From 9b6e610afcde183fe5fc177933fef60867cf6464 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 10 Jun 2026 13:42:44 -0400
Subject: [PATCH 1/5] feat(evidence-forms): add Account Types document type
 (CS-513)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a new "Account Types" evidence document type so it can be linked to
NIST SP 800-53 controls in the framework editor.

The form is a table of [Account Type, Allowed/Disallowed, Justification]
pre-seeded with the 10 standard account types. This required two small,
reusable additions to the evidence-form platform:
- matrix columns can now be dropdown picklists (type: 'select' + options),
  not just free text;
- matrix fields can ship default/seed rows.

Conditional validation: a Justification is required only when a row is
Allowed; Disallowed rows may leave it blank.

Touch points (the current — code-only — way to add a document type):
- EvidenceFormType enum + migration (packages/db)
- @trycompai/company: form-types, db-form-type-map, types, definitions,
  submission-schemas
- app wizard renders select columns + seeded rows (MatrixCellControl)
- framework-editor DOCUMENT_TYPE_OPTIONS + app DOCUMENT_TYPE_LABELS

Tests: 8 definition/validation specs + 1 wizard render spec (10 seeded
rows, Allowed/Disallowed dropdowns, prefilled values).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ...anySubmissionWizard.account-types.test.tsx | 66 ++++++++++++++
 .../components/CompanySubmissionWizard.tsx    | 67 +++++++++++---
 .../components/account-types-form.test.ts     | 87 +++++++++++++++++++
 .../documents/components/submission-utils.tsx |  2 +
 .../components/documentTypeLabels.ts          |  1 +
 .../(pages)/controls/document-type-options.ts |  1 +
 .../src/evidence-forms/db-form-type-map.ts    |  2 +
 .../company/src/evidence-forms/definitions.ts | 52 +++++++++++
 .../company/src/evidence-forms/form-types.ts  |  1 +
 .../src/evidence-forms/submission-schemas.ts  | 55 ++++++++++++
 packages/company/src/evidence-forms/types.ts  |  6 ++
 .../migration.sql                             |  2 +
 packages/db/prisma/schema/shared.prisma       |  1 +
 13 files changed, 329 insertions(+), 14 deletions(-)
 create mode 100644 apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.account-types.test.tsx
 create mode 100644 apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
 create mode 100644 packages/db/prisma/migrations/20260610133701_add_account_types_evidence_form_type/migration.sql

diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.account-types.test.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.account-types.test.tsx
new file mode 100644
index 0000000000..cc4c13044c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.account-types.test.tsx
@@ -0,0 +1,66 @@
+import { fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn(), refresh: vi.fn() }),
+}));
+vi.mock('@/lib/api-client', () => ({ api: { post: vi.fn() } }));
+vi.mock('@/components/file-uploader', () => ({ FileUploader: () => <div /> }));
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
+
+// Light design-system mock: render a Select as a native <select> so the
+// dropdown options and matrix cells are queryable in jsdom.
+vi.mock('@trycompai/design-system', () => {
+  const Passthrough = ({ children }: any) => <div>{children}</div>;
+  return {
+    Alert: Passthrough,
+    Button: ({ children, ...props }: any) => <button {...props}>{children}</button>,
+    Field: Passthrough,
+    FieldError: () => null,
+    FieldGroup: Passthrough,
+    FieldLabel: ({ children, htmlFor }: any) => <label htmlFor={htmlFor}>{children}</label>,
+    Input: (props: any) => <input {...props} />,
+    Section: Passthrough,
+    Text: ({ children }: any) => <span>{children}</span>,
+    Textarea: (props: any) => <textarea {...props} />,
+    Select: ({ value, onValueChange, children }: any) => (
+      <select
+        data-testid="ds-select"
+        value={value}
+        onChange={(e) => onValueChange?.(e.target.value)}
+      >
+        {children}
+      </select>
+    ),
+    SelectContent: ({ children }: any) => <>{children}</>,
+    SelectItem: ({ value, children }: any) => <option value={value}>{children}</option>,
+    SelectTrigger: () => null,
+    SelectValue: () => null,
+  };
+});
+
+import { CompanySubmissionWizard } from './CompanySubmissionWizard';
+
+describe('CompanySubmissionWizard — account-types rendering', () => {
+  it('renders the 10 seeded rows with Allowed/Disallowed dropdowns and prefilled values', async () => {
+    render(<CompanySubmissionWizard organizationId="org_test" formType="account-types" />);
+
+    // The Account Types table (matrix) lives on the second step.
+    fireEvent.click(screen.getByRole('button', { name: 'Continue' }));
+
+    // 10 default rows → 10 status dropdowns, each offering Allowed/Disallowed.
+    await waitFor(() => {
+      expect(screen.getAllByTestId('ds-select')).toHaveLength(10);
+    });
+    const selects = screen.getAllByTestId('ds-select') as HTMLSelectElement[];
+    const options = within(selects[0]).getAllByRole('option').map((o) => o.textContent);
+    expect(options).toEqual(['Allowed', 'Disallowed']);
+
+    // First row is pre-filled per the spec.
+    expect(selects[0].value).toBe('Allowed');
+    expect(screen.getByDisplayValue('Individual')).toBeTruthy();
+    expect(screen.getByDisplayValue('Needed by each employee/worker')).toBeTruthy();
+    // A Disallowed default row has a blank justification.
+    expect(screen.getByDisplayValue('Developer')).toBeTruthy();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
index 3c6f32b224..253951df87 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
@@ -64,6 +64,46 @@ function createEmptyMatrixRow(columns: ReadonlyArray<MatrixColumnDefinition>): M
   return Object.fromEntries(columns.map((column) => [column.key, '']));
 }
 
+// A single matrix cell: a dropdown when the column declares `type: 'select'`,
+// otherwise a free-text input.
+function MatrixCellControl({
+  id,
+  column,
+  value,
+  onChange,
+}: {
+  id: string;
+  column: MatrixColumnDefinition;
+  value: string;
+  onChange: (value: string) => void;
+}) {
+  if (column.type === 'select' && column.options) {
+    return (
+      <Select value={value} onValueChange={(next) => onChange(next ?? '')}>
+        <SelectTrigger id={id}>
+          <SelectValue placeholder={column.placeholder ?? 'Select...'} />
+        </SelectTrigger>
+        <SelectContent>
+          {column.options.map((option) => (
+            <SelectItem key={option.value} value={option.value}>
+              {option.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    );
+  }
+
+  return (
+    <Input
+      id={id}
+      value={value}
+      onChange={(event) => onChange(event.target.value)}
+      placeholder={column.placeholder}
+    />
+  );
+}
+
 export function CompanySubmissionWizard({
   organizationId,
   formType,
@@ -150,7 +190,11 @@ export function CompanySubmissionWizard({
     }
 
     for (const matrixField of matrixFields) {
-      defaults[matrixField.key] = [createEmptyMatrixRow(matrixField.columns)];
+      const seedRows = matrixField.defaultRows;
+      defaults[matrixField.key] =
+        seedRows && seedRows.length > 0
+          ? seedRows.map((row) => ({ ...createEmptyMatrixRow(matrixField.columns), ...row }))
+          : [createEmptyMatrixRow(matrixField.columns)];
     }
 
