diff --git a/src/components/forms/LinksEditor.vue b/src/components/forms/LinksEditor.vue
new file mode 100644
index 00000000..6f247748
--- /dev/null
+++ b/src/components/forms/LinksEditor.vue
@@ -0,0 +1,87 @@
+<template>
+  <div class="space-y-3">
+    <div
+      v-for="(link, index) in model"
+      :key="index"
+      class="rounded-md border border-ccf-300 p-3 dark:border-slate-700"
+    >
+      <div class="flex items-start justify-between gap-2">
+        <div class="grid flex-1 grid-cols-1 gap-3 md:grid-cols-2">
+          <div class="md:col-span-2">
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Href
+            </label>
+            <InputText
+              v-model="link.href"
+              placeholder="URL or #resource reference"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Rel
+            </label>
+            <InputText
+              v-model="link.rel"
+              placeholder="Relationship (e.g. reference)"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Text
+            </label>
+            <InputText
+              v-model="link.text"
+              placeholder="Display text"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+        </div>
+        <TertiaryButton
+          type="button"
+          class="px-1!"
+          :aria-label="`Remove link ${index + 1}`"
+          @click="remove(index)"
+        >
+          <BIconX />
+        </TertiaryButton>
+      </div>
+    </div>
+
+    <p v-if="!model.length" class="text-sm text-gray-600 dark:text-slate-400">
+      No links added.
+    </p>
+
+    <SecondaryButton size="small" type="button" @click="add">
+      Add Link
+    </SecondaryButton>
+  </div>
+</template>
+
+<script setup lang="ts">
+import type { Link } from '@/oscal';
+import InputText from '@/volt/InputText.vue';
+import SecondaryButton from '@/volt/SecondaryButton.vue';
+import TertiaryButton from '@/volt/TertiaryButton.vue';
+import { BIconX } from 'bootstrap-icons-vue';
+
+const model = defineModel<Link[]>({ required: true });
+
+function add() {
+  model.value = [...model.value, { href: '' }];
+}
+
+function remove(index: number) {
+  model.value = model.value.filter((_, i) => i !== index);
+}
+</script>
diff --git a/src/components/forms/PropsEditor.vue b/src/components/forms/PropsEditor.vue
new file mode 100644
index 00000000..220170f2
--- /dev/null
+++ b/src/components/forms/PropsEditor.vue
@@ -0,0 +1,100 @@
+<template>
+  <div class="space-y-3">
+    <div
+      v-for="(prop, index) in model"
+      :key="index"
+      class="rounded-md border border-ccf-300 p-3 dark:border-slate-700"
+    >
+      <div class="flex items-start justify-between gap-2">
+        <div class="grid flex-1 grid-cols-1 gap-3 md:grid-cols-2">
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Name
+            </label>
+            <InputText
+              v-model="prop.name"
+              placeholder="Property name"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Value
+            </label>
+            <InputText
+              v-model="prop.value"
+              placeholder="Property value"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Class
+            </label>
+            <InputText
+              v-model="prop.class"
+              placeholder="Optional class"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Remarks
+            </label>
+            <InputText
+              v-model="prop.remarks"
+              placeholder="Optional remarks"
+              size="small"
+              class="mt-1 w-full"
+            />
+          </div>
+        </div>
+        <TertiaryButton
+          type="button"
+          class="px-1!"
+          :aria-label="`Remove property ${index + 1}`"
+          @click="remove(index)"
+        >
+          <BIconX />
+        </TertiaryButton>
+      </div>
+    </div>
+
+    <p v-if="!model.length" class="text-sm text-gray-600 dark:text-slate-400">
+      No properties added.
+    </p>
+
+    <SecondaryButton size="small" type="button" @click="add">
+      Add Property
+    </SecondaryButton>
+  </div>
+</template>
+
+<script setup lang="ts">
+import type { Property } from '@/oscal';
+import InputText from '@/volt/InputText.vue';
+import SecondaryButton from '@/volt/SecondaryButton.vue';
+import TertiaryButton from '@/volt/TertiaryButton.vue';
+import { BIconX } from 'bootstrap-icons-vue';
+
+const model = defineModel<Property[]>({ required: true });
+
+function add() {
+  model.value = [...model.value, { name: '', value: '' }];
+}
+
+function remove(index: number) {
+  model.value = model.value.filter((_, i) => i !== index);
+}
+</script>
diff --git a/src/components/lineage/__tests__/nodeMeta.spec.ts b/src/components/lineage/__tests__/nodeMeta.spec.ts
index 7111a0b6..8785212f 100644
--- a/src/components/lineage/__tests__/nodeMeta.spec.ts
+++ b/src/components/lineage/__tests__/nodeMeta.spec.ts
@@ -242,6 +242,27 @@ describe('nodeDetailRoute', () => {
     ).toEqual({ name: 'risks:detail', params: { riskId: 'r-2' } });
   });
 
