training curriculum",
+    "identifier": "12.10.4",
+    "createdAt": "2026-04-13 14:37:49.494",
+    "updatedAt": "2026-04-13 14:37:49.494"
+  },
+  {
+    "id": "frk_rq_69dcff8cb4d4d1d377d3a9fc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Failures of any critical security control are responded to promptly; root cause is identified, documented, and resolved.",
+    "description": "Incident records with root cause analysis (RCA); RCA documentation; remediation evidence",
+    "identifier": "10.7.3",
+    "createdAt": "2026-04-13 14:37:00.095",
+    "updatedAt": "2026-04-13 14:37:00.095"
+  },
+  {
+    "id": "frk_rq_69dcff8e7a4db0d82942a727",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Roles and responsibilities for activities under Requirement 11 are documented, assigned, and understood.",
+    "description": "RACI or job descriptions; signed acknowledgments",
+    "identifier": "11.1.2",
+    "createdAt": "2026-04-13 14:37:01.961",
+    "updatedAt": "2026-04-13 14:37:01.961"
+  },
+  {
+    "id": "frk_rq_69dcff8f197c76085dff0f70",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Authorized and unauthorized wireless access points are managed.",
+    "description": "Wireless scanning tool (WIPS/WIDS) configuration; quarterly wireless scan reports; unauthorized AP detection/response records",
+    "identifier": "11.2.1",
+    "createdAt": "2026-04-13 14:37:02.974",
+    "updatedAt": "2026-04-13 14:37:02.974"
+  },
+  {
+    "id": "frk_rq_69dcff90072c1b750388be26",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "An inventory of authorized wireless access points is maintained.",
+    "description": "Wireless AP inventory with make, model, location, and MAC address; last-updated date",
+    "identifier": "11.2.2",
+    "createdAt": "2026-04-13 14:37:03.890",
+    "updatedAt": "2026-04-13 14:37:03.890"
+  },
+  {
+    "id": "frk_rq_69dcff91b7e21c99696af30c",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal vulnerability scans are performed at least once every three months.",
+    "description": "Quarterly internal scan reports; scan schedule; authenticated (credentialed) scan configuration and evidence",
+    "identifier": "11.3.1",
+    "createdAt": "2026-04-13 14:37:04.822",
+    "updatedAt": "2026-04-13 14:37:04.822"
+  },
+  {
+    "id": "frk_rq_69dcff92f25a500690ecb1d2",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal vulnerability scans are performed after significant changes.",
+    "description": "Change-triggered scan records; scan reports linked to change tickets",
+    "identifier": "11.3.1.1",
+    "createdAt": "2026-04-13 14:37:05.875",
+    "updatedAt": "2026-04-13 14:37:05.875"
+  },
+  {
+    "id": "frk_rq_69dcff944cc63873ea85c709",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Internal vulnerability scan findings are remediated and a rescan is performed to confirm resolution.",
+    "description": "Remediation records for high/critical findings; rescan reports confirming resolution; exception register for accepted risks",
+    "identifier": "11.3.1.3",
+    "createdAt": "2026-04-13 14:37:07.858",
+    "updatedAt": "2026-04-13 14:37:07.858"
+  },
+  {
+    "id": "frk_rq_69dcff95ecf248dcbe4462f7",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "External vulnerability scans are performed at least once every three months by an Approved Scanning Vendor (ASV).",
+    "description": "ASV scan reports (passing status); ASV certification evidence; quarterly scan schedule",
+    "identifier": "11.3.2",
+    "createdAt": "2026-04-13 14:37:08.803",
+    "updatedAt": "2026-04-13 14:37:08.803"
+  },
+  {
+    "id": "frk_rq_69dcff965d4daf381dbebb56",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "External vulnerability scan findings are remediated and passing scans are achieved.",
+    "description": "Remediation records; re-scan reports showing passing status; ASV dispute process records if applicable",
+    "identifier": "11.3.2.1",
+    "createdAt": "2026-04-13 14:37:09.762",
+    "updatedAt": "2026-04-13 14:37:09.762"
+  },
+  {
+    "id": "frk_rq_69dcff977f23cf8501f592c3",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A penetration testing methodology is defined, documented, and implemented.",
+    "description": "Penetration testing methodology document covering network and application layers, exploitation, and reporting requirements",
+    "identifier": "11.4.1",
+    "createdAt": "2026-04-13 14:37:10.692",
+    "updatedAt": "2026-04-13 14:37:10.692"
+  },
+  {
+    "id": "frk_rq_69dcff9974c7634956ba7f0a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "External penetration testing is performed at least annually and after significant changes.",
+    "description": "Annual external pen test reports; tester qualifications (CREST/OSCP or equivalent); on-change pen test records",
+    "identifier": "11.4.3",
+    "createdAt": "2026-04-13 14:37:12.579",
+    "updatedAt": "2026-04-13 14:37:12.579"
+  },
+  {
+    "id": "frk_rq_69dcff9a172f64b803d4f523",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Exploitable vulnerabilities and security weaknesses found during penetration testing are corrected.",
+    "description": "Remediation records for pen test findings; re-test evidence confirming resolution; risk acceptance for accepted findings with management sign-off",
+    "identifier": "11.4.4",
+    "createdAt": "2026-04-13 14:37:13.509",
+    "updatedAt": "2026-04-13 14:37:13.509"
+  },
+  {
+    "id": "frk_rq_69dcff9b08ac85014f447336",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "If segmentation is used to isolate the CDE, segmentation controls are verified at least every six months and after significant change.",
+    "description": "Bi-annual segmentation test reports; methodology documentation; on-change test records",
+    "identifier": "11.4.5",
+    "createdAt": "2026-04-13 14:37:14.501",
+    "updatedAt": "2026-04-13 14:37:14.501"
+  },
+  {
+    "id": "frk_rq_69dcff9b7b0dfdd22bc2d410",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: Pen testing of segmentation controls is performed at least every six months. (SP)",
+    "description": "Bi-annual segmentation pen test reports; scoping documentation showing all service provider testing boundaries",
+    "identifier": "11.4.6",
+    "createdAt": "2026-04-13 14:37:15.420",
+    "updatedAt": "2026-04-13 14:37:15.420"
+  },
+  {
+    "id": "frk_rq_69dcff9d4484fa6ab009ad50",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Intrusion-detection and/or intrusion-prevention techniques are used to detect and/or prevent intrusions into the network.",
+    "description": "IDS/IPS deployment evidence; signature update logs; alert records; tuning documentation",
+    "identifier": "11.5.1",
+    "createdAt": "2026-04-13 14:37:17.380",
+    "updatedAt": "2026-04-13 14:37:17.380"
+  },
+  {
+    "id": "frk_rq_69dcffa2854a8978069abc2e",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The information security policy clearly defines information security roles and responsibilities for all personnel.",
+    "description": "IS policy sections defining roles; RACI; job descriptions",
+    "identifier": "12.1.3",
+    "createdAt": "2026-04-13 14:37:22.171",
+    "updatedAt": "2026-04-13 14:37:22.171"
+  },
+  {
+    "id": "frk_rq_69dcffa34047058834cd7552",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Responsibility for information security is formally assigned to a CISO or another information-security-knowledgeable member of executive management.",
+    "description": "CISO appointment documentation; executive security accountability records; organization chart",
+    "identifier": "12.1.4",
+    "createdAt": "2026-04-13 14:37:23.159",
+    "updatedAt": "2026-04-13 14:37:23.159"
+  },
+  {
+    "id": "frk_rq_69dcffa5bbe2ac63ba382ae6",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A targeted risk analysis is performed for each PCI DSS requirement that allows flexibility in activity frequency.",
+    "description": "Targeted risk analysis documents per applicable requirement; management approval records",
+    "identifier": "12.3.1",
+    "createdAt": "2026-04-13 14:37:25.005",
+    "updatedAt": "2026-04-13 14:37:25.005"
+  },
+  {
+    "id": "frk_rq_69dcffa63136b4e7a84d10fc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A targeted risk analysis is performed for each PCI DSS requirement specified as needing a customized approach.",
+    "description": "Customized approach risk analyses; control design documentation; independent review evidence",
+    "identifier": "12.3.2",
+    "createdAt": "2026-04-13 14:37:26.016",
+    "updatedAt": "2026-04-13 14:37:26.016"
+  },
+  {
+    "id": "frk_rq_69dcffa89c6236dea8c3797d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Hardware and software technologies in use are reviewed at least annually to confirm that they continue to receive security fixes and support.",
+    "description": "Technology lifecycle inventory; annual vendor support status review; EOL/EOS tracking register",
+    "identifier": "12.3.4",
+    "createdAt": "2026-04-13 14:37:27.962",
+    "updatedAt": "2026-04-13 14:37:27.962"
+  },
+  {
+    "id": "frk_rq_69dcffa91626c1563c561918",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: Executive management establishes responsibility for protection of cardholder data and a PCI DSS compliance program. (SP)",
+    "description": "Executive charter for PCI DSS compliance; management acknowledgment; named executive accountability",
+    "identifier": "12.4.1",
+    "createdAt": "2026-04-13 14:37:29.005",
+    "updatedAt": "2026-04-13 14:37:29.005"
+  },
+  {
+    "id": "frk_rq_69dcffaa44f250f4729f4ae0",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: Reviews confirming that personnel follow security policies and procedures are performed at least quarterly. (SP)",
+    "description": "Quarterly compliance review records; review scope and methodology; sign-offs",
+    "identifier": "12.4.2",
+    "createdAt": "2026-04-13 14:37:29.970",
+    "updatedAt": "2026-04-13 14:37:29.970"
+  },
+  {
+    "id": "frk_rq_69dcffaebee28285f81befad",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A formal security awareness program is implemented to make all personnel aware of the information security policy and procedures.",
+    "description": "Security awareness program documentation; training schedule; completion records",
+    "identifier": "12.6.1",
+    "createdAt": "2026-04-13 14:37:33.891",
+    "updatedAt": "2026-04-13 14:37:33.891"
+  },
+  {
+    "id": "frk_rq_69dcffafdd6076fb6394fab2",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The security awareness program is reviewed at least annually and updated as needed.",
+    "description": "Annual review records; version history; update log",
+    "identifier": "12.6.2",
+    "createdAt": "2026-04-13 14:37:34.806",
+    "updatedAt": "2026-04-13 14:37:34.806"
+  },
+  {
+    "id": "frk_rq_69dcffb1c482f1b4c9faa676",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Security awareness training includes awareness of threats and vulnerabilities that could impact the CDE.",
+    "description": "Training curriculum covering phishing, social engineering, CHD handling, password security, physical security",
+    "identifier": "12.6.3.1",
+    "createdAt": "2026-04-13 14:37:36.658",
+    "updatedAt": "2026-04-13 14:37:36.658"
+  },
+  {
+    "id": "frk_rq_69dcffb3bb48dd2bca628d6a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Potential personnel who will have access to the CDE are screened prior to hire, within the constraints of local laws.",
+    "description": "Background check policy; background check records for CDE-access personnel; screening scope documentation",
+    "identifier": "12.7.1",
+    "createdAt": "2026-04-13 14:37:38.598",
+    "updatedAt": "2026-04-13 14:37:38.598"
+  },
+  {
+    "id": "frk_rq_69dcffb4bfef6f7f83a002a5",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "A list of all third-party service providers (TPSPs) with whom account data is shared or that could affect security of account data is maintained.",
+    "description": "TPSP register with service type, data shared, and contact details",
+    "identifier": "12.8.1",
+    "createdAt": "2026-04-13 14:37:39.687",
+    "updatedAt": "2026-04-13 14:37:39.687"
+  },
+  {
+    "id": "frk_rq_69dcffb5976c9bf607b589bf",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Written agreements with all TPSPs acknowledge their responsibility for the security of account data they possess or could affect.",
+    "description": "TPSP agreements with PCI DSS clauses; responsibility acknowledgments",
+    "identifier": "12.8.2",
+    "createdAt": "2026-04-13 14:37:40.728",
+    "updatedAt": "2026-04-13 14:37:40.728"
+  },
+  {
+    "id": "frk_rq_69dcffbae18a11fa1fefd5cc",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Additional requirement for service providers: TPSPs support customers' requests for information related to their PCI DSS compliance. (SP)",
+    "description": "Customer request handling process; records of customer inquiries and responses",
+    "identifier": "12.9.2",
+    "createdAt": "2026-04-13 14:37:45.709",
+    "updatedAt": "2026-04-13 14:37:45.709"
+  },
+  {
+    "id": "frk_rq_69dcffbcc00c2a8335362cd9",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "At least once every 12 months, the incident response plan is reviewed and tested.",
+    "description": "Annual IRP test records (tabletop exercise or live drill); review sign-offs; lessons-learned documentation",
+    "identifier": "12.10.2",
+    "createdAt": "2026-04-13 14:37:47.623",
+    "updatedAt": "2026-04-13 14:37:47.623"
+  },
+  {
+    "id": "frk_rq_69dcffbe8febb9ad32cee3ac",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The incident response plan includes monitoring and responding to alerts from security monitoring systems.",
+    "description": "IRP sections covering SIEM/IDS/FIM alerts; playbooks for common alert types; escalation procedures",
+    "identifier": "12.10.5",
+    "createdAt": "2026-04-13 14:37:50.454",
+    "updatedAt": "2026-04-13 14:37:50.454"
+  },
+  {
+    "id": "frk_rq_69dcffbfa920236e68274c8a",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "The incident response plan is modified and evolved according to lessons learned and industry developments.",
+    "description": "IRP version history; lessons-learned records from incidents and tests; review schedule",
+    "identifier": "12.10.6",
+    "createdAt": "2026-04-13 14:37:51.469",
+    "updatedAt": "2026-04-13 14:37:51.469"
+  },
+  {
+    "id": "frk_rq_69dcffc0f183d6d459f7374d",
+    "frameworkId": "frk_69dcfb280b550e7ee231f312",
+    "name": "Incident response procedures are in place for detection of stored PAN where it should not be.",
+    "description": "IRP section covering unauthorized PAN discovery; data classification and remediation procedures",
+    "identifier": "12.10.7",
+    "createdAt": "2026-04-13 14:37:52.400",
+    "updatedAt": "2026-04-13 14:37:52.400"
+  },
+  {
+    "id": "frk_rq_681ed20a3f7335dd1ec64b6c",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.10 Organizational Controls",
+    "description": "Acceptable use of information and other associated assets",
+    "identifier": "A.5.10",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 14:59:49.552"
+  },
+  {
+    "id": "frk_rq_69e918bdb25c8526688fa93e",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right to Restrict Processing",
+    "description": "It's easy for your customers to ask you to stop processing their data.",
+    "identifier": "PR-4",
+    "createdAt": "2026-04-22 18:51:41.481",
+    "updatedAt": "2026-04-22 18:51:41.481"
+  },
+  {
+    "id": "frk_rq_681ed61f357c7bf776300aa7",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.7.5 Physical Controls",
+    "description": "Protecting against physical and environmental threats",
+    "identifier": "A.7.5 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:26.023"
+  },
+  {
+    "id": "frk_rq_681ed7532959ec62c8ae815c",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.8.19 Technological Controls ",
+    "description": "Installation of software on operational systems",
+    "identifier": "\t A.8.19",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:27.407"
+  },
+  {
+    "id": "frk_rq_681ed7794b363009725bab5b",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.8.21 Technological Controls",
+    "description": "Security of network services",
+    "identifier": "A.8.21",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:27.613"
+  },
+  {
+    "id": "frk_rq_69e918be4efe14f478e1f46a",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right to Object",
+    "description": "It's easy for your customers to object to you processing their data.",
+    "identifier": "PR-6",
+    "createdAt": "2026-04-22 18:51:42.292",
+    "updatedAt": "2026-04-22 18:51:42.292"
+  },
+  {
+    "id": "frk_rq_681ecca11f8e93d33110f582",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "4.1 Context of the organization",
+    "description": "Understanding the organization and its context",
+    "identifier": "4.1 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:28.601"
+  },
+  {
+    "id": "frk_rq_681eccf8ea16a6a8c71b2043",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "4.3 Context of the organization",
+    "description": "Determining the scope of the ISMS",
+    "identifier": "4.3 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:28.665"
+  },
+  {
+    "id": "frk_rq_69e918bf7e5efe469442d414",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Automated Decision-Making Safeguards",
+    "description": "If you make decisions about people based on automated processes, you have a procedure to protect their rights.",
+    "identifier": "PR-7",
+    "createdAt": "2026-04-22 18:51:42.643",
+    "updatedAt": "2026-04-22 18:51:42.643"
+  },
+  {
+    "id": "frk_rq_681eccda0b0048baacc8384f",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "4.2 Context of the organization",
+    "description": "Needs & expectations of interested parties",
+    "identifier": "4.2 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:28.718"
+  },
+  {
+    "id": "frk_rq_681ed6f360678a6cf25345b2",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.8.9 Technological Controls",
+    "description": "Configuration management",
+    "identifier": "\t A.8.9",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:12.244"
+  },
+  {
+    "id": "frk_rq_681ed1433a712ae09dc7633b",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "10.1 Improvement ",
+    "description": "Nonconformity and corrective action",
+    "identifier": "\t 10.1 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:29.048"
+  },
+  {
+    "id": "frk_rq_681ecee267499cb4e89dd597",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "5.3 Leadership",
+    "description": "Organizational roles, responsibilities, and authorities",
+    "identifier": "5.3 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:29.156"
+  },
+  {
+    "id": "frk_rq_681ed29613b703c7f368ffdc",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.19 Organizational Controls ",
+    "description": "Information security in supplier relationships",
+    "identifier": "A.5.19",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:29.987"
+  },
+  {
+    "id": "frk_rq_681ed38c0abdd2731880fa6e",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.5.30 Organizational Controls",
+    "description": "ICT readiness for business continuity",
+    "identifier": "A.5.30",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-20 15:04:32.109"
+  },
+  {
+    "id": "frk_rq_69e91593a0551c32d5c99972",
+    "frameworkId": "frk_68d12ec2791043b5a1555950",
+    "name": "External Vulnerability Scanning",
+    "description": "External vulnerability scans must be performed at least once every three months and after any significant change to the external attack surface. Scans must be conducted by a PCI SSC Approved Scanning Vendor (ASV) and meet ASV Program Guide passing criteria. All high-risk and critical vulnerabilities must be remediated and the environment rescanned until a passing scan is achieved.",
+    "identifier": "11.3.2",
+    "createdAt": "2026-04-22 18:38:11.289",
+    "updatedAt": "2026-04-22 18:38:11.289"
+  },
+  {
+    "id": "frk_rq_69e918b79f38966f5f583cec",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Information Audit",
+    "description": "Conduct an information audit to determine what information you process and who has access to it.",
+    "identifier": "LBT-1",
+    "createdAt": "2026-04-22 18:51:35.305",
+    "updatedAt": "2026-04-22 18:51:35.305"
+  },
+  {
+    "id": "frk_rq_69e918b890ecd3f9bb6f77d5",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Legal Justification for Processing",
+    "description": "Have a legal justification for your data processing activities.",
+    "identifier": "LBT-2",
+    "createdAt": "2026-04-22 18:51:35.729",
+    "updatedAt": "2026-04-22 18:51:35.729"
+  },
+  {
+    "id": "frk_rq_69e918b8311dfe1878703dc4",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Transparent Privacy Policy",
+    "description": "Provide clear information about your data processing and legal justification in your privacy policy.",
+    "identifier": "LBT-3",
+    "createdAt": "2026-04-22 18:51:36.121",
+    "updatedAt": "2026-04-22 18:51:36.121"
+  },
+  {
+    "id": "frk_rq_69e918b9edbcd14b1ce1c115",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Privacy by Design and by Default",
+    "description": "Take data protection into account at all times, from the moment you begin developing a product to each time you process data.",
+    "identifier": "DS-1",
+    "createdAt": "2026-04-22 18:51:36.583",
+    "updatedAt": "2026-04-22 18:51:36.583"
+  },
+  {
+    "id": "frk_rq_69e918b9915691574d0c306e",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Data Minimization and Pseudonymization",
+    "description": "Encrypt, pseudonymize, or anonymize personal data wherever possible.",
+    "identifier": "DS-2",
+    "createdAt": "2026-04-22 18:51:37.047",
+    "updatedAt": "2026-04-22 18:51:37.047"
+  },
+  {
+    "id": "frk_rq_69e918b9c01cf05118ad6c9f",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Internal Security Policy and Awareness",
+    "description": "Create an internal security policy for your team members, and build awareness about data protection.",
+    "identifier": "DS-3",
+    "createdAt": "2026-04-22 18:51:37.422",
+    "updatedAt": "2026-04-22 18:51:37.422"
+  },
+  {
+    "id": "frk_rq_69e918ba0847fd461d701bf3",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Data Protection Impact Assessment",
+    "description": "Know when to conduct a data protection impact assessment, and have a process in place to carry it out.",
+    "identifier": "DS-4",
+    "createdAt": "2026-04-22 18:51:37.823",
+    "updatedAt": "2026-04-22 18:51:37.823"
+  },
+  {
+    "id": "frk_rq_69e918ba40b8476a90d01fb2",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Breach Notification Process",
+    "description": "Have a process in place to notify the authorities and your data subjects in the event of a data breach.",
+    "identifier": "DS-5",
+    "createdAt": "2026-04-22 18:51:38.221",
+    "updatedAt": "2026-04-22 18:51:38.221"
+  },
+  {
+    "id": "frk_rq_69e918bb12c8b04e6f46554d",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "GDPR Accountability Owner",
+    "description": "Designate someone responsible for ensuring GDPR compliance across your organization.",
+    "identifier": "AG-1",
+    "createdAt": "2026-04-22 18:51:38.678",
+    "updatedAt": "2026-04-22 18:51:38.678"
+  },
+  {
+    "id": "frk_rq_681ed81d5e01d43ada52ffae",
+    "frameworkId": "frk_681ecc34e85064efdbb76993",
+    "name": "A.8.34 Technological Controls ",
+    "description": "Protection of information systems during audit and testing",
+    "identifier": "A.8.34 ",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-23 14:43:12.959"
+  },
+  {
+    "id": "frk_rq_69e918bd12d2800d62e187a5",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right to Erasure",
+    "description": "It's easy for your customers to request to have their personal data deleted.",
+    "identifier": "PR-3",
+    "createdAt": "2026-04-22 18:51:41.081",
+    "updatedAt": "2026-04-22 18:51:41.081"
+  },
+  {
+    "id": "frk_rq_69e918befc216b296cbbdae9",
+    "frameworkId": "frk_69e9187a649152cdc715f1ad",
+    "name": "Right to Data Portability",
+    "description": "It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company.",
+    "identifier": "PR-5",
+    "createdAt": "2026-04-22 18:51:41.846",
+    "updatedAt": "2026-04-22 18:51:41.846"
+  },
+  {
+    "id": "frk_rq_69eaa7b7f5a7e613f2506e2e",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Automated Decision-Making Safeguards",
+    "description": "If you make decisions about people based on automated processes, you have a procedure to protect their rights.",
+    "identifier": "PR-7",
+    "createdAt": "2026-04-23 23:13:58.662",
+    "updatedAt": "2026-04-23 23:13:58.662"
+  },
+  {
+    "id": "frk_rq_69eaa7b7f31a0487875d4020",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Breach Notification Process",
+    "description": "Have a process in place to notify the authorities and your data subjects in the event of a data breach.",
+    "identifier": "DS-5",
+    "createdAt": "2026-04-23 23:13:58.782",
+    "updatedAt": "2026-04-23 23:13:58.782"
+  },
+  {
+    "id": "frk_rq_69eaa7b7da0c92ffd26e6f7e",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Data Minimization and Pseudonymization",
+    "description": "Encrypt, pseudonymize, or anonymize personal data wherever possible.",
+    "identifier": "DS-2",
+    "createdAt": "2026-04-23 23:13:58.862",
+    "updatedAt": "2026-04-23 23:13:58.862"
+  },
+  {
+    "id": "frk_rq_69eaa7b71e2f3c4710aa383f",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Data Processor Agreements",
+    "description": "Sign a data processing agreement between your organization and any third parties that process personal data on your behalf.",
+    "identifier": "AG-2",
+    "createdAt": "2026-04-23 23:13:58.927",
+    "updatedAt": "2026-04-23 23:13:58.927"
+  },
+  {
+    "id": "frk_rq_69eaa7b77bf5981d7557e448",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Data Protection Impact Assessment",
+    "description": "Know when to conduct a data protection impact assessment, and have a process in place to carry it out.",
+    "identifier": "DS-4",
+    "createdAt": "2026-04-23 23:13:59.014",
+    "updatedAt": "2026-04-23 23:13:59.014"
+  },
+  {
+    "id": "frk_rq_69eaa7b76c115a489f4f4b08",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Data Protection Officer",
+    "description": "Appoint a Data Protection Officer (if necessary).",
+    "identifier": "AG-4",
+    "createdAt": "2026-04-23 23:13:59.084",
+    "updatedAt": "2026-04-23 23:13:59.084"
+  },
+  {
+    "id": "frk_rq_69eaa7b7b237bc35bb52c10d",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "EU Representative",
+    "description": "If your organization is outside the EU, appoint a representative within one of the EU member states.",
+    "identifier": "AG-3",
+    "createdAt": "2026-04-23 23:13:59.165",
+    "updatedAt": "2026-04-23 23:13:59.165"
+  },
+  {
+    "id": "frk_rq_69eaa7b735898b1be6a9ebf2",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "GDPR Accountability Owner",
+    "description": "Designate someone responsible for ensuring GDPR compliance across your organization.",
+    "identifier": "AG-1",
+    "createdAt": "2026-04-23 23:13:59.299",
+    "updatedAt": "2026-04-23 23:13:59.299"
+  },
+  {
+    "id": "frk_rq_69eaa7b733cf653074d17a7f",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Information Audit",
+    "description": "Conduct an information audit to determine what information you process and who has access to it.",
+    "identifier": "LBT-1",
+    "createdAt": "2026-04-23 23:13:59.379",
+    "updatedAt": "2026-04-23 23:13:59.379"
+  },
+  {
+    "id": "frk_rq_69eaa7b707e431b82960342c",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Internal Security Policy and Awareness",
+    "description": "Create an internal security policy for your team members, and build awareness about data protection.",
+    "identifier": "DS-3",
+    "createdAt": "2026-04-23 23:13:59.470",
+    "updatedAt": "2026-04-23 23:13:59.470"
+  },
+  {
+    "id": "frk_rq_69eaa7b8ebe34c5dbee1528f",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Legal Justification for Processing",
+    "description": "Have a legal justification for your data processing activities.",
+    "identifier": "LBT-2",
+    "createdAt": "2026-04-23 23:13:59.550",
+    "updatedAt": "2026-04-23 23:13:59.550"
+  },
+  {
+    "id": "frk_rq_69eaa7b8e4e4347bb2b861d5",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Privacy by Design and by Default",
+    "description": "Take data protection into account at all times, from the moment you begin developing a product to each time you process data.",
+    "identifier": "DS-1",
+    "createdAt": "2026-04-23 23:13:59.630",
+    "updatedAt": "2026-04-23 23:13:59.630"
+  },
+  {
+    "id": "frk_rq_69eaa7b859ec0d1cb67baf70",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right of Access",
+    "description": "It's easy for your customers to request and receive all the information you have about them.",
+    "identifier": "PR-1",
+    "createdAt": "2026-04-23 23:13:59.711",
+    "updatedAt": "2026-04-23 23:13:59.711"
+  },
+  {
+    "id": "frk_rq_69eaa7b8673a4dc99e803097",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right to Data Portability",
+    "description": "It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company.",
+    "identifier": "PR-5",
+    "createdAt": "2026-04-23 23:13:59.823",
+    "updatedAt": "2026-04-23 23:13:59.823"
+  },
+  {
+    "id": "frk_rq_69eaa7b8d85d601c3b8fd630",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right to Erasure",
+    "description": "It's easy for your customers to request to have their personal data deleted.",
+    "identifier": "PR-3",
+    "createdAt": "2026-04-23 23:13:59.901",
+    "updatedAt": "2026-04-23 23:13:59.901"
+  },
+  {
+    "id": "frk_rq_69eaa7b8cdabaf034bb4f34e",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right to Object",
+    "description": "It's easy for your customers to object to you processing their data.",
+    "identifier": "PR-6",
+    "createdAt": "2026-04-23 23:13:59.976",
+    "updatedAt": "2026-04-23 23:13:59.976"
+  },
+  {
+    "id": "frk_rq_69eaa7b867e5acb44fc95468",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right to Rectification",
+    "description": "It's easy for your customers to correct or update inaccurate or incomplete information.",
+    "identifier": "PR-2",
+    "createdAt": "2026-04-23 23:14:00.048",
+    "updatedAt": "2026-04-23 23:14:00.048"
+  },
+  {
+    "id": "frk_rq_69eaa7b866cb7cb0261b9fe2",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Right to Restrict Processing",
+    "description": "It's easy for your customers to ask you to stop processing their data.",
+    "identifier": "PR-4",
+    "createdAt": "2026-04-23 23:14:00.125",
+    "updatedAt": "2026-04-23 23:14:00.125"
+  },
+  {
+    "id": "frk_rq_69eaa7b832769b4ecf0e9295",
+    "frameworkId": "frk_681ef1952907deb7cb85896d",
+    "name": "Transparent Privacy Policy",
+    "description": "Provide clear information about your data processing and legal justification in your privacy policy.",
+    "identifier": "LBT-3",
+    "createdAt": "2026-04-23 23:14:00.217",
+    "updatedAt": "2026-04-23 23:14:00.217"
+  },
+  {
+    "id": "frk_rq_681fe40489876e2fe301c757",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.306(d.3) General Rules",
+    "description": "Implementation specifications\r\n\r\nWhen a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes addressable implementation specifications, a covered entity or business associate must—\r\n\r\n(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and\r\n\r\n(ii) As applicable to the covered entity or business associate—\r\n\r\n(A) Implement the implementation specification if reasonable and appropriate; or\r\n\r\n(B) If implementing the implementation specification is not reasonable and appropriate—\r\n\r\n$(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and\r\n\r\n$(2) Implement an equivalent alternative measure if reasonable and appropriate.",
+    "identifier": "164.306(d.3)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:31.430"
+  },
+  {
+    "id": "frk_rq_681fe7022814f2d467948e70",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.308(a.5.ii.B) Administrative safeguards",
+    "description": "Protection from malicious software (Addressable).  \r\n\r\nProcedures for guarding against, detecting, and reporting malicious software.",
+    "identifier": "164.308(a.5.ii.B)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:39.061"
+  },
+  {
+    "id": "frk_rq_681fe79871e99458f760abba",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.308(a.6.i) Administrative safeguards",