     return defaults;
@@ -783,18 +827,13 @@ export function CompanySubmissionWizard({
                                       {column.description}
                                     </Text>
                                   )}
-                                  <Input
+                                  <MatrixCellControl
                                     id={`${field.key}-${rowIndex}-${column.key}`}
+                                    column={column}
                                     value={row[column.key] ?? ''}
-                                    onChange={(event) =>
-                                      updateMatrixCell(
-                                        field,
-                                        rowIndex,
-                                        column.key,
-                                        event.target.value,
-                                      )
+                                    onChange={(value) =>
+                                      updateMatrixCell(field, rowIndex, column.key, value)
                                     }
-                                    placeholder={column.placeholder}
                                   />
                                 </Field>
                               ))}
@@ -948,13 +987,13 @@ export function CompanySubmissionWizard({
                                   {column.description}
                                 </Text>
                               )}
-                              <Input
+                              <MatrixCellControl
                                 id={`${field.key}-${rowIndex}-${column.key}`}
+                                column={column}
                                 value={row[column.key] ?? ''}
-                                onChange={(event) =>
-                                  updateMatrixCell(field, rowIndex, column.key, event.target.value)
+                                onChange={(value) =>
+                                  updateMatrixCell(field, rowIndex, column.key, value)
                                 }
-                                placeholder={column.placeholder}
                               />
                             </Field>
                           ))}
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
new file mode 100644
index 0000000000..2f703e021b
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest';
+import {
+  evidenceFormDefinitions,
+  evidenceFormSubmissionSchemaMap,
+} from '@/app/(app)/[orgId]/documents/forms';
+
+const schema = evidenceFormSubmissionSchemaMap['account-types'];
+const definition = evidenceFormDefinitions['account-types'];
+
+function submission(rows: Array<Record<string, string>>) {
+  return { submissionDate: '2026-06-10', accountTypeRows: rows };
+}
+
+describe('account-types document type definition', () => {
+  it('has the requested title and intro', () => {
+    expect(definition.title).toBe('New Account Types Submission');
+    expect(definition.description).toBe('Document allowed Account types, with justification.');
+  });
+
+  it('exposes an Allowed/Disallowed dropdown column and a justification column', () => {
+    const matrix = definition.fields.find((f) => f.type === 'matrix');
+    const columns = matrix?.columns ?? [];
+    const status = columns.find((c) => c.key === 'status');
+    expect(status?.type).toBe('select');
+    expect(status?.options?.map((o) => o.value)).toEqual(['Allowed', 'Disallowed']);
+    expect(columns.map((c) => c.key)).toEqual(['accountType', 'status', 'justification']);
+  });
+
+  it('ships the 10 default rows from the spec, pre-filled correctly', () => {
+    const matrix = definition.fields.find((f) => f.type === 'matrix');
+    const rows = matrix?.defaultRows ?? [];
+    expect(rows).toHaveLength(10);
+    expect(rows[0]).toMatchObject({
+      accountType: 'Individual',
+      status: 'Allowed',
+      justification: 'Needed by each employee/worker',
+    });
+    expect(rows.find((r) => r.accountType === 'Developer')).toMatchObject({
+      status: 'Disallowed',
+      justification: '',
+    });
+    // Every Allowed default row carries a justification (so defaults pass validation).
+    for (const row of rows) {
+      if (row.status === 'Allowed') expect(row.justification.trim().length).toBeGreaterThan(0);
+    }
+  });
+});
+
+describe('account-types conditional validation', () => {
+  it('accepts the shipped default rows as-is', () => {
+    const matrix = definition.fields.find((f) => f.type === 'matrix');
+    const rows = [...(matrix?.defaultRows ?? [])];
+    expect(schema.safeParse(submission(rows)).success).toBe(true);
+  });
+
+  it('requires a justification when a row is Allowed', () => {
+    const result = schema.safeParse(
+      submission([{ accountType: 'Contractor', status: 'Allowed', justification: '' }]),
+    );
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const issue = result.error.issues.find((i) => i.path.includes('justification'));
+      expect(issue?.message).toMatch(/justification is required/i);
+    }
+  });
+
+  it('allows a blank justification when a row is Disallowed', () => {
+    const result = schema.safeParse(
+      submission([{ accountType: 'Guest account', status: 'Disallowed', justification: '' }]),
+    );
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects a status that is neither Allowed nor Disallowed', () => {
+    const result = schema.safeParse(
+      submission([{ accountType: 'Weird', status: 'Maybe', justification: '' }]),
+    );
+    expect(result.success).toBe(false);
+  });
+
+  it('requires at least one filled account-type row', () => {
+    const result = schema.safeParse(
+      submission([{ accountType: '', status: '', justification: '' }]),
+    );
+    expect(result.success).toBe(false);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx
index d79da522db..8fe3bfdb16 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/submission-utils.tsx
@@ -98,6 +98,8 @@ export type MatrixColumnDefinition = {
   required?: boolean;
   placeholder?: string;
   description?: string;
+  type?: 'text' | 'select';
+  options?: ReadonlyArray<{ label: string; value: string }>;
 };
 
 export function isMatrixField(
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/documentTypeLabels.ts b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/documentTypeLabels.ts
index 1b79495bab..b18821ee8e 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/documentTypeLabels.ts
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/documentTypeLabels.ts
@@ -19,6 +19,7 @@ export const DOCUMENT_TYPE_LABELS: Record<EvidenceFormType, string> = {
   employee_performance_evaluation: 'Employee Performance Evaluation',
   network_diagram: 'Network Diagram',
   tabletop_exercise: 'Tabletop Exercise',
+  account_types: 'Account Types',
 };
 
 export const ALL_DOCUMENT_TYPES = Object.keys(
diff --git a/apps/framework-editor/app/(pages)/controls/document-type-options.ts b/apps/framework-editor/app/(pages)/controls/document-type-options.ts
index 32b81c582c..9fc037d285 100644
--- a/apps/framework-editor/app/(pages)/controls/document-type-options.ts
+++ b/apps/framework-editor/app/(pages)/controls/document-type-options.ts
@@ -18,6 +18,7 @@ export const DOCUMENT_TYPE_OPTIONS: MultiSelectOption[] = [
   { value: 'tabletop_exercise', label: 'Incident Response Tabletop Exercise', category: 'Security' },
   { value: 'whistleblower_report', label: 'Whistleblower Report', category: 'People' },
   { value: 'employee_performance_evaluation', label: 'Employee Performance Evaluation', category: 'People' },
+  { value: 'account_types', label: 'Account Types', category: 'Security' },
 ];
 