+  it('routes risk nodes to the SSP-scoped detail route when an sspId is given', () => {
+    expect(
+      nodeDetailRoute(base({ nodeType: 'risk', riskId: 'r-1' }), 'ssp-1'),
+    ).toEqual({
+      name: 'system-security-plan-risk-detail',
+      params: { id: 'ssp-1', riskId: 'r-1' },
+    });
+  });
+
+  it("prefers the risk node's own sspId over the active scope sspId", () => {
+    expect(
+      nodeDetailRoute(
+        base({ nodeType: 'risk', riskId: 'r-1', sspId: 'ssp-own' }),
+        'ssp-scope',
+      ),
+    ).toEqual({
+      name: 'system-security-plan-risk-detail',
+      params: { id: 'ssp-own', riskId: 'r-1' },
+    });
+  });
+
   it('routes evidence nodes to evidence:view with the evidenceId', () => {
     expect(
       nodeDetailRoute(base({ nodeType: 'evidence', evidenceId: 'e-1' })),
diff --git a/src/components/lineage/nodeMeta.ts b/src/components/lineage/nodeMeta.ts
index 3321f4e9..375cdbf4 100644
--- a/src/components/lineage/nodeMeta.ts
+++ b/src/components/lineage/nodeMeta.ts
@@ -429,10 +429,22 @@ function idFromKey(key: string): string {
  */
 export function nodeDetailRoute(
   node: LineageNode,
+  sspId?: string | null,
 ): { name: string; params: Record<string, string> } | null {
   if (node.nodeType === 'risk') {
     const riskId = node.riskId || idFromKey(node.key);
-    return riskId ? { name: 'risks:detail', params: { riskId } } : null;
+    if (!riskId) return null;
+    // Prefer the risk's own SSP: a lineage view scoped to one SSP can still
+    // render cross-SSP risks, so routing by the active scope would open the
+    // wrong SSP's context. Fall back to the active scope, then to the unscoped
+    // detail route when neither is known.
+    const targetSspId = node.sspId || sspId;
+    return targetSspId
+      ? {
+          name: 'system-security-plan-risk-detail',
+          params: { id: targetSspId, riskId },
+        }
+      : { name: 'risks:detail', params: { riskId } };
   }
   if (node.nodeType === 'evidence') {
     // The evidence key holds the *stream* uuid, not the record id — only
diff --git a/src/components/risk/RiskCreateForm.vue b/src/components/risk/RiskCreateForm.vue
index d21c6ab7..2652026c 100644
--- a/src/components/risk/RiskCreateForm.vue
+++ b/src/components/risk/RiskCreateForm.vue
@@ -102,6 +102,49 @@
         </select>
       </div>
 
+      <div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
+        <div>
+          <label
+            class="block text-sm font-medium text-gray-700 dark:text-slate-400 mb-1"
+          >
+            Likelihood
+          </label>
+          <select
+            v-model="formData.likelihood"
+            class="w-full px-3 py-2 border border-gray-300 dark:border-slate-600 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 dark:bg-slate-800 dark:text-slate-300"
+          >
+            <option value="">Not set</option>
+            <option
+              v-for="level in riskLevelOptions"
+              :key="`likelihood-${level.value}`"
+              :value="level.value"
+            >
+              {{ level.label }}
+            </option>
+          </select>
+        </div>
+        <div>
+          <label
+            class="block text-sm font-medium text-gray-700 dark:text-slate-400 mb-1"
+          >
+            Impact
+          </label>
+          <select
+            v-model="formData.impact"
+            class="w-full px-3 py-2 border border-gray-300 dark:border-slate-600 rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 dark:bg-slate-800 dark:text-slate-300"
+          >
+            <option value="">Not set</option>
+            <option
+              v-for="level in riskLevelOptions"
+              :key="`impact-${level.value}`"
+              :value="level.value"
+            >
+              {{ level.label }}
+            </option>
+          </select>
+        </div>
+      </div>
+
       <div
         class="rounded-md border border-ccf-300 dark:border-slate-700 bg-gray-50 dark:bg-slate-900 p-4"
       >
@@ -263,7 +306,9 @@ const props = defineProps<{
 
 const emit = defineEmits<{
   cancel: [];
-  created: [risk: Risk];
+  // The SSP-scoped register create responds with a register risk carrying an
+  // `id`; the plain OSCAL create does not, hence the optional field.
+  created: [risk: Risk & { id?: string }];
 }>();
 
 const toast = useToast();
@@ -276,6 +321,14 @@ const riskStatusOptions = [
   { value: 'closed', label: 'Closed' },
 ];
 