+    "description": "Standard: Security incident procedures.  Implement policies and procedures to address security incidents.",
+    "identifier": "164.308(a.6.i)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:40.230"
+  },
+  {
+    "id": "frk_rq_681fe2c0b70c40a7af7538c1",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.306(a.4) General Rules",
+    "description": "General requirements\r\n\r\nEnsure compliance with this subpart by its workforce.",
+    "identifier": "164.306(a.4)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:59.459"
+  },
+  {
+    "id": "frk_rq_681fe7b3f5e3ea69698e52e2",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.308(a.6.ii) Administrative safeguards",
+    "description": "Implementation specification: Response and reporting (Required).  \r\n\r\nIdentify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.",
+    "identifier": "164.308(a.6.ii)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:40.628"
+  },
+  {
+    "id": "frk_rq_681fea4735996fcd17f711bb",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.310(d.1.iii) Physical Safeguards",
+    "description": "Accountability (Addressable).  \r\n\r\nMaintain a record of the movements of hardware and electronic media and any person responsible therefore",
+    "identifier": "164.310(d.1.iii)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:47.677"
+  },
+  {
+    "id": "frk_rq_681fea1b35a991691d685345",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.310(d.1) Physical Safeguards",
+    "description": "Standard: Device and media controls.  Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.",
+    "identifier": "164.310(d.1)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:49.246"
+  },
+  {
+    "id": "frk_rq_681fec08c1179a2bfe677069",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.314(a.2.iii) Organizational requirements.",
+    "description": "Business associate contracts with subcontractors.  The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.",
+    "identifier": "164.314(a.2.iii)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:54.686"
+  },
+  {
+    "id": "frk_rq_681fec1b32de927d4dbeb093",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.314(b.1) Organizational requirements.",
+    "description": "Standard: Requirements for group health plans.  Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to § 164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.",
+    "identifier": "164.314(b.1)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:55.910"
+  },
+  {
+    "id": "frk_rq_681fec55c16831a6cd91f592",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.314(b.2) Organizational requirements.",
+    "description": "Implementation specifications (Required). \r\n\r\nThe plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to—\r\n\r\n(i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;\r\n\r\n(ii) Ensure that the adequate separation required by § 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;\r\n\r\n(iii) Ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and\r\n\r\n(iv) Report to the group health plan any security incident of which it becomes aware.",
+    "identifier": "164.314(b.2)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:58:56.274"
+  },
+  {
+    "id": "frk_rq_681fe27650feb9e1decf9b8e",
+    "frameworkId": "frk_681fdd150f59a1560a66c89a",
+    "name": "164.306(a.2) General Rules",
+    "description": "General requirements\r\n\r\nProtect against any reasonably anticipated threats or hazards to the security or integrity of such information.",
+    "identifier": "164.306(a.2)",
+    "createdAt": "2025-05-14 19:20:44.920",
+    "updatedAt": "2026-04-24 14:59:00.460"
+  },
+  {
+    "id": "frk_rq_69efa5b70d056f596dc2a7ae",
+    "frameworkId": "frk_683f377429b8408d1c85f9bd",
+    "name": "The entity demonstrates a commitment to integrity and ethical values.",
+    "description": "The organization requires contractor agreements to include a code of conduct or reference to the company code of conduct.",
+    "identifier": "CC1.1",
+    "createdAt": "2026-04-27 18:06:47.141",
+    "updatedAt": "2026-04-27 18:15:27.263"
+  },
+  {
+    "id": "frk_rq_69efd572c76b7b41d94b0968",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Data Inventory and Mapping",
+    "description": "Identify and document all personal information the business collects, stores, processes, and shares. Classify data types and map data flows within the organization.",
+    "identifier": "CCPA-1",
+    "createdAt": "2026-04-27 21:30:25.566",
+    "updatedAt": "2026-04-27 21:30:25.566"
+  },
+  {
+    "id": "frk_rq_69efd574f36aa744a461b0f9",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Privacy Policy Updates",
+    "description": "Maintain a CCPA-compliant privacy policy that clarifies the type and purpose of data collected, sources, collection methods/formats, parties with shared access, contact details for data subjects, and notices for CCPA/CPRA rights.",
+    "identifier": "CCPA-2",
+    "createdAt": "2026-04-27 21:30:27.654",
+    "updatedAt": "2026-04-27 21:30:27.654"
+  },
+  {
+    "id": "frk_rq_69efd575c5f8bf35c14f5d69",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Consumer Rights and Requests",
+    "description": "Honor all CCPA/CPRA consumer rights: Right to Know, Right to Delete, Right to Opt-Out of sale, Right to Non-Discrimination, Right to Correct, and Right to Limit use of sensitive personal information.",
+    "identifier": "CCPA-3",
+    "createdAt": "2026-04-27 21:30:29.199",
+    "updatedAt": "2026-04-27 21:30:29.199"
+  },
+  {
+    "id": "frk_rq_69efd57711c3f0a61fe673a4",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Verification of Consumer Requests",
+    "description": "Develop procedures to verify the identity of consumers submitting rights requests in order to prevent fraudulent data access or modification.",
+    "identifier": "CCPA-4",
+    "createdAt": "2026-04-27 21:30:30.986",
+    "updatedAt": "2026-04-27 21:30:30.986"
+  },
+  {
+    "id": "frk_rq_69efd578456ecb3bb27776f6",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Training and Awareness",
+    "description": "Train employees who handle personal information on CCPA requirements and educate staff on internal compliance procedures for processing consumer rights requests.",
+    "identifier": "CCPA-5",
+    "createdAt": "2026-04-27 21:30:32.334",
+    "updatedAt": "2026-04-27 21:30:32.334"
+  },
+  {
+    "id": "frk_rq_69efd57ab20b0aab665f6d8d",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Data Security Measures",
+    "description": "Implement and maintain reasonable technical and organizational safeguards to protect personal information against unauthorized access, destruction, use, modification, or disclosure.",
+    "identifier": "CCPA-6",
+    "createdAt": "2026-04-27 21:30:33.784",
+    "updatedAt": "2026-04-27 21:30:33.784"
+  },
+  {
+    "id": "frk_rq_69efd57cea0d187006ea6b13",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Service Provider Contracts",
+    "description": "Review and update contracts with service providers and contractors to ensure CCPA compliance, including provisions restricting their use of personal information to the specified business purpose.",
+    "identifier": "CCPA-7",
+    "createdAt": "2026-04-27 21:30:35.955",
+    "updatedAt": "2026-04-27 21:30:35.955"
+  },
+  {
+    "id": "frk_rq_69efd57d8ecf1576f93a0603",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Record Keeping",
+    "description": "Maintain records of consumer rights requests and the business's responses for at least 24 months. Document compliance efforts and processes.",
+    "identifier": "CCPA-8",
+    "createdAt": "2026-04-27 21:30:36.926",
+    "updatedAt": "2026-04-27 21:30:36.926"
+  },
+  {
+    "id": "frk_rq_69efd57e84aa9eb34fbdb270",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Opt-Out Mechanism",
+    "description": "Provide a clear, accessible \"Do Not Sell or Share My Personal Information\" opt-out mechanism and ensure consumers can easily exercise this right.",
+    "identifier": "CCPA-9",
+    "createdAt": "2026-04-27 21:30:38.367",
+    "updatedAt": "2026-04-27 21:30:38.367"
+  },
+  {
+    "id": "frk_rq_69efd580bc382953d7136073",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Minors' Data",
+    "description": "Obtain affirmative opt-in consent before selling or sharing the personal information of consumers under 16. For consumers under 13, obtain verifiable parental consent.",
+    "identifier": "CCPA-10",
+    "createdAt": "2026-04-27 21:30:39.858",
+    "updatedAt": "2026-04-27 21:30:39.858"
+  },
+  {
+    "id": "frk_rq_69efd581f8bf5b44eeecd048",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Regular Audits and Updates",
+    "description": "Conduct regular audits of CCPA compliance processes, monitor regulatory changes, and amend compliance measures accordingly.",
+    "identifier": "CCPA-11",
+    "createdAt": "2026-04-27 21:30:41.018",
+    "updatedAt": "2026-04-27 21:30:41.018"
+  },
+  {
+    "id": "frk_rq_69efd583f4e5404bcb066b56",
+    "frameworkId": "frk_69efd433584ba436ae00d413",
+    "name": "Communications and Notifications",
+    "description": "Provide all required CCPA consumer communications: Notice at Collection, comprehensive Privacy Policy, Authorized Agent Notice, Notice of Financial Incentive (if applicable), timely breach notifications, and a prominently displayed privacy policy link.",
+    "identifier": "CCPA-12",
+    "createdAt": "2026-04-27 21:30:42.895",
+    "updatedAt": "2026-04-27 21:30:42.895"
+  },
+  {
+    "id": "frk_rq_69f3d8f9325e9331eb352d02",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Accountability",
+    "description": "Designate one or more individuals accountable for PIPEDA compliance, implement privacy policies and practices that govern personal information under the organization's control (including information transferred to third parties), train staff, and make the identity of the accountable person known on request.",
+    "identifier": "PIPEDA-1",
+    "createdAt": "2026-04-30 22:34:32.639",
+    "updatedAt": "2026-04-30 22:34:32.639"
+  },
+  {
+    "id": "frk_rq_69f3d8f97b102c78dd60613e",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Identifying Purposes",
+    "description": "Identify and document the purposes for which personal information is collected at or before the time of collection, communicate those purposes clearly to individuals, and obtain new consent before using information for any purpose not previously identified.",
+    "identifier": "PIPEDA-2",
+    "createdAt": "2026-04-30 22:34:33.047",
+    "updatedAt": "2026-04-30 22:34:33.047"
+  },
+  {
+    "id": "frk_rq_69f3d8fa35b14429dc6a5ae2",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Consent",
+    "description": "Obtain meaningful, informed consent for the collection, use, or disclosure of personal information except where inappropriate or otherwise permitted by law. Use express consent for sensitive information, allow individuals to withdraw consent subject to legal/contractual restrictions, and never make consent beyond what is necessary a condition of service.",
+    "identifier": "PIPEDA-3",
+    "createdAt": "2026-04-30 22:34:33.508",
+    "updatedAt": "2026-04-30 22:34:33.508"
+  },
+  {
+    "id": "frk_rq_69f3d8faaaa018c49827ba66",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Limiting Collection",
+    "description": "Limit the collection of personal information (both type and amount) to what is necessary for the identified purposes, and collect only by fair and lawful means. Distinguish mandatory from optional information and respect statutory restrictions such as those on Social Insurance Numbers.",
+    "identifier": "PIPEDA-4",
+    "createdAt": "2026-04-30 22:34:33.982",
+    "updatedAt": "2026-04-30 22:34:33.982"
+  },
+  {
+    "id": "frk_rq_69f3d8fab461cfff700cd0fc",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Limiting Use, Disclosure, and Retention",
+    "description": "Use or disclose personal information only for the purposes for which it was collected, except with consent or as required by law. Retain personal information only as long as necessary to fulfill those purposes, with documented retention schedules and secure destruction or anonymization procedures.",
+    "identifier": "PIPEDA-5",
+    "createdAt": "2026-04-30 22:34:34.449",
+    "updatedAt": "2026-04-30 22:34:34.449"
+  },
+  {
+    "id": "frk_rq_69f3d8fb5e54d4c7ab693e1a",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Accuracy",
+    "description": "Keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is used, with documented procedures for verifying accuracy, recording sources and update dates, and amending information when challenged successfully by individuals.",
+    "identifier": "PIPEDA-6",
+    "createdAt": "2026-04-30 22:34:34.826",
+    "updatedAt": "2026-04-30 22:34:34.826"
+  },
+  {
+    "id": "frk_rq_69f3d8fb285f6ce15ead0408",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Safeguards",
+    "description": "Protect personal information with security safeguards appropriate to its sensitivity — including physical, organizational, and technological measures — covering access control, encryption, secure transmission, employee awareness, breach response, secure disposal, and protection of information used outside the office.",
+    "identifier": "PIPEDA-7",
+    "createdAt": "2026-04-30 22:34:35.296",
+    "updatedAt": "2026-04-30 22:34:35.296"
+  },
+  {
+    "id": "frk_rq_69f3d8fca6daba5a2eaddaaa",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Openness",
+    "description": "Make information about the organization's personal information management policies and practices readily available to individuals in an understandable form, including the name and contact information of the accountable person, how to access personal information, what information is held and its general use, and any disclosure to related organizations.",
+    "identifier": "PIPEDA-8",
+    "createdAt": "2026-04-30 22:34:35.656",
+    "updatedAt": "2026-04-30 22:34:35.656"
+  },
+  {
+    "id": "frk_rq_69f3d8fc64fbb4b8bd63a0f7",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Individual Access",
+    "description": "On written request, inform individuals of the existence, use, and disclosure of their personal information, give them access to that information, allow them to challenge accuracy/completeness, and respond within 30 days at minimal or no cost. Document refusals with reasons and recourse, and propagate amendments to relevant third parties.",
+    "identifier": "PIPEDA-9",
+    "createdAt": "2026-04-30 22:34:36.118",
+    "updatedAt": "2026-04-30 22:34:36.118"
+  },
+  {
+    "id": "frk_rq_69f3d8fd143d9729bbe92c18",
+    "frameworkId": "frk_69f3d7821751ec330608f200",
+    "name": "Challenging Compliance",
+    "description": "Provide individuals with an easily accessible procedure to challenge the organization's compliance with PIPEDA, investigate all complaints, take corrective action where complaints are justified (including amending policies and practices), and inform complainants of the outcome and recourse available.",
+    "identifier": "PIPEDA-10",
+    "createdAt": "2026-04-30 22:34:36.603",
+    "updatedAt": "2026-04-30 22:34:36.603"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json b/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
index 423b364e79..7941651fff 100644
--- a/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
+++ b/packages/db/prisma/seed/primitives/FrameworkEditorTaskTemplate.json
@@ -22,11 +22,11 @@
   {
     "id": "frk_tt_68406951bd282273ebe286cc",
     "name": "Employee Verification",
-    "description": "Maintain a list of reference checks you made for every new hire. Verify the identity of every new hire.\n\nFor ISO 27001: Ensure you are also storing the NDA, candidate evaluation form and access creation request with its approval evidence\n\nFor PCI: For employees with potential access to the CDE, document background verification checks (e.g., reference check, prior employment) before granting access to CHD systems.\n",
+    "description": "Maintain a list of reference checks you made for every new hire. Verify the identity of every new hire.\n\nFor ISO 27001: Ensure you are also storing the NDA, candidate evaluation form and access creation request with its approval evidence\n\nFor PCI: For employees with potential access to the CDE, document background verification checks (e.g., reference check, prior employment) before granting access to CHD systems.\n\nBackground checks can be ran within the Comp AI Plaform, in the People Tab. Select the User => Background Check\n",
     "frequency": "yearly",
     "department": "hr",
     "createdAt": "2025-06-04 15:42:08.603",
-    "updatedAt": "2025-09-10 21:06:07.350",
+    "updatedAt": "2026-04-30 23:56:40.630",
     "automationStatus": "AUTOMATED"
   },
   {
@@ -80,13 +80,13 @@
     "automationStatus": "AUTOMATED"
   },
   {
-    "id": "frk_tt_68b59e7a29bec89c57014868",
-    "name": "Statement of Applicability",
-    "description": "The Statement of Applicability identifies relevant ISO 27001 Annex A controls, explains their inclusion or exclusion, and shows their implementation status within the ISMS.\n\nReview the Statement of Applicability in the Questionnaire Tab in the Comp AI app",
+    "id": "frk_tt_68406d64f09f13271c14dd01",
+    "name": "Code Changes",
+    "description": "Enable branch protection on your main branch to prevent direct pushes and enforce pull requests. Ensure regression testing is done.\n\nUpload a screenshot of these settings, demonstrating the disallowed direct push and required pull request.\n\nFor ISO 27001: Show change approval with peer review, change testing evidence, rollback plan and impact assessment.\n\nFor ISO 42001: Extend change management to include AI-specific changes to models, training data, and algorithms. Document review/approval for impacts on risk, ethics, and compliance.\n\nFor PCI: Demonstrate documented change control for CHD application or infrastructure code changes, including approval, testing, rollback plan, and segregation of duties.",
     "frequency": "yearly",
-    "department": "admin",
-    "createdAt": "2025-09-01 13:24:09.841",
-    "updatedAt": "2025-12-02 18:46:36.579",
+    "department": "gov",
+    "createdAt": "2025-06-04 15:59:31.795",
+    "updatedAt": "2025-09-18 16:14:21.813",
     "automationStatus": "AUTOMATED"
   },
   {
@@ -96,18 +96,8 @@
     "frequency": "yearly",
     "department": "it",
     "createdAt": "2025-07-07 04:46:43.319",
-    "updatedAt": "2025-09-10 21:12:35.061",
-    "automationStatus": "AUTOMATED"
-  },
-  {
-    "id": "frk_tt_68406d64f09f13271c14dd01",
-    "name": "Code Changes",
-    "description": "Enable branch protection on your main branch to prevent direct pushes and enforce pull requests. Ensure regression testing is done.\n\nUpload a screenshot of these settings, demonstrating the disallowed direct push and required pull request.\n\nFor ISO 27001: Show change approval with peer review, change testing evidence, rollback plan and impact assessment.\n\nFor ISO 42001: Extend change management to include AI-specific changes to models, training data, and algorithms. Document review/approval for impacts on risk, ethics, and compliance.\n\nFor PCI: Demonstrate documented change control for CHD application or infrastructure code changes, including approval, testing, rollback plan, and segregation of duties.",
-    "frequency": "yearly",
-    "department": "gov",
-    "createdAt": "2025-06-04 15:59:31.795",
-    "updatedAt": "2025-09-18 16:14:21.813",
-    "automationStatus": "AUTOMATED"
+    "updatedAt": "2026-03-18 18:43:35.242",
+    "automationStatus": "MANUAL"
   },
   {
     "id": "frk_tt_68406903839203801ac8041a",
@@ -120,23 +110,23 @@
     "automationStatus": "AUTOMATED"
   },
   {
-    "id": "frk_tt_68406d2e86acc048d1774ea6",
-    "name": "App Availability",
-    "description": "Make sure your website or app doesn't slow down or crash because too many people are using it, or if there's a problem. \n\nUpload a screenshot showing you have DDoS protection enabled / auto-scale turned on.\n\nShow evidence of firewall configuration on production databases\n",
+    "id": "frk_tt_68406eedf0f0ddd220ea19c2",
+    "name": "Sanitized Inputs",
+    "description": "Implement input validation and sanitization using libraries such as Zod, Pydantic, or equivalent. \n\n",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-06-04 15:58:37.662",
-    "updatedAt": "2025-10-06 20:24:37.179",
+    "createdAt": "2025-06-04 16:06:05.042",
+    "updatedAt": "2026-04-28 15:41:08.190",
     "automationStatus": "AUTOMATED"
   },
   {
-    "id": "frk_tt_68406eedf0f0ddd220ea19c2",
-    "name": "Sanitized Inputs",
-    "description": "Implement input validation and sanitization using libraries such as Zod, Pydantic, or equivalent. \n\nEnable a static code analysis tool such as CodeQL (or its equivalent) to automatically detect security vulnerabilities and insecure coding patterns.\n\nUpload a screenshot showing both measures in use or being enforced.",
+    "id": "frk_tt_68406d2e86acc048d1774ea6",
+    "name": "App Availability",
+    "description": "Make sure your website or app doesn't slow down or crash because too many people are using it, or if there's a problem. \n\nUpload a screenshot showing you have DDoS protection enabled / auto-scale turned on.\n\nShow evidence of firewall configuration on production databases\n",
     "frequency": "yearly",
     "department": "it",
-    "createdAt": "2025-06-04 16:06:05.042",
-    "updatedAt": "2025-10-14 19:27:06.034",
+    "createdAt": "2025-06-04 15:58:37.662",
+    "updatedAt": "2025-10-06 20:24:37.179",
     "automationStatus": "AUTOMATED"
   },
   {
@@ -459,16 +449,6 @@
     "updatedAt": "2025-10-13 23:15:34.934",
     "automationStatus": "AUTOMATED"
   },
-  {
-    "id": "frk_tt_68e80545a8b432bc59eb8037",
-    "name": "Incident Response Tabletop Exercise",
-    "description": "Conduct a periodic tabletop exercise to test the effectiveness of your incident response plan. Simulate a security incident to ensure all team members understand their roles, communication channels, and procedures during a real event.\n\nUpload evidence of the most recent exercise, including the agenda or scenario, a list of attendees with their roles, and session notes. You must also include an after-action report that lists findings, improvement actions, assigned owners, and due dates.\n\nTemplate available here: https://docs.google.com/document/d/1HwJPsGEO9rX3H0w-Nzy5AbYWh68kCsjg/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
-    "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-10-09 18:56:04.980",
-    "updatedAt": "2026-01-14 21:31:39.063",
-    "automationStatus": "MANUAL"
-  },
   {
     "id": "frk_tt_68e805457c2dcc784e72e3cc",
     "name": "Access Review Log",
@@ -549,6 +529,16 @@
     "updatedAt": "2026-01-14 21:31:38.908",
     "automationStatus": "MANUAL"
   },
+  {
+    "id": "frk_tt_69033a6bfeb4759be36257bc",
+    "name": "Infrastructure Inventory",
+    "description": "Maintain an up-to-date inventory of all infrastructure assets, including cloud accounts, compute resources, databases, storage, and networks. SOC 2 requires that you identify and track all assets in your environment to ensure they are protected and ownership is assigned.\n\nUpload an export or screenshot from your cloud provider (e.g., AWS, GCP, Azure) or CMDB listing these assets. Ensure the evidence clearly shows asset names, tags, owners, and a last-updated date.\n\nTemplate here: https://docs.google.com/spreadsheets/d/170csMBWNcmKIkyC6TE0H3lqwv3C1e5dc/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
+    "frequency": "yearly",
+    "department": "itsm",
+    "createdAt": "2025-10-30 10:14:03.155",
+    "updatedAt": "2026-02-06 21:39:59.516",
+    "automationStatus": "MANUAL"
+  },
   {
     "id": "frk_tt_68e52b269db179c434734766",
     "name": "Backup Restoration Test",
@@ -569,16 +559,6 @@
     "updatedAt": "2025-11-19 11:20:23.305",
     "automationStatus": "AUTOMATED"
   },
-  {
-    "id": "frk_tt_69033a6bfeb4759be36257bc",
-    "name": "Infrastructure Inventory",
-    "description": "Maintain an up-to-date inventory of all infrastructure assets, including cloud accounts, compute resources, databases, storage, and networks. SOC 2 requires that you identify and track all assets in your environment to ensure they are protected and ownership is assigned.\n\nUpload an export or screenshot from your cloud provider (e.g., AWS, GCP, Azure) or CMDB listing these assets. Ensure the evidence clearly shows asset names, tags, owners, and a last-updated date.\n\nTemplate here: https://docs.google.com/spreadsheets/d/170csMBWNcmKIkyC6TE0H3lqwv3C1e5dc/edit?usp=drive_link&ouid=105483817633840137498&rtpof=true&sd=true",
-    "frequency": "yearly",
-    "department": "itsm",
-    "createdAt": "2025-10-30 10:14:03.155",
-    "updatedAt": "2025-11-19 11:20:22.122",
-    "automationStatus": "AUTOMATED"
-  },
   {
     "id": "frk_tt_68e52b27c4bdbf1b24051b8b",
     "name": "Employee Performance Evaluations",
@@ -679,6 +659,16 @@
     "updatedAt": "2026-01-13 12:40:19.823",
     "automationStatus": "AUTOMATED"
   },
+  {
+    "id": "frk_tt_69ea915f44950702d9f7733c",
+    "name": "AIMS Manual",
+    "description": "Establish, implement and maintain the AI management system, including the processes required and their interactions, in accordance with ISO/IEC 42001.\n\nUpload the AIMS Manual (or equivalent master document) as evidence.\n\nAcceptance criteria: describes AIMS processes, process interactions (inputs/outputs), responsibilities, resources, and references to supporting policies/procedures. Must include version, owner, approver and approval date.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:39.284",
+    "updatedAt": "2026-04-23 21:38:39.658",
+    "automationStatus": "MANUAL"
+  },
   {
     "id": "frk_tt_691e6d9cd5bf039fdc6d364f",
     "name": "Internal Audit Reports & Schedule",
@@ -692,7 +682,7 @@
   {
     "id": "frk_tt_6840796f77d8a0dff53f947a",
     "name": "Secure Devices",
-    "description": "Ensure all devices meet the following security requirements:\n\n• Full disk encryption enabled (BitLocker for Windows, FileVault for macOS)\n\n• Screen lock enabled after 15 minutes of inactivity\n\n• Minimum password length of 8+ characters\n\n• Automatic installation of security updates\n\n• Anti-virus enabled (Windows Defender on Windows or macOS XProtect)\n\nYou may verify compliance by uploading screenshots for each device or by installing the Comp AI device agent.\n\nIf you already use a third-party MDM provider (e.g., Jamf, Intune, Kandji, etc.), it is recommended that you do not install the Comp AI device agent, as running multiple device management agents may cause conflicts. In these cases, please upload screenshots instead.\n\nThe Comp AI device agent can be downloaded from: portal.trycomp.ai",
+    "description": "Ensure all devices meet the following security requirements:\n\n• Full disk encryption enabled (BitLocker for Windows, FileVault for macOS)\n\n• Screen lock enabled after 5 minutes of inactivity on macOS and 15 minutes on Windows\n\n• Minimum password length of 8+ characters\n\n• Automatic installation of security updates\n\n• Anti-virus enabled (Windows Defender on Windows or macOS XProtect)\n\nYou may verify compliance by uploading screenshots for each device or by installing the Comp AI device agent.\n\nIf you already use a third-party MDM provider (e.g., Jamf, Intune, Kandji, etc.), it is recommended that you do not install the Comp AI device agent, as running multiple device management agents may cause conflicts. In these cases, please upload screenshots instead.\n\nThe Comp AI device agent can be downloaded from: portal.trycomp.ai",
     "frequency": "yearly",
     "department": "itsm",
     "createdAt": "2025-06-04 16:50:54.671",
@@ -729,6 +719,66 @@
     "updatedAt": "2026-01-14 21:33:59.506",
     "automationStatus": "MANUAL"
   },
+  {
+    "id": "frk_tt_69ea9161097ef7eb142b70ff",
+    "name": "AI Leadership Commitment Record",
+    "description": "Top management demonstrates leadership and commitment to the AIMS by approving the AI policy and objectives, ensuring resources are available, and communicating the importance of effective AIMS.\n\nUpload evidence of leadership commitment (signed AI policy, board/exec meeting minutes, or a dated management statement).\n\nAcceptance criteria: attendees/signatories, date, explicit approval of AI policy and objectives, resource decisions, and references to AIMS performance discussions.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:40.588",
+    "updatedAt": "2026-04-23 21:38:40.769",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916227fbbb6a722126b6",
+    "name": "AI Policy Alignment Review",
+    "description": "Review the AI policy for alignment with other organizational policies (information security, privacy, quality, risk, ethics, HR) and resolve any conflicts.\n\nUpload the AI Policy Alignment Review record as evidence.\n\nAcceptance criteria: policies reviewed, conflicts identified, resolution actions, reviewer, date, sign-off, and the resulting changes to AI policy or the related policies.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:41.643",
+    "updatedAt": "2026-04-23 21:38:41.846",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9167679a59212c7db16f",
+    "name": "AI Tooling Inventory",
+    "description": "Maintain an inventory of tooling used across the AI lifecycle (frameworks, libraries, model registries, MLOps platforms, evaluation tools) including versions and approval status.\n\nUpload the AI Tooling Inventory as evidence.\n\nAcceptance criteria: tool name, version, purpose, owner, license, approved-for-use status, security review date, and associated AI systems.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:47.164",
+    "updatedAt": "2026-04-23 21:38:47.402",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69efd9f81f073e643fb5a19d",
+    "name": "Quarterly Privacy Notice Display Review",
+    "description": "Verify each quarter that the Notice at Collection, privacy policy link, \"Do Not Sell or Share\" link, \"Limit the Use of My Sensitive Personal Information\" link, and any Notice of Financial Incentive remain visible, accurate, and accessible across all properties.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:43.915",
+    "updatedAt": "2026-04-27 21:49:43.915",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_698cacc0f06de04786d097ca",
+    "name": "Security Awareness Training",
+    "description": "Upload evidence showing that all employees and contractors complete annual security awareness training. ",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-02-11 16:22:24.072",
+    "updatedAt": "2026-02-12 17:22:47.428",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69dd3fb7c4f015f0b5851eb0",
+    "name": "POI register & tamper inspection set",
+    "description": "Current POI register (make, model, serial, site) plus a sample set of completed periodic tamper/inspection checklists with dates and inspector.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-13 19:10:47.221",
+    "updatedAt": "2026-04-13 19:12:10.867",
+    "automationStatus": "MANUAL"
+  },
   {
     "id": "frk_tt_6901e041bb02b41fa3b7dca9",
     "name": "Office Access & Door Monitoring",
@@ -736,7 +786,697 @@
     "frequency": "yearly",
     "department": "admin",
     "createdAt": "2025-10-29 09:37:04.804",
-    "updatedAt": "2026-01-14 21:33:59.041",
+    "updatedAt": "2026-03-02 20:35:23.610",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69dd3f8f62639b078e7cc061",
+    "name": "Executive PCI accountability assignment",
+    "description": "Executive charter or board/management record formally assigning PCI DSS accountability (e.g. to CISO or named executive) and the compliance program.",
+    "frequency": "quarterly",
+    "department": "admin",
+    "createdAt": "2026-04-13 19:10:07.078",
+    "updatedAt": "2026-04-13 19:10:22.925",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69dd400bdc718337e0354ff7",
+    "name": "Passing ASV quarterly scan evidence",
+    "description": "Most recent passing quarterly ASV report for all in-scope external IPs/FQDNs, with ASV attestations and scan completion dates visible.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-13 19:12:10.715",
+    "updatedAt": "2026-04-13 19:12:10.715",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69dd3fe1317ecf573a463bbb",
+    "name": "Payment page script approval & live integrity config",
+    "description": "Authorized third-party script inventory for the payment checkout page, tied to change tickets or approvals, plus exported CSP / SRI configuration from the live payment environment.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-13 19:11:28.561",
+    "updatedAt": "2026-04-13 19:12:11.036",
     "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69dd3f6094fc732d635210ae",