 export function getDocumentTypeLabel(value: string): string {
diff --git a/packages/company/src/evidence-forms/db-form-type-map.ts b/packages/company/src/evidence-forms/db-form-type-map.ts
index 7678aa651b..3713d7ce39 100644
--- a/packages/company/src/evidence-forms/db-form-type-map.ts
+++ b/packages/company/src/evidence-forms/db-form-type-map.ts
@@ -14,6 +14,7 @@ export const EXTERNAL_TO_DB_EVIDENCE_FORM_TYPE = {
   'employee-performance-evaluation': 'employee_performance_evaluation',
   'network-diagram': 'network_diagram',
   'tabletop-exercise': 'tabletop_exercise',
+  'account-types': 'account_types',
 } as const satisfies Record<EvidenceFormType, string>;
 
 export type DbEvidenceFormTypeValue = (typeof EXTERNAL_TO_DB_EVIDENCE_FORM_TYPE)[EvidenceFormType];
@@ -31,6 +32,7 @@ export const DB_TO_EXTERNAL_EVIDENCE_FORM_TYPE = {
   employee_performance_evaluation: 'employee-performance-evaluation',
   network_diagram: 'network-diagram',
   tabletop_exercise: 'tabletop-exercise',
+  account_types: 'account-types',
 } as const satisfies Record<DbEvidenceFormTypeValue, EvidenceFormType>;
 
 export function toDbEvidenceFormTypeValue(formType: EvidenceFormType): DbEvidenceFormTypeValue {
diff --git a/packages/company/src/evidence-forms/definitions.ts b/packages/company/src/evidence-forms/definitions.ts
index 02487f0ed3..334c57c3b3 100644
--- a/packages/company/src/evidence-forms/definitions.ts
+++ b/packages/company/src/evidence-forms/definitions.ts
@@ -583,6 +583,58 @@ Injects: At 10:30, media contacts the company about the incident.`,
       },
     ],
   },
+  'account-types': {
+    type: 'account-types',
+    title: 'New Account Types Submission',
+    description: 'Document allowed Account types, with justification.',
+    category: 'Security',
+    submissionDateMode: 'custom',
+    portalAccessible: false,
+    fields: [
+      {
+        key: 'accountTypeRows',
+        label: 'Account Types',
+        type: 'matrix',
+        required: true,
+        addRowLabel: 'Add account type',
+        columns: [
+          {
+            key: 'accountType',
+            label: 'Account Type',
+            required: true,
+            placeholder: 'e.g. Individual',
+          },
+          {
+            key: 'status',
+            label: 'Allowed / Disallowed',
+            required: true,
+            type: 'select',
+            options: [
+              { label: 'Allowed', value: 'Allowed' },
+              { label: 'Disallowed', value: 'Disallowed' },
+            ],
+          },
+          {
+            key: 'justification',
+            label: 'Justification',
+            placeholder: 'Required when Allowed',
+          },
+        ],
+        defaultRows: [
+          { accountType: 'Individual', status: 'Allowed', justification: 'Needed by each employee/worker' },
+          { accountType: 'System/Sysadmin', status: 'Allowed', justification: 'Required by administrators' },
+          { accountType: 'Developer', status: 'Disallowed', justification: '' },
+          { accountType: 'Service account', status: 'Allowed', justification: 'Needed for background services' },
+          { accountType: 'Shared account', status: 'Disallowed', justification: '' },
+          { accountType: 'Group account', status: 'Disallowed', justification: '' },
+          { accountType: 'Emergency account', status: 'Disallowed', justification: '' },
+          { accountType: 'Anonymous account', status: 'Disallowed', justification: '' },
+          { accountType: 'Temporary account', status: 'Disallowed', justification: '' },
+          { accountType: 'Guest account', status: 'Disallowed', justification: '' },
+        ],
+      },
+    ],
+  },
 };
 
 export const evidenceFormDefinitionList = Object.values(evidenceFormDefinitions);
diff --git a/packages/company/src/evidence-forms/form-types.ts b/packages/company/src/evidence-forms/form-types.ts
index a3ca696c43..fe9cbfb44b 100644
--- a/packages/company/src/evidence-forms/form-types.ts
+++ b/packages/company/src/evidence-forms/form-types.ts
@@ -13,6 +13,7 @@ export const evidenceFormTypeSchema = z.enum([
   'employee-performance-evaluation',
   'network-diagram',
   'tabletop-exercise',
+  'account-types',
 ]);
 
 export type EvidenceFormType = z.infer<typeof evidenceFormTypeSchema>;
diff --git a/packages/company/src/evidence-forms/submission-schemas.ts b/packages/company/src/evidence-forms/submission-schemas.ts
index acda4a4c77..edb34ab61f 100644
--- a/packages/company/src/evidence-forms/submission-schemas.ts
+++ b/packages/company/src/evidence-forms/submission-schemas.ts
@@ -185,6 +185,60 @@ const tabletopExerciseDataSchema = z.object({
   evidenceFile: evidenceFormFileSchema.optional(),
 });
 
+// Lenient row schema so the pre-seeded default rows parse before the
+// superRefine applies the conditional (Allowed ⇒ Justification) rule.
+const accountTypeRowSchemaLenient = z.object({
+  accountType: z.string().default(''),
+  status: z.string().default(''),
+  justification: z.string().default(''),
+});
+
+const accountTypesDataSchema = z
+  .object({
+    submissionDate: required('Submission date'),
+    accountTypeRows: z.array(accountTypeRowSchemaLenient).optional(),
+  })
+  .superRefine((data, ctx) => {
+    const rows = data.accountTypeRows ?? [];
+    const isRowEmpty = (row: { accountType: string; status: string; justification: string }) =>
+      !row.accountType.trim() && !row.status.trim() && !row.justification.trim();
+
+    if (!rows.some((row) => !isRowEmpty(row))) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: 'Add at least one account type',
+        path: ['accountTypeRows'],
+      });
+      return;
+    }
+
+    rows.forEach((row, i) => {
+      if (isRowEmpty(row)) return;
+      if (!row.accountType.trim()) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'Account type is required',
+          path: ['accountTypeRows', i, 'accountType'],
+        });
+      }
+      if (row.status !== 'Allowed' && row.status !== 'Disallowed') {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'Select Allowed or Disallowed',
+          path: ['accountTypeRows', i, 'status'],
+        });
+      }
+      // Conditional rule: justification is mandatory only when Allowed.
+      if (row.status === 'Allowed' && !row.justification.trim()) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: 'Justification is required when the account type is Allowed',
+          path: ['accountTypeRows', i, 'justification'],
+        });
+      }
+    });
+  });
+
 export const evidenceFormSubmissionSchemaMap = {
   meeting: meetingDataSchema,
   'board-meeting': meetingDataSchema,
@@ -198,4 +252,5 @@ export const evidenceFormSubmissionSchemaMap = {
   'employee-performance-evaluation': employeePerformanceEvaluationDataSchema,
   'network-diagram': networkDiagramDataSchema,
   'tabletop-exercise': tabletopExerciseDataSchema,
+  'account-types': accountTypesDataSchema,
 } as const satisfies Record<EvidenceFormType, z.ZodTypeAny>;
diff --git a/packages/company/src/evidence-forms/types.ts b/packages/company/src/evidence-forms/types.ts
index a9cd61b937..c2def72fb4 100644
--- a/packages/company/src/evidence-forms/types.ts
+++ b/packages/company/src/evidence-forms/types.ts
@@ -6,6 +6,10 @@ export type EvidenceFormMatrixColumnDefinition = {
   required?: boolean;
   placeholder?: string;
   description?: string;
+  // Defaults to a free-text input. Set to 'select' to render a dropdown
+  // picklist using `options`.
+  type?: 'text' | 'select';
+  options?: ReadonlyArray<{ label: string; value: string }>;
 };
 