+const riskLevelOptions = [
+  { value: 'negligible', label: 'Negligible' },
+  { value: 'low', label: 'Low' },
+  { value: 'moderate', label: 'Moderate' },
+  { value: 'high', label: 'High' },
+  { value: 'critical', label: 'Critical' },
+];
+
 const riskContext = computed<RiskContext | null>(() => {
   if (props.sspId) {
     return {
@@ -332,9 +385,20 @@ const formData = reactive({
   description: '',
   statement: '',
   status: '',
+  likelihood: '',
+  impact: '',
   deadline: '',
   remarks: '',
 });
+
+function normalizeRiskLevel(value?: string | null): string {
+  const normalized = value?.trim().toLowerCase();
+  if (!normalized) return '';
+  const canonical = normalized === 'medium' ? 'moderate' : normalized;
+  return riskLevelOptions.some((level) => level.value === canonical)
+    ? canonical
+    : '';
+}
 const showTemplateSelector = ref(false);
 const selectedTemplate = ref<RiskTemplate | null>(null);
 const selectedTemplateName = ref('');
@@ -488,6 +552,8 @@ function applyTemplate(template: RiskTemplate) {
   formData.title = template.title;
   formData.description = statement;
   formData.statement = statement;
+  formData.likelihood = normalizeRiskLevel(template.likelihoodHint);
+  formData.impact = normalizeRiskLevel(template.impactHint);
   selectedTemplate.value = template;
 
   const templateRemarks = buildTemplateRemarks(template);
@@ -579,8 +645,8 @@ async function submit() {
       description: formData.description,
       statement: formData.statement,
       status: formData.status,
-      likelihood: toOptionalString(selectedTemplate.value?.likelihoodHint),
-      impact: toOptionalString(selectedTemplate.value?.impactHint),
+      likelihood: toOptionalString(formData.likelihood),
+      impact: toOptionalString(formData.impact),
       threatIds: selectedTemplate.value
         ? getThreatIdsFromTemplate(selectedTemplate.value)
         : undefined,
diff --git a/src/composables/useLineage/fixtures.ts b/src/composables/useLineage/fixtures.ts
index 3ee05378..b55496a3 100644
--- a/src/composables/useLineage/fixtures.ts
+++ b/src/composables/useLineage/fixtures.ts
@@ -426,6 +426,8 @@ const riskCredLeak = node({
   likelihood: 'likely',
   impact: 'high',
   linkedEvidenceCount: 2,
+  sspId: 'demo-ssp-acme',
+  sspTitle: 'Acme Production',
   reviewDeadline: '2026-08-15T00:00:00Z',
   firstSeenAt: '2026-05-02T00:00:00Z',
   lastSeenAt: '2026-07-01T00:00:00Z',
@@ -455,6 +457,8 @@ const riskStaleAccess = node({
   likelihood: 'possible',
   impact: 'critical',
   linkedEvidenceCount: 0,
+  sspId: 'demo-ssp-globex',
+  sspTitle: 'Globex Staging',
   risk: {
     openScoreSum: 42,
     mutedScoreSum: 0,
diff --git a/src/composables/useLineage/types.ts b/src/composables/useLineage/types.ts
index 051c2ba1..fc0f9343 100644
--- a/src/composables/useLineage/types.ts
+++ b/src/composables/useLineage/types.ts
@@ -138,6 +138,9 @@ export interface LineageNode {
   lastReviewedAt?: string;
   firstSeenAt?: string;
   lastSeenAt?: string;
+  /** The single SSP this risk belongs to (risks always have exactly one). */
+  sspId?: string;
+  sspTitle?: string;
 
   // --- evidence nodes (nodeType === 'evidence') ---
   evidenceId?: string;
diff --git a/src/views/evidence/CreateView.vue b/src/views/evidence/CreateView.vue
index 3e01aea9..bac343c6 100644
--- a/src/views/evidence/CreateView.vue
+++ b/src/views/evidence/CreateView.vue
@@ -19,7 +19,6 @@ import type {
   EvidenceStatus,
 } from '@/stores/evidence.ts';
 import router from '@/router';
-import { v4 as uuidv4 } from 'uuid';
 import EvidenceForm from './partial/EvidenceForm.vue';
 
 import type { BackMatterResource } from '@/oscal';
@@ -35,9 +34,7 @@ const { data: createdEvidence, execute: createEvidence } = useDataApi<Evidence>(
 );
 
 const backmatterResources = ref<BackMatterResource[]>([]);
-const evidence = ref<Partial<Evidence>>({
-  uuid: uuidv4(),
-});
+const evidence = ref<Partial<Evidence>>({});
 