+    "name": "Scope confirmation & CDE inventory pack",
+    "description": "Signed annual (or bi-annual SP) scope confirmation with attached CDE network/data-flow diagrams and in-scope system list (owner, function, location).",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-13 19:09:20.365",
+    "updatedAt": "2026-04-13 21:18:49.624",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69e928283390c5483dccbcde",
+    "name": "Maintain Records of Processing Activities (RoPA)",
+    "description": "Maintain and review the organization's Article 30 Records of Processing Activities. For each processing activity, document the purpose, categories of data subjects and personal data, recipients, international transfers, retention periods, and applicable security measures. Review at least annually and whenever processing activities materially change. Identify and document who has access to each dataset.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-22 19:57:27.749",
+    "updatedAt": "2026-04-22 19:57:27.749",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69e92829b6aa752b0dfba9a8",
+    "name": "Data Protection Awareness Training",
+    "description": "Deliver data protection and privacy awareness training to all personnel at onboarding and at least annually thereafter. Training must cover lawful processing, data subject rights, incident reporting, and the internal security policy. Track completion and retain evidence (sign-off, quiz results, or LMS completion reports).",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-04-22 19:57:28.639",
+    "updatedAt": "2026-04-22 19:57:28.639",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69e92829ac42d6ca48bc6cd9",
+    "name": "DPIA Trigger Review and Execution",
+    "description": "Review planned and current processing activities against DPIA trigger criteria (e.g., large-scale processing of special categories, systematic monitoring, new technologies, automated decision-making with significant effects). For each triggered activity, complete a DPIA, document residual risks, implement mitigations, and consult the supervisory authority where residual risk remains high. Retain DPIA records.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-22 19:57:29.078",
+    "updatedAt": "2026-04-22 19:57:29.078",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69e92829e97f5a494f13d67b",
+    "name": "Data Subject Rights Request Handling",
+    "description": "Review the Data Subject Access Request (DSAR) log covering the rights of access, rectification, erasure, restriction, portability, and objection. For each request, verify that identity was confirmed, the response was provided within one month (or a justified two-month extension was communicated), and the outcome was documented. Identify any SLA breaches or systemic issues and remediate.",
+    "frequency": "quarterly",
+    "department": "admin",
+    "createdAt": "2026-04-22 19:57:29.435",
+    "updatedAt": "2026-04-22 19:57:29.435",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69e92cc75996378b01b27ec9",
+    "name": "Cookie Consent and Tracking Review",
+    "description": "Inventory all cookies, SDKs, pixels, and trackers used across the organization's public websites and apps. Confirm a consent banner presents non-essential cookies as opt-in with the default off, loads no non-essential trackers before consent, and offers a way to reject as easily as to accept. Confirm a cookie policy discloses the name, purpose, duration, and third-party recipient for each cookie category. Verify consent records are stored with timestamp and scope, and that consent withdrawal is as easy as granting. Reconcile the banner's declared cookie list against what is actually set in production, and remediate drift.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-22 20:17:11.002",
+    "updatedAt": "2026-04-22 20:17:11.002",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69ea915ebae9e6858fa4fa07",
+    "name": "AIMS Scope Statement",
+    "description": "Define and document the boundaries and applicability of the AI management system. Consider external/internal issues, interested-party requirements, organizational activities, and your role across the AI lifecycle (provider, developer, deployer, user).\n\nUpload the approved AIMS Scope Statement document as evidence.\n\nAcceptance criteria: included (in/out of scope), excluded items with justification, organizational role(s), covered AI systems, owner, approver, approval date, and review cadence.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:38.208",
+    "updatedAt": "2026-04-23 21:38:38.496",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69e92828297806545638eed7",
+    "name": "Review Data Retention, Minimization, and Encryption",
+    "description": "Review personal data holdings to confirm collection is limited to what is necessary for the stated purpose, retention periods are enforced, and data past its retention limit is deleted or anonymized. Verify personal data is encrypted in transit and at rest, and pseudonymized or anonymized wherever feasible. \n\nDocument the review and any remediation performed.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-22 19:57:28.176",
+    "updatedAt": "2026-04-30 23:56:41.573",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69ea9163eb166db383bb2140",
+    "name": "AI Policy Review",
+    "description": "Review the AI policy at planned intervals and when significant changes occur to confirm continuing suitability, adequacy and effectiveness.\n\nUpload the AI Policy Review record (with updated policy if changed) as evidence.\n\nAcceptance criteria: review date, reviewers, inputs considered (incidents, audits, regulatory changes, impact assessments), outcome (no change / amended / reissued), new version number, and approver.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:42.710",
+    "updatedAt": "2026-04-23 21:38:42.902",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9164c6574221a69e1107",
+    "name": "AI Risk and Opportunity Register",
+    "description": "Maintain a register of risks and opportunities relevant to the AIMS (not individual-system AI risks, which are handled separately) and the planned actions to address them.\n\nUpload the AI Risk and Opportunity Register as evidence.\n\nAcceptance criteria: each entry includes description, likelihood/impact rating, owner, planned action, due date, status, and linkage into AIMS processes.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:43.710",
+    "updatedAt": "2026-04-23 21:38:43.875",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9165056eb451ccc79c0f",
+    "name": "AI Societal Impact Assessment",
+    "description": "Assess potential societal impacts of each in-scope AI system (economic, environmental, cultural, democratic) and identify mitigations.\n\nUpload the AI Societal Impact Assessment record(s) as evidence.\n\nAcceptance criteria: AI system name, impact categories considered, affected groups/communities, severity and likelihood, mitigations, residual risk, assessor and approver, date, and next review.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:44.710",
+    "updatedAt": "2026-04-23 21:38:44.882",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9166fd0793a689981939",
+    "name": "AI Data Resource Register",
+    "description": "Maintain an inventory of data resources used by AI systems (training, validation, testing, operational inputs) with ownership, classification, access, retention and intended use.\n\nUpload the AI Data Resource Register as evidence.\n\nAcceptance criteria: dataset name, source, sensitivity, owner, lawful basis, retention, access controls, associated AI system(s), and last-updated date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:45.752",
+    "updatedAt": "2026-04-23 21:38:45.920",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea91684c77e2310a928a7a",
+    "name": "AI Awareness Program",
+    "description": "Ensure personnel whose work affects AI systems are aware of the AI policy, their contribution to AIMS effectiveness, implications of non-conformance, and potential impacts of the AI systems they develop, deploy or use.\n\nUpload evidence of AI awareness activities (training completion report, attendance list, or acknowledged communication).\n\nAcceptance criteria: audience, content summary, delivery method, completion rate, date, and owner. Include the awareness materials themselves (deck, doc, or link).",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-04-23 21:38:48.218",
+    "updatedAt": "2026-04-23 21:38:48.444",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916984bd6ff9ec7fd09b",
+    "name": "AI Competence Record",
+    "description": "Determine competencies required for AI-related roles, assess personnel against them, and close gaps through training/experience/recruitment.\n\nUpload the AI Competence Record (role-to-competence matrix plus evidence of training/assessment).\n\nAcceptance criteria: role, required competencies, person, current level, gap, actions taken, completion dates, and reviewer.",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-04-23 21:38:49.260",
+    "updatedAt": "2026-04-23 21:38:49.499",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916a881ab0d59e67c930",
+    "name": "AIMS Documented Information Index",
+    "description": "Maintain a control index of AIMS documented information (policies, procedures, records) with identification, classification, access, retention and disposal rules.\n\nUpload the AIMS Documented Information Index as evidence.\n\nAcceptance criteria: document name, owner, current version, storage location, access/distribution controls, retention period, review date, and change-history reference.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:50.299",
+    "updatedAt": "2026-04-23 21:38:50.544",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916b05b146a8a544c406",
+    "name": "Responsible AI Development Objectives",
+    "description": "Define and approve objectives for the responsible development of AI systems (fairness, reliability, safety, security, privacy, transparency, explainability, accountability, environmental impact) and direct development activities to meet them.\n\nUpload the Responsible AI Development Objectives document as evidence.\n\nAcceptance criteria: objectives with measurable targets, rationale, owner, approver, approval date, and how each objective flows into design/engineering activities.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:38:51.337",
+    "updatedAt": "2026-04-23 21:38:51.582",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916c7b0b9487da3dbe78",
+    "name": "AI System Requirements and Specification",
+    "description": "For each in-scope AI system, produce and approve a requirements-and-specification document covering intended purpose, performance, safety, security, privacy, fairness, transparency, human oversight and applicable regulatory requirements.\n\nUpload the AI System Requirements & Specification document(s) as evidence.\n\nAcceptance criteria: AI system name, intended purpose and users, functional/non-functional requirements, acceptance criteria, regulatory references, author, reviewer, approver, and date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:52.408",
+    "updatedAt": "2026-04-23 21:38:52.638",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916e273fdb8732d89fc6",
+    "name": "AI Design and Development Documentation",
+    "description": "For each in-scope AI system, document the design and development (data used, architecture, training procedure, key parameters, evaluation approach, known limitations) sufficient to enable assessment, reproduction and oversight.\n\nUpload the AI Design & Development documentation as evidence (design doc, model architecture, training config, evaluation results).\n\nAcceptance criteria: AI system name, design choices with rationale, data used, training/evaluation results, known limitations, author, reviewer, approval date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:53.583",
+    "updatedAt": "2026-04-23 21:38:53.752",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea916f42193436fb7b55de",
+    "name": "AI Verification & Validation Report",
+    "description": "Perform and document verification & validation for each in-scope AI system: functional testing, performance, robustness, fairness, safety, security and privacy checks, against defined acceptance criteria, before deployment and after significant changes.\n\nUpload the AI V&V Report(s) as evidence.\n\nAcceptance criteria: AI system name, test scope, methods, datasets, metrics vs. targets (including fairness/robustness), defects found and dispositions, acceptance decision, tester, approver, date.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:54.622",
+    "updatedAt": "2026-04-23 21:38:54.798",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea917069457debb719152e",
+    "name": "AI System Operation & Monitoring Plan",
+    "description": "Operate and monitor each in-scope AI system in production for performance, drift, reliability, safety, security and ethical outcomes. Define metrics, thresholds, alerting and response procedures.\n\nUpload the AI System Operation & Monitoring Plan and the latest monitoring report as evidence.\n\nAcceptance criteria: AI system name, metrics, thresholds and alert rules, responsible team, review cadence, latest results, drift/incident findings, and corrective actions taken.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:55.736",
+    "updatedAt": "2026-04-23 21:38:55.948",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea917139f2541637597cc4",
+    "name": "AI System Technical Documentation (Model Card)",
+    "description": "For each in-scope AI system, maintain technical documentation (model card or equivalent) describing intended use, capabilities, limitations, training/evaluation data summary, performance characteristics and risk information, sufficient to support interested parties and regulators.\n\nUpload the AI System Technical Documentation / Model Card(s) as evidence.\n\nAcceptance criteria: AI system name, intended use/users, capabilities, limitations, training & evaluation data summary, performance by relevant subgroups, ethical considerations, owner, version, last-updated date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:56.777",
+    "updatedAt": "2026-04-23 21:38:56.957",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea91725a27f56747512056",
+    "name": "AI System Event Logging Configuration",
+    "description": "Record event logs generated by AI systems (inputs, outputs, decisions, user interactions, system events) with sufficient integrity, retention and access control to support monitoring, incident response and accountability.\n\nUpload evidence of the AI event-logging configuration (config screenshots, log schema, retention policy) and a sample log extract.\n\nAcceptance criteria: AI system name, log categories captured, integrity/retention settings, access controls, sample log entries, reviewer, date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:57.871",
+    "updatedAt": "2026-04-23 21:38:58.036",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9173e73c9a96895468c8",
+    "name": "AI Data Acquisition Record",
+    "description": "For each dataset acquired for AI use, document the lawful basis, contractual rights, licensing, ethical sourcing, consent where required, and acquisition criteria.\n\nUpload the AI Data Acquisition Record(s) as evidence (with source agreements/licenses where applicable).\n\nAcceptance criteria: dataset name, source, lawful basis, license/contract reference, consent where required, acquisition date, reviewer, approver.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:58.928",
+    "updatedAt": "2026-04-23 21:38:59.100",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9174fe7e40c0405cd057",
+    "name": "AI Data Quality Assessment",
+    "description": "Assess the quality of each dataset used by AI systems against defined requirements (accuracy, completeness, consistency, timeliness, relevance, bias). Record results and remediate issues.\n\nUpload the AI Data Quality Assessment report as evidence.\n\nAcceptance criteria: dataset name, metrics and thresholds, results, bias/representativeness findings, remediation actions, owner, assessment date.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:38:59.911",
+    "updatedAt": "2026-04-23 21:39:00.105",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9175640d0bbbddde05a7",
+    "name": "AI Data Provenance Record",
+    "description": "Record and maintain the provenance of each dataset used by AI systems (source, transformations, lineage, handling history) to support reproducibility, accountability and impact assessment.\n\nUpload the AI Data Provenance Record(s) as evidence.\n\nAcceptance criteria: dataset name, origin, transformations applied (with tools and operators), lineage to upstream sources, hashes/version identifiers, owner, last-updated date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:39:00.917",
+    "updatedAt": "2026-04-23 21:39:01.079",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea91761c04c37d4f867908",
+    "name": "AI Data Preparation Record",
+    "description": "Document data preparation activities (cleaning, labeling, annotation, transformation, augmentation, splitting) including rationale, tooling, reviewers and acceptance criteria.\n\nUpload the AI Data Preparation Record(s) as evidence.\n\nAcceptance criteria: dataset name, preparation steps, tools/scripts used (with versions), labeling/annotation procedure and reviewers, acceptance criteria and results, approver, date.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-23 21:39:01.859",
+    "updatedAt": "2026-04-23 21:39:02.118",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea91773112b091b458de8d",
+    "name": "Intended Use Statement",
+    "description": "For each in-scope AI system, determine, document and communicate the intended use and the conditions of that use. Identify reasonably foreseeable misuse and put measures in place to prevent and respond to it.\n\nUpload the Intended Use Statement(s) as evidence.\n\nAcceptance criteria: AI system name, intended users, intended use and conditions, out-of-scope/prohibited uses, foreseeable misuse scenarios with mitigations, owner, approval date.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:03.004",
+    "updatedAt": "2026-04-23 21:39:03.203",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea9178aaa6c6a7058c0fcf",
+    "name": "Responsible AI Use Procedure",
+    "description": "Establish an organization-wide procedure for the responsible use of AI systems, including acceptable-use guidance, human-oversight requirements, escalation paths and periodic review.\n\nUpload the Responsible AI Use Procedure as evidence.\n\nAcceptance criteria: acceptable/prohibited uses, human-oversight responsibilities, escalation and reporting channels, review cadence, owner, approver, approval date.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:04.078",
+    "updatedAt": "2026-04-23 21:39:04.285",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea917abdbda1fa183386d2",
+    "name": "AI Third-Party Responsibility Matrix",
+    "description": "Identify and document the allocation of AI-related responsibilities across the organization, suppliers, partners and customers across the AI lifecycle.\n\nUpload the AI Third-Party Responsibility Matrix as evidence.\n\nAcceptance criteria: lifecycle stage, responsibility (RACI), internal owner, external counterpart, contractual reference, approval date, and review cadence.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:06.218",
+    "updatedAt": "2026-04-23 21:39:06.393",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea91794c21fc8f347cdddd",
+    "name": "Responsible AI Use Objectives",
+    "description": "Define and communicate objectives for the responsible use of AI systems (accountability, transparency, human oversight, harm prevention) and measure progress against them.\n\nUpload the Responsible AI Use Objectives record and latest measurement results as evidence.\n\nAcceptance criteria: objectives with measurable targets, measurement method, current results, gaps, actions, owner, approval date.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:05.184",
+    "updatedAt": "2026-04-23 21:39:05.346",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea917b78c7fc9f3c659a90",
+    "name": "AI Supplier Register",
+    "description": "Maintain a register of AI-related suppliers (model, data, tooling, services), with due diligence, contractual obligations, monitoring and offboarding expectations.\n\nUpload the AI Supplier Register as evidence.\n\nAcceptance criteria: supplier name, service provided, risk rating, due-diligence evidence, contract reference (with AI-specific clauses), monitoring cadence, status, owner.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:07.329",
+    "updatedAt": "2026-04-23 21:39:07.508",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69ea917c23d26cfe23eb8fca",
+    "name": "AI Management Review Minutes",
+    "description": "Top management reviews the AIMS at planned intervals covering required inputs (status of actions, changes, performance, risks, opportunities, improvement) and producing decisions on improvement.\n\nUpload the AI Management Review Minutes as evidence.\n\nAcceptance criteria: date, attendees, inputs covered (Clause 9.3.2 items), decisions and actions (with owners and due dates), next-review date, approver.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-23 21:39:08.439",
+    "updatedAt": "2026-04-23 21:39:08.621",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69eb875d089573be3295269e",
+    "name": "Sanction Policy",
+    "description": "Apply and document appropriate sanctions against workforce members who fail to comply with security policies and procedures. Maintain evidence of sanctions applied.",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-04-24 15:08:13.443",
+    "updatedAt": "2026-04-24 15:08:13.443",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69eb875e9567b702dbb7f05e",
+    "name": "Security Officer Assignment",
+    "description": "Designate a HIPAA Security Official responsible for developing and implementing required security policies and procedures. Maintain written designation and scope of responsibilities.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-24 15:08:13.804",
+    "updatedAt": "2026-04-24 15:16:54.860",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69efd9de89f2f4d93e527127",
+    "name": "Annual CCPA Compliance Audit",
+    "description": "Conduct a documented annual audit of CCPA/CPRA compliance covering disclosures, request handling, training, vendor contracts, and security controls. Track regulatory changes and update measures.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:18.377",
+    "updatedAt": "2026-04-27 21:49:18.377",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69eb87606cb315ebeb98ea49",
+    "name": "Policy Documentation & Retention",
+    "description": "Retain HIPAA policies, procedures, and related documentation for at least 6 years from date of creation or last effective date. Make documentation available to those responsible for implementing procedures.\n\nThis is satisfied by maintaining polices in the Policies tab, ensure these are up to date, and reviewed and adjusted as needed or yearly",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-24 15:08:15.914",
+    "updatedAt": "2026-04-30 19:20:56.477",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69eb875ffe511e3ce5298e21",
+    "name": "Media Sanitization & Disposal Log",
+    "description": "Maintain a log documenting the disposal, re-use, and movement of hardware and electronic media containing ePHI, including sanitization method and accountability.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-24 15:08:15.067",
+    "updatedAt": "2026-04-27 14:53:07.153",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69eb875e71616f3b8a9fadde",
+    "name": "Business Associate Agreement Registry",
+    "description": "Maintain a registry of all Business Associates handling ePHI with signed Business Associate Agreements (BAAs). Review agreements at least annually and upon contract changes.\n\nMaintain Business Associate Agreements in the Vendor section by creating a new task for each applicable vendor, and uploading the signed BAA for that vendor in the comments of that task",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-24 15:08:14.253",
+    "updatedAt": "2026-04-27 15:06:56.645",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69efd9e081684a02f1207ee0",
+    "name": "Annual Privacy Policy Review and Update",
+    "description": "Review the public-facing privacy policy at least annually (or upon material change in processing). Ensure all CCPA/CPRA-required disclosures are accurate and the policy is prominently linked from every page collecting personal information.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:20.246",
+    "updatedAt": "2026-04-27 21:49:20.246",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9e2f40bdd1dd45c057e",
+    "name": "Annual CCPA Privacy Training",
+    "description": "Deliver annual CCPA/CPRA privacy training to all employees handling personal information or consumer rights requests. Track completion and retain records.",
+    "frequency": "yearly",
+    "department": "hr",
+    "createdAt": "2026-04-27 21:49:22.106",
+    "updatedAt": "2026-04-27 21:49:22.106",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9e45e6f00c44f622173",
+    "name": "Quarterly DSAR Volume and Response Time Review",
+    "description": "Review the volume, types, and response times of consumer rights requests (Know, Delete, Correct, Opt-Out, Limit) each quarter. Identify trends, SLA breaches, or operational improvements.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:24.270",
+    "updatedAt": "2026-04-27 21:49:24.270",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9e7f46963f71debd961",
+    "name": "Annual Data Inventory and Data Flow Refresh",
+    "description": "Re-validate the personal information inventory and data flow maps at least annually, capturing new systems, vendors, data categories, and processing purposes.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:27.424",
+    "updatedAt": "2026-04-27 21:49:27.424",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9ed795877621cdbd56d",
+    "name": "Annual Service Provider and Contractor Contract Review",
+    "description": "Review all service provider, contractor, and third-party agreements that involve personal information at least annually. Confirm CCPA/CPRA-required terms (limited purpose, no sale/share, cooperation with consumer rights, confidentiality).",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:32.926",
+    "updatedAt": "2026-04-27 21:49:32.926",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9ef3ff6e8fed0fc0028",
+    "name": "Verify Global Privacy Control (GPC) Signal Honoring",
+    "description": "Test that the website honors the Global Privacy Control browser signal as a valid opt-out of sale/sharing for all sites and applications subject to the CCPA/CPRA.",
+    "frequency": "quarterly",
+    "department": "it",
+    "createdAt": "2026-04-27 21:49:34.636",
+    "updatedAt": "2026-04-27 21:49:34.636",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9f0124f63db79cb50b0",
+    "name": "Annual Incident Response Tabletop Exercise",
+    "description": "Run an annual tabletop exercise covering a personal information breach scenario. Validate detection, escalation, consumer notification, and Attorney General notification timelines under California Civil Code § 1798.82.",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-27 21:49:36.353",
+    "updatedAt": "2026-04-27 21:49:36.353",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69eb875d77ef6407785a500f",
+    "name": "Risk Analysis & Treatment Plan",
+    "description": "Conduct and document an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Document risk treatment decisions and implementation.\n\nThis is handled in the Risk tab in the app. Ensure we have logged and assessed HIPAA related risks, and we can mark this as complete",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-24 15:08:12.975",
+    "updatedAt": "2026-04-30 16:45:36.071",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69eb876033531483191663a1",
+    "name": "Workforce Authorization & Supervision",
+    "description": "Authorize workforce access to ePHI and supervise workforce members whose roles require access. Maintain records of authorization decisions and supervision activities.\n\nThis can be satisfied by use of the RBAX Document in the Documents tab",
+    "frequency": "quarterly",
+    "department": "hr",
+    "createdAt": "2026-04-24 15:08:16.319",
+    "updatedAt": "2026-04-30 17:12:49.144",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69eb8761ff2b2d874ae2a4da",
+    "name": "Login Monitoring & Password Management",
+    "description": "Monitor login attempts and discrepancies, and enforce password management procedures including creation, change, and safeguarding of credentials.\n\nInstall the Comp AI device agent on portal.trycomp.ai, or provide manual evidence of device settings. https://www.trycomp.ai/docs/device-agent#manual-evidence-collection\n\n",
+    "frequency": "monthly",
+    "department": "it",
+    "createdAt": "2026-04-24 15:08:16.690",
+    "updatedAt": "2026-04-30 19:13:58.750",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69efd9f2322df1e829df8087",
+    "name": "Annual Identity Verification Procedure Review",
+    "description": "Review the consumer identity verification procedure annually. Ensure verification rigor matches the sensitivity of the data and the type of request, and that fraud controls remain effective.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:49:37.837",
+    "updatedAt": "2026-04-30 23:56:39.959",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69efdbcee1d3e72ee6873ed1",
+    "name": "Document Consumer Rights Request Fulfillment",
+    "description": "For each consumer rights request received (Right to Know, Right to Delete, authorized-agent submission, etc.), capture and retain a record of: requester identity and verification method/result, request type and scope, authorized-agent verification (if applicable), business response, fulfillment or denial reason, and dates of receipt and response. Records must be retained for at least 24 months and serve as the primary evidence for CCPA/CPRA consumer rights handling.",
+    "frequency": "monthly",
+    "department": "gov",
+    "createdAt": "2026-04-27 21:57:34.432",
+    "updatedAt": "2026-04-27 21:57:34.432",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f0d514d103c34ca40ad332",
+    "name": "Static Code Scanning  ",
+    "description": "Enable a static code analysis tool such as CodeQL (or its equivalent) to automatically detect security vulnerabilities and insecure coding patterns.",
+    "frequency": "quarterly",
+    "department": "none",
+    "createdAt": "2026-04-28 15:41:07.897",
+    "updatedAt": "2026-04-28 15:41:07.897",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f10edce3013d5b6e0ab7c9",
+    "name": "Updated tasl",
+    "description": "test",
+    "frequency": "monthly",
+    "department": "none",
+    "createdAt": "2026-04-28 19:47:40.321",
+    "updatedAt": "2026-04-28 19:47:40.321",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f10edc75a040a97dd41d0a",
+    "name": "Updated tasl",
+    "description": "test",
+    "frequency": "monthly",
+    "department": "none",
+    "createdAt": "2026-04-28 19:47:40.398",
+    "updatedAt": "2026-04-28 19:47:40.398",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69eb8760d56cb8d18c53df13",
+    "name": "Contingency Plan Testing & Revision",
+    "description": "Periodically test contingency plans (data backup, disaster recovery, emergency mode operations) and document results. Revise plans based on test findings and operational changes.\n\nWhat to upload: test report (date, scenarios tested e.g. ransomware/region outage, participants, RTO/RPO results, gaps found, plan revisions). HIPAA cites §164.308(a)(7).",
+    "frequency": "yearly",
+    "department": "it",
+    "createdAt": "2026-04-24 15:08:15.544",
+    "updatedAt": "2026-04-30 17:13:41.699",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69eb875fa49f13b4b81e9f3b",
+    "name": "Facility Security Plan",
+    "description": "Document and maintain a facility security plan that safeguards facilities and the equipment therein from unauthorized physical access, tampering, and theft.\n\nList required sections (access control, contingency ops, maintenance records, device/media controls), upload the signed plan + photos of safeguards (locks, cameras, server room)\n\nIf team is fully remote, or no physical PHI stored on site, you can mark this as not relevant. ",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-24 15:08:14.631",