 export type EvidenceFormFieldDefinition = {
@@ -19,6 +23,8 @@ export type EvidenceFormFieldDefinition = {
   accept?: string;
   columns?: ReadonlyArray<EvidenceFormMatrixColumnDefinition>;
   addRowLabel?: string;
+  // Matrix only: rows the form is pre-seeded with (keyed by column key).
+  defaultRows?: ReadonlyArray<Readonly<Record<string, string>>>;
 };
 
 export type EvidenceFormDefinition = {
diff --git a/packages/db/prisma/migrations/20260610133701_add_account_types_evidence_form_type/migration.sql b/packages/db/prisma/migrations/20260610133701_add_account_types_evidence_form_type/migration.sql
new file mode 100644
index 0000000000..a8ba4f31c8
--- /dev/null
+++ b/packages/db/prisma/migrations/20260610133701_add_account_types_evidence_form_type/migration.sql
@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "EvidenceFormType" ADD VALUE 'account-types';
diff --git a/packages/db/prisma/schema/shared.prisma b/packages/db/prisma/schema/shared.prisma
index 279e6a5b6d..0e9fa2ca4c 100644
--- a/packages/db/prisma/schema/shared.prisma
+++ b/packages/db/prisma/schema/shared.prisma
@@ -69,6 +69,7 @@ enum EvidenceFormType {
   employee_performance_evaluation @map("employee-performance-evaluation")
   network_diagram                 @map("network-diagram")
   tabletop_exercise               @map("tabletop-exercise")
+  account_types                   @map("account-types")
 }
 
 model GlobalVendors {

From 680e47d5b86c109d6cbd921868e2e5be70a1d898 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 10 Jun 2026 14:24:01 -0400
Subject: [PATCH 2/5] fix(evidence-forms): mark Account Types optional so it
 doesn't change org scores

The org-wide documents-progress scorers (taskEvidenceDocumentsScore +
frameworks-scores.helper) count every !hidden && !optional form as an
expected document for all orgs. Account Types is NIST-specific, so without
this flag it would add an unsubmitted "outstanding" document to every org and
lower their documents score.

optional: true keeps it out of that global count while leaving it fully
available in the documents UI and linkable to controls; per-control scoring
counts it for any control it is linked to (it reads the control's linked
types, not this flag).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../documents/components/account-types-form.test.ts       | 8 ++++++++
 packages/company/src/evidence-forms/definitions.ts        | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
index 2f703e021b..986e3c1d66 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
@@ -17,6 +17,14 @@ describe('account-types document type definition', () => {
     expect(definition.description).toBe('Document allowed Account types, with justification.');
   });
 
+  it('is optional so it does not change the org-wide expected-documents score', () => {
+    // The global documents-progress scorers count `!hidden && !optional` forms.
+    // Account Types is NIST-specific and must stay out of that count for every
+    // org; it still counts for any control it is explicitly linked to.
+    expect(definition.optional).toBe(true);
+    expect(definition.hidden).toBeFalsy();
+  });
+
   it('exposes an Allowed/Disallowed dropdown column and a justification column', () => {
     const matrix = definition.fields.find((f) => f.type === 'matrix');
     const columns = matrix?.columns ?? [];
diff --git a/packages/company/src/evidence-forms/definitions.ts b/packages/company/src/evidence-forms/definitions.ts
index 334c57c3b3..6ee4ff232a 100644
--- a/packages/company/src/evidence-forms/definitions.ts
+++ b/packages/company/src/evidence-forms/definitions.ts
@@ -590,6 +590,11 @@ Injects: At 10:30, media contacts the company about the incident.`,
     category: 'Security',
     submissionDateMode: 'custom',
     portalAccessible: false,
+    // NIST-specific: relevant only to orgs that link it to a control, so it is
+    // NOT counted in the org-wide "expected documents" score (which would ding
+    // every org). It still appears in the documents UI and counts for any
+    // control it is linked to (per-control scoring uses the linked types).
+    optional: true,
     fields: [
       {
         key: 'accountTypeRows',

From 628b22004905db8aae7651d923182eac4691a5d2 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 10 Jun 2026 14:38:24 -0400
Subject: [PATCH 3/5] fix(evidence-forms): hide Account Types from the global
 Documents browse list

Account Types is NIST-specific. hidden: true keeps it out of every org's
Documents browse list (so non-NIST customers never see it); optional: true
keeps it out of the org-wide expected-documents score. It stays fully usable
where it matters: CS links it to a control in the Framework Editor, and the
customer reaches and submits it from that control's Documents tab (the form
route and per-control scoring use the linked types, not these flags).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../documents/components/account-types-form.test.ts   | 11 ++++++-----
 packages/company/src/evidence-forms/definitions.ts    | 11 +++++++----
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
index 986e3c1d66..727b9ad1f4 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/account-types-form.test.ts
@@ -17,12 +17,13 @@ describe('account-types document type definition', () => {
     expect(definition.description).toBe('Document allowed Account types, with justification.');
   });
 
-  it('is optional so it does not change the org-wide expected-documents score', () => {
-    // The global documents-progress scorers count `!hidden && !optional` forms.
-    // Account Types is NIST-specific and must stay out of that count for every
-    // org; it still counts for any control it is explicitly linked to.
+  it('is hidden + optional so it stays out of the global browse list and scores', () => {
+    // NIST-specific: must not appear in every org's Documents browse list
+    // (hidden) and must not change the org-wide expected-documents score
+    // (the scorers count `!hidden && !optional`). It is still reachable and
+    // counted via any control it is explicitly linked to.
+    expect(definition.hidden).toBe(true);
     expect(definition.optional).toBe(true);
-    expect(definition.hidden).toBeFalsy();
   });
 
   it('exposes an Allowed/Disallowed dropdown column and a justification column', () => {
diff --git a/packages/company/src/evidence-forms/definitions.ts b/packages/company/src/evidence-forms/definitions.ts
index 6ee4ff232a..532e027f9c 100644
--- a/packages/company/src/evidence-forms/definitions.ts
+++ b/packages/company/src/evidence-forms/definitions.ts
@@ -590,10 +590,13 @@ Injects: At 10:30, media contacts the company about the incident.`,
     category: 'Security',
     submissionDateMode: 'custom',
     portalAccessible: false,
-    // NIST-specific: relevant only to orgs that link it to a control, so it is
-    // NOT counted in the org-wide "expected documents" score (which would ding
-    // every org). It still appears in the documents UI and counts for any
-    // control it is linked to (per-control scoring uses the linked types).
+    // NIST-specific: it should not appear in the global Documents browse list
+    // (hidden) and must not affect the org-wide "expected documents" score
+    // (optional). It stays fully usable where it matters: CS links it to a
+    // control in the Framework Editor, and the customer reaches/submits it from
+    // that control's Documents tab (the form route and per-control scoring use
+    // the linked types, not these flags).
+    hidden: true,
     optional: true,
     fields: [
       {