 async function submit(
   updatedEvidence: Partial<Evidence>,
diff --git a/src/views/evidence/UpdateView.vue b/src/views/evidence/UpdateView.vue
index 33f8fcd8..e2109283 100644
--- a/src/views/evidence/UpdateView.vue
+++ b/src/views/evidence/UpdateView.vue
@@ -1,7 +1,8 @@
 <template>
-  <PageHeader> Update Evidence </PageHeader>
+  <PageHeader> Re-submit Evidence </PageHeader>
   <PageSubHeader>
-    Update the details of an existing piece of evidence.
+    Submit a new revision of this evidence. The revision joins the same evidence
+    stream and becomes the latest record.
   </PageSubHeader>
   <template v-if="isLoading">
     <div class="text-center">
diff --git a/src/views/evidence/ViewView.vue b/src/views/evidence/ViewView.vue
index 2980699e..1ddfc725 100644
--- a/src/views/evidence/ViewView.vue
+++ b/src/views/evidence/ViewView.vue
@@ -25,7 +25,7 @@
           Back to Execution
         </RouterLinkButton>
         <SecondaryButton v-if="evidence" @click="directToUpdate()">
-          Update Evidence
+          Re-submit
         </SecondaryButton>
       </div>
     </div>
@@ -348,6 +348,153 @@
         </PageCard>
       </div>
 
+      <div v-else-if="activeTab === 'risks'" class="space-y-4">
+        <PageCard>
+          <div class="flex flex-wrap items-start justify-between gap-4">
+            <div>
+              <h3
+                class="text-lg font-semibold text-zinc-700 dark:text-slate-200"
+              >
+                Associated Risks
+              </h3>
+              <p class="mt-2 text-sm text-gray-700 dark:text-slate-300">
+                Risks linked to this evidence stream, across all system security
+                plans.
+              </p>
+            </div>
+            <SecondaryButton
+              :disabled="!hasStreamUuid || !can(RESOURCES.RISK, ACTIONS.CREATE)"
+              v-tooltip.top="{
+                value: permissionTooltip(RESOURCES.RISK, ACTIONS.CREATE),
+                disabled: can(RESOURCES.RISK, ACTIONS.CREATE),
+              }"
+              @click="openCreateRiskDialog"
+            >
+              Create Risk
+            </SecondaryButton>
+          </div>
+
+          <Message
+            v-if="!hasStreamUuid"
+            severity="warn"
+            variant="outlined"
+            class="mt-4"
+          >
+            This evidence record has no stream identifier, so risks cannot be
+            associated with it.
+          </Message>
+
+          <div
+            v-else-if="risksLoading"
+            class="mt-4 text-sm text-gray-600 dark:text-slate-400"
+          >
+            Loading associated risks...
+          </div>
+
+          <Message
+            v-else-if="risksError"
+            severity="error"
+            variant="outlined"
+            class="mt-4"
+          >
+            Failed to load risks for this evidence record.
+          </Message>
+
+          <div v-else-if="evidenceRisks.length" class="mt-4 space-y-3">
+            <div
+              v-for="risk in evidenceRisks"
+              :key="risk.id"
+              class="rounded-md border border-ccf-300 p-4 dark:border-slate-700"
+            >
+              <div class="flex flex-wrap items-center gap-3">
+                <RouterLink
+                  :to="{
+                    name: 'system-security-plan-risk-detail',
+                    params: { id: risk.sspId, riskId: risk.id },
+                  }"
+                  class="font-medium text-blue-600 underline dark:text-blue-400"
+                >
+                  {{ risk.title || 'Untitled Risk' }}
+                </RouterLink>
+                <span
+                  :class="[
+                    'inline-flex rounded-full border px-3 py-1 text-xs font-semibold uppercase tracking-wide',
+                    getRiskStatusColor(risk.status),
+                  ]"
+                >
+                  {{ riskStatusLabel(risk.status) }}
+                </span>
+                <span
+                  v-if="risk.sourceType === 'evidence-auto'"
+                  class="inline-flex rounded-full bg-slate-100 px-2 py-0.5 text-xs dark:bg-slate-800"
+                >
+                  Auto-generated
+                </span>
+              </div>
+              <p
+                v-if="risk.description"
+                class="mt-2 text-sm text-gray-700 dark:text-slate-300"
+              >
+                {{ risk.description }}
+              </p>
+              <div class="mt-3 flex flex-wrap items-center gap-2">
+                <span
+                  :class="[
+                    'inline-flex items-center gap-1.5 rounded-full border px-3 py-1 text-xs',
+                    neutralPillColor,
+                  ]"
+                >
+                  <span
+                    class="text-[10px] font-medium uppercase tracking-wide opacity-60"
+                  >
+                    SSP
+                  </span>
+                  <span class="font-semibold">
+                    {{ risk.sspTitle || risk.sspId }}
+                  </span>
+                </span>
+                <span
+                  v-if="risk.likelihood"
+                  :class="[
+                    'inline-flex items-center gap-1.5 rounded-full border px-3 py-1 text-xs',
+                    getRiskLevelColor(risk.likelihood),
+                  ]"
+                >
+                  <span
+                    class="text-[10px] font-medium uppercase tracking-wide opacity-60"
+                  >
+                    Likelihood
+                  </span>
+                  <span class="font-semibold uppercase tracking-wide">
+                    {{ risk.likelihood }}
+                  </span>
+                </span>
+                <span
+                  v-if="risk.impact"
+                  :class="[
+                    'inline-flex items-center gap-1.5 rounded-full border px-3 py-1 text-xs',
+                    getRiskLevelColor(risk.impact),
+                  ]"
+                >
+                  <span
+                    class="text-[10px] font-medium uppercase tracking-wide opacity-60"
+                  >
+                    Impact
+                  </span>
+                  <span class="font-semibold uppercase tracking-wide">
+                    {{ risk.impact }}
+                  </span>
+                </span>
+              </div>
+            </div>
+          </div>
+
+          <p v-else class="mt-4 text-sm text-gray-600 dark:text-slate-400">
+            No risks are associated with this evidence record.
+          </p>
+        </PageCard>
+      </div>
+
       <div v-else-if="activeTab === 'media'" class="space-y-4">
         <PageCard>
           <h3 class="text-lg font-semibold text-zinc-700 dark:text-slate-200">
@@ -702,6 +849,42 @@
         <EvidenceHistorySection :uuid="evidence.uuid" />
       </div>
 