+    "updatedAt": "2026-04-30 17:14:57.750",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ac66d4f449b6c8c503c4",
+    "name": "test",
+    "description": "test",
+    "frequency": "monthly",
+    "department": "none",
+    "createdAt": "2026-04-30 19:24:21.757",
+    "updatedAt": "2026-04-30 19:24:21.757",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f3ea6497e3c0fbd6726ea5",
+    "name": "Quarterly PIPEDA Privacy Notice Display Review",
+    "description": "Verify each quarter that the PIPEDA privacy notice (or a meaningful link to it) is displayed at every collection point — web forms, account creation flows, mobile apps, in-person collection materials, and contracts — and that the Privacy Officer's contact details and complaint channel remain visible and accurate. Record any gaps and remediation timelines.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:52.431",
+    "updatedAt": "2026-04-30 23:48:52.431",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f3ea65dd312f6d70654ac4",
+    "name": "Review International Personal Information Transfers (PIPEDA Accountability)",
+    "description": "Review every transfer of personal information outside Canada at least annually. For each transfer, document the destination country, the recipient, the purpose, the categories of personal information involved, and the safeguards applied (contractual commitments, encryption, access controls). Confirm the organization's PIPEDA accountability is preserved regardless of where processing occurs, and update the privacy notice and Personal Information Register where the transfer landscape changes.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-30 23:48:53.271",
+    "updatedAt": "2026-04-30 23:48:53.271",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f3ea63df40dfc906558bb5",
+    "name": "Appoint or Review Privacy Officer (PIPEDA)",
+    "description": "Formally designate one or more individuals accountable for the organization's compliance with PIPEDA. Document the Privacy Officer's name, contact details, role description, and authority. Confirm the designation is published so it can be made known on request. Review at least annually or whenever the role changes, and retain the appointment letter or governance record as evidence.",
+    "frequency": "yearly",
+    "department": "admin",
+    "createdAt": "2026-04-30 23:48:50.894",
+    "updatedAt": "2026-04-30 23:56:40.469",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ea66b653b0af244cf869",
+    "name": "PIPEDA Access Request Log Review",
+    "description": "Review the PIPEDA access request log each quarter. \n\nFor each request, verify: identity verification used a method proportionate to the sensitivity of the data, the response was delivered within 30 days (or an extension of up to 30 additional days was communicated in writing), an account of use and disclosure was provided, third-party recipients were identified as specifically as possible, and any refusal cited the specific PIPEDA Section 9 exception in writing along with the right to complain to the OPC. \n\nIdentify SLA breaches or systemic issues and remediate.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:54.272",
+    "updatedAt": "2026-04-30 23:56:41.029",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ea65d5b1a04e9c7e0a91",
+    "name": "PIPEDA Consent Records Audit",
+    "description": "Sample consent records each quarter to validate timestamp, method (express vs. implied), the version of the privacy notice presented, and the scope of consent. \n\nFor sensitive personal information (health, financial, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, sex life or sexual orientation), confirm express opt-in consent is on file. Review the consent withdrawal log to confirm withdrawals are propagated across all systems within five business days, and that consequences were communicated to the individual. \n\nRecord sampling results and any remediation.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:52.859",
+    "updatedAt": "2026-04-30 23:56:41.189",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ea640e0ea50dd2ed8efd",
+    "name": "Annual PIPEDA Privacy Notice Review",
+    "description": "Review the public-facing PIPEDA privacy notice at least annually, or within 30 days of any material change to collection, use, disclosure, or retention practices. Confirm the notice describes: the Privacy Officer's identity and contact details, categories of personal information collected, purposes, recipients, cross-border transfers, retention periods, individual rights under PIPEDA, and procedures for access requests and complaints. Retain dated versions and evidence of publication.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:51.920",
+    "updatedAt": "2026-04-30 23:56:40.125",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ea660239b769839c49d4",
+    "name": "Periodic Personal Information Accuracy Audit",
+    "description": "Conduct a documented accuracy review at least annually for high-impact personal information categories (e.g. customer profiles used for billing, employee records used for compensation). \n\nValidate that records are accurate, complete, and current to the level required for their use. Where automated synchronization exists, document the cadence. \n\nFor any inaccuracies found, amend the record, communicate the amendment to third parties that received the original information within 30 days, and capture metrics on median time from challenge to amendment.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:53.785",
+    "updatedAt": "2026-04-30 23:56:40.871",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f3ea67f1bbe13880b55fa4",
+    "name": "Annual Information Amendment & Refusal Procedure Review",
+    "description": "Review the procedure for amending personal information following a substantiated challenge, and for documenting refusals. Confirm: amendments are applied without undue delay, downstream third parties that received the original information are notified within 30 days of amendment, refusals to amend are recorded as a note on the record, and refused amendments are accompanied by clear notice of the individual's recourse — including the right to file a complaint with the OPC. Sample recent amendment and refusal cases to validate compliance.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:54.766",
+    "updatedAt": "2026-04-30 23:48:54.766",
+    "automationStatus": "AUTOMATED"
+  },
+  {
+    "id": "frk_tt_69f3ea63c50892f7c9354dbb",
+    "name": "Annual Service Provider & Processor Contract Review (PIPEDA)",
+    "description": "Review every service provider, processor, and contractor agreement that involves personal information at least annually. \n\nConfirm contracts include: limitation of processing to documented purposes, return or secure destruction of personal information on termination, breach notification obligations, sub-processor disclosure, support for the organization's 30-day access-request fulfilment, and a comparable level of privacy protection per Principle 1 (Accountability). \n\nRecord any non-conforming agreements and remediation. \n\nThis can be satisfied in the Vendor section, by creating new tasks for each vendor.",
+    "frequency": "yearly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:51.414",
+    "updatedAt": "2026-04-30 23:56:40.316",
+    "automationStatus": "MANUAL"
+  },
+  {
+    "id": "frk_tt_69f3ea67845abbb56763649f",
+    "name": "PIPEDA Privacy Complaint Register & Investigation Review",
+    "description": "Review the PIPEDA privacy complaint register and open investigations each quarter. Confirm every complaint was acknowledged within five business days, was assigned to a competent and impartial reviewer, and is being investigated without undue delay. For each completed investigation, document findings, root causes, corrective action taken, and the outcome communicated to the complainant in writing. Where the complaint was not upheld, confirm the complainant was informed of the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) and provided the OPC's contact details. Where the complaint was upheld, confirm corrective action — policy amendment, record correction, retraining, or termination of non-compliant processing — was completed and tracked to closure. Track median time to acknowledge, investigate, and resolve. Identify systemic issues across multiple complaints and feed findings into the annual review of privacy policies and controls.",
+    "frequency": "quarterly",
+    "department": "gov",
+    "createdAt": "2026-04-30 23:48:55.224",
+    "updatedAt": "2026-05-01 00:11:09.620",
+    "automationStatus": "AUTOMATED"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
index d34a7f83c9..2d138ae81a 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorPolicyTemplate.json
@@ -320,25 +320,53 @@
     "B": "frk_pt_685e42a3bbd08ad14de297f0"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_pt_685e462046667f75a50a2c3e"
+    "A": "frk_ct_69efd5a163fc3dcd87372ccc",
+    "B": "frk_pt_69efd9cd0541d8cdb4cae9d1"
+  },
+  {
+    "A": "frk_ct_69efd5ce50b1ede13c3848f2",
+    "B": "frk_pt_69efd9ae049ec9c862a64982"
   },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e462046667f75a50a2c3e"
   },
+  {
+    "A": "frk_ct_69f3d98163541c15c34554c0",
+    "B": "frk_pt_69f3de9fefdbd94ed82d7fb0"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e3f7b4ebcb27b60c51434"
   },
+  {
+    "A": "frk_ct_69f3d981cefe4efa0efe0847",
+    "B": "frk_pt_69f3de9f7e48fbcc7752a946"
+  },
+  {
+    "A": "frk_ct_69f3d97c03fd8213c05dbbde",
+    "B": "frk_pt_69f3dea01f1406bc00bc3d92"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e40d46e7b1123022bf3e8"
   },
+  {
+    "A": "frk_ct_69efd5ce50b1ede13c3848f2",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e43555493efd5f79c15be"
   },
+  {
+    "A": "frk_ct_69f3d97b66301a97f6b8e4a3",
+    "B": "frk_pt_69f3de9f7e48fbcc7752a946"
+  },
+  {
+    "A": "frk_ct_69f3d98a95c7623e660bf33d",
+    "B": "frk_pt_69f3de9f7e48fbcc7752a946"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e4319a5bb1d2d411975e6"
@@ -351,14 +379,26 @@
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e4177d5da489e7c5e1b1b"
   },
+  {
+    "A": "frk_ct_69f3d97d7c0f6c1d629e8fbf",
+    "B": "frk_pt_69f3dea01f1406bc00bc3d92"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e42188e2df1c285cca159"
   },
+  {
+    "A": "frk_ct_69f3d9846258471679ba5a28",
+    "B": "frk_pt_69f3dea1ba102e2350be4f9b"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e42445c99797321ef051a"
   },
+  {
+    "A": "frk_ct_69f3d98d61c5a3ef65a23e20",
+    "B": "frk_pt_69f3dea2fcbd4cc5934aacfa"
+  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_685e43e23b78127274355980"
@@ -428,16 +468,40 @@
     "B": "frk_pt_691e4bd04aac53e783cb7c14"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
+    "A": "frk_ct_69f3d98f897fe2984e8163e5",
+    "B": "frk_pt_69f3dea3d44e30408069e513"
+  },
+  {
+    "A": "frk_ct_69f3d98fd53148ecfa29efa0",
+    "B": "frk_pt_69f3dea3d44e30408069e513"
+  },
+  {
+    "A": "frk_ct_69f3d976c53fd192b48e6236",
+    "B": "frk_pt_685e3f7b4ebcb27b60c51434"
+  },
+  {
+    "A": "frk_ct_69f3d977f853eaee5ff05fe7",
+    "B": "frk_pt_685e3f7b4ebcb27b60c51434"
+  },
+  {
+    "A": "frk_ct_69f3d977f853eaee5ff05fe7",
+    "B": "frk_pt_685e405054f7c35d89ccccf2"
+  },
+  {
+    "A": "frk_ct_69f3d9781dacd8da2864fd17",
+    "B": "frk_pt_69efd9cb30f8a9ef5e517812"
+  },
+  {
+    "A": "frk_ct_69f3d9808d78f354f8f804b4",
     "B": "frk_pt_685e40d46e7b1123022bf3e8"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_pt_685e4010bde64520b9abaf1d"
+    "A": "frk_ct_69f3d98163541c15c34554c0",
+    "B": "frk_pt_685e46557bc14fbddea6468a"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_pt_685e410082a807a0274b4531"
+    "A": "frk_ct_69f3d983dce2e00263034481",
+    "B": "frk_pt_685e414029124c24387beff0"
   },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
@@ -450,5 +514,261 @@
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_pt_6944570c25631cd097be8119"
+  },
+  {
+    "A": "frk_ct_69becde6133891181f5fbfe1",
+    "B": "frk_pt_685e453cad89de25e5aebf4a"
+  },
+  {
+    "A": "frk_ct_69e639b8c95150ea34dc07bf",
+    "B": "frk_pt_685e453cad89de25e5aebf4a"
+  },
+  {
+    "A": "frk_ct_69e639b8c95150ea34dc07bf",
+    "B": "frk_pt_685e4508d8c0d14ae873e644"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_pt_685e44939f827e6a9f736fd4"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_pt_68e3f39e77b0a823add09bf5"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_pt_68bb155d6b8eaafd14904188"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_pt_685e3fc75bd72cd0745dc5d1"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_pt_685e4010bde64520b9abaf1d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_pt_685e458a49e1eff0af54e3d2"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_pt_685e4508d8c0d14ae873e644"
+  },
+  {
+    "A": "frk_ct_69e669af7fd9ef27754dc041",
+    "B": "frk_pt_685e4177d5da489e7c5e1b1b"
+  },
+  {
+    "A": "frk_ct_69e918e6d72a45b4f933a112",
+    "B": "frk_pt_685e40d46e7b1123022bf3e8"
+  },
+  {
+    "A": "frk_ct_69f3d987482f9da8d882e592",
+    "B": "frk_pt_685e4508d8c0d14ae873e644"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_pt_685e4177d5da489e7c5e1b1b"
+  },
+  {
+    "A": "frk_ct_69e918e805776785f8f80a14",
+    "B": "frk_pt_685e40d46e7b1123022bf3e8"
+  },
+  {
+    "A": "frk_ct_69e918e8cc289b978f31a12a",
+    "B": "frk_pt_685e40d46e7b1123022bf3e8"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_pt_685e453cad89de25e5aebf4a"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_pt_685e45c938ad29ad775a2344"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_pt_685e45f736049f188c3439b4"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_pt_685e426ccbb0de15a90cf446"
+  },
+  {
+    "A": "frk_ct_69f3d9891d140c7d3b7d542c",
+    "B": "frk_pt_685e43e23b78127274355980"
+  },
+  {
+    "A": "frk_ct_69f3d98b12951c79a1a1cf36",
+    "B": "frk_pt_685e410082a807a0274b4531"
+  },
+  {
+    "A": "frk_ct_69e918e7f403f696c2577de1",
+    "B": "frk_pt_685e410082a807a0274b4531"
+  },
+  {
+    "A": "frk_ct_69e918e7f7739946f5034799",
+    "B": "frk_pt_685e410082a807a0274b4531"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_pt_685e410082a807a0274b4531"
+  },
+  {
+    "A": "frk_ct_69e918eb8f6e80605d3fa3e5",
+    "B": "frk_pt_685e410082a807a0274b4531"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_pt_685e4010bde64520b9abaf1d"
+  },
+  {
+    "A": "frk_ct_69f3d97a7b80d8564339ffc5",
+    "B": "frk_pt_69f3de9fefdbd94ed82d7fb0"
+  },
+  {
+    "A": "frk_ct_69f3d97fab711de81e99e786",
+    "B": "frk_pt_69f3dea01f1406bc00bc3d92"
+  },
+  {
+    "A": "frk_ct_69f3d98c52d9000ac36cc791",
+    "B": "frk_pt_69f3dea2fcbd4cc5934aacfa"
+  },
+  {
+    "A": "frk_ct_69f3d98e0758e358b1f71b49",
+    "B": "frk_pt_69f3dea2fcbd4cc5934aacfa"
+  },
+  {
+    "A": "frk_ct_69f3d9793720eec4d4945150",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_69f3d9793720eec4d4945150",
+    "B": "frk_pt_68bb155d6b8eaafd14904188"
+  },
+  {
+    "A": "frk_ct_69f3d982f21bf2e86c1ef98d",
+    "B": "frk_pt_685e414029124c24387beff0"
+  },
+  {
+    "A": "frk_ct_69f3d9864551468e007fc4d8",
+    "B": "frk_pt_69efd9c4a9d86fd3bdc08de1"
+  },
+  {
+    "A": "frk_ct_69e918e9be6da6eba7d0ea4e",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_pt_685e42188e2df1c285cca159"
+  },
+  {
+    "A": "frk_ct_69e918eaa930d07ea41dd0d0",
+    "B": "frk_pt_685e462046667f75a50a2c3e"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_pt_685e42445c99797321ef051a"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_pt_685e43997555c7ab39983c21"
+  },
+  {
+    "A": "frk_ct_69e918e8c57e2f6756c995ca",
+    "B": "frk_pt_685e458a49e1eff0af54e3d2"
+  },
+  {
+    "A": "frk_ct_69e918e94e68c0fb15ee98d0",
+    "B": "frk_pt_685e43e23b78127274355980"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_pt_691e4bd04aac53e783cb7c14"
+  },
+  {
+    "A": "frk_ct_69efd5a32e52c113f97254db",
+    "B": "frk_pt_69efd9ae049ec9c862a64982"
+  },
+  {
+    "A": "frk_ct_69efd5e12d61c6019d213f60",
+    "B": "frk_pt_69efd9ae049ec9c862a64982"
+  },
+  {
+    "A": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "B": "frk_pt_69efd9ae049ec9c862a64982"
+  },
+  {
+    "A": "frk_ct_69efd5e71ad52c5ab2ec069e",
+    "B": "frk_pt_69efd9ae049ec9c862a64982"
+  },
+  {
+    "A": "frk_ct_69efd5a6e66d4c6c92fdd3df",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5a87004249e7b6e62af",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5aac8f24094878ff701",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5ad9dcc82739178f525",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5b1e6f19c87845f5939",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5b3cdfebf7ee46a5cf7",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5e395082fabf04e53b7",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5c63e9c6fc1f8bec055",
+    "B": "frk_pt_69efd9b6276adc8d2eb7844c"
+  },
+  {
+    "A": "frk_ct_69efd5a87004249e7b6e62af",
+    "B": "frk_pt_69efd9bf92ab808ec559b766"
+  },
+  {
+    "A": "frk_ct_69efd5cd34220c6db57b2710",
+    "B": "frk_pt_69efd9bf92ab808ec559b766"
+  },
+  {
+    "A": "frk_ct_69efd5c9acbf83b0a500050e",
+    "B": "frk_pt_69efd9c4a9d86fd3bdc08de1"
+  },
+  {
+    "A": "frk_ct_69efd5e906d5418ee6b5dc6a",
+    "B": "frk_pt_69efd9c800ed19d26d6175f4"
+  },
+  {
+    "A": "frk_ct_69efd5c9acbf83b0a500050e",
+    "B": "frk_pt_69efd9c800ed19d26d6175f4"
+  },
+  {
+    "A": "frk_ct_69efd5cb8d9092bd71665722",
+    "B": "frk_pt_69efd9ca0c5691e9ec1b1241"
+  },
+  {
+    "A": "frk_ct_69efd5c84ccf6f3f5bbe29bd",
+    "B": "frk_pt_69efd9cb30f8a9ef5e517812"
+  },
+  {
+    "A": "frk_ct_69efd5d1c0499ab2c136b759",
+    "B": "frk_pt_69efd9cfa8d70d31297f025e"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
index 0d7477b581..fd2a33e653 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorRequirement.json
@@ -823,14 +823,6 @@
     "A": "frk_ct_68407429371f33886d8ab80d",
     "B": "frk_rq_683f76a572050393764a447d"
   },
-  {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_rq_68b59a381860dff55c1ab1aa"
-  },
-  {
-    "A": "frk_ct_68b59e50eeb9f92ce425327c",
-    "B": "frk_rq_68b59f4c9739efdb63dd807e"
-  },
   {
     "A": "frk_ct_683f4a410cf5bf6d40bf3583",
     "B": "frk_rq_681fb2e7e7f7686a992f2119"
@@ -1059,6 +1051,42 @@
     "A": "frk_ct_683f47cc2faa426603d6bee8",
     "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
   },
+  {
+    "A": "frk_ct_69e914db8cd2039367ccbf0f",
+    "B": "frk_rq_69e91593a0551c32d5c99972"
+  },
+  {
+    "A": "frk_ct_69efd5a163fc3dcd87372ccc",
+    "B": "frk_rq_69efd572c76b7b41d94b0968"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed663b850258024b0b236"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed686b626f985dac54c52"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed47bac3dee3588290b04"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed6347b1e6eea717482ca"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed6497c1e390fe89f0dfa"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed651d81e6c51934134bc"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed65bb490440ea4f3b552"
+  },
   {
     "A": "frk_ct_684072e06f4a49ee669076cc",
     "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
@@ -1447,6 +1475,34 @@
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_rq_691e29c635f28a1b3ca06e04"
   },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed66d77af963d9763adeb"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed6761e8f45c900e60be3"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed46ff23ef8614d7f3042"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed48f152068a490f317ac"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed62a1ad145f4554d4068"
+  },
+  {
+    "A": "frk_ct_69efd5a32e52c113f97254db",
+    "B": "frk_rq_69efd574f36aa744a461b0f9"
+  },
+  {
+    "A": "frk_ct_69e65ef9c20933590d85cc31",
+    "B": "frk_rq_681ed61f357c7bf776300aa7"
+  },
   {
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_rq_691e2aab4fefd371003a6a80"
@@ -1459,6 +1515,10 @@
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_rq_691e29b816512da0f3f146fc"
   },
+  {
+    "A": "frk_ct_69efd5a6e66d4c6c92fdd3df",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
   {
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_rq_691e2b8edc97c7179946aa7c"
@@ -1490,5 +1550,4265 @@
   {
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_rq_691e29d304e34e75472399c0"
+  },
+  {
+    "A": "frk_ct_683f4457b14856e700c8c25b",
+    "B": "frk_rq_6840a68d409f43b4d0efd3c1"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7f04a624c5b6746879e47"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7e74ab37477b3cb910456"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7f069bba09cd6fde415b4"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69d7e725c3b1c5035b646414"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69d7e76988750007ab774faf"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69d7e7dc23b7f38d35c92917"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69d7e7b42dea66c8ad0751ea"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69d7e76988750007ab774faf"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69d7e7dc23b7f38d35c92917"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69d7e7a53e9ce2aeac1a4738"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69d7e76988750007ab774faf"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69d7f6a2717be78f524ee2d5"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69d7e7dc23b7f38d35c92917"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69d7f6c0c17faabc4e00be1a"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69d7ec749fdfe0889e8e1004"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69d7e74ab37477b3cb910456"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69d7e7fe5acf93ce81590446"
+  },
+  {
+    "A": "frk_ct_683f4457b14856e700c8c25b",
+    "B": "frk_rq_69d7ec749fdfe0889e8e1004"
+  },
+  {
+    "A": "frk_ct_683f4457b14856e700c8c25b",
+    "B": "frk_rq_69d7e657b68baf33653627a1"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69d7e7b42dea66c8ad0751ea"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69d7f6aa16228e705a19b376"
+  },
+  {
+    "A": "frk_ct_683f45c5058c486f3fa5b7bc",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_683f45c5058c486f3fa5b7bc",
+    "B": "frk_rq_69d7e757ea97d3f6fc14a16f"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69d7f6ba36b85d9fcdab3676"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69d7f6b31a628c6d4a1eefca"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69d7e76988750007ab774faf"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69d7e7a53e9ce2aeac1a4738"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69d7f6beb47525c0472e5a28"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69d7e74ab37477b3cb910456"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69d7e7a53e9ce2aeac1a4738"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69d7f6beb47525c0472e5a28"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69d7ecc2e48e690433555325"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69d7f07a5dde9e3489417256"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69d7f15174a126ae9318c700"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69d7f6ae46305678b122956f"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69d7f069bba09cd6fde415b4"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69d7f15174a126ae9318c700"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69d7e76988750007ab774faf"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69d7f6a1e9853f081604ebb6"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69d7f069bba09cd6fde415b4"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69d7f6a079d5fe17bb88ddca"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69d7f6a47ba0011b49e504b1"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69d7f6b4775baf784cba6dc5"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69d7f6b5fe119219dd0ddd6d"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69d7f6b2837296fc18c8e05e"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69d7f6b2837296fc18c8e05e"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69d7f6b1f6533b5ebd588a61"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_rq_69d7f6b899f3425ec64a4e78"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_rq_69d7f6b7b4984a3804a9f169"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_rq_69d7f6c4333b851266824b47"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69d7f6a2717be78f524ee2d5"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69d7f6b4cc3364592f0a4b17"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69d7f6b4775baf784cba6dc5"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69d7f6b899f3425ec64a4e78"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69d7f6c4333b851266824b47"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_rq_69d7f6a36f14aa8d8d69619c"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_rq_69d7f6c33da8c8699a30e69a"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_rq_69d7f6adeddd2e0c23b6e615"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_69d7e576d8b4cc0f5440725d"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_69d7e725c3b1c5035b646414"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69d7f6ba36b85d9fcdab3676"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69d7f6b31a628c6d4a1eefca"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69d7f6b5fe119219dd0ddd6d"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69d7f6c0c17faabc4e00be1a"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69d7f6b899f3425ec64a4e78"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69d7f6c4333b851266824b47"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69d7e73978f57e698ba562fb"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69d7f6b0a7ffde853174b371"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69d7f6b2837296fc18c8e05e"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69d7f6b1f6533b5ebd588a61"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_rq_69d7f6b1f6533b5ebd588a61"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69d7f6b0a7ffde853174b371"
+  },
+  {
+    "A": "frk_ct_69ea8dac2ff1cd0bfe0c8614",
+    "B": "frk_rq_68cc0e5eddc90f9619ae850d"
+  },
+  {
+    "A": "frk_ct_69ea8daf133ebd28ca732b9d",
+    "B": "frk_rq_68cc0ecd7ec7814948c7f618"
+  },
+  {
+    "A": "frk_ct_69ea8db16a12eecb3f3a5ecb",
+    "B": "frk_rq_68cc0f9de0890c314f870108"
+  },
+  {
+    "A": "frk_ct_69ea8db2c7ed1af765c5981d",
+    "B": "frk_rq_68cc588533f95e19633f1adc"
+  },
+  {
+    "A": "frk_ct_69ea8db4a22bb4f0e4c649e1",
+    "B": "frk_rq_68cc0fb516f402f740147419"
+  },
+  {
+    "A": "frk_ct_69e918eb8f6e80605d3fa3e5",
+    "B": "frk_rq_69eaa7b7f5a7e613f2506e2e"
+  },
+  {
+    "A": "frk_ct_69efd5a87004249e7b6e62af",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
+  {
+    "A": "frk_ct_69efd5aac8f24094878ff701",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69d7e74ab37477b3cb910456"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69d7f6bf60aa81ed491d2fbc"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_69e918eb8f6e80605d3fa3e5",
+    "B": "frk_rq_69e918bf7e5efe469442d414"
+  },
+  {
+    "A": "frk_ct_69ea8dad9910710084d184a2",
+    "B": "frk_rq_68cc0e89f26cd9c83ed5e882"
+  },
+  {
+    "A": "frk_ct_69ea8daea335821ba4148123",
+    "B": "frk_rq_68cc0eadde4caac33efff2ce"
+  },
+  {
+    "A": "frk_ct_69ea8db0b7f88f1ce0079240",
+    "B": "frk_rq_68cc0f7b1fe3d0eba7057907"
+  },
+  {
+    "A": "frk_ct_69ea8db16a12eecb3f3a5ecb",
+    "B": "frk_rq_68cc58794cb877178071a215"
+  },
+  {
+    "A": "frk_ct_69ea8db3571415b8485b6976",
+    "B": "frk_rq_68cc5893f5f46050ad0ea974"
+  },
+  {
+    "A": "frk_ct_69ea8db4a22bb4f0e4c649e1",
+    "B": "frk_rq_68cc58aea3157dcac365d9f7"
+  },
+  {
+    "A": "frk_ct_69e918e7f7739946f5034799",
+    "B": "frk_rq_69eaa7b832769b4ecf0e9295"
+  },
+  {
+    "A": "frk_ct_69efd5aac8f24094878ff701",
+    "B": "frk_rq_69efd57e84aa9eb34fbdb270"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69d7f6b2837296fc18c8e05e"
+  },
+  {
+    "A": "frk_ct_69ea8db5182a7a6a4ad28ce1",
+    "B": "frk_rq_68cc58bb7fa931aabc7d29f2"
+  },
+  {
+    "A": "frk_ct_69ea8db77c8dd4b36c9ac007",
+    "B": "frk_rq_68cc0ff05be924f5d0d58a6f"
+  },
+  {
+    "A": "frk_ct_69ea8db865093703fdf71fc7",
+    "B": "frk_rq_68cc1023e32bf22413738e2f"
+  },
+  {
+    "A": "frk_ct_69ea8db865093703fdf71fc7",
+    "B": "frk_rq_68cc1356217bdfd8243f6ffa"
+  },
+  {
+    "A": "frk_ct_69ea8db92daf193f6aba0348",
+    "B": "frk_rq_68cc1037f2716f51a47b2a2c"
+  },
+  {
+    "A": "frk_ct_69ea8db92daf193f6aba0348",
+    "B": "frk_rq_68cc5a4fd31458ffff814315"
+  },
+  {
+    "A": "frk_ct_69ea8dbbf19cd6ba156e97bd",
+    "B": "frk_rq_68cc5a5a379347f5e3eb59bf"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b866cb7cb0261b9fe2"
+  },
+  {
+    "A": "frk_ct_69efd5ad9dcc82739178f525",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
+  {
+    "A": "frk_ct_69efd5b1e6f19c87845f5939",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
+  {
+    "A": "frk_ct_684071e280c4e0f777b957f7",
+    "B": "frk_rq_69d7f490f8a6458bf15ef544"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69d7f6ab0ce69e3e2743b723"
+  },
+  {
+    "A": "frk_ct_684073ba24475a83ba048022",
+    "B": "frk_rq_69d7e576d8b4cc0f5440725d"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69d7f6b1f6533b5ebd588a61"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69d7f6c0c17faabc4e00be1a"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69d7f6c0c17faabc4e00be1a"
+  },
+  {
+    "A": "frk_ct_68407c9513000617776104c7",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_68407c9513000617776104c7",
+    "B": "frk_rq_69d7e74ab37477b3cb910456"
+  },
+  {
+    "A": "frk_ct_68407c9513000617776104c7",
+    "B": "frk_rq_69d7e576d8b4cc0f5440725d"
+  },
+  {
+    "A": "frk_ct_68e8079750107bcc63fc79d9",
+    "B": "frk_rq_69d7f6ad063694ae9c92b3d8"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_rq_69d7e7dc23b7f38d35c92917"
+  },
+  {
+    "A": "frk_ct_684070c1f0091d850df02e59",
+    "B": "frk_rq_69dcffa4409aba79cfbb6863"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcffa4409aba79cfbb6863"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcffa4409aba79cfbb6863"
+  },
+  {
+    "A": "frk_ct_68407c9513000617776104c7",
+    "B": "frk_rq_69dcffa4409aba79cfbb6863"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4c94051eec2eb36978"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcff4c94051eec2eb36978"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff3ee7b85cd010d78dcc"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff02f9ade221fa118fbb"
+  },
+  {
+    "A": "frk_ct_684071e280c4e0f777b957f7",
+    "B": "frk_rq_69dcff02f9ade221fa118fbb"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcfe7d2e55a7bd0d38374e"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcfe7e9c17b826488010fc"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfe7fd9e733b180b8ff84"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfee58e52a2062649dacd"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfee61935b50ba3d0a22c"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfee70753501e66c6e02b"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfee8e213a935800448c6"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfee943bdcd3eef5178b1"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeea714798633b651170"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeeb2ca10880083b7f82"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeec0b624eb54eb28e89"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeedbe961b4ad3875add"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeeecdf5ed81b9692fa2"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeef48700ce37f4b36ee"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef0b5a41febaa878746"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef10367e82c5c60ea24"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef2652e248e46a4d10e"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef29d9116e66aa52b2a"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef3ab8a1c333b3b3a7f"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef47bd26dd287a7ad11"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfef554c52d0a4e141e26"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcfef554c52d0a4e141e26"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcfef3ab8a1c333b3b3a7f"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcfef29d9116e66aa52b2a"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcfeedbe961b4ad3875add"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcfeedbe961b4ad3875add"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcfeec0b624eb54eb28e89"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcfeec0b624eb54eb28e89"