From 2b30fa74b0422505203d9b0b760f02608c64697e Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 10 Jun 2026 14:53:26 -0400
Subject: [PATCH 4/5] fix(framework-editor): default Controls tab to Name A-Z
 sort (CS-511)

The Controls grid initialized its sort state to [] (no sort), so it opened in
arbitrary creation order and reset on every tab switch (the grid remounts per
tab). Default the sort to the Name column ascending so it always opens A-Z,
matching the Requirements tab's existing default-sort behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../controls/ControlsClientPage.sort.test.tsx | 79 +++++++++++++++++++
 .../(pages)/controls/ControlsClientPage.tsx   |  4 +-
 2 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx

diff --git a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx
new file mode 100644
index 0000000000..184103b327
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx
@@ -0,0 +1,79 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+// Stub heavy deps; render each cell's value as text so we can read row order.
+vi.mock('@/app/lib/api-client', () => ({ apiClient: vi.fn() }));
+vi.mock('../../components/AddExistingItemDialog', () => ({ AddExistingItemDialog: () => null }));
+vi.mock('./ManageFamiliesDialog', () => ({ ManageFamiliesDialog: () => null }));
+vi.mock('@trycompai/ui', () => ({
+  Button: ({ children, ...props }: any) => <button {...props}>{children}</button>,
+}));
+vi.mock('../../components/table', () => ({
+  ComboboxCell: () => null,
+  DateCell: () => null,
+  MultiSelectCell: () => null,
+  RelationalCell: () => null,
+  EditableCell: ({ value, columnId }: { value: string | null; columnId: string }) => (
+    <span data-testid={`cell-${columnId}`}>{value}</span>
+  ),
+}));
+
+function gridRow(id: string, name: string) {
+  return {
+    id,
+    name,
+    description: '',
+    controlFamily: null,
+    policyTemplates: [],
+    requirements: [],
+    taskTemplates: [],
+    documentTypes: [],
+    policyTemplatesLength: 0,
+    requirementsLength: 0,
+    taskTemplatesLength: 0,
+    documentTypesLength: 0,
+    createdAt: new Date('2026-01-01'),
+    updatedAt: new Date('2026-01-01'),
+  };
+}
+
+// Rows are returned in deliberately non-alphabetical (creation-ish) order.
+vi.mock('./hooks/useChangeTracking', () => ({
+  simpleUUID: () => 'temp-id',
+  useChangeTracking: () => ({
+    data: [gridRow('c1', 'Zebra control'), gridRow('c2', 'Apple control'), gridRow('c3', 'Mango control')],
+    updateCell: vi.fn(),
+    batchUpdateCells: vi.fn(),
+    updateRelational: vi.fn(),
+    addRow: vi.fn(),
+    deleteRow: vi.fn(),
+    getRowClassName: () => '',
+    handleCommit: vi.fn(),
+    handleCancel: vi.fn(),
+    isDirty: false,
+    createdIds: new Set<string>(),
+    changesSummary: '',
+  }),
+}));
+
+vi.mock('./hooks/useFamiliesManagement', () => ({
+  useFamiliesManagement: () => ({
+    families: [],
+    uniqueFamilies: [],
+    manageFamiliesOpen: false,
+    setManageFamiliesOpen: vi.fn(),
+    handleRenameFamily: vi.fn(),
+    handleDeleteFamily: vi.fn(),
+  }),
+}));
+
+import { ControlsClientPage } from './ControlsClientPage';
+
+describe('ControlsClientPage default sort (CS-511)', () => {
+  it('opens with controls sorted by Name A–Z regardless of input order', () => {
+    render(<ControlsClientPage initialControls={[]} frameworkId="frk_1" />);
+
+    const names = screen.getAllByTestId('cell-name').map((el) => el.textContent);
+    expect(names).toEqual(['Apple control', 'Mango control', 'Zebra control']);
+  });
+});
diff --git a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
index 3e5af15073..c3bc548442 100644
--- a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
+++ b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
@@ -408,7 +408,9 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
     [uniqueFamilies, updateCell, updateRelational, deleteRow, createdIds, handleDocumentTypesUpdate, frameworkId, getRequirementItems],
   );
 
-  const [sorting, setSorting] = useState<SortingState>([]);
+  // Default to Name A–Z so the tab always opens in a predictable order
+  // (the grid remounts on every tab switch, resetting this state).
+  const [sorting, setSorting] = useState<SortingState>([{ id: 'name', desc: false }]);
 
   const table = useReactTable({
     data,

From f60775c0cab4f4aa28c13e18a7ec3ef127c698d0 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Wed, 10 Jun 2026 15:14:38 -0400
Subject: [PATCH 5/5] feat(framework-editor): remove Control Family column from
 Controls tab (CS-512)

Controls are internal and reused across frameworks, so a per-control family
makes no sense on the Controls tab (the family concept lives on Requirements).
Removes the Control Family column plus the now-orphaned Manage Families button,
dialog, and useFamiliesManagement hook (all exclusively served that column).

The controlFamily field is left intact in the grid data and create/update
payloads, so existing values are preserved and nothing downstream breaks; it is
simply no longer shown or editable on this tab.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../controls/ControlsClientPage.sort.test.tsx |  25 +-
 .../(pages)/controls/ControlsClientPage.tsx   |  49 +---
 .../controls/DeleteFamilyConfirmation.tsx     | 118 ---------
 .../(pages)/controls/ManageFamiliesDialog.tsx | 236 ------------------
 .../controls/hooks/useFamiliesManagement.ts   |  96 -------
 5 files changed, 12 insertions(+), 512 deletions(-)
 delete mode 100644 apps/framework-editor/app/(pages)/controls/DeleteFamilyConfirmation.tsx
 delete mode 100644 apps/framework-editor/app/(pages)/controls/ManageFamiliesDialog.tsx
 delete mode 100644 apps/framework-editor/app/(pages)/controls/hooks/useFamiliesManagement.ts

diff --git a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx
index 184103b327..4df0af9259 100644
--- a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx
+++ b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.sort.test.tsx
@@ -4,12 +4,10 @@ import { describe, expect, it, vi } from 'vitest';
 // Stub heavy deps; render each cell's value as text so we can read row order.
 vi.mock('@/app/lib/api-client', () => ({ apiClient: vi.fn() }));
 vi.mock('../../components/AddExistingItemDialog', () => ({ AddExistingItemDialog: () => null }));
-vi.mock('./ManageFamiliesDialog', () => ({ ManageFamiliesDialog: () => null }));
 vi.mock('@trycompai/ui', () => ({
   Button: ({ children, ...props }: any) => <button {...props}>{children}</button>,
 }));
 vi.mock('../../components/table', () => ({
-  ComboboxCell: () => null,
   DateCell: () => null,
   MultiSelectCell: () => null,
   RelationalCell: () => null,
@@ -56,24 +54,21 @@ vi.mock('./hooks/useChangeTracking', () => ({
   }),
 }));
 