+      <Dialog
+        v-model:visible="showCreateRiskDialog"
+        modal
+        header="Create Risk from Evidence"
+      >
+        <div class="w-[48rem] max-w-full space-y-4 px-4 pt-2">
+          <div>
+            <label
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              System Security Plan
+            </label>
+            <Select
+              v-model="createRiskSspId"
+              :options="sspOptions"
+              option-label="title"
+              option-value="uuid"
+              placeholder="Select the SSP this risk belongs to"
+              class="mt-1 w-full"
+            />
+            <p class="mt-1 text-xs text-gray-500 dark:text-slate-400">
+              Risks live in a system security plan's risk register. The new risk
+              will be linked to this evidence stream.
+            </p>
+          </div>
+
+          <RiskCreateForm
+            v-if="createRiskSspId"
+            :key="createRiskSspId"
+            :ssp-id="createRiskSspId"
+            @cancel="showCreateRiskDialog = false"
+            @created="onRiskCreated"
+          />
+        </div>
+      </Dialog>
+
       <Dialog
         v-model:visible="showActivitiesModal"
         maximizable
@@ -759,18 +942,37 @@ import SecondaryButton from '@/volt/SecondaryButton.vue';
 import Dialog from '@/volt/Dialog.vue';
 import Message from '@/volt/Message.vue';
 import RouterLinkButton from '@/components/RouterLinkButton.vue';
+import RiskCreateForm from '@/components/risk/RiskCreateForm.vue';
+import Select from '@/volt/Select.vue';
 import {
   BIconDownload,
   BIconLockFill,
   BIconUnlockFill,
 } from 'bootstrap-icons-vue';
-import { useDataApi } from '@/composables/axios';
+import { useDataApi, decamelizeKeys } from '@/composables/axios';
+import { useToast } from 'primevue/usetoast';
+import { usePermissions } from '@/composables/usePermissions';
+import { RESOURCES, ACTIONS } from '@/constants/permissions';
+import { riskStatusLabel } from '@/utils/risk-workflow';
+import type { Risk as OscalRisk, SystemSecurityPlan } from '@/oscal';
 import type {
   Evidence,
   SignatureDetail,
   VerificationResult,
 } from '@/stores/evidence.ts';
 
