Imports and templates

• Control Mapping Concierge - use when you have existing control IDs, framework references, owners, statuses, evidence references, or notes.
• Vendor import - use for ICT providers, outsourcing records, criticality, review dates, and dependency information.
• Evidence import - use for metadata and file references. Filename references still need the file upload step.
• Incident import - use for historical incidents or structured exports from another incident tool.
• Training and policy imports - use when you have existing ownership or attestation records to load in bulk.

• Keep one header row and do not merge cells.
• Use stable IDs where available, such as customer control ID, vendor ID, or external incident ID.
• Use ISO-style dates where possible, for example 2026-05-31.
• Use one row per record. Put multiple evidence references in the evidence reference column separated as the template describes.
• Avoid formulas, macros, hidden sheets, and password protection.

• BLOCKER - must be fixed before commit. Example: missing required ID or invalid framework reference.
• WARNING - review before commit. Example: unknown owner or low-confidence mapping suggestion.
• INFO - useful context, not blocking. Example: evidence filename carried forward for later upload.

• Exact re-upload should not create duplicates.
• Changed rows appear as reviewable differences.
• Missing rows are treated as archive candidates, not silent deletes.
• Committed batches can be rolled back where downstream edits do not create conflicts.

Evidence references are metadata until the actual file exists in OneComply. A URL is stored as a reference, a filename waits for upload, and a note tells the reviewer what follow-up evidence is expected.