-vi.mock('./hooks/useFamiliesManagement', () => ({
-  useFamiliesManagement: () => ({
-    families: [],
-    uniqueFamilies: [],
-    manageFamiliesOpen: false,
-    setManageFamiliesOpen: vi.fn(),
-    handleRenameFamily: vi.fn(),
-    handleDeleteFamily: vi.fn(),
-  }),
-}));
-
 import { ControlsClientPage } from './ControlsClientPage';
 
-describe('ControlsClientPage default sort (CS-511)', () => {
-  it('opens with controls sorted by Name A–Z regardless of input order', () => {
+describe('ControlsClientPage', () => {
+  it('opens with controls sorted by Name A–Z regardless of input order (CS-511)', () => {
     render(<ControlsClientPage initialControls={[]} frameworkId="frk_1" />);
 
     const names = screen.getAllByTestId('cell-name').map((el) => el.textContent);
     expect(names).toEqual(['Apple control', 'Mango control', 'Zebra control']);
   });
+
+  it('does not render the Control Family column or Manage Families control (CS-512)', () => {
+    render(<ControlsClientPage initialControls={[]} frameworkId="frk_1" />);
+
+    expect(screen.queryAllByTestId('cell-controlFamily')).toHaveLength(0);
+    expect(screen.queryByText('Control Family')).toBeNull();
+    expect(screen.queryByText('Manage Families')).toBeNull();
+  });
 });
diff --git a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
index c3bc548442..53797a68c9 100644
--- a/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
+++ b/apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx
@@ -10,16 +10,14 @@ import {
   type SortingState,
 } from '@tanstack/react-table';
 import { Button } from '@trycompai/ui';
-import { ArrowDown, ArrowUp, ArrowUpDown, Link, Plus, Settings, Trash2 } from 'lucide-react';
+import { ArrowDown, ArrowUp, ArrowUpDown, Link, Plus, Trash2 } from 'lucide-react';
 import { useCallback, useMemo, useState } from 'react';
 import {
   AddExistingItemDialog,
   type ExistingItemRaw,
 } from '../../components/AddExistingItemDialog';
 import type { RequirementOption } from '../../components/ControlRequirementSelect';
-import { ManageFamiliesDialog } from './ManageFamiliesDialog';
 import {
-  ComboboxCell,
   DateCell,
   EditableCell,
   MultiSelectCell,
@@ -28,7 +26,6 @@ import {
 } from '../../components/table';
 import { DOCUMENT_TYPE_OPTIONS } from './document-type-options';
 import { simpleUUID, useChangeTracking, type ControlMutations } from './hooks/useChangeTracking';
-import { useFamiliesManagement } from './hooks/useFamiliesManagement';
 import type { ControlsPageGridData, FrameworkEditorControlTemplateWithRelatedData } from './types';
 
 interface RequirementApiItem {
@@ -193,7 +190,6 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
   const {
     data,
     updateCell,
-    batchUpdateCells,
     updateRelational,
     addRow,
     deleteRow,
@@ -207,15 +203,6 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
     requireRequirementLink: !!frameworkId,
   });
 
-  const {
-    families,
-    uniqueFamilies,
-    manageFamiliesOpen,
-    setManageFamiliesOpen,
-    handleRenameFamily,
-    handleDeleteFamily,
-  } = useFamiliesManagement({ data, batchUpdateCells });
-
   const handleDocumentTypesUpdate = useCallback(
     (rowId: string, values: string[]) => {
       updateCell(rowId, 'documentTypes', values);
@@ -258,20 +245,6 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
           />
         ),
       }),
-      columnHelper.accessor('controlFamily', {
-        header: 'Control Family',
-        size: 200,
-        cell: ({ row, getValue }) => (
-          <ComboboxCell
-            value={getValue()}
-            rowId={row.original.id}
-            columnId="controlFamily"
-            options={uniqueFamilies}
-            onUpdate={updateCell}
-            placeholder="Select family..."
-          />
-        ),
-      }),
       columnHelper.accessor('policyTemplates', {
         header: 'Linked Policies',
         size: 220,
@@ -405,7 +378,7 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
         ),
       }),
     ],
-    [uniqueFamilies, updateCell, updateRelational, deleteRow, createdIds, handleDocumentTypesUpdate, frameworkId, getRequirementItems],
+    [updateCell, updateRelational, deleteRow, createdIds, handleDocumentTypesUpdate, frameworkId, getRequirementItems],
   );
 
   // Default to Name A–Z so the tab always opens in a predictable order
@@ -470,17 +443,6 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
           )}
         </div>
         <div className="flex items-center gap-2">
-          {families.length > 0 && (
-            <Button
-              variant="outline"
-              onClick={() => setManageFamiliesOpen(true)}
-              size="sm"
-              className="rounded-xs"
-            >
-              <Settings className="mr-1 h-4 w-4" />
-              Manage Families
-            </Button>
-          )}
           {frameworkId && (
             <Button
               variant="outline"
@@ -511,13 +473,6 @@ export function ControlsClientPage({ initialControls, emptyMessage, frameworkId
         />
       )}
 
-      <ManageFamiliesDialog
-        open={manageFamiliesOpen}
-        onOpenChange={setManageFamiliesOpen}
-        families={families}
-        onRename={handleRenameFamily}
-        onDelete={handleDeleteFamily}
-      />
 