+interface EvidenceRisk {
+  id: string;
+  title: string;
+  description?: string;
+  status: string;
+  likelihood?: string;
+  impact?: string;
+  sspId: string;
+  sspTitle?: string;
+  sourceType?: string;
+}
+
 const route = useRoute();
 const router = useRouter();
 const evidenceId = computed(() => route.params.id as string);
@@ -782,6 +984,7 @@ const backToEvidenceRoute = computed(() => ({
 const tabs = [
   { id: 'overview', label: 'Overview' },
   { id: 'metadata', label: 'Metadata' },
+  { id: 'risks', label: 'Risks' },
   { id: 'media', label: 'Media' },
   { id: 'signature', label: 'Signature' },
   { id: 'history', label: 'History' },
@@ -792,6 +995,12 @@ const activities = ref<Activity[]>([] as Activity[]);
 const showActivitiesModal = ref(false);
 const verificationAttempted = ref(false);
 const expandedTextMedia = ref<Set<string>>(new Set());
+const showCreateRiskDialog = ref(false);
+const createRiskSspId = ref<string | null>(null);
+const risksLoadedForUuid = ref<string | null>(null);
+
+const toast = useToast();
+const { can, permissionTooltip } = usePermissions();
 
 const {
   data: evidence,
@@ -816,6 +1025,22 @@ const {
   { method: 'POST' },
   { immediate: false },
 );
+const {
+  data: evidenceRisksData,
+  isLoading: risksLoading,
+  error: risksError,
+  execute: loadEvidenceRisks,
+} = useDataApi<EvidenceRisk[]>(null, null, { immediate: false });
+const { data: ssps, execute: loadSsps } = useDataApi<SystemSecurityPlan[]>(
+  null,
+  null,
+  { immediate: false },
+);
+const { execute: executeLinkEvidence } = useDataApi(
+  null,
+  { method: 'POST', transformRequest: [decamelizeKeys] },
+  { immediate: false },
+);
 
 const workflowExecutionId = computed(
   () =>
@@ -831,6 +1056,20 @@ const workflowExecutionRoute = computed(() =>
     : null,
 );
 
+const ZERO_UUID = '00000000-0000-0000-0000-000000000000';
+const hasStreamUuid = computed(() =>
+  Boolean(evidence.value?.uuid && evidence.value.uuid !== ZERO_UUID),
+);
+const evidenceRisks = computed<EvidenceRisk[]>(
+  () => evidenceRisksData.value ?? [],
+);
+const sspOptions = computed(() =>
+  (ssps.value ?? []).map((ssp) => ({
+    uuid: ssp.uuid,
+    title: ssp.metadata?.title || ssp.uuid,
+  })),
+);
+
 const metadataProps = computed<Property[]>(() => evidence.value?.props ?? []);
 const metadataLinks = computed<Link[]>(() => evidence.value?.links ?? []);
 const backMatterResources = computed<BackMatterResource[]>(
@@ -1030,6 +1269,102 @@ function getEvidenceStatusColor(status?: string): string {
   );
 }
 
+const RISK_STATUS_COLORS: Record<string, string> = {
+  open: FindingStatusColor['NOT-SATISFIED'],
+  investigating: FindingStatusColor['IN-PROGRESS'],
+  'mitigating-planned': FindingStatusColor['IN-PROGRESS'],
+  'mitigating-implemented': FindingStatusColor['IN-PROGRESS'],
+  remediated: FindingStatusColor.SATISFIED,
+  closed: FindingStatusColor.SATISFIED,
+  'risk-accepted': FindingStatusColor.UNKNOWN,
+  accepted: FindingStatusColor.UNKNOWN,
+};
+
+function getRiskStatusColor(status?: string): string {
+  return (
+    RISK_STATUS_COLORS[status?.toLowerCase() ?? ''] ||
+    FindingStatusColor.UNKNOWN
+  );
+}
+
+const neutralPillColor = FindingStatusColor.UNKNOWN;
+
+const RISK_LEVEL_COLORS: Record<string, string> = {
+  critical: FindingStatusColor['NOT-SATISFIED'],
+  high: FindingStatusColor['NOT-SATISFIED'],
+  moderate: FindingStatusColor['IN-PROGRESS'],
+  medium: FindingStatusColor['IN-PROGRESS'],
+  low: FindingStatusColor.SATISFIED,
+  negligible: FindingStatusColor.UNKNOWN,
+};
+
+function getRiskLevelColor(level?: string): string {
+  return RISK_LEVEL_COLORS[level?.toLowerCase() ?? ''] || neutralPillColor;
+}
+
+async function refreshEvidenceRisks() {
+  const streamUuid = evidence.value?.uuid;
+  if (!streamUuid || streamUuid === ZERO_UUID) {
+    return;
+  }
+  try {
+    await loadEvidenceRisks(`/api/evidence/${evidenceId.value}/risks`);
+    // Mark loaded only after the fetch succeeds so a failed request retries on
+    // the next Risks-tab visit instead of staying stuck on the error state.
+    risksLoadedForUuid.value = streamUuid;
+  } catch {
+    // The failure is surfaced through risksError; leave risksLoadedForUuid unset.
+  }
+}
+
+async function ensureEvidenceRisksLoaded() {
+  if (
+    !evidence.value?.uuid ||
+    risksLoadedForUuid.value === evidence.value.uuid
+  ) {
+    return;
+  }
+  await refreshEvidenceRisks();
+}
+
+function openCreateRiskDialog() {
+  createRiskSspId.value = null;
+  showCreateRiskDialog.value = true;
+  if (!ssps.value?.length) {
+    loadSsps('/api/oscal/system-security-plans');
+  }
+}
+
+async function onRiskCreated(risk: OscalRisk & { id?: string }) {
+  showCreateRiskDialog.value = false;
+
+  // The SSP-scoped register create responds with a register risk carrying an
+  // `id`; a plain OSCAL risk has none, so it's optional on the payload.
+  const riskId = risk.id;
+  const sspId = createRiskSspId.value;
+  const streamUuid = evidence.value?.uuid;
+  if (!riskId || !sspId || !streamUuid) {
+    return;
+  }
+
+  try {
+    await executeLinkEvidence(
+      `/api/oscal/system-security-plans/${sspId}/risks/${riskId}/evidence`,
+      { data: { evidenceId: streamUuid } },
+    );
+  } catch {
+    toast.add({
+      severity: 'warn',
+      summary: 'Evidence link failed',
+      detail:
+        'The risk was created, but it could not be linked to this evidence.',
+      life: 5000,
+    });
+  }
+
+  await refreshEvidenceRisks();
+}
+
 function directToUpdate() {
   return router.push({
     name: 'evidence:update',
@@ -1156,10 +1491,13 @@ watch(
     verificationResult.value = undefined;
     verifyError.value = undefined;
     showActivitiesModal.value = false;
+    showCreateRiskDialog.value = false;
     expandedTextMedia.value = new Set();
     evidence.value = undefined;
     signatureDetail.value = undefined;
     latestEvidence.value = undefined;
+    evidenceRisksData.value = undefined;
+    risksLoadedForUuid.value = null;
 