+  },
+  {
+    "A": "frk_ct_6849ba93636ff0155eb89158",
+    "B": "frk_rq_69dcfeeb2ca10880083b7f82"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfeeb2ca10880083b7f82"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcfeea714798633b651170"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfee943bdcd3eef5178b1"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcfee8e213a935800448c6"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcfee70753501e66c6e02b"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcfee61935b50ba3d0a22c"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcfee58e52a2062649dacd"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfe7fd9e733b180b8ff84"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfef6b0e7be6f8e62f448"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcfef6b0e7be6f8e62f448"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcfef70c971c9098bf6e14"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfef70c971c9098bf6e14"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfef8b4c232559209d742"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_rq_69dcfef8b4c232559209d742"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfef9fc8be55124e1ce08"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcfef9fc8be55124e1ce08"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfefaf0ce72126bd10d60"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcfefaf0ce72126bd10d60"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfefb1b23d778e3f0f70c"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfefc580593304a75c2a0"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfefc580593304a75c2a0"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfefd004ff3cd6e459921"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcfefd004ff3cd6e459921"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfefe7539265b071b130b"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcfefe7539265b071b130b"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeff9f3ac4d37add4ab0"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfeff9f3ac4d37add4ab0"
+  },
+  {
+    "A": "frk_ct_684070c1f0091d850df02e59",
+    "B": "frk_rq_69dcfeff9f3ac4d37add4ab0"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcfeffce3d8f57d4eadd06"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcfeffce3d8f57d4eadd06"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcfeffce3d8f57d4eadd06"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff004d2e6d95f036ac58"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff004d2e6d95f036ac58"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff004d2e6d95f036ac58"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff01d0e636be71476447"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff01d0e636be71476447"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff02f9ade221fa118fbb"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff035133fef9160ef01e"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff035133fef9160ef01e"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff0462ae94b7a97d2d2e"
+  },
+  {
+    "A": "frk_ct_6849c343d7fbe4e71446ce78",
+    "B": "frk_rq_69dcff05530220c5959ec50c"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff05530220c5959ec50c"
+  },
+  {
+    "A": "frk_ct_6849c343d7fbe4e71446ce78",
+    "B": "frk_rq_69dcff06faa8fa63e5c02dfd"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff0747513fb4a06145e7"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0aa9d13acc126b2de8"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff0b6928a6e5169089f5"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0c1dc0b5e7a8bb40b9"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff0c1dc0b5e7a8bb40b9"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0d6ba2d210146b7e0b"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff12f1a473ff1c537988"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1303e257a95fbe5049"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff15b5e8ee31c7093b64"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1629621152913d7324"
+  },
+  {
+    "A": "frk_ct_69ea8db62ab22968f85f85f6",
+    "B": "frk_rq_68cc0fd04f279d7a96eacc6f"
+  },
+  {
+    "A": "frk_ct_69ea8db77c8dd4b36c9ac007",
+    "B": "frk_rq_68cc1342bdd7f557947e44a2"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b867e5acb44fc95468"
+  },
+  {
+    "A": "frk_ct_69efd5b3cdfebf7ee46a5cf7",
+    "B": "frk_rq_69efd575c5f8bf35c14f5d69"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0462ae94b7a97d2d2e"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff091f650503a28195a1"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff091f650503a28195a1"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff0aa9d13acc126b2de8"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff0aa9d13acc126b2de8"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0b6928a6e5169089f5"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff0d6ba2d210146b7e0b"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0ff6667eeb439ac92d"
+  },
+  {
+    "A": "frk_ct_69ea8db92daf193f6aba0348",
+    "B": "frk_rq_68cc136d293aef7e72dae81a"
+  },
+  {
+    "A": "frk_ct_69ea8dbdbd2ce5e539a326fa",
+    "B": "frk_rq_68cc5a771abf96227e04340d"
+  },
+  {
+    "A": "frk_ct_69ea8dbe99f14797e50f9685",
+    "B": "frk_rq_68cc104bfdfae778fc876c94"
+  },
+  {
+    "A": "frk_ct_69ea8dc048654718cfb1d12c",
+    "B": "frk_rq_68cc106d0cdb75961110d7bd"
+  },
+  {
+    "A": "frk_ct_69ea8dc5682f9f3146944252",
+    "B": "frk_rq_68cc5a3a422aaca23633eba8"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b8cdabaf034bb4f34e"
+  },
+  {
+    "A": "frk_ct_69efd5c63e9c6fc1f8bec055",
+    "B": "frk_rq_69efd57711c3f0a61fe673a4"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_rq_69dcff06faa8fa63e5c02dfd"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff06faa8fa63e5c02dfd"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0747513fb4a06145e7"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff084dcf233d1ca149b9"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0c6466103e02fdec19"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff0edfa877f8fd59e4fa"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1171ddc363fe1163fd"
+  },
+  {
+    "A": "frk_ct_69ea8dbccf28e8a000ba1934",
+    "B": "frk_rq_68cc5a6ca8269484c65f9ec4"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b8d85d601c3b8fd630"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b8673a4dc99e803097"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_rq_69eaa7b859ec0d1cb67baf70"
+  },
+  {
+    "A": "frk_ct_69efd5c84ccf6f3f5bbe29bd",
+    "B": "frk_rq_69efd578456ecb3bb27776f6"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1079df11c41407d594"
+  },
+  {
+    "A": "frk_ct_69ea8dbfb341d9b1021c8897",
+    "B": "frk_rq_68cc10611c3b98926aaf2cd5"
+  },
+  {
+    "A": "frk_ct_69ea8dc1f55bd5e338716f16",
+    "B": "frk_rq_68cc58dc1ef78d1fe51b83be"
+  },
+  {
+    "A": "frk_ct_69ea8dc4c401188497d417c2",
+    "B": "frk_rq_68cc5906894ada4eceff256b"
+  },
+  {
+    "A": "frk_ct_69ea8dc6f10b53075c3beacb",
+    "B": "frk_rq_68cc108f1697a1687b11d500"
+  },
+  {
+    "A": "frk_ct_69e918e805776785f8f80a14",
+    "B": "frk_rq_69eaa7b8e4e4347bb2b861d5"
+  },
+  {
+    "A": "frk_ct_69efd5c9acbf83b0a500050e",
+    "B": "frk_rq_69efd57ab20b0aab665f6d8d"
+  },
+  {
+    "A": "frk_ct_69efd5cb8d9092bd71665722",
+    "B": "frk_rq_69efd57cea0d187006ea6b13"
+  },
+  {
+    "A": "frk_ct_69efd5d1c0499ab2c136b759",
+    "B": "frk_rq_69efd580bc382953d7136073"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff140e07cd3e7afa53e8"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcff1629621152913d7324"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff177062f35e09be9e5c"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff177062f35e09be9e5c"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff1881e1bebb12a5c6eb"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff1881e1bebb12a5c6eb"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff19a50ef3f4cc515dba"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff19a50ef3f4cc515dba"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1a165baf0394644b51"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff1a165baf0394644b51"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff1b3c019806a66495aa"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff1b3c019806a66495aa"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_69dcff1cb3c3a0c1bcf6346b"
+  },
+  {
+    "A": "frk_ct_684071e280c4e0f777b957f7",
+    "B": "frk_rq_69dcff1cb3c3a0c1bcf6346b"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff1d859fd998bac7948e"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff1d859fd998bac7948e"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff1d6e8e06f38769eb37"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff1d6e8e06f38769eb37"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff1eb2e612067cc06689"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff1eb2e612067cc06689"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff1f913a3851412e6152"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_rq_69dcff20b57ba3362e33b03b"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff20b57ba3362e33b03b"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff2178ae451953e6ccad"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff2178ae451953e6ccad"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff22146c8825df44cba4"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff23517e30660b32e82a"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff249c8cac39dc053355"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff25f930412d8f4a7fdc"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff26e497c0d93bb8b841"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff276033713e3105e596"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff287f85466efc21f5ef"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2905d5e8bf0f39d088"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff2905d5e8bf0f39d088"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff2a6b628ffc40d594cb"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2a6b628ffc40d594cb"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2bdb1b55a1c3806a0f"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2cc3942cb41ecd6889"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcff2cc3942cb41ecd6889"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2de69d0de80dc895c7"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff2de69d0de80dc895c7"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2e1bf5bf4be8c2b03e"
+  },
+  {
+    "A": "frk_ct_684073ba24475a83ba048022",
+    "B": "frk_rq_69dcff2e1bf5bf4be8c2b03e"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff2f9a128163f0f0394e"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff2f9a128163f0f0394e"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff307f0939472c98b0d8"
+  },
+  {
+    "A": "frk_ct_684073d541bfb8b8b777e529",
+    "B": "frk_rq_69dcff307f0939472c98b0d8"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff313299b5055bf4a37a"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff313299b5055bf4a37a"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcff32217541c6335876d7"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff32217541c6335876d7"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_681f965d3ddb6537459de9a0"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_681f965d3ddb6537459de9a0"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff34a4d5d4d838e9354d"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff34a4d5d4d838e9354d"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff35ebe7f0f919be1220"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff35ebe7f0f919be1220"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff36a0de7399adf64cb1"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff3772ddda25fa510528"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcff3772ddda25fa510528"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff3772ddda25fa510528"
+  },
+  {
+    "A": "frk_ct_684073ba24475a83ba048022",
+    "B": "frk_rq_69dcff38d92835591f6d33e1"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff38d92835591f6d33e1"
+  },
+  {
+    "A": "frk_ct_684073ba24475a83ba048022",
+    "B": "frk_rq_69dcff39f841d3b959277a95"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff39f841d3b959277a95"
+  },
+  {
+    "A": "frk_ct_6849c343d7fbe4e71446ce78",
+    "B": "frk_rq_69dcff3a4e59825c6b2bf8a4"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff3a4e59825c6b2bf8a4"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff3a6999fa45c9973ba1"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff3a6999fa45c9973ba1"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff3bd6eab0cabf8e5143"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff3c7b813604dd33848b"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff3d7eff2daf7d1eecb6"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff3f412d52f5b06ca705"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff408cc7a841ed94e038"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff41955f84ea0e563041"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff42de2711fed58334d5"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff43e91cb5685c511c93"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff454540cdc67ec5cc55"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4683b09426d28bd353"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff463d117670a150959e"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff47dcbb3e7cf896a31f"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff47dcbb3e7cf896a31f"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff48933a909e70ec59f1"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff48933a909e70ec59f1"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff49428742555a80f331"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff49428742555a80f331"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4a4a17963ebdb7e8db"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff4a4a17963ebdb7e8db"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff4bb1fdf4c5a72375ce"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff4deaf158a194b31651"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcff4eef4d973db6749aaa"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff5459bbc24b82e95346"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff5be046e7444d27c470"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff5be046e7444d27c470"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff5c4e2e039756c30c04"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff5c4e2e039756c30c04"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff633226b6615536612b"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff7240318f3d092f02a6"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_69dcff73fd64fa5ccce46aa9"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_69dcff7462dbb18b93e55650"
+  },
+  {
+    "A": "frk_ct_69ea8dc2e0fd4e97481baafd",
+    "B": "frk_rq_68cc58e8ea648286acddda43"
+  },
+  {
+    "A": "frk_ct_69ea8dc3a37b3f833dc7d6f3",
+    "B": "frk_rq_68cc58f88bcbeef356b5081c"
+  },
+  {
+    "A": "frk_ct_69ea8dcd4cffcf9dd949ca02",
+    "B": "frk_rq_68cc5ab9b661ac977104733b"
+  },
+  {
+    "A": "frk_ct_69e918e7f403f696c2577de1",
+    "B": "frk_rq_69eaa7b8ebe34c5dbee1528f"
+  },
+  {
+    "A": "frk_ct_69efd5cd34220c6db57b2710",
+    "B": "frk_rq_69efd57d8ecf1576f93a0603"
+  },
+  {
+    "A": "frk_ct_69efd5d2b0758b1e1c1b6d87",
+    "B": "frk_rq_69efd581f8bf5b44eeecd048"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff4a4a17963ebdb7e8db"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4bb1fdf4c5a72375ce"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff4fcd6918d1cb665e86"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff53f0d3e72346c35750"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff558d7ef3b5791eb24f"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff56d1dc19e437dcc6da"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_rq_69dcff580c8abb1ed5c36b09"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff5a0689e9848805617c"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff5fdc280eb94be0039d"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff5fdc280eb94be0039d"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff6707ec7913810857e4"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6707ec7913810857e4"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6b75060bf37b99db11"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6da2df8cba3c6adc88"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff6eebcdcef1b3719bf7"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff70db9f49439ea3a578"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff718575d135791b7d6e"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcff73fd64fa5ccce46aa9"
+  },
+  {
+    "A": "frk_ct_69ea8dc667172a41022fcf27",
+    "B": "frk_rq_68cc124496843ba357887e21"
+  },
+  {
+    "A": "frk_ct_69ea8dc718a407d992cda795",
+    "B": "frk_rq_68cc126823caf86fae495b66"
+  },
+  {
+    "A": "frk_ct_69ea8dc8ec4ced8e76b114c0",
+    "B": "frk_rq_68cc12d0f52f5c1d91f117f1"
+  },
+  {
+    "A": "frk_ct_69ea8dc8ec4ced8e76b114c0",
+    "B": "frk_rq_68cc12e9ccf8c0f87b0ab7ed"
+  },
+  {
+    "A": "frk_ct_69ea8dc8ec4ced8e76b114c0",
+    "B": "frk_rq_68cc12fe773e2545f63bbb68"
+  },
+  {
+    "A": "frk_ct_69ea8dcb210958cb72f499f2",
+    "B": "frk_rq_68cc5a9d72bacbed2987c4b8"
+  },
+  {
+    "A": "frk_ct_69ea8dccd7c01c6d2503448b",
+    "B": "frk_rq_68cc5aaaeb5095fd2da1a92c"
+  },
+  {
+    "A": "frk_ct_69e918e7f7739946f5034799",
+    "B": "frk_rq_69eaa7b8ebe34c5dbee1528f"
+  },
+  {
+    "A": "frk_ct_69e918e8c57e2f6756c995ca",
+    "B": "frk_rq_69eaa7b707e431b82960342c"
+  },
+  {
+    "A": "frk_ct_69efd5ce50b1ede13c3848f2",
+    "B": "frk_rq_69efd57e84aa9eb34fbdb270"
+  },
+  {
+    "A": "frk_ct_684073617d0706858cceb8c7",
+    "B": "frk_rq_69dcff4c94051eec2eb36978"
+  },
+  {
+    "A": "frk_ct_69ea8dcaa9b51a2b1e5f2abd",
+    "B": "frk_rq_68cc131dece6bc88bea70bea"
+  },
+  {
+    "A": "frk_ct_69ea8dd8aa91ceac379fa2c3",
+    "B": "frk_rq_68cc5b5f0af0a89e2ddbc059"
+  },
+  {
+    "A": "frk_ct_69e918e6d72a45b4f933a112",
+    "B": "frk_rq_69eaa7b733cf653074d17a7f"
+  },
+  {
+    "A": "frk_ct_69efd5e12d61c6019d213f60",
+    "B": "frk_rq_69efd583f4e5404bcb066b56"
+  },
+  {
+    "A": "frk_ct_69efd5e395082fabf04e53b7",
+    "B": "frk_rq_69efd583f4e5404bcb066b56"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4deaf158a194b31651"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff4eef4d973db6749aaa"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff505832b24179f594da"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff512f1643822ffc40e9"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_rq_69dcff5244a445e2083124bb"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcff56d1dc19e437dcc6da"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff56d1dc19e437dcc6da"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff57a27eda29d28d1a51"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff57a27eda29d28d1a51"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcff57a27eda29d28d1a51"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff580c8abb1ed5c36b09"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff59093f80b6b5f93ede"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff5a0689e9848805617c"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff5d5419b9e6dd0fecda"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcff5d5419b9e6dd0fecda"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff5e675b23b53711e58a"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcff5e675b23b53711e58a"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff60aaa239198fc1a3d0"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff60aaa239198fc1a3d0"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff618eb41f404917d281"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff622b60baca6c5cb4cd"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff63a09efbccfe305a95"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_rq_69dcff63a09efbccfe305a95"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff64fea13841683f18bb"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff65403b9e40cecd10ed"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff66b9c46103ddf77fd9"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff68a147f3de0eea37e4"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff68a147f3de0eea37e4"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_rq_69dcff696445afd56ff3c2e0"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff696445afd56ff3c2e0"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6ad323e7481a2a947b"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff6b75060bf37b99db11"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6cce53eb27962c728d"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69dcff6cce53eb27962c728d"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff6da2df8cba3c6adc88"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_rq_69dcff6eebcdcef1b3719bf7"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff6f571248c093ade975"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_69dcff718575d135791b7d6e"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff718575d135791b7d6e"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_69dcff7240318f3d092f02a6"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff7462dbb18b93e55650"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff75b6b39b136c68f7ef"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff76e8f6202ef0251616"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff76214ca4507aeb9676"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff770e9408ee767d7d61"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff78e9f10b1a12834a54"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff79046ad91bb49f4bc6"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff7af382be7a8fddd851"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff7bca5070a954e4b926"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff7c6886d812e3bca1a2"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff7dd59284f830693a8e"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff7e6837c1fdcc088bee"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff7f641df666a0c22817"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff8066ac2874e0cafac8"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff81e3687caf7f1bd030"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff81e3687caf7f1bd030"
+  },
+  {
+    "A": "frk_ct_6849ba93636ff0155eb89158",
+    "B": "frk_rq_69dcff824662a071ea30b728"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff824662a071ea30b728"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff83f48edc965b711dd3"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff83f48edc965b711dd3"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff84eb2f0175af1a5a4a"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff84eb2f0175af1a5a4a"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff85c4d2a8dae74164a1"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff86ca9ca870073fc2d8"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcff86a14a58f051949e0b"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff86a14a58f051949e0b"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff8794897fee8d23e907"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcff8794897fee8d23e907"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff888d17e2a40c5ade06"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcff888d17e2a40c5ade06"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_rq_69dcff89e8f8db6da78dca7a"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff89e8f8db6da78dca7a"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_rq_69dcff8a58ad310935d80fad"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcff8a58ad310935d80fad"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff8b10fa6474b498b5f6"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcff8b10fa6474b498b5f6"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcff8cb4d4d1d377d3a9fc"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff8dccf4c2d977dd9998"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff8e7a4db0d82942a727"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff8f197c76085dff0f70"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff90072c1b750388be26"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcff90072c1b750388be26"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff91b7e21c99696af30c"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff92f25a500690ecb1d2"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff92f25a500690ecb1d2"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff936bcdd3953dd57be7"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff944cc63873ea85c709"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_rq_69dcff95ecf248dcbe4462f7"
+  },
+  {
+    "A": "frk_ct_683f4c9db20e7cf4a303af1f",
+    "B": "frk_rq_69dcff95ecf248dcbe4462f7"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_rq_69dcff965d4daf381dbebb56"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff977f23cf8501f592c3"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_rq_69dcff9833b29ae89c1eb64f"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff9833b29ae89c1eb64f"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9974c7634956ba7f0a"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff9a172f64b803d4f523"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcff9b7b0dfdd22bc2d410"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9c8daaf57bbf28b8ef"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcff9c8daaf57bbf28b8ef"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcff9efe92caf1c8f48290"
+  },
+  {
+    "A": "frk_ct_69dd33a73264cb77236367ba",
+    "B": "frk_rq_69dcff9f2a32fccc4bdee381"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_rq_69dcff9f2a32fccc4bdee381"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcffa89c6236dea8c3797d"
+  },
+  {
+    "A": "frk_ct_69ea8dcef8ff3c2ed55ea14a",
+    "B": "frk_rq_68cc5aca98f03da8f8367cba"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_rq_69eaa7b735898b1be6a9ebf2"
+  },
+  {
+    "A": "frk_ct_69efd5e71ad52c5ab2ec069e",
+    "B": "frk_rq_69efd583f4e5404bcb066b56"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff965d4daf381dbebb56"
+  },
+  {
+    "A": "frk_ct_69ea8dcfcba021703a55bf97",
+    "B": "frk_rq_68cc5ad9f59cea7dc12cb935"
+  },
+  {
+    "A": "frk_ct_69ea8dd0de2f746bb95acd4b",
+    "B": "frk_rq_68cc5ae5ff5cddebb560aa22"
+  },
+  {
+    "A": "frk_ct_69ea8dd28d9b23fd806840e7",
+    "B": "frk_rq_68cc5afff58160f9f1c4dd20"
+  },
+  {
+    "A": "frk_ct_69ea8dd44d3b368f85df728c",
+    "B": "frk_rq_68cc5b1b6a671e5fdb9e83f8"
+  },
+  {
+    "A": "frk_ct_69ea8dd5a750b30e2eb69d18",
+    "B": "frk_rq_68cc5b28c6250d5e578180f9"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_rq_69eaa7b7b237bc35bb52c10d"
+  },
+  {
+    "A": "frk_ct_69efd5e906d5418ee6b5dc6a",
+    "B": "frk_rq_69efd583f4e5404bcb066b56"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_rq_69dcff977f23cf8501f592c3"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_rq_69dcff9974c7634956ba7f0a"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9b08ac85014f447336"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcff9b08ac85014f447336"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9b7b0dfdd22bc2d410"
+  },
+  {
+    "A": "frk_ct_6849ba93636ff0155eb89158",
+    "B": "frk_rq_69dcff9efe92caf1c8f48290"
+  },
+  {
+    "A": "frk_ct_69ea8dd148f84ea6656bce7d",
+    "B": "frk_rq_68cc5af0bf60b2e58133ff53"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_rq_69eaa7b76c115a489f4f4b08"
+  },
+  {
+    "A": "frk_ct_69efd5e906d5418ee6b5dc6a",
+    "B": "frk_rq_69efd57ab20b0aab665f6d8d"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcff977f23cf8501f592c3"
+  },
+  {
+    "A": "frk_ct_69ea8dd38d7945cd54758b49",
+    "B": "frk_rq_68cc5b0cffc0c85df3924feb"
+  },
+  {
+    "A": "frk_ct_69ea8dd54053dfd453b9dc4a",
+    "B": "frk_rq_68cc5b347ac42a6ed8a90c67"
+  },
+  {
+    "A": "frk_ct_69ea8dd6097d1766ac51e294",
+    "B": "frk_rq_68cc5b41171a8cadfef58dd7"
+  },
+  {
+    "A": "frk_ct_69ea8dd7f551ad7a56706b46",
+    "B": "frk_rq_68cc5b4f01de903a82db622d"
+  },
+  {
+    "A": "frk_ct_69ea8dd9462f30b929260abf",
+    "B": "frk_rq_68cc5b76ac80dbc2af7ee28b"
+  },
+  {
+    "A": "frk_ct_69ea8dda97d0010af0cf826d",
+    "B": "frk_rq_68cc5b81b072f6717d2acfc5"
+  },
+  {
+    "A": "frk_ct_69ea8ddbb737f1f09bbcd82e",
+    "B": "frk_rq_68cc5b8c4bbc9a2326ce718a"
+  },
+  {
+    "A": "frk_ct_69e918e9be6da6eba7d0ea4e",
+    "B": "frk_rq_69eaa7b77bf5981d7557e448"
+  },
+  {
+    "A": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "B": "frk_rq_69efd583f4e5404bcb066b56"
+  },
+  {
+    "A": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "B": "frk_rq_69efd574f36aa744a461b0f9"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9833b29ae89c1eb64f"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_rq_69dcff9974c7634956ba7f0a"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_rq_69dcff9a172f64b803d4f523"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_rq_69dcff9d4484fa6ab009ad50"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffa0cd7071a70c25eff6"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffa119474a2d5739cad6"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69dcffa34047058834cd7552"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_rq_69dcffa72b879950a33ff8ff"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffa72b879950a33ff8ff"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_rq_69dcffa89c6236dea8c3797d"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69dcffa91626c1563c561918"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffaa44f250f4729f4ae0"
+  },
+  {
+    "A": "frk_ct_69ea8ddce361e7f7eb0fc2b9",
+    "B": "frk_rq_68cc5b9f143db7a8e8f2fd99"
+  },
+  {
+    "A": "frk_ct_69e918eaa930d07ea41dd0d0",
+    "B": "frk_rq_69eaa7b71e2f3c4710aa383f"
+  },
+  {
+    "A": "frk_ct_69e918e8cc289b978f31a12a",
+    "B": "frk_rq_69eaa7b7da0c92ffd26e6f7e"
+  },
+  {
+    "A": "frk_ct_69f3d976c53fd192b48e6236",
+    "B": "frk_rq_69f3d8f9325e9331eb352d02"
+  },
+  {
+    "A": "frk_ct_69f3d9793720eec4d4945150",
+    "B": "frk_rq_69f3d8f9325e9331eb352d02"
+  },
+  {
+    "A": "frk_ct_69f3d97b66301a97f6b8e4a3",
+    "B": "frk_rq_69f3d8f97b102c78dd60613e"
+  },
+  {
+    "A": "frk_ct_69f3d983dce2e00263034481",
+    "B": "frk_rq_69f3d8fab461cfff700cd0fc"
+  },
+  {
+    "A": "frk_ct_69f3d9846258471679ba5a28",
+    "B": "frk_rq_69f3d8fb5e54d4c7ab693e1a"
+  },
+  {
+    "A": "frk_ct_69f3d9854a029af0a24299a3",
+    "B": "frk_rq_69f3d8fb5e54d4c7ab693e1a"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_rq_69dcff9d4484fa6ab009ad50"
+  },
+  {
+    "A": "frk_ct_6849ba93636ff0155eb89158",
+    "B": "frk_rq_69dcff9f2a32fccc4bdee381"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69dcffa0cd7071a70c25eff6"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcffa2854a8978069abc2e"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffa4409aba79cfbb6863"
+  },
+  {
+    "A": "frk_ct_683f4c9db20e7cf4a303af1f",
+    "B": "frk_rq_69dcffa5bbe2ac63ba382ae6"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcffa5bbe2ac63ba382ae6"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_rq_69dcffa63136b4e7a84d10fc"
+  },
+  {
+    "A": "frk_ct_69ea8dddda00d3522c538085",
+    "B": "frk_rq_68cc5bb1b016fed3f0f73d6f"
+  },
+  {
+    "A": "frk_ct_69e918e94e68c0fb15ee98d0",
+    "B": "frk_rq_69eaa7b7f31a0487875d4020"
+  },
+  {
+    "A": "frk_ct_69f3d977f853eaee5ff05fe7",
+    "B": "frk_rq_69f3d8f9325e9331eb352d02"
+  },
+  {
+    "A": "frk_ct_69f3d9781dacd8da2864fd17",
+    "B": "frk_rq_69f3d8f9325e9331eb352d02"
+  },
+  {
+    "A": "frk_ct_69f3d97a7b80d8564339ffc5",
+    "B": "frk_rq_69f3d8f97b102c78dd60613e"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffa2854a8978069abc2e"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_rq_69dcffa34047058834cd7552"
+  },
+  {
+    "A": "frk_ct_683f4f59dea367ca96145e14",
+    "B": "frk_rq_69dcffa63136b4e7a84d10fc"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_69dcffa91626c1563c561918"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_rq_69dcffaa44f250f4729f4ae0"
+  },
+  {
+    "A": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "B": "frk_rq_69dcffab5b3ab140e35b2a8f"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcffab5b3ab140e35b2a8f"
+  },
+  {
+    "A": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "B": "frk_rq_69dcffac9c60c52edbd56fef"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_rq_69dcffac9c60c52edbd56fef"
+  },
+  {