       <div className="scrollbar-primary border-border min-h-0 flex-1 overflow-auto rounded-xs border">
         <table className="w-full border-collapse">
diff --git a/apps/framework-editor/app/(pages)/controls/DeleteFamilyConfirmation.tsx b/apps/framework-editor/app/(pages)/controls/DeleteFamilyConfirmation.tsx
deleted file mode 100644
index 7ccb8b62f6..0000000000
--- a/apps/framework-editor/app/(pages)/controls/DeleteFamilyConfirmation.tsx
+++ /dev/null
@@ -1,118 +0,0 @@
-'use client';
-
-import { ChevronDown, ChevronRight } from 'lucide-react';
-import { useMemo, useState } from 'react';
-import type { FamilyInfo } from './ManageFamiliesDialog';
-
-const PREVIEW_LIMIT = 10;
-
-export function DeleteFamilyConfirmation({
-  family,
-  onConfirm,
-  onCancel,
-}: {
-  family: FamilyInfo;
-  onConfirm: () => void;
-  onCancel: () => void;
-}) {
-  const [showDetails, setShowDetails] = useState(false);
-  const [confirmedOnce, setConfirmedOnce] = useState(false);
-  const count = family.controls.length;
-
-  const affectedFrameworks = useMemo(() => {
-    const fws = new Set<string>();
-    for (const c of family.controls) {
-      for (const fw of c.frameworks) fws.add(fw);
-    }
-    return [...fws].sort();
-  }, [family.controls]);
-
-  const preview = family.controls.slice(0, PREVIEW_LIMIT);
-  const remaining = count - PREVIEW_LIMIT;
-
-  return (
-    <div className="space-y-3 rounded-lg border border-destructive/20 bg-destructive/5 p-4">
-      <div>
-        <p className="text-destructive text-sm font-medium">
-          Remove &ldquo;{family.name}&rdquo;?
-        </p>
-        <p className="text-muted-foreground mt-1 text-xs">
-          This will ungroup {count} control{count !== 1 ? 's' : ''}.
-          {affectedFrameworks.length > 0 && (
-            <> Affects {affectedFrameworks.join(', ')}.</>
-          )}
-        </p>
-      </div>
-
-      {count > 0 && (
-        <div>
-          <button
-            type="button"
-            className="text-muted-foreground hover:text-foreground flex items-center gap-1 text-xs"
-            onClick={() => setShowDetails((prev) => !prev)}
-          >
-            {showDetails ? (
-              <ChevronDown className="h-3 w-3" />
-            ) : (
-              <ChevronRight className="h-3 w-3" />
-            )}
-            {count} affected control{count !== 1 ? 's' : ''}
-          </button>
-          {showDetails && (
-            <ul className="mt-1.5 max-h-36 space-y-px overflow-y-auto rounded border border-border bg-background px-3 py-2">
-              {preview.map((c) => (
-                <li key={c.id} className="text-muted-foreground truncate text-xs">
-                  {c.name || 'Unnamed control'}
-                </li>
-              ))}
-              {remaining > 0 && (
-                <li className="text-muted-foreground/60 mt-0.5 text-xs">
-                  + {remaining} more
-                </li>
-              )}
-            </ul>
-          )}
-        </div>
-      )}
-
-      <div className="flex items-center gap-2">
-        {confirmedOnce ? (
-          <>
-            <span className="text-destructive text-xs font-medium">Are you sure?</span>
-            <button
-              type="button"
-              onClick={onConfirm}
-              className="bg-destructive text-destructive-foreground rounded px-3 py-1.5 text-xs font-medium transition-colors hover:opacity-90"
-            >
-              Yes, remove
-            </button>
-            <button
-              type="button"
-              onClick={() => setConfirmedOnce(false)}
-              className="text-muted-foreground hover:text-foreground rounded px-3 py-1.5 text-xs transition-colors"
-            >
-              No
-            </button>
-          </>
-        ) : (
-          <>
-            <button
-              type="button"
-              onClick={() => setConfirmedOnce(true)}
-              className="bg-destructive text-destructive-foreground rounded px-3 py-1.5 text-xs font-medium transition-colors hover:opacity-90"
-            >
-              Remove family
-            </button>
-            <button
-              type="button"
-              onClick={onCancel}
-              className="text-muted-foreground hover:text-foreground rounded px-3 py-1.5 text-xs transition-colors"
-            >
-              Cancel
-            </button>
-          </>
-        )}
-      </div>
-    </div>
-  );
-}
diff --git a/apps/framework-editor/app/(pages)/controls/ManageFamiliesDialog.tsx b/apps/framework-editor/app/(pages)/controls/ManageFamiliesDialog.tsx
deleted file mode 100644
index 5626fc8044..0000000000
--- a/apps/framework-editor/app/(pages)/controls/ManageFamiliesDialog.tsx
+++ /dev/null
@@ -1,236 +0,0 @@
-'use client';
-
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle,
-} from '@trycompai/design-system';
-import { Check, Pencil, Search, Trash2, X } from 'lucide-react';
-import { useCallback, useMemo, useState } from 'react';
-import { DeleteFamilyConfirmation } from './DeleteFamilyConfirmation';
-
-export interface FamilyInfo {
-  name: string;
-  controls: Array<{ id: string; name: string | null; frameworks: string[] }>;
-}
-
-interface ManageFamiliesDialogProps {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-  families: FamilyInfo[];
-  onRename: (oldName: string, newName: string) => void;
-  onDelete: (familyName: string) => void;
-}
-
-export function ManageFamiliesDialog({
-  open,
-  onOpenChange,
-  families,
-  onRename,
-  onDelete,
-}: ManageFamiliesDialogProps) {
-  const [searchTerm, setSearchTerm] = useState('');
-  const [editingFamily, setEditingFamily] = useState<string | null>(null);
-  const [editValue, setEditValue] = useState('');
-  const [deletingFamily, setDeletingFamily] = useState<string | null>(null);
-
-  const filteredFamilies = useMemo(() => {
-    if (!searchTerm.trim()) return families;
-    const lower = searchTerm.toLowerCase();
-    return families.filter((f) => f.name.toLowerCase().includes(lower));
-  }, [families, searchTerm]);
-
-  const handleStartEdit = useCallback((familyName: string) => {
-    setEditingFamily(familyName);
-    setEditValue(familyName);
-    setDeletingFamily(null);
-  }, []);
-
-  const handleConfirmEdit = useCallback(() => {
-    if (!editingFamily) return;
-    const trimmed = editValue.trim();
-    if (trimmed && trimmed !== editingFamily) {
-      onRename(editingFamily, trimmed);
-    }
-    setEditingFamily(null);
-    setEditValue('');
-  }, [editingFamily, editValue, onRename]);
-
-  const handleCancelEdit = useCallback(() => {
-    setEditingFamily(null);
-    setEditValue('');
-  }, []);
-
-  const handleStartDelete = useCallback((familyName: string) => {
-    setDeletingFamily(familyName);
-    setEditingFamily(null);
-  }, []);
-
-  const handleConfirmDelete = useCallback(() => {
-    if (!deletingFamily) return;
-    onDelete(deletingFamily);
-    setDeletingFamily(null);
-  }, [deletingFamily, onDelete]);
-
-  const handleCancelDelete = useCallback(() => {
-    setDeletingFamily(null);
-  }, []);
-
-  const handleKeyDown = useCallback(
-    (e: React.KeyboardEvent) => {
-      if (e.key === 'Enter') {
-        handleConfirmEdit();
-      } else if (e.key === 'Escape') {
-        handleCancelEdit();
-      }
-    },
-    [handleConfirmEdit, handleCancelEdit],
-  );
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent size="lg" showCloseButton={false}>
-        <DialogHeader>
-          <DialogTitle>Manage Control Families</DialogTitle>
-          <DialogDescription>