     await Promise.allSettled([
       loadEvidence(`/api/evidence/${id}`),
@@ -1174,7 +1512,17 @@ watch(
         loadLatestEvidence(`/api/evidence/latest/${evidenceUuid}`),
       ]);
     }
+
+    if (activeTab.value === 'risks') {
+      await ensureEvidenceRisksLoaded();
+    }
   },
   { immediate: true },
 );
+
+watch(activeTab, async (tab) => {
+  if (tab === 'risks') {
+    await ensureEvidenceRisksLoaded();
+  }
+});
 </script>
diff --git a/src/views/evidence/__tests__/ViewView.spec.ts b/src/views/evidence/__tests__/ViewView.spec.ts
index 12c8e382..3152bef6 100644
--- a/src/views/evidence/__tests__/ViewView.spec.ts
+++ b/src/views/evidence/__tests__/ViewView.spec.ts
@@ -1,5 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { flushPromises, mount } from '@vue/test-utils';
+import PrimeVue from 'primevue/config';
+import ToastService from 'primevue/toastservice';
 import ViewView from '../ViewView.vue';
 
 type MockRef<T> = {
@@ -25,10 +27,15 @@ type ViewTestRefs = {
   history: MockRef<Array<Record<string, unknown>>>;
   compliance: MockRef<Array<Record<string, unknown>>>;
   heartbeat: MockRef<Array<Record<string, unknown>>>;
+  risks: MockRef<Array<Record<string, unknown>> | undefined>;
+  risksResponse: Array<Record<string, unknown>>;
+  ssps: MockRef<Array<Record<string, unknown>> | undefined>;
+  sspsResponse: Array<Record<string, unknown>>;
   loading: MockRef<boolean>;
   error: MockRef<unknown>;
   signatureError: MockRef<unknown>;
   verifyError: MockRef<unknown>;
+  risksError: MockRef<unknown>;
   route: MockRouteState;
 };
 