+    "A": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "B": "frk_rq_69dcffad14c5796fac50382b"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffaebee28285f81befad"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_rq_69dcffaebee28285f81befad"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffafdd6076fb6394fab2"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffb0d294a6b409bf2777"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffb1c482f1b4c9faa676"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffb221021671f9e15650"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69dcffb3bb48dd2bca628d6a"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb4bfef6f7f83a002a5"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb5976c9bf607b589bf"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb652f1be5f58bda75d"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb7c9bb0dab205bcd0f"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb80d9e0ce7eccf5b66"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffb936d930f67bf2acc9"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_rq_69dcffbae18a11fa1fefd5cc"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbbae320285dfd82b59"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbcc00c2a8335362cd9"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbd079e9609d8754451"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbd5a29f5ca49f033a2"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbe8febb9ad32cee3ac"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffbfa920236e68274c8a"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_rq_69dcffc0f183d6d459f7374d"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_rq_69dcffc0f183d6d459f7374d"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_681fbad250580796989c2740"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_681fbb0582eaf9324e47bf66"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_681fbae74869a7453e32ca50"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_681fbb1b006e7a70070d2530"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_rq_681fbabb950f98ecf6a87401"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_6820cffa8b186b46aeba463e"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_6820cfff003be02cf6f1a966"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_681fd69f2811265875854c99"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_681fd6b64760a2a0e22dca94"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_69dcffb936d930f67bf2acc9"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_rq_69dcffbae18a11fa1fefd5cc"
+  },
+  {
+    "A": "frk_ct_69ea8dde7453dbed221162e8",
+    "B": "frk_rq_68cc5bba0a7d17f5e4e79ffc"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe258330b292af74be717"
+  },
+  {
+    "A": "frk_ct_69f3d97c03fd8213c05dbbde",
+    "B": "frk_rq_69f3d8fa35b14429dc6a5ae2"
+  },
+  {
+    "A": "frk_ct_69f3d9808d78f354f8f804b4",
+    "B": "frk_rq_69f3d8faaaa018c49827ba66"
+  },
+  {
+    "A": "frk_ct_69f3d981cefe4efa0efe0847",
+    "B": "frk_rq_69f3d8faaaa018c49827ba66"
+  },
+  {
+    "A": "frk_ct_69f3d98163541c15c34554c0",
+    "B": "frk_rq_69f3d8fab461cfff700cd0fc"
+  },
+  {
+    "A": "frk_ct_69f3d982f21bf2e86c1ef98d",
+    "B": "frk_rq_69f3d8fab461cfff700cd0fc"
+  },
+  {
+    "A": "frk_ct_69f3d98d61c5a3ef65a23e20",
+    "B": "frk_rq_69f3d8fc64fbb4b8bd63a0f7"
+  },
+  {
+    "A": "frk_ct_69f3d98fd53148ecfa29efa0",
+    "B": "frk_rq_69f3d8fd143d9729bbe92c18"
+  },
+  {
+    "A": "frk_ct_69ea8ddf8ba2e517ab4a366d",
+    "B": "frk_rq_68cc5bc95fa70354cb5631c6"
+  },
+  {
+    "A": "frk_ct_69ea8ddf2226651c7382d81c",
+    "B": "frk_rq_68cc5bd5e8781f93897c507f"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe27650feb9e1decf9b8e"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe3516e9d623341576827"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe373eec04bb563a58ebc"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe3e05e9443385b5f512a"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe40489876e2fe301c757"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe569c808990634c7168b"
+  },
+  {
+    "A": "frk_ct_69f3d97d7c0f6c1d629e8fbf",
+    "B": "frk_rq_69f3d8fa35b14429dc6a5ae2"
+  },
+  {
+    "A": "frk_ct_69f3d97fab711de81e99e786",
+    "B": "frk_rq_69f3d8fa35b14429dc6a5ae2"
+  },
+  {
+    "A": "frk_ct_69ea8de02be9da8bf00ad0aa",
+    "B": "frk_rq_68cc5be2faf1c4c90a37c8bc"
+  },
+  {
+    "A": "frk_ct_69ea8de1bd41309fdbe08e20",
+    "B": "frk_rq_68cc139ce4e9397e774a970b"
+  },
+  {
+    "A": "frk_ct_69ea8de302274112e7ccc264",
+    "B": "frk_rq_68cc13f34b88f4b16f70a060"
+  },
+  {
+    "A": "frk_ct_69ea8de302274112e7ccc264",
+    "B": "frk_rq_68cc1424b567f1f8cb7c31f0"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe28e3e639ff197fed198"
+  },
+  {
+    "A": "frk_ct_69f3d9864551468e007fc4d8",
+    "B": "frk_rq_69f3d8fb285f6ce15ead0408"
+  },
+  {
+    "A": "frk_ct_69f3d987482f9da8d882e592",
+    "B": "frk_rq_69f3d8fb285f6ce15ead0408"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_rq_69f3d8fb285f6ce15ead0408"
+  },
+  {
+    "A": "frk_ct_69f3d9891d140c7d3b7d542c",
+    "B": "frk_rq_69f3d8fb285f6ce15ead0408"
+  },
+  {
+    "A": "frk_ct_69f3d98b12951c79a1a1cf36",
+    "B": "frk_rq_69f3d8fca6daba5a2eaddaaa"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_rq_681ed29613b703c7f368ffdc"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_rq_681ed2a8bda2e236fbc46492"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_rq_681ed2be08112d94334bd319"
+  },
+  {
+    "A": "frk_ct_69e639b9bf66b5a6ffb17d27",
+    "B": "frk_rq_681ed2c844494f7d1b01fa45"
+  },
+  {
+    "A": "frk_ct_69ea8de2d97d1f09cc61b896",
+    "B": "frk_rq_68cc13aebd1f91aa8a6e2288"
+  },
+  {
+    "A": "frk_ct_69ea8de2d97d1f09cc61b896",
+    "B": "frk_rq_68cc13c78fe780fd336736f8"
+  },
+  {
+    "A": "frk_ct_69ea8de302274112e7ccc264",
+    "B": "frk_rq_68cc13d7452ced814c6e99f0"
+  },
+  {
+    "A": "frk_ct_69ea8de5cc73e611573e6db4",
+    "B": "frk_rq_68cc1484d319859ad5a42fc1"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe2c0b70c40a7af7538c1"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe315f94ce26cea6c87de"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe3bfba9f2b5679d07384"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_rq_69f3d8fb285f6ce15ead0408"
+  },
+  {
+    "A": "frk_ct_69f3d98a95c7623e660bf33d",
+    "B": "frk_rq_69f3d8fca6daba5a2eaddaaa"
+  },
+  {
+    "A": "frk_ct_69f3d98c52d9000ac36cc791",
+    "B": "frk_rq_69f3d8fc64fbb4b8bd63a0f7"
+  },
+  {
+    "A": "frk_ct_69f3d98e0758e358b1f71b49",
+    "B": "frk_rq_69f3d8fc64fbb4b8bd63a0f7"
+  },
+  {
+    "A": "frk_ct_69f3d98f897fe2984e8163e5",
+    "B": "frk_rq_69f3d8fd143d9729bbe92c18"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed417c678d6e4a72ecc21"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed173c4617d8242804d37"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecca11f8e93d33110f582"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681eccda0b0048baacc8384f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681eccf8ea16a6a8c71b2043"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecea78867657c2a877498"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecec3bacaf5ec71310399"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681eced25693b9ef01953cda"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecee267499cb4e89dd597"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecf02da21ed278b8719a3"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecef18eb5fc1de4b36922"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ecf0edd81451c5d7f942e"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed058cb46f0ca43f4ac04"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed06702eb40f21d9c3280"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed079b20c266ed3bcae4e"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed083826218fefed135f7"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed09f0d780a205029c6f8"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed0aa105e90005119af94"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed0bfb77656558d34e07c"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed0d7a55af6c0b644188b"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed0e87f1d7e373d990d48"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed0f93b445441d7092481"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1090eab65d82db8ba3e"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed11ec29b25b1192e96f6"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1295a639db1210e9237"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed13272f6276ce54c2e23"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1433a712ae09dc7633b"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1525f18dab66c1a2203"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed16583aa68b76c80917a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1946de8b1beb5d5b987"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed17f36423e887ec130f6"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1ac19e3e7e1aef48517"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1d5f29a33fa8735d51c"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1e1ad96b7f5e1659cab"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1f09741eeebee147fcb"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed1fe624cd14c34876ee8"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed20a3f7335dd1ec64b6c"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2170cb1b15f842b6f6d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2229fa221e338501d51"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2314f568a3e5c3f1fbf"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed23c61c97af7967b50c2"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed24aa0809f09c4d22256"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed261918bb47df6590dac"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed277348377c5b5f81649"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2893326942f0ac88d81"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed29613b703c7f368ffdc"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2a8bda2e236fbc46492"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2be08112d94334bd319"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2c844494f7d1b01fa45"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2e32d00654588c5103f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed2f378d4fbe2e39f5f76"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed30003a95e3808397d6d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3455f6b6695283a7c72"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed35d6330398a089100c1"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed36f9d1446b067a4990d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed37df872af70c5430e7f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed38c0abdd2731880fa6e"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed39e1c2f759d433992a7"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3ad17d5f7844774977a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3b87e88e0a249c2098a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3c23adb2d4461dc09da"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3d0342b5d531935cd62"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3dc1663fa62052ef548"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3e78e9b73cb6b279906"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed3f78f28fba67dedc302"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed40ec3b505552b76ce5f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed423b43ec990bbd5f3b5"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed4316c72a80ff5d1fdc6"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed43f84399c54accb82b9"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed417c678d6e4a72ecc21"
+  },
+  {
+    "A": "frk_ct_69ea8de6018b6b80d862c906",
+    "B": "frk_rq_68cc1499a406e703a08e8d8a"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fe413d1788e6d2a2e0e70"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681fecb74a602ca1480b819a"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_rq_681fe50a602bee19cc6c58de"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_rq_681fe525546b5f5cbaa4caba"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_rq_681fe614fa8f4da199b1ab38"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_rq_681fe694c60456dba73c3560"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_rq_681fe6d4eca9ce895d67b372"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_rq_681fe6e799239e3a7cbe2dec"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_rq_681fe75f468516745997ca4f"
+  },
+  {
+    "A": "frk_ct_69f897d2abcbb2cff15807ac",
+    "B": "frk_rq_681feb51b84ba0badd659fe4"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed3f78f28fba67dedc302"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed40ec3b505552b76ce5f"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed423b43ec990bbd5f3b5"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed4316c72a80ff5d1fdc6"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed43f84399c54accb82b9"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed448a7cfe00afd2b0a19"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_rq_681feccc0a6b9c390f81ccab"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_rq_681fe4f2409a61f406391e27"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_rq_681fe87de28c10ea32f74832"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_rq_681fe539da6767ccaa42fd4f"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_rq_681fe62d157ad538df0ac0b7"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_rq_681fe74bab9fd5739de31a2c"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_rq_681fe8577f4153ab83dbedf2"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_rq_681fe8697bff206f287d79cb"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fe89fa3aa895de49e995e"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fe8aa3d80a91789ce36c6"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fe8b819b58da63cf250ac"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fec08c1179a2bfe677069"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fec1b32de927d4dbeb093"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681fec55c16831a6cd91f592"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_rq_681fe924a5f99c526e7a2e01"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_rq_681fe96d757fb6b5c75cdf76"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_rq_681fea39308dba0a946b8ec8"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_rq_681fea57826a6f30eba2db5c"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_rq_681ed4019aa553be924ee291"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed448a7cfe00afd2b0a19"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed45b92c3b3f329d3858f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed46ff23ef8614d7f3042"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed47bac3dee3588290b04"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed48f152068a490f317ac"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed61f357c7bf776300aa7"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed62a1ad145f4554d4068"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6347b1e6eea717482ca"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6497c1e390fe89f0dfa"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed651d81e6c51934134bc"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed65bb490440ea4f3b552"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed663b850258024b0b236"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed66d77af963d9763adeb"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6761e8f45c900e60be3"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed686b626f985dac54c52"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed69ce5f84cf315240f7a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6a5d1683d54c08f7084"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6afecd253fe6c3c060a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6ba79910ff5b9c7d76f"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6c7eee985561d1f4d9b"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6d277a609269207598d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6dc2a941d8ed887fa01"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6eab8348ae42e9622d2"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6f360678a6cf25345b2"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed6fbb7447647d630bfac"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed70245119fe4e1943d4a"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed70cd5e3fc570dd75770"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed713c378baffc34d25f5"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed71f9deddd61109308dd"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7326db82252ea6faa67"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed739dc6d14f4ad5d95d2"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed74124bbe51a72d0c154"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed748dab9fd6d58f20964"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7532959ec62c8ae815c"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed76e19cca49a6ac49bf8"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7794b363009725bab5b"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed781b79f824466be5394"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed789b359f075b12e20c0"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7901ab04aa5a1d27890"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed799ca7b40e2d8ed55ba"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7b407395dfc68ff955d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7c75e421b346480e046"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7ce83ab2029a9dc414c"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7d719388daff946a68d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7de305465fe226fc39d"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed4019aa553be924ee291"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed7e50f718eb161dd5605"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed80ab572359972e06ace"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed813388d3297b3ed3e73"
+  },
+  {
+    "A": "frk_ct_69e639b90a3bf8c1443cbf5b",
+    "B": "frk_rq_681ed81d5e01d43ada52ffae"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681feb8df6c8f41d44a9e287"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681febd6a160cdcafacbc30a"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_rq_681febf659324baa56a6a189"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ecec3bacaf5ec71310399"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681eced25693b9ef01953cda"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ecee267499cb4e89dd597"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ecf02da21ed278b8719a3"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ecef18eb5fc1de4b36922"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ecf0edd81451c5d7f942e"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed058cb46f0ca43f4ac04"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed06702eb40f21d9c3280"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed079b20c266ed3bcae4e"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed083826218fefed135f7"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed09f0d780a205029c6f8"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed0aa105e90005119af94"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed0bfb77656558d34e07c"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed0d7a55af6c0b644188b"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed0e87f1d7e373d990d48"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed0f93b445441d7092481"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1090eab65d82db8ba3e"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed11ec29b25b1192e96f6"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1295a639db1210e9237"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed13272f6276ce54c2e23"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1433a712ae09dc7633b"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1525f18dab66c1a2203"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed16583aa68b76c80917a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1946de8b1beb5d5b987"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed17f36423e887ec130f6"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1ac19e3e7e1aef48517"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1d5f29a33fa8735d51c"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1e1ad96b7f5e1659cab"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1f09741eeebee147fcb"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed1fe624cd14c34876ee8"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed20a3f7335dd1ec64b6c"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_rq_681fe90ba7477425a75f2993"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed781b79f824466be5394"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed789b359f075b12e20c0"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7901ab04aa5a1d27890"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed799ca7b40e2d8ed55ba"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7b407395dfc68ff955d"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7c75e421b346480e046"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7ce83ab2029a9dc414c"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7d719388daff946a68d"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7de305465fe226fc39d"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed4019aa553be924ee291"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed7e50f718eb161dd5605"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed80ab572359972e06ace"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed813388d3297b3ed3e73"
+  },
+  {
+    "A": "frk_ct_69e639b9d5ced482c12ae932",
+    "B": "frk_rq_681ed81d5e01d43ada52ffae"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed417c678d6e4a72ecc21"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed173c4617d8242804d37"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecca11f8e93d33110f582"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681eccda0b0048baacc8384f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681eccf8ea16a6a8c71b2043"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecea78867657c2a877498"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecec3bacaf5ec71310399"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681eced25693b9ef01953cda"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecee267499cb4e89dd597"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecf02da21ed278b8719a3"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecef18eb5fc1de4b36922"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ecf0edd81451c5d7f942e"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed058cb46f0ca43f4ac04"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed06702eb40f21d9c3280"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed079b20c266ed3bcae4e"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed083826218fefed135f7"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed09f0d780a205029c6f8"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed0aa105e90005119af94"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed0bfb77656558d34e07c"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed0d7a55af6c0b644188b"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed0e87f1d7e373d990d48"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed0f93b445441d7092481"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1090eab65d82db8ba3e"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed11ec29b25b1192e96f6"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2170cb1b15f842b6f6d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2229fa221e338501d51"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2314f568a3e5c3f1fbf"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed23c61c97af7967b50c2"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed24aa0809f09c4d22256"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed261918bb47df6590dac"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed277348377c5b5f81649"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2893326942f0ac88d81"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed29613b703c7f368ffdc"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2a8bda2e236fbc46492"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2be08112d94334bd319"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2c844494f7d1b01fa45"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2e32d00654588c5103f"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed2f378d4fbe2e39f5f76"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed30003a95e3808397d6d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3455f6b6695283a7c72"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed35d6330398a089100c1"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed36f9d1446b067a4990d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed37df872af70c5430e7f"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed38c0abdd2731880fa6e"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed39e1c2f759d433992a7"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3ad17d5f7844774977a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3b87e88e0a249c2098a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3c23adb2d4461dc09da"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3d0342b5d531935cd62"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3dc1663fa62052ef548"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3e78e9b73cb6b279906"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed3f78f28fba67dedc302"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed40ec3b505552b76ce5f"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed423b43ec990bbd5f3b5"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed4316c72a80ff5d1fdc6"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed43f84399c54accb82b9"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed448a7cfe00afd2b0a19"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed45b92c3b3f329d3858f"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed46ff23ef8614d7f3042"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed47bac3dee3588290b04"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed48f152068a490f317ac"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed61f357c7bf776300aa7"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed62a1ad145f4554d4068"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6347b1e6eea717482ca"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6497c1e390fe89f0dfa"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed651d81e6c51934134bc"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed65bb490440ea4f3b552"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed663b850258024b0b236"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed66d77af963d9763adeb"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6761e8f45c900e60be3"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed686b626f985dac54c52"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed69ce5f84cf315240f7a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6a5d1683d54c08f7084"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6afecd253fe6c3c060a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6ba79910ff5b9c7d76f"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6c7eee985561d1f4d9b"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6d277a609269207598d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6dc2a941d8ed887fa01"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6eab8348ae42e9622d2"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6f360678a6cf25345b2"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed6fbb7447647d630bfac"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed70245119fe4e1943d4a"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed70cd5e3fc570dd75770"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed713c378baffc34d25f5"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed71f9deddd61109308dd"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7326db82252ea6faa67"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed739dc6d14f4ad5d95d2"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed74124bbe51a72d0c154"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed748dab9fd6d58f20964"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7532959ec62c8ae815c"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed76e19cca49a6ac49bf8"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7794b363009725bab5b"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed781b79f824466be5394"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed789b359f075b12e20c0"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7901ab04aa5a1d27890"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed799ca7b40e2d8ed55ba"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7b407395dfc68ff955d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7c75e421b346480e046"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7ce83ab2029a9dc414c"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7d719388daff946a68d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7de305465fe226fc39d"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed4019aa553be924ee291"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed7e50f718eb161dd5605"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed80ab572359972e06ace"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed813388d3297b3ed3e73"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_rq_681ed81d5e01d43ada52ffae"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_rq_681fe936fa81524e6aeca7c5"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_rq_681fe9465c707c6339b9b335"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_rq_681fea2c2d9331380c8b215f"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_rq_681feb3ed01dfe41d1902a2b"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1295a639db1210e9237"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed13272f6276ce54c2e23"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1433a712ae09dc7633b"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1525f18dab66c1a2203"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed16583aa68b76c80917a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1946de8b1beb5d5b987"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed17f36423e887ec130f6"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1ac19e3e7e1aef48517"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1d5f29a33fa8735d51c"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1e1ad96b7f5e1659cab"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1f09741eeebee147fcb"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed1fe624cd14c34876ee8"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed20a3f7335dd1ec64b6c"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2170cb1b15f842b6f6d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2229fa221e338501d51"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2314f568a3e5c3f1fbf"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed23c61c97af7967b50c2"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed24aa0809f09c4d22256"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed261918bb47df6590dac"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed277348377c5b5f81649"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2893326942f0ac88d81"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed29613b703c7f368ffdc"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2a8bda2e236fbc46492"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2be08112d94334bd319"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2c844494f7d1b01fa45"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2e32d00654588c5103f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed2f378d4fbe2e39f5f76"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed30003a95e3808397d6d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3455f6b6695283a7c72"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed35d6330398a089100c1"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed36f9d1446b067a4990d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed37df872af70c5430e7f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed38c0abdd2731880fa6e"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed39e1c2f759d433992a7"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3ad17d5f7844774977a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3b87e88e0a249c2098a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3c23adb2d4461dc09da"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3d0342b5d531935cd62"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3dc1663fa62052ef548"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3e78e9b73cb6b279906"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed3f78f28fba67dedc302"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed40ec3b505552b76ce5f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed423b43ec990bbd5f3b5"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed4316c72a80ff5d1fdc6"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed43f84399c54accb82b9"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed448a7cfe00afd2b0a19"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed45b92c3b3f329d3858f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed46ff23ef8614d7f3042"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed47bac3dee3588290b04"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed48f152068a490f317ac"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed61f357c7bf776300aa7"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed62a1ad145f4554d4068"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6347b1e6eea717482ca"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6497c1e390fe89f0dfa"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed651d81e6c51934134bc"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed65bb490440ea4f3b552"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed663b850258024b0b236"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed66d77af963d9763adeb"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6761e8f45c900e60be3"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed686b626f985dac54c52"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed69ce5f84cf315240f7a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6a5d1683d54c08f7084"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6afecd253fe6c3c060a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6ba79910ff5b9c7d76f"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6c7eee985561d1f4d9b"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6d277a609269207598d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6dc2a941d8ed887fa01"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6eab8348ae42e9622d2"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6f360678a6cf25345b2"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed6fbb7447647d630bfac"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed70245119fe4e1943d4a"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed70cd5e3fc570dd75770"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed713c378baffc34d25f5"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed71f9deddd61109308dd"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7326db82252ea6faa67"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed739dc6d14f4ad5d95d2"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed74124bbe51a72d0c154"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed748dab9fd6d58f20964"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7532959ec62c8ae815c"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed76e19cca49a6ac49bf8"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7794b363009725bab5b"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed781b79f824466be5394"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed789b359f075b12e20c0"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7901ab04aa5a1d27890"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed799ca7b40e2d8ed55ba"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7b407395dfc68ff955d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7c75e421b346480e046"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7ce83ab2029a9dc414c"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7d719388daff946a68d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7de305465fe226fc39d"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed4019aa553be924ee291"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed7e50f718eb161dd5605"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed80ab572359972e06ace"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed813388d3297b3ed3e73"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_rq_681ed81d5e01d43ada52ffae"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_rq_69efa5b70d056f596dc2a7ae"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