-            Rename or remove control families. Changes apply to all controls using that family.
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="border-border flex items-center rounded-md border px-3 py-2">
-          <Search className="text-muted-foreground mr-2 h-4 w-4 shrink-0" />
-          <input
-            type="text"
-            value={searchTerm}
-            onChange={(e) => setSearchTerm(e.target.value)}
-            placeholder="Search families..."
-            className="w-full bg-transparent text-sm outline-none"
-          />
-        </div>
-
-        <div className="max-h-80 space-y-1 overflow-y-auto">
-          {filteredFamilies.map((family) => (
-            <FamilyRow
-              key={family.name}
-              family={family}
-              isEditing={editingFamily === family.name}
-              isDeleting={deletingFamily === family.name}
-              editValue={editValue}
-              onEditValueChange={setEditValue}
-              onStartEdit={handleStartEdit}
-              onConfirmEdit={handleConfirmEdit}
-              onCancelEdit={handleCancelEdit}
-              onStartDelete={handleStartDelete}
-              onConfirmDelete={handleConfirmDelete}
-              onCancelDelete={handleCancelDelete}
-              onKeyDown={handleKeyDown}
-            />
-          ))}
-          {filteredFamilies.length === 0 && (
-            <p className="text-muted-foreground py-6 text-center text-sm">
-              {families.length === 0 ? 'No control families found.' : 'No matching families.'}
-            </p>
-          )}
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}
-
-interface FamilyRowProps {
-  family: FamilyInfo;
-  isEditing: boolean;
-  isDeleting: boolean;
-  editValue: string;
-  onEditValueChange: (value: string) => void;
-  onStartEdit: (name: string) => void;
-  onConfirmEdit: () => void;
-  onCancelEdit: () => void;
-  onStartDelete: (name: string) => void;
-  onConfirmDelete: () => void;
-  onCancelDelete: () => void;
-  onKeyDown: (e: React.KeyboardEvent) => void;
-}
-
-function FamilyRow({
-  family,
-  isEditing,
-  isDeleting,
-  editValue,
-  onEditValueChange,
-  onStartEdit,
-  onConfirmEdit,
-  onCancelEdit,
-  onStartDelete,
-  onConfirmDelete,
-  onCancelDelete,
-  onKeyDown,
-}: FamilyRowProps) {
-  if (isEditing) {
-    return (
-      <div className="flex items-center gap-2 rounded px-2 py-1.5">
-        <input
-          type="text"
-          value={editValue}
-          onChange={(e) => onEditValueChange(e.target.value)}
-          onKeyDown={onKeyDown}
-          className="border-border bg-background flex-1 rounded border px-2 py-1 text-sm"
-          autoFocus
-        />
-        <button
-          type="button"
-          onClick={onConfirmEdit}
-          className="text-muted-foreground hover:text-foreground rounded p-1 transition-colors"
-        >
-          <Check className="h-4 w-4" />
-        </button>
-        <button
-          type="button"
-          onClick={onCancelEdit}
-          className="text-muted-foreground hover:text-foreground rounded p-1 transition-colors"
-        >
-          <X className="h-4 w-4" />
-        </button>
-      </div>
-    );
-  }
-
-  if (isDeleting) {
-    return (
-      <DeleteFamilyConfirmation
-        family={family}
-        onConfirm={onConfirmDelete}
-        onCancel={onCancelDelete}
-      />
-    );
-  }
-
-  return (
-    <div className="hover:bg-muted/50 group flex items-center justify-between rounded px-2 py-1.5">
-      <div className="min-w-0 flex-1">
-        <span className="text-sm">{family.name}</span>
-        <span className="text-muted-foreground ml-2 text-xs">
-          Used by {family.controls.length} control{family.controls.length !== 1 ? 's' : ''}
-        </span>
-      </div>
-      <div className="flex items-center gap-1 opacity-0 group-hover:opacity-100">
-        <button
-          type="button"
-          onClick={() => onStartEdit(family.name)}
-          className="text-muted-foreground hover:text-foreground rounded p-1 transition-colors"
-        >
-          <Pencil className="h-3.5 w-3.5" />
-        </button>
-        <button
-          type="button"
-          onClick={() => onStartDelete(family.name)}
-          className="text-muted-foreground hover:text-destructive rounded p-1 transition-colors"
-        >
-          <Trash2 className="h-3.5 w-3.5" />
-        </button>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/framework-editor/app/(pages)/controls/hooks/useFamiliesManagement.ts b/apps/framework-editor/app/(pages)/controls/hooks/useFamiliesManagement.ts
deleted file mode 100644
index 017786399d..0000000000
--- a/apps/framework-editor/app/(pages)/controls/hooks/useFamiliesManagement.ts
+++ /dev/null
@@ -1,96 +0,0 @@
-import { useCallback, useMemo, useState } from 'react';
-import type { ControlsPageGridData } from '../types';
-
-interface FamilyControl {
-  id: string;
-  name: string | null;
-  frameworks: string[];
-}
-
-interface Family {
-  name: string;
-  controls: FamilyControl[];
-}
-
-interface UseFamiliesManagementParams {
-  data: ControlsPageGridData[];
-  batchUpdateCells: (updates: Array<{ rowId: string; columnId: string; value: string | string[] | null }>) => void;
-}
-
-interface UseFamiliesManagementReturn {
-  families: Family[];
-  uniqueFamilies: string[];
-  manageFamiliesOpen: boolean;
-  setManageFamiliesOpen: (open: boolean) => void;
-  handleRenameFamily: (oldName: string, newName: string) => void;
-  handleDeleteFamily: (familyName: string) => void;
-}
-
-export function useFamiliesManagement({
-  data,
-  batchUpdateCells,
-}: UseFamiliesManagementParams): UseFamiliesManagementReturn {
-  const [manageFamiliesOpen, setManageFamiliesOpen] = useState(false);
-
-  const families = useMemo(() => {
-    const familyMap = new Map<string, FamilyControl[]>();
-    for (const row of data) {
-      if (row.controlFamily) {
-        const controls = familyMap.get(row.controlFamily) ?? [];
-        const frameworks = [
-          ...new Set(
-            row.requirements
-              .map((r) => r.sublabel)
-              .filter((s): s is string => s != null && s !== ''),
-          ),
-        ];
-        controls.push({ id: row.id, name: row.name, frameworks });
-        familyMap.set(row.controlFamily, controls);
-      }
-    }
-    return [...familyMap.entries()]
-      .map(([name, controls]) => ({ name, controls }))
-      .sort((a, b) => a.name.localeCompare(b.name));
-  }, [data]);
-
-  const uniqueFamilies = useMemo(
-    () =>
-      [
-        ...new Set(
-          data
-            .map((r) => r.controlFamily)
-            .filter((f): f is string => f != null && f !== ''),
-        ),
-      ].sort(),
-    [data],
-  );
-
-  const handleRenameFamily = useCallback(
-    (oldName: string, newName: string) => {
-      const updates = data
-        .filter((row) => row.controlFamily === oldName)
-        .map((row) => ({ rowId: row.id, columnId: 'controlFamily', value: newName }));
-      batchUpdateCells(updates);
-    },
-    [data, batchUpdateCells],
-  );
-
-  const handleDeleteFamily = useCallback(
-    (familyName: string) => {
-      const updates = data
-        .filter((row) => row.controlFamily === familyName)
-        .map((row) => ({ rowId: row.id, columnId: 'controlFamily', value: null as null }));
-      batchUpdateCells(updates);
-    },
-    [data, batchUpdateCells],
-  );
-
-  return {
-    families,
-    uniqueFamilies,
-    manageFamiliesOpen,
-    setManageFamiliesOpen,
-    handleRenameFamily,
-    handleDeleteFamily,
-  };
-}