index accdeed941..b0cf084daf 100644
--- a/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
+++ b/packages/db/prisma/seed/relations/_FrameworkEditorControlTemplateToFrameworkEditorTaskTemplate.json
@@ -27,13 +27,17 @@
     "A": "frk_ct_683f4dd564057a97ae323c9f",
     "B": "frk_tt_68406e7abae2a9b16c2cc197"
   },
+  {
+    "A": "frk_ct_69e918e7f403f696c2577de1",
+    "B": "frk_tt_69e92cc75996378b01b27ec9"
+  },
   {
     "A": "frk_ct_684071e280c4e0f777b957f7",
     "B": "frk_tt_6840791cac0a7b780dbaf932"
   },
   {
-    "A": "frk_ct_684070f0b4f6c2036306e23c",
-    "B": "frk_tt_6849aad98c50d734dd904d98"
+    "A": "frk_ct_69e918e7f7739946f5034799",
+    "B": "frk_tt_69e92cc75996378b01b27ec9"
   },
   {
     "A": "frk_ct_6849c343d7fbe4e71446ce78",
@@ -55,10 +59,6 @@
     "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
     "B": "frk_tt_68406cd9dde2d8cd4c463fe0"
   },
-  {
-    "A": "frk_ct_683f4d7360a876b972aba39a",
-    "B": "frk_tt_68406e353df3bc002994acef"
-  },
   {
     "A": "frk_ct_683f50aae46f5e4e096e6bb3",
     "B": "frk_tt_68406eedf0f0ddd220ea19c2"
@@ -80,44 +80,40 @@
     "B": "frk_tt_6849c1a1038c3f18cfff47bf"
   },
   {
-    "A": "frk_ct_68b59e50eeb9f92ce425327c",
-    "B": "frk_tt_68b59e7a29bec89c57014868"
-  },
-  {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9b5393ae083c3beadf"
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_tt_69e92cc75996378b01b27ec9"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9d508cacf8e4517b56"
+    "A": "frk_ct_69ea8db0b7f88f1ce0079240",
+    "B": "frk_tt_69ea9161097ef7eb142b70ff"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
+    "A": "frk_ct_69ea8db2c7ed1af765c5981d",
+    "B": "frk_tt_69ea916227fbbb6a722126b6"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+    "A": "frk_ct_69ea8db62ab22968f85f85f6",
+    "B": "frk_tt_69ea9164c6574221a69e1107"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_6840791cac0a7b780dbaf932"
+    "A": "frk_ct_69ea8dc2e0fd4e97481baafd",
+    "B": "frk_tt_69ea9166fd0793a689981939"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_6849aad98c50d734dd904d98"
+    "A": "frk_ct_69ea8dd44d3b368f85df728c",
+    "B": "frk_tt_69ea9166fd0793a689981939"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68406e353df3bc002994acef"
+    "A": "frk_ct_69ea8dc3a37b3f833dc7d6f3",
+    "B": "frk_tt_69ea9167679a59212c7db16f"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68406af04a4acb93083413b9"
+    "A": "frk_ct_69ea8dc667172a41022fcf27",
+    "B": "frk_tt_69ea91684c77e2310a928a7a"
   },
   {
-    "A": "frk_ct_68b59a16b172e5c360e57536",
-    "B": "frk_tt_68406d2e86acc048d1774ea6"
+    "A": "frk_ct_69ea8dc6f10b53075c3beacb",
+    "B": "frk_tt_69ea916984bd6ff9ec7fd09b"
   },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
@@ -171,10 +167,6 @@
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_tt_68407ae5274a64092c305104"
   },
-  {
-    "A": "frk_ct_68c1eb1c5f317f452216e2d7",
-    "B": "frk_tt_6849aad98c50d734dd904d98"
-  },
   {
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_tt_6849c1a1038c3f18cfff47bf"
@@ -191,14 +183,6 @@
     "A": "frk_ct_68c1eb1c5f317f452216e2d7",
     "B": "frk_tt_68c332c3bc6d696bb61e7351"
   },
-  {
-    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
-    "B": "frk_tt_68c8309516fdbc514404988d"
-  },
-  {
-    "A": "frk_ct_683f4036b541126388e2989a",
-    "B": "frk_tt_68c8309516fdbc514404988d"
-  },
   {
     "A": "frk_ct_68cc25ac90e3fe79c1beb98d",
     "B": "frk_tt_68cc25658bacb2ccff56adf9"
@@ -279,14 +263,6 @@
     "A": "frk_ct_68e1364141d03b5e6d70e728",
     "B": "frk_tt_68e1d5667f2b14a9b0c2daf8"
   },
-  {
-    "A": "frk_ct_68e1364141d03b5e6d70e728",
-    "B": "frk_tt_68e1d619944625cc1876540c"
-  },
-  {
-    "A": "frk_ct_68e1364141d03b5e6d70e728",
-    "B": "frk_tt_68b59e7a29bec89c57014868"
-  },
   {
     "A": "frk_ct_68e1364141d03b5e6d70e728",
     "B": "frk_tt_68d28f68f117d45c0adcba33"
@@ -323,14 +299,6 @@
     "A": "frk_ct_68b59e50eeb9f92ce425327c",
     "B": "frk_tt_68e52b26b166e2c0a0d11956"
   },
-  {
-    "A": "frk_ct_68b59e50eeb9f92ce425327c",
-    "B": "frk_tt_68e52b274a7c38c62db08e80"
-  },
-  {
-    "A": "frk_ct_68b59e50eeb9f92ce425327c",
-    "B": "frk_tt_68e52b27c4bdbf1b24051b8b"
-  },
   {
     "A": "frk_ct_68b59e50eeb9f92ce425327c",
     "B": "frk_tt_68e52a484cad0014de7a628f"
@@ -339,33 +307,33 @@
     "A": "frk_ct_683f4a410cf5bf6d40bf3583",
     "B": "frk_tt_68e805457c2dcc784e72e3cc"
   },
-  {
-    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
-    "B": "frk_tt_68e80544d9734e0402cfa807"
-  },
   {
     "A": "frk_ct_68e8079750107bcc63fc79d9",
     "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
   },
   {
-    "A": "frk_ct_68e80a11f225cb2253e31fa0",
-    "B": "frk_tt_68e52b274a7c38c62db08e80"
+    "A": "frk_ct_69ea8dcaa9b51a2b1e5f2abd",
+    "B": "frk_tt_68cc25658bacb2ccff56adf9"
   },
   {
-    "A": "frk_ct_68e80a11f225cb2253e31fa0",
-    "B": "frk_tt_68e52b27c4bdbf1b24051b8b"
+    "A": "frk_ct_69ea8dc8ec4ced8e76b114c0",
+    "B": "frk_tt_69ea916a881ab0d59e67c930"
   },
   {
     "A": "frk_ct_683f47cc2faa426603d6bee8",
     "B": "frk_tt_68e52b269db179c434734766"
   },
   {
-    "A": "frk_ct_683f47cc2faa426603d6bee8",
-    "B": "frk_tt_68e80545a8b432bc59eb8037"
+    "A": "frk_ct_69ea8dcb210958cb72f499f2",
+    "B": "frk_tt_69ea916b05b146a8a544c406"
   },
   {
-    "A": "frk_ct_683f484fc7b5506ab97c26af",
-    "B": "frk_tt_69033a6bfeb4759be36257bc"
+    "A": "frk_ct_69ea8dcd4cffcf9dd949ca02",
+    "B": "frk_tt_69ea916c7b0b9487da3dbe78"
+  },
+  {
+    "A": "frk_ct_69ea8dcfcba021703a55bf97",
+    "B": "frk_tt_69ea916f42193436fb7b55de"
   },
   {
     "A": "frk_ct_68407122565b1968676d93db",
@@ -384,8 +352,8 @@
     "B": "frk_tt_6901e0aa6d3f2bbab1ea5b84"
   },
   {
-    "A": "frk_ct_683f42c71eea99f22f9df060",
-    "B": "frk_tt_69033a6bfeb4759be36257bc"
+    "A": "frk_ct_69ea8dd5a750b30e2eb69d18",
+    "B": "frk_tt_69ea9173e73c9a96895468c8"
   },
   {
     "A": "frk_ct_684070f0b4f6c2036306e23c",
@@ -416,8 +384,8 @@
     "B": "frk_tt_691e6d9c3d9e14f014b75a7b"
   },
   {
-    "A": "frk_ct_691e53f4024ab9cc096bbc70",
-    "B": "frk_tt_691e6d9df70eabe2354b444d"
+    "A": "frk_ct_69ea8ddce361e7f7eb0fc2b9",
+    "B": "frk_tt_69ea9178aaa6c6a7058c0fcf"
   },
   {
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
@@ -430,5 +398,861 @@
   {
     "A": "frk_ct_691e53f4024ab9cc096bbc70",
     "B": "frk_tt_691e6d9cb17ea23bfc68c57b"
+  },
+  {
+    "A": "frk_ct_69becde6133891181f5fbfe1",
+    "B": "frk_tt_68406cd9dde2d8cd4c463fe0"
+  },
+  {
+    "A": "frk_ct_69ea8dddda00d3522c538085",
+    "B": "frk_tt_69ea91794c21fc8f347cdddd"
+  },
+  {
+    "A": "frk_ct_69ea8ddf8ba2e517ab4a366d",
+    "B": "frk_tt_69ea917abdbda1fa183386d2"
+  },
+  {
+    "A": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "B": "frk_tt_68406903839203801ac8041a"
+  },
+  {
+    "A": "frk_ct_69dd33a6d12ae294a95e9ac1",
+    "B": "frk_tt_69dd3f6094fc732d635210ae"
+  },
+  {
+    "A": "frk_ct_69dd33a6c094ddd8a7268013",
+    "B": "frk_tt_69dd3f8f62639b078e7cc061"
+  },
+  {
+    "A": "frk_ct_69dd3265dadac07cd88ae96c",
+    "B": "frk_tt_69dd3fb7c4f015f0b5851eb0"
+  },
+  {
+    "A": "frk_ct_69dd33a73264cb77236367ba",
+    "B": "frk_tt_69dd3fe1317ecf573a463bbb"
+  },
+  {
+    "A": "frk_ct_69dd33a74b6fd1d459c4af20",
+    "B": "frk_tt_69dd400bdc718337e0354ff7"
+  },
+  {
+    "A": "frk_ct_69e639b9148c96a37c8936fc",
+    "B": "frk_tt_68d28f68f117d45c0adcba33"
+  },
+  {
+    "A": "frk_ct_69e639b96ad6c5e729676acb",
+    "B": "frk_tt_68e52b2618cb9d9722c6edfd"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_tt_68406951bd282273ebe286cc"
+  },
+  {
+    "A": "frk_ct_69e639b958a20954c4afa186",
+    "B": "frk_tt_68e52b27c4bdbf1b24051b8b"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_tt_68407ae5274a64092c305104"
+  },
+  {
+    "A": "frk_ct_69e669af7fd9ef27754dc041",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69ea8de302274112e7ccc264",
+    "B": "frk_tt_69ea917c23d26cfe23eb8fca"
+  },
+  {
+    "A": "frk_ct_69ea8dbfb341d9b1021c8897",
+    "B": "frk_tt_68cc301a8fd914534ab95b11"
+  },
+  {
+    "A": "frk_ct_69ea8dc048654718cfb1d12c",
+    "B": "frk_tt_68cc30fbbeabb8a4c2f56082"
+  },
+  {
+    "A": "frk_ct_69e918e805776785f8f80a14",
+    "B": "frk_tt_68406d2e86acc048d1774ea6"
+  },
+  {
+    "A": "frk_ct_69ea8dc718a407d992cda795",
+    "B": "frk_tt_68cc327ff5d3130a1b42420b"
+  },
+  {
+    "A": "frk_ct_69ea8dcaa9b51a2b1e5f2abd",
+    "B": "frk_tt_68cc395b90e179fe3209b795"
+  },
+  {
+    "A": "frk_ct_69ea8dbccf28e8a000ba1934",
+    "B": "frk_tt_68cc3ffab3fb703917f51e19"
+  },
+  {
+    "A": "frk_ct_69ea8de5cc73e611573e6db4",
+    "B": "frk_tt_68cc459ed57b70a4cb631e72"
+  },
+  {
+    "A": "frk_ct_69ea8dd148f84ea6656bce7d",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_69ea8de1bd41309fdbe08e20",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_69ea8dc5682f9f3146944252",
+    "B": "frk_tt_68406951bd282273ebe286cc"
+  },
+  {
+    "A": "frk_ct_69ea8db16a12eecb3f3a5ecb",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8dd9462f30b929260abf",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8ddbb737f1f09bbcd82e",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8de02be9da8bf00ad0aa",
+    "B": "frk_tt_68406a514e90bb6e32e0b107"
+  },
+  {
+    "A": "frk_ct_69ea8dccd7c01c6d2503448b",
+    "B": "frk_tt_68406d64f09f13271c14dd01"
+  },
+  {
+    "A": "frk_ct_69ea8dc4c401188497d417c2",
+    "B": "frk_tt_68406d2e86acc048d1774ea6"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_tt_68b5ce9b5393ae083c3beadf"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_tt_69eb875e9567b702dbb7f05e"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_tt_69eb87606cb315ebeb98ea49"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_tt_69eb875d77ef6407785a500f"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_68406ca292d9fffb264991b9"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_68e805457c2dcc784e72e3cc"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_tt_69eb8761ff2b2d874ae2a4da"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_tt_68e52b269db179c434734766"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_tt_69eb875e71616f3b8a9fadde"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_tt_6901e041bb02b41fa3b7dca9"
+  },
+  {
+    "A": "frk_ct_69efd5d2b0758b1e1c1b6d87",
+    "B": "frk_tt_69efd9de89f2f4d93e527127"
+  },
+  {
+    "A": "frk_ct_69efd5c84ccf6f3f5bbe29bd",
+    "B": "frk_tt_69efd9e2f40bdd1dd45c057e"
+  },
+  {
+    "A": "frk_ct_69e918ea7bd6df3b3cdd2ddc",
+    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
+  },
+  {
+    "A": "frk_ct_69e918eaa930d07ea41dd0d0",
+    "B": "frk_tt_68b5ce9c6c1bdb171870f623"
+  },
+  {
+    "A": "frk_ct_69efd5a6e66d4c6c92fdd3df",
+    "B": "frk_tt_69efd9e45e6f00c44f622173"
+  },
+  {
+    "A": "frk_ct_69efd5a87004249e7b6e62af",
+    "B": "frk_tt_69efd9e45e6f00c44f622173"
+  },
+  {
+    "A": "frk_ct_69efd5b3cdfebf7ee46a5cf7",
+    "B": "frk_tt_69efd9e45e6f00c44f622173"
+  },
+  {
+    "A": "frk_ct_69efd5aac8f24094878ff701",
+    "B": "frk_tt_69efd9ef3ff6e8fed0fc0028"
+  },
+  {
+    "A": "frk_ct_69efd5e12d61c6019d213f60",
+    "B": "frk_tt_69efd9f81f073e643fb5a19d"
+  },
+  {
+    "A": "frk_ct_69efd5e395082fabf04e53b7",
+    "B": "frk_tt_69efd9f81f073e643fb5a19d"
+  },
+  {
+    "A": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "B": "frk_tt_69efd9f81f073e643fb5a19d"
+  },
+  {
+    "A": "frk_ct_69e918e94e68c0fb15ee98d0",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_69e918e8c57e2f6756c995ca",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_69efd5b3cdfebf7ee46a5cf7",
+    "B": "frk_tt_69efd9f81f073e643fb5a19d"
+  },
+  {
+    "A": "frk_ct_69efd5a6e66d4c6c92fdd3df",
+    "B": "frk_tt_69efdbcee1d3e72ee6873ed1"
+  },
+  {
+    "A": "frk_ct_69efd5a87004249e7b6e62af",
+    "B": "frk_tt_69efdbcee1d3e72ee6873ed1"
+  },
+  {
+    "A": "frk_ct_69ea8daea335821ba4148123",
+    "B": "frk_tt_69ea915ebae9e6858fa4fa07"
+  },
+  {
+    "A": "frk_ct_69ea8daf133ebd28ca732b9d",
+    "B": "frk_tt_69ea915f44950702d9f7733c"
+  },
+  {
+    "A": "frk_ct_69ea8db3571415b8485b6976",
+    "B": "frk_tt_69ea9163eb166db383bb2140"
+  },
+  {
+    "A": "frk_ct_69ea8dbdbd2ce5e539a326fa",
+    "B": "frk_tt_69ea9165056eb451ccc79c0f"
+  },
+  {
+    "A": "frk_ct_69ea8dcef8ff3c2ed55ea14a",
+    "B": "frk_tt_69ea916e273fdb8732d89fc6"
+  },
+  {
+    "A": "frk_ct_69ea8dd148f84ea6656bce7d",
+    "B": "frk_tt_69ea917069457debb719152e"
+  },
+  {
+    "A": "frk_ct_69ea8dd28d9b23fd806840e7",
+    "B": "frk_tt_69ea917139f2541637597cc4"
+  },
+  {
+    "A": "frk_ct_69e918e94e68c0fb15ee98d0",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_69ea8dd38d7945cd54758b49",
+    "B": "frk_tt_69ea91725a27f56747512056"
+  },
+  {
+    "A": "frk_ct_69ea8dd54053dfd453b9dc4a",
+    "B": "frk_tt_69ea9174fe7e40c0405cd057"
+  },
+  {
+    "A": "frk_ct_69ea8dd6097d1766ac51e294",
+    "B": "frk_tt_69ea9175640d0bbbddde05a7"
+  },
+  {
+    "A": "frk_ct_69ea8dd7f551ad7a56706b46",
+    "B": "frk_tt_69ea91761c04c37d4f867908"
+  },
+  {
+    "A": "frk_ct_69ea8dde7453dbed221162e8",
+    "B": "frk_tt_69ea91773112b091b458de8d"
+  },
+  {
+    "A": "frk_ct_69ea8ddf2226651c7382d81c",
+    "B": "frk_tt_69ea917b78c7fc9f3c659a90"
+  },
+  {
+    "A": "frk_ct_69ea8dac2ff1cd0bfe0c8614",
+    "B": "frk_tt_68cc25658bacb2ccff56adf9"
+  },
+  {
+    "A": "frk_ct_69ea8dad9910710084d184a2",
+    "B": "frk_tt_68cc27431d1266e3c77d7c0f"
+  },
+  {
+    "A": "frk_ct_69e918e7f7739946f5034799",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8db4a22bb4f0e4c649e1",
+    "B": "frk_tt_68cc2ce9cb0d2a4774975ace"
+  },
+  {
+    "A": "frk_ct_69ea8db92daf193f6aba0348",
+    "B": "frk_tt_68cc2f30b51920e5515465e6"
+  },
+  {
+    "A": "frk_ct_69ea8dbe99f14797e50f9685",
+    "B": "frk_tt_68cc2fa423533e602e4dee25"
+  },
+  {
+    "A": "frk_ct_69ea8dc1f55bd5e338716f16",
+    "B": "frk_tt_68cc30fbbeabb8a4c2f56082"
+  },
+  {
+    "A": "frk_ct_69ea8db77c8dd4b36c9ac007",
+    "B": "frk_tt_68cc39efd7916e240451cae5"
+  },
+  {
+    "A": "frk_ct_69ea8db865093703fdf71fc7",
+    "B": "frk_tt_68cc3f427e309607f1ad5ba4"
+  },
+  {
+    "A": "frk_ct_69ea8dbbf19cd6ba156e97bd",
+    "B": "frk_tt_68cc3ffab3fb703917f51e19"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8de2d97d1f09cc61b896",
+    "B": "frk_tt_68cc4190caf0b458effcee6e"
+  },
+  {
+    "A": "frk_ct_69e918e6d72a45b4f933a112",
+    "B": "frk_tt_68b5ce9d508cacf8e4517b56"
+  },
+  {
+    "A": "frk_ct_69ea8de2d97d1f09cc61b896",
+    "B": "frk_tt_68cc41ad7cbd2839c0bc7104"
+  },
+  {
+    "A": "frk_ct_69ea8dda97d0010af0cf826d",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_69ea8de6018b6b80d862c906",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_69ea8dd8aa91ceac379fa2c3",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69ea8db5182a7a6a4ad28ce1",
+    "B": "frk_tt_68406a514e90bb6e32e0b107"
+  },
+  {
+    "A": "frk_ct_69ea8dd0de2f746bb95acd4b",
+    "B": "frk_tt_68406d64f09f13271c14dd01"
+  },
+  {
+    "A": "frk_ct_69e918eaa930d07ea41dd0d0",
+    "B": "frk_tt_68b5ce9d508cacf8e4517b56"
+  },
+  {
+    "A": "frk_ct_69e918e8cc289b978f31a12a",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_tt_68e52b2618cb9d9722c6edfd"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_69eb875d089573be3295269e"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_69eb876033531483191663a1"
+  },
+  {
+    "A": "frk_ct_69e918e805776785f8f80a14",
+    "B": "frk_tt_68406e353df3bc002994acef"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_tt_698cacc0f06de04786d097ca"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_tt_69eb8760d56cb8d18c53df13"
+  },
+  {
+    "A": "frk_ct_69e918e6d72a45b4f933a112",
+    "B": "frk_tt_69e928283390c5483dccbcde"
+  },
+  {
+    "A": "frk_ct_69e918e8cc289b978f31a12a",
+    "B": "frk_tt_69e92828297806545638eed7"
+  },
+  {
+    "A": "frk_ct_69e918e8c57e2f6756c995ca",
+    "B": "frk_tt_69e92829b6aa752b0dfba9a8"
+  },
+  {
+    "A": "frk_ct_69e918e9be6da6eba7d0ea4e",
+    "B": "frk_tt_69e92829ac42d6ca48bc6cd9"
+  },
+  {
+    "A": "frk_ct_69e918eb724c553d2e5749ea",
+    "B": "frk_tt_69e92829e97f5a494f13d67b"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_tt_69eb875fa49f13b4b81e9f3b"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_tt_6901e0aa49fb834934748c93"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_tt_6901e040a21d5e8fdc9736e8"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_tt_69eb875ffe511e3ce5298e21"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_tt_6840796f77d8a0dff53f947a"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_tt_6901e0aa6d3f2bbab1ea5b84"
+  },
+  {
+    "A": "frk_ct_69efd5a32e52c113f97254db",
+    "B": "frk_tt_69efd9e081684a02f1207ee0"
+  },
+  {
+    "A": "frk_ct_69efd5ee3eb484fc081cd20a",
+    "B": "frk_tt_69efd9e081684a02f1207ee0"
+  },
+  {
+    "A": "frk_ct_69efd5b1e6f19c87845f5939",
+    "B": "frk_tt_69efd9e45e6f00c44f622173"
+  },
+  {
+    "A": "frk_ct_69efd5cd34220c6db57b2710",
+    "B": "frk_tt_69efd9e45e6f00c44f622173"
+  },
+  {
+    "A": "frk_ct_69efd5a163fc3dcd87372ccc",
+    "B": "frk_tt_69efd9e7f46963f71debd961"
+  },
+  {
+    "A": "frk_ct_69efd5cb8d9092bd71665722",
+    "B": "frk_tt_69efd9ed795877621cdbd56d"
+  },
+  {
+    "A": "frk_ct_69efd5ce50b1ede13c3848f2",
+    "B": "frk_tt_69efd9ef3ff6e8fed0fc0028"
+  },
+  {
+    "A": "frk_ct_69efd5e906d5418ee6b5dc6a",
+    "B": "frk_tt_69efd9f0124f63db79cb50b0"
+  },
+  {
+    "A": "frk_ct_69efd5c63e9c6fc1f8bec055",
+    "B": "frk_tt_69efd9f2322df1e829df8087"
+  },
+  {
+    "A": "frk_ct_69efd5e71ad52c5ab2ec069e",
+    "B": "frk_tt_69efd9f81f073e643fb5a19d"
+  },
+  {
+    "A": "frk_ct_69efd5e395082fabf04e53b7",
+    "B": "frk_tt_69efdbcee1d3e72ee6873ed1"
+  },
+  {
+    "A": "frk_ct_69efd5c63e9c6fc1f8bec055",
+    "B": "frk_tt_69efdbcee1d3e72ee6873ed1"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_tt_69f0d514d103c34ca40ad332"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_tt_69f0d514d103c34ca40ad332"
+  },
+  {
+    "A": "frk_ct_69f3d9808d78f354f8f804b4",
+    "B": "frk_tt_69e92828297806545638eed7"
+  },
+  {
+    "A": "frk_ct_69f3d982f21bf2e86c1ef98d",
+    "B": "frk_tt_69e92828297806545638eed7"
+  },
+  {
+    "A": "frk_ct_69f3d983dce2e00263034481",
+    "B": "frk_tt_69e92828297806545638eed7"
+  },
+  {
+    "A": "frk_ct_69f3d98d61c5a3ef65a23e20",
+    "B": "frk_tt_69efd9f2322df1e829df8087"
+  },
+  {
+    "A": "frk_ct_69f3d9864551468e007fc4d8",
+    "B": "frk_tt_68e52b2618cb9d9722c6edfd"
+  },
+  {
+    "A": "frk_ct_69f3d98847a47dc8f9eacae4",
+    "B": "frk_tt_68406951bd282273ebe286cc"
+  },
+  {
+    "A": "frk_ct_69f3d98b12951c79a1a1cf36",
+    "B": "frk_tt_6840791cac0a7b780dbaf932"
+  },
+  {
+    "A": "frk_ct_69f3d987482f9da8d882e592",
+    "B": "frk_tt_6901e041bb02b41fa3b7dca9"
+  },
+  {
+    "A": "frk_ct_69f3d987482f9da8d882e592",
+    "B": "frk_tt_6901e0aa6d3f2bbab1ea5b84"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_tt_68406cd9dde2d8cd4c463fe0"
+  },
+  {
+    "A": "frk_ct_69f3d988421e37ecdc514fc0",
+    "B": "frk_tt_68406af04a4acb93083413b9"
+  },
+  {
+    "A": "frk_ct_69f3d9891d140c7d3b7d542c",
+    "B": "frk_tt_68406b4f40c87c12ae0479ce"
+  },
+  {
+    "A": "frk_ct_69f3d976c53fd192b48e6236",
+    "B": "frk_tt_69f3ea63df40dfc906558bb5"
+  },
+  {
+    "A": "frk_ct_69f3d9793720eec4d4945150",
+    "B": "frk_tt_69f3ea63c50892f7c9354dbb"
+  },
+  {
+    "A": "frk_ct_69f3d97b66301a97f6b8e4a3",
+    "B": "frk_tt_69f3ea640e0ea50dd2ed8efd"
+  },
+  {
+    "A": "frk_ct_69f3d98a95c7623e660bf33d",
+    "B": "frk_tt_69f3ea640e0ea50dd2ed8efd"
+  },
+  {
+    "A": "frk_ct_69f3d97b66301a97f6b8e4a3",
+    "B": "frk_tt_69f3ea6497e3c0fbd6726ea5"
+  },
+  {
+    "A": "frk_ct_69f3d98a95c7623e660bf33d",
+    "B": "frk_tt_69f3ea6497e3c0fbd6726ea5"
+  },
+  {
+    "A": "frk_ct_69f3d97c03fd8213c05dbbde",
+    "B": "frk_tt_69f3ea65d5b1a04e9c7e0a91"
+  },
+  {
+    "A": "frk_ct_69f3d97d7c0f6c1d629e8fbf",
+    "B": "frk_tt_69f3ea65d5b1a04e9c7e0a91"
+  },
+  {
+    "A": "frk_ct_69f3d97fab711de81e99e786",
+    "B": "frk_tt_69f3ea65d5b1a04e9c7e0a91"
+  },
+  {
+    "A": "frk_ct_69f3d98163541c15c34554c0",
+    "B": "frk_tt_69f3ea65dd312f6d70654ac4"
+  },
+  {
+    "A": "frk_ct_69f3d9846258471679ba5a28",
+    "B": "frk_tt_69f3ea660239b769839c49d4"
+  },
+  {
+    "A": "frk_ct_69f3d9854a029af0a24299a3",
+    "B": "frk_tt_69f3ea660239b769839c49d4"
+  },
+  {
+    "A": "frk_ct_69f3d98c52d9000ac36cc791",
+    "B": "frk_tt_69f3ea66b653b0af244cf869"
+  },
+  {
+    "A": "frk_ct_69f3d98e0758e358b1f71b49",
+    "B": "frk_tt_69f3ea67f1bbe13880b55fa4"
+  },
+  {
+    "A": "frk_ct_69f3d98f897fe2984e8163e5",
+    "B": "frk_tt_69f3ea67845abbb56763649f"
+  },
+  {
+    "A": "frk_ct_69f3d98fd53148ecfa29efa0",
+    "B": "frk_tt_69f3ea67845abbb56763649f"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb876ea13506b36fd63a3e",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb876ec7f4fc346ff10b12",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb876f3270ed0b11233ece",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb87703649e5234a56d529",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb877091d96bcaeae40219",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb87717ae82d509fb927ed",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_69f897d2abcbb2cff15807ac",
+    "B": "frk_tt_68e52b26bf0e656af9e4e9c3"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_tt_68fa2a852e70f757188f0c39"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_tt_68406d2e86acc048d1774ea6"
+  },
+  {
+    "A": "frk_ct_69eb87701093fde54e1169dc",
+    "B": "frk_tt_68406d2e86acc048d1774ea6"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_684069a3a0dd8322b2ac3f03"
+  },
+  {
+    "A": "frk_ct_69eb876f6362393759ecd351",
+    "B": "frk_tt_68406951bd282273ebe286cc"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_tt_68406eedf0f0ddd220ea19c2"
+  },
+  {
+    "A": "frk_ct_68406fc94e08f884cc085ded",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_684071e280c4e0f777b957f7",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68407429371f33886d8ab80d",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_6840738800f98fa3c0f3a3ae",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_684072e06f4a49ee669076cc",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_684070831cc83c4ab4c2c4d8",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_6840731ae0b857152b35ca8f",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_684073ba24475a83ba048022",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68407c9513000617776104c7",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4ae4acbd63d0e558a6f5",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4b7614d209f8b6ffd477",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4c30e2d3f1117fa58e13",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4ef6c6a5481a377be413",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f50aae46f5e4e096e6bb3",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68407122565b1968676d93db",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68407406644c56d42eac3295",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4036b541126388e2989a",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f43a65de3b6044e63220f",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4457b14856e700c8c25b",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f44c8074680be528353c1",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f45c5058c486f3fa5b7bc",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f464bec8bea67de7b9c31",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f46f3f181af3f93773c1d",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f47cc2faa426603d6bee8",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f48ee9534e1e0a088e922",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68e8079750107bcc63fc79d9",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_68e80a11f225cb2253e31fa0",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4a410cf5bf6d40bf3583",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_684070f0b4f6c2036306e23c",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f42c71eea99f22f9df060",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4dd564057a97ae323c9f",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f41e775f4ca03d8f6bae2",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f3ecd42e62fde624c59c1",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f484fc7b5506ab97c26af",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
+  },
+  {
+    "A": "frk_ct_683f4d7360a876b972aba39a",
+    "B": "frk_tt_68e52a484cad0014de7a628f"
   }
 ]
\ No newline at end of file
diff --git a/packages/db/src/client.test.ts b/packages/db/src/client.test.ts
new file mode 100644
index 0000000000..c31515f9ed
--- /dev/null
+++ b/packages/db/src/client.test.ts
@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'bun:test';
+import { resolveSslConfig } from './ssl-config';
+
+describe('resolveSslConfig', () => {
+  it('returns undefined for localhost', () => {
+    expect(resolveSslConfig('postgresql://u:p@localhost:5432/x', {})).toBeUndefined();
+  });
+
+  it('returns undefined for 127.0.0.1', () => {
+    expect(resolveSslConfig('postgresql://u:p@127.0.0.1:5432/x', {})).toBeUndefined();
+  });
+
+  it('returns undefined for ::1', () => {
+    expect(resolveSslConfig('postgresql://u:p@[::1]:5432/x', {})).toBeUndefined();
+  });
+
+  it('returns checkServerIdentity-noop when NODE_EXTRA_CA_CERTS is set', () => {
+    const result = resolveSslConfig('postgresql://u:p@db.prod.example.com:5432/x', {
+      NODE_EXTRA_CA_CERTS: '/etc/ssl/certs/ca-certificates.crt',
+    });
+    expect(result).toBeDefined();
+    expect(typeof (result as { checkServerIdentity: unknown }).checkServerIdentity).toBe('function');
+    // The function returns undefined (no error → identity accepted)
+    expect((result as { checkServerIdentity: () => undefined }).checkServerIdentity()).toBeUndefined();
+  });
+
+  it('returns rejectUnauthorized:false when PRISMA_ALLOW_INSECURE_TLS=1', () => {
+    expect(
+      resolveSslConfig('postgresql://u:p@db.prod.example.com:5432/x', {
+        PRISMA_ALLOW_INSECURE_TLS: '1',
+      }),
+    ).toEqual({ rejectUnauthorized: false });
+  });
+
+  it('throws on remote URL with neither env var set', () => {
+    expect(() => resolveSslConfig('postgresql://u:p@db.prod.example.com:5432/x', {})).toThrow(
+      /Refusing to connect/,
+    );
+  });
+
+  it('treats malformed URLs as remote (defensive)', () => {
+    expect(() => resolveSslConfig('not-a-valid-url', {})).toThrow(/Refusing to connect/);
+  });
+
+  it('prefers verified TLS over insecure opt-in when both are set', () => {
+    const result = resolveSslConfig('postgresql://u:p@db.prod.example.com:5432/x', {
+      NODE_EXTRA_CA_CERTS: '/etc/ssl/certs/ca-certificates.crt',
+      PRISMA_ALLOW_INSECURE_TLS: '1',
+    });
+    expect(result).toBeDefined();
+    expect(typeof (result as { checkServerIdentity: unknown }).checkServerIdentity).toBe('function');
+  });
+});
diff --git a/packages/db/src/client.ts b/packages/db/src/client.ts
index 1bd8069f56..43a9d130e2 100644
--- a/packages/db/src/client.ts
+++ b/packages/db/src/client.ts
@@ -1,7 +1,11 @@
 import { PrismaClient } from '@prisma/client';
 import { PrismaPg } from '@prisma/adapter-pg';
+import { resolveSslConfig } from './ssl-config';
 
-const globalForPrisma = global as unknown as { prisma: PrismaClient };
+export type { SslConfig } from './ssl-config';
+export { resolveSslConfig } from './ssl-config';
+
+const globalForPrisma = global as unknown as { prisma?: PrismaClient };
 
 function stripSslMode(connectionString: string): string {
   const url = new URL(connectionString);
@@ -11,22 +15,30 @@ function stripSslMode(connectionString: string): string {
 
 function createPrismaClient(): PrismaClient {
   const rawUrl = process.env.DATABASE_URL!;
-  const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(rawUrl);
-  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
-  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
-  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
-  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
-  // Strip sslmode from the connection string to avoid conflicts with the explicit ssl option
+  const ssl = resolveSslConfig(rawUrl);
   const url = ssl !== undefined ? stripSslMode(rawUrl) : rawUrl;
   const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({
     adapter,
-    transactionOptions: {
-      timeout: 60000,
-    },
+    transactionOptions: { timeout: 60000 },
   });
 }
 
-export const db = globalForPrisma.prisma || createPrismaClient();
+// Lazy initialization. Importing this module does NOT construct a Prisma client
+// — that only happens on first property access on `db`. Critical so that
+// Next.js `next build` (which imports every route handler to analyze it) does
+// not trigger the strict TLS check at build time when no actual queries run.
+function getClient(): PrismaClient {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = createPrismaClient();
+  }
+  return globalForPrisma.prisma;
+}
 
-if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = db;
+export const db = new Proxy({} as PrismaClient, {
+  get(_target, prop, _receiver) {
+    const client = getClient();
+    const value = Reflect.get(client, prop, client);
+    return typeof value === 'function' ? value.bind(client) : value;
+  },
+});
diff --git a/packages/db/src/ssl-config.ts b/packages/db/src/ssl-config.ts
new file mode 100644
index 0000000000..e2fd586da5
--- /dev/null
+++ b/packages/db/src/ssl-config.ts
@@ -0,0 +1,38 @@
+export type SslConfig =
+  | undefined
+  | { checkServerIdentity: () => undefined }
+  | { rejectUnauthorized: false };
+
+const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
+
+function isLocalhostUrl(connectionString: string): boolean {
+  try {
+    const { hostname } = new URL(connectionString);
+    const stripped = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    return LOCAL_HOSTNAMES.has(stripped);
+  } catch {
+    // Malformed URL — be conservative and treat as remote so we don't
+    // accidentally disable TLS verification.
+    return false;
+  }
+}
+
+export function resolveSslConfig(
+  databaseUrl: string,
+  env: Partial<NodeJS.ProcessEnv> = process.env,
+): SslConfig {
+  const isLocalhost = isLocalhostUrl(databaseUrl);
+  const hasCABundle = !!env.NODE_EXTRA_CA_CERTS;
+  const allowInsecure = env.PRISMA_ALLOW_INSECURE_TLS === '1';
+
+  if (isLocalhost) return undefined;
+  // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
+  // RDS CA to the trust store). Skip hostname check because connections may
+  // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
+  // The chain check still rejects forged or wrong-CA certs.
+  if (hasCABundle) return { checkServerIdentity: () => undefined };
+  if (allowInsecure) return { rejectUnauthorized: false };
+  throw new Error(
+    'Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.',
+  );
+}
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index 78b5977896..b9fe7944c4 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -485,7 +485,7 @@
         },
         "responses": {
           "default": {
-            "description": "Ownership transferred successfully",
+            "description": "Not found - Organization or member not found\n\nForbidden - Only organization owner can transfer ownership\n\nUnauthorized - Invalid or missing authentication\n\nBad request - Invalid input\n\nOwnership transferred successfully",
             "content": {
               "application/json": {
                 "schema": {
@@ -866,6 +866,22 @@
         ]
       }
     },
+    "/v1/organization-access/auto-approve": {
+      "post": {
+        "description": "Grants hasAccess on the active organization if the requesting user is an internal trycomp.ai user, the deployment is self-hosted, or the user email domain matches the organization website domain and is an active Stripe customer.",
+        "operationId": "OrganizationAccessController_autoApprove_v1",
+        "parameters": [],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "summary": "Auto-approve organization access via domain or self-hosted check",
+        "tags": [
+          "Organization"
+        ]
+      }
+    },
     "/v1/people/invite": {
       "post": {
         "operationId": "PeopleController_inviteMembers_v1",
@@ -8092,7 +8108,7 @@
         "parameters": [],
         "responses": {
           "default": {
-            "description": "macOS agent DMG file download",
+            "description": "Internal server error\n\nmacOS agent file not found in S3\n\nUnauthorized - Invalid or missing authentication\n\nmacOS agent DMG file download",
             "content": {
               "application/x-apple-diskimage": {
                 "schema": {
@@ -8138,7 +8154,7 @@
         "parameters": [],
         "responses": {
           "default": {
-            "description": "Windows agent ZIP file download containing MSI installer and setup scripts",
+            "description": "Internal server error\n\nWindows agent file not found in S3\n\nUnauthorized - Invalid or missing authentication\n\nWindows agent ZIP file download containing MSI installer and setup scripts",
             "content": {
               "application/zip": {
                 "schema": {
@@ -11962,6 +11978,44 @@
         ]
       }
     },
+    "/v1/trust-access/access/{token}/policies/{policyId}/download": {
+      "get": {
+        "description": "Generate watermarked PDF for a specific published policy and return a signed download URL",
+        "operationId": "TrustAccessController_downloadPolicy_v1",
+        "parameters": [
+          {
+            "name": "token",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "policyId",
+            "required": true,
+            "in": "path",
+            "description": "Policy ID",
+            "schema": {
+              "example": "pol_abc123",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Signed URL for watermarked PDF returned"
+          },
+          "404": {
+            "description": "Policy not found"
+          }
+        },
+        "summary": "Download single policy as watermarked PDF",
+        "tags": [
+          "Trust Access"
+        ]
+      }
+    },
     "/v1/trust-access/access/{token}/policies/download-all-zip": {
       "get": {
         "description": "Generate ZIP archive containing individual watermarked PDFs for each policy",
@@ -22001,6 +22055,11 @@
             "type": "string",
             "description": "Member join date (createdAt override)",
             "example": "2024-01-15T00:00:00.000Z"
+          },
+          "backgroundCheckExempt": {
+            "type": "boolean",
+            "description": "When true, this member is exempt from the org-level background check requirement and will count as complete in people scores.",
+            "example": false
           }
         }
       },
@@ -22526,6 +22585,23 @@
               "severe"
             ]
           },
+          "treatmentStrategy": {
+            "type": "string",
+            "description": "Risk treatment strategy",
+            "enum": [
+              "accept",
+              "avoid",
+              "mitigate",
+              "transfer"
+            ],
+            "default": "accept",
+            "example": "mitigate"
+          },
+          "treatmentStrategyDescription": {
+            "type": "object",
+            "description": "Description of the treatment strategy",
+            "example": "We isolated the vendor to a dedicated VPC."
+          },
           "website": {
             "type": "string",
             "description": "Vendor website URL"
@@ -25643,6 +25719,7 @@
           "assignee": {
             "description": "Assignee information",
             "nullable": true,
+            "type": "object",
             "allOf": [
               {
                 "$ref": "#/components/schemas/TaskItemAssigneeDto"
@@ -25660,6 +25737,7 @@
           "updatedBy": {
             "description": "Last updater information",
             "nullable": true,
+            "type": "object",
             "allOf": [
               {
                 "$ref": "#/components/schemas/TaskItemUpdaterDto"
diff --git a/packages/integration-platform/src/manifests/jumpcloud/checks/employee-sync.ts b/packages/integration-platform/src/manifests/jumpcloud/checks/employee-sync.ts
deleted file mode 100644
index 80b533dabe..0000000000
--- a/packages/integration-platform/src/manifests/jumpcloud/checks/employee-sync.ts
+++ /dev/null
@@ -1,169 +0,0 @@
-import { TASK_TEMPLATES } from '../../../task-mappings';
-import type { CheckContext, IntegrationCheck } from '../../../types';
-import type { JumpCloudEmployee, JumpCloudUser, JumpCloudUsersResponse } from '../types';
-import { includeSuspendedVariable } from '../variables';
-
-/**
- * Helper to determine user status from JumpCloud state
- */
-const getUserStatus = (user: JumpCloudUser): 'active' | 'suspended' | 'staged' => {
-  if (user.suspended) return 'suspended';
-  if (user.state === 'STAGED') return 'staged';
-  if (user.state === 'ACTIVATED' && user.activated) return 'active';
-  return 'suspended';
-};
-
-/**
- * Helper to build full name from user data
- */
-const getFullName = (user: JumpCloudUser): string => {
-  if (user.displayname) return user.displayname;
-  const parts = [user.firstname, user.lastname].filter(Boolean);
-  if (parts.length > 0) return parts.join(' ');
-  return user.username;
-};
-
-/**
- * Employee Sync Check
- *
- * Fetches all users from JumpCloud and syncs them as employees.
- * This provides a complete list of team members for access review and compliance.
- */
-export const employeeSyncCheck: IntegrationCheck = {
-  id: 'employee-sync',
-  name: 'Employee Sync',
-  description: 'Sync users from JumpCloud as employees for access review and verification',
-  taskMapping: TASK_TEMPLATES.employeeAccess,
-  defaultSeverity: 'info',
-  variables: [includeSuspendedVariable],
-
-  run: async (ctx: CheckContext) => {
-    ctx.log('Starting JumpCloud Employee Sync');
-
-    const includeSuspended = ctx.variables.include_suspended === 'true';
-
-    // JumpCloud API v1 uses pagination with limit/skip
-    const allUsers: JumpCloudUser[] = [];
-    const limit = 100;
-    let skip = 0;
-    let hasMore = true;
-
-    ctx.log('Fetching users from JumpCloud...');
-
-    while (hasMore) {
-      // Note: path must NOT start with / when using baseUrl, otherwise URL constructor
-      // treats it as absolute from domain root
-      const response = await ctx.fetch<JumpCloudUsersResponse>('systemusers', {
-        baseUrl: 'https://console.jumpcloud.com/api/',
-        params: {
-          limit: String(limit),
-          skip: String(skip),
-          sort: 'email',
-        },
-      });
-
-      if (response.results && response.results.length > 0) {
-        allUsers.push(...response.results);
-        skip += response.results.length;
-
-        // Check if we've fetched all users
-        if (response.results.length < limit || skip >= response.totalCount) {
-          hasMore = false;
-        }
-      } else {
-        hasMore = false;
-      }
-
-      ctx.log(`Fetched ${allUsers.length} of ${response.totalCount} users`);
-    }
-
-    ctx.log(`Fetched ${allUsers.length} total users from JumpCloud`);
-
-    // Filter users based on configuration
-    const filteredUsers = allUsers.filter((user) => {
-      // Always exclude staged users (not yet activated)
-      if (user.state === 'STAGED') return false;
-
-      // Include/exclude suspended users based on variable
-      if (user.suspended && !includeSuspended) return false;
-
-      return true;
-    });
-
-    ctx.log(`Found ${filteredUsers.length} users after filtering`);
-
-    // Build manager lookup map
-    const userById = new Map(allUsers.map((u) => [u._id, u]));
-
-    // Transform to employee format
-    const employees: JumpCloudEmployee[] = filteredUsers.map((user) => ({
-      id: user._id,
-      email: user.email,
-      name: getFullName(user),
-      firstName: user.firstname,
-      lastName: user.lastname,
-      username: user.username,
-      jobTitle: user.jobTitle,
-      department: user.department,
-      employeeType: user.employeeType,
-      managerId: user.manager,
-      status: getUserStatus(user),
-      mfaEnabled: user.mfa?.configured ?? user.totp_enabled ?? false,
-      isAdmin: user.sudo ?? false,
-      createdAt: user.created,
-    }));
-
-    // Calculate statistics
-    const activeUsers = employees.filter((e) => e.status === 'active');
-    const suspendedUsers = employees.filter((e) => e.status === 'suspended');
-    const mfaEnabled = employees.filter((e) => e.mfaEnabled);
-    const admins = employees.filter((e) => e.isAdmin);
-
-    // Group by department for summary
-    const departmentCounts = new Map<string, number>();
-    for (const emp of employees) {
-      const dept = emp.department || 'No Department';
-      departmentCounts.set(dept, (departmentCounts.get(dept) || 0) + 1);
-    }
-
-    const departmentSummary = Array.from(departmentCounts.entries())
-      .map(([name, count]) => ({ department: name, count }))
-      .sort((a, b) => b.count - a.count);
-
-    // Build employee list with manager names resolved
-    const employeeList = employees.map((emp) => {
-      let managerName: string | undefined;
-      if (emp.managerId) {
-        const manager = userById.get(emp.managerId);
-        if (manager) {
-          managerName = getFullName(manager);
-        }
-      }
-
-      return {
-        ...emp,
-        managerName,
-      };
-    });
-
-    // Pass with the full employee list as evidence
-    ctx.pass({
-      title: 'JumpCloud Employee List',
-      resourceType: 'organization',
-      resourceId: 'jumpcloud',
-      description: `Retrieved ${employees.length} employees from JumpCloud (${activeUsers.length} active, ${suspendedUsers.length} suspended, ${admins.length} admins, ${mfaEnabled.length} with MFA)`,
-      evidence: {
-        totalUsers: employees.length,
-        activeCount: activeUsers.length,
-        suspendedCount: suspendedUsers.length,
-        adminCount: admins.length,
-        mfaEnabledCount: mfaEnabled.length,
-        departmentSummary,
-        reviewedAt: new Date().toISOString(),
-        employees: employeeList,
-      },
-    });
-
-    ctx.log('JumpCloud Employee Sync complete');
-  },
-};
diff --git a/packages/integration-platform/src/manifests/jumpcloud/checks/index.ts b/packages/integration-platform/src/manifests/jumpcloud/checks/index.ts
deleted file mode 100644
index df3c6b7509..0000000000
--- a/packages/integration-platform/src/manifests/jumpcloud/checks/index.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * JumpCloud Check Exports
- *
- * Export all checks from this folder for use in the manifest.
- */
-
-export { employeeSyncCheck } from './employee-sync';
diff --git a/packages/integration-platform/src/manifests/jumpcloud/index.ts b/packages/integration-platform/src/manifests/jumpcloud/index.ts
deleted file mode 100644
index 89ea8a165f..0000000000
--- a/packages/integration-platform/src/manifests/jumpcloud/index.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * JumpCloud Integration Manifest
- *
- * This integration connects to JumpCloud to sync users as employees.
- * JumpCloud is an identity and access management platform that provides
- * a cloud directory for managing users, devices, and access.
- *
- * @see https://docs.jumpcloud.com/api/1.0/index.html
- * @see https://docs.jumpcloud.com/api/2.0/index.html
- */
-
-import type { IntegrationManifest } from '../../types';
-import { employeeSyncCheck } from './checks';
-import { syncExcludedUsersVariable } from './variables';
-
-export const manifest: IntegrationManifest = {
-  id: 'jumpcloud',
-  name: 'JumpCloud',
-  description: 'Sync users from JumpCloud as employees for access review and compliance.',
-  category: 'Identity & Access',
-  logoUrl: 'https://img.logo.dev/jumpcloud.com?token=pk_AZatYxV5QDSfWpRDaBxzRQ',
-  docsUrl: 'https://docs.trycomp.ai/integrations/jumpcloud',
-
-  // JumpCloud API v1 base URL (used for systemusers endpoint)
-  // Note: trailing slash is required for proper URL construction
-  baseUrl: 'https://console.jumpcloud.com/api/',
-  defaultHeaders: {
-    Accept: 'application/json',
-    'Content-Type': 'application/json',
-  },
-
-  auth: {
-    type: 'api_key',
-    config: {
-      in: 'header',
-      name: 'x-api-key',
-    },
-  },
-
-  credentialFields: [
-    {
-      id: 'api_key',
-      label: 'JumpCloud Admin API Key',
-      type: 'password',
-      required: true,
-      placeholder: 'Your JumpCloud API key',
-      helpText:
-        'https://jumpcloud.com/university/resources/guided-simulations/generating-a-new-api-key',
-    },
-  ],
-
-  // Supports both checks and sync capabilities
-  capabilities: ['checks', 'sync'],
-
-  services: [
-    { id: 'user-sync', name: 'User Sync', description: 'Sync users from JumpCloud as organization members', enabledByDefault: true, implemented: true },
-    { id: 'mfa-monitoring', name: 'MFA Monitoring', description: 'Monitor multi-factor authentication enrollment status', implemented: false },
-  ],
-
-  variables: [syncExcludedUsersVariable],
-
-  // Employee sync check
-  checks: [employeeSyncCheck],
-
-  isActive: true,
-};
-
-export default manifest;
-export * from './types';
diff --git a/packages/integration-platform/src/manifests/jumpcloud/types.ts b/packages/integration-platform/src/manifests/jumpcloud/types.ts
deleted file mode 100644
index 344cb32594..0000000000
--- a/packages/integration-platform/src/manifests/jumpcloud/types.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-/**
- * JumpCloud API Types
- *
- * Types for JumpCloud System Users API v1
- * @see https://docs.jumpcloud.com/api/1.0/index.html
- */
-
-/**
- * JumpCloud System User
- * Represents a user in JumpCloud's directory
- */
-export interface JumpCloudUser {
-  /** Unique identifier for the user */
-  _id: string;
-
-  /** User's login username */
-  username: string;
-
-  /** User's email address (required, globally unique) */
-  email: string;
-
-  /** User's first name */
-  firstname?: string;
-
-  /** User's last name */
-  lastname?: string;
-
-  /** User's display name */
-  displayname?: string;
-
-  /** User's job title */
-  jobTitle?: string;
-
-  /** Department the user belongs to */
-  department?: string;
-
-  /** Cost center */
-  costCenter?: string;
-
-  /** Employee identifier */
-  employeeIdentifier?: string;
-
-  /** Employee type (e.g., full-time, contractor) */
-  employeeType?: string;
-
-  /** Company name */
-  company?: string;
-
-  /** User's location */
-  location?: string;
-
-  /** Description / notes about the user */
-  description?: string;
-
-  /** Manager's user ID */
-  manager?: string;
-
-  /** User's current state */
-  state: 'ACTIVATED' | 'SUSPENDED' | 'STAGED' | 'PENDING_LOCK_STATE';
-
-  /** Whether the user account is activated */
-  activated: boolean;
-
-  /** Whether the user account is suspended */
-  suspended: boolean;
-
-  /** Whether MFA is enabled for the user */
-  mfa?: {
-    configured: boolean;
-    exclusion: boolean;
-    exclusionUntil?: string;
-  };
-
-  /** Whether TOTP is enabled */
-  totp_enabled?: boolean;
-
-  /** Whether the user has admin privileges */
-  sudo?: boolean;
-
-  /** Whether this is an LDAP binding user */
-  ldap_binding_user?: boolean;
-
-  /** Whether password never expires */
-  password_never_expires?: boolean;
-
-  /** Account creation timestamp */
-  created?: string;
-
-  /** Last password set timestamp */
-  password_date?: string;
-
-  /** Account locked status */
-  account_locked?: boolean;
-
-  /** Account locked date */
-  account_locked_date?: string;
-
-  /** User's phone numbers */
-  phoneNumbers?: Array<{
-    type: string;
-    number: string;
-  }>;
-
-  /** User's addresses */
-  addresses?: Array<{
-    type: string;
-    streetAddress?: string;
-    locality?: string;
-    region?: string;
-    postalCode?: string;
-    country?: string;
-  }>;
-
-  /** External source synchronization */
-  external_source_type?: string;
-
-  /** External DN (for AD/LDAP synced users) */
-  external_dn?: string;
-
-  /** Organization ID */
-  organization?: string;
-}
-
-/**
- * Response from JumpCloud System Users list endpoint
- */
-export interface JumpCloudUsersResponse {
-  /** Total count of users matching the query */
-  totalCount: number;
-
-  /** Array of user objects */
-  results: JumpCloudUser[];
-}
-
-/**
- * Simplified employee record for sync
- */
-export interface JumpCloudEmployee {
-  id: string;
-  email: string;
-  name: string;
-  firstName?: string;
-  lastName?: string;
-  username: string;
-  jobTitle?: string;
-  department?: string;
-  employeeType?: string;
-  managerId?: string;
-  status: 'active' | 'suspended' | 'staged';
-  mfaEnabled: boolean;
-  isAdmin: boolean;
-  createdAt?: string;
-}
diff --git a/packages/integration-platform/src/manifests/jumpcloud/variables.ts b/packages/integration-platform/src/manifests/jumpcloud/variables.ts
deleted file mode 100644
index 7f71823121..0000000000
--- a/packages/integration-platform/src/manifests/jumpcloud/variables.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Shared Variables for JumpCloud Integration
- *
- * Variables that can be reused across multiple checks.
- */
-
-import type { CheckVariable } from '../../types';
-
-/**
- * Whether to include suspended users in the sync
- */
-export const includeSuspendedVariable: CheckVariable = {
-  id: 'include_suspended',
-  label: 'Include suspended users',
-  type: 'select',
-  required: false,
-  default: 'false',
-  helpText: 'Include suspended users in the employee list',
-  options: [
-    { value: 'false', label: 'No - Active users only' },
-    { value: 'true', label: 'Yes - Include suspended users' },
-  ],
-};
-
-/**
- * Filter by department
- */
-export const departmentFilterVariable: CheckVariable = {
-  id: 'department_filter',
-  label: 'Filter by department',
-  type: 'text',
-  required: false,
-  placeholder: 'e.g., Engineering',
-  helpText: 'Only include users from this department (leave empty for all)',
-};
-
-/**
- * Exclude specific accounts from employee sync.
- */
-export const syncExcludedUsersVariable: CheckVariable = {
-  id: 'sync_excluded_emails',
-  label: 'Exclude from Sync',
-  type: 'multi-select',
-  required: false,
-  placeholder: 'Type a value and press Enter',
-  helpText:
-    'Add full emails, domains (@company.com or company.com), or partial text. Matching users are skipped during JumpCloud employee sync. Suspended/deleted users can still be deactivated.',
-};
diff --git a/packages/integration-platform/src/registry/index.ts b/packages/integration-platform/src/registry/index.ts
index b2babe6de6..3e10442840 100644
--- a/packages/integration-platform/src/registry/index.ts
+++ b/packages/integration-platform/src/registry/index.ts
@@ -13,7 +13,6 @@ import { azureManifest } from '../manifests/azure';
 import { gcpManifest } from '../manifests/gcp';
 import { manifest as githubManifest } from '../manifests/github';
 import { googleWorkspaceManifest } from '../manifests/google-workspace';
-import { manifest as jumpcloudManifest } from '../manifests/jumpcloud';
 import { ripplingManifest } from '../manifests/rippling';
 import { vercelManifest } from '../manifests/vercel';
 
@@ -143,7 +142,6 @@ const allManifests: IntegrationManifest[] = [
   gcpManifest,
   githubManifest,
   googleWorkspaceManifest,
-  jumpcloudManifest,
   ripplingManifest,
   vercelManifest,
   aikidoManifest,