@@ -36,12 +43,16 @@ const {
   mockRoute,
   routerPush,
   executeVerify,
+  loadEvidenceRisks,
+  loadSsps,
   baseEvidence,
   signedSignatureDetail,
   invalidVerificationResult,
   historyItems,
   complianceHistory,
   heartbeatHistory,
+  evidenceRisks,
+  sspList,
   refs,
 } = vi.hoisted(() => ({
   mockRoute: {
@@ -60,6 +71,17 @@ const {
     refs.verification.value = invalidVerificationResult;
     return { data: { value: { data: invalidVerificationResult } }, url };
   }),
+  loadEvidenceRisks: vi.fn(async (url?: string) => {
+    if (refs.risksError.value) {
+      throw refs.risksError.value;
+    }
+    refs.risks.value = structuredClone(refs.risksResponse);
+    return { data: { value: { data: refs.risks.value } }, url };
+  }),
+  loadSsps: vi.fn(async (url?: string) => {
+    refs.ssps.value = structuredClone(refs.sspsResponse);
+    return { data: { value: { data: refs.ssps.value } }, url };
+  }),
   baseEvidence: {
     id: 'evidence-1',
     uuid: 'evidence-uuid-1',
@@ -220,6 +242,31 @@ const {
       statuses: [{ status: 'healthy', count: 1 }],
     },
   ],
+  evidenceRisks: [
+    {
+      id: 'risk-1',
+      title: 'Unencrypted storage bucket',
+      description: 'Bucket allows public reads.',
+      status: 'open',
+      likelihood: 'high',
+      impact: 'high',
+      sspId: 'ssp-1',
+      sspTitle: 'Production SSP',
+      sourceType: 'evidence-auto',
+    },
+    {
+      id: 'risk-2',
+      title: 'Manual review overdue',
+      status: 'investigating',
+      sspId: 'ssp-2',
+      sspTitle: 'Staging SSP',
+      sourceType: 'manual',
+    },
+  ],
+  sspList: [
+    { uuid: 'ssp-1', metadata: { title: 'Production SSP' } },
+    { uuid: 'ssp-2', metadata: { title: 'Staging SSP' } },
+  ],
   refs: {
     nullGetCallIndex: 0,
   } as ViewTestRefs,
@@ -232,6 +279,13 @@ vi.mock('vue-router', () => ({
   }),
 }));
 
+vi.mock('@/composables/usePermissions', () => ({
+  usePermissions: () => ({
+    can: () => true,
+    permissionTooltip: () => '',
+  }),
+}));
+
 vi.mock('@/parsers/findings.ts', () => ({
   calculateComplianceOverTimeData: () => ({
     datasets: [],
@@ -257,13 +311,17 @@ vi.mock('@/composables/axios', async () => {
   refs.history = ref(historyItems);
   refs.compliance = ref(complianceHistory);
   refs.heartbeat = ref(heartbeatHistory);
+  refs.risks = ref(evidenceRisks);
+  refs.ssps = ref(sspList);
   refs.loading = ref(false);
   refs.error = ref(null);
   refs.signatureError = ref(null);
   refs.verifyError = ref(null);
+  refs.risksError = ref(null);
   refs.route = reactive(structuredClone(mockRoute));
 
   return {
+    decamelizeKeys: (data: unknown) => data,
     useDataApi: (
       url: string | { value?: string } | null,
       config?: { method?: string },
@@ -332,30 +390,48 @@ vi.mock('@/composables/axios', async () => {
           };
         }
 
+        if (refs.nullGetCallIndex === 3) {
+          return {
+            data: refs.latestEvidence,
+            error: refs.error,
+            execute: vi.fn(async (nextUrl?: string) => {
+              if (refs.error.value) {
+                throw refs.error.value;
+              }
+
+              if (nextUrl === '/api/evidence/latest/evidence-uuid-1') {
+                refs.latestEvidence.value = structuredClone(
+                  refs.latestEvidenceResponse,
+                );
+              }
+
+              if (nextUrl === '/api/evidence/latest/evidence-uuid-2') {
+                refs.latestEvidence.value = {
+                  ...structuredClone(baseEvidence),
+                  id: 'evidence-2',
+                  uuid: 'evidence-uuid-2',
+                  title: 'Second evidence record',
+                };
+              }
+              return { data: { value: { data: refs.latestEvidence.value } } };
+            }),
+          };
+        }
+
+        if (refs.nullGetCallIndex === 4) {
+          return {
+            data: refs.risks,
+            isLoading: refs.loading,
+            error: refs.risksError,
+            execute: loadEvidenceRisks,
+          };
+        }
+
         return {
-          data: refs.latestEvidence,
+          data: refs.ssps,
+          isLoading: refs.loading,
           error: refs.error,
-          execute: vi.fn(async (nextUrl?: string) => {
-            if (refs.error.value) {
-              throw refs.error.value;
-            }
-
-            if (nextUrl === '/api/evidence/latest/evidence-uuid-1') {
-              refs.latestEvidence.value = structuredClone(
-                refs.latestEvidenceResponse,
-              );
-            }
-
-            if (nextUrl === '/api/evidence/latest/evidence-uuid-2') {
-              refs.latestEvidence.value = {
-                ...structuredClone(baseEvidence),
-                id: 'evidence-2',
-                uuid: 'evidence-uuid-2',
-                title: 'Second evidence record',
-              };
-            }
-            return { data: { value: { data: refs.latestEvidence.value } } };
-          }),
+          execute: loadSsps,
         };
       }
 
@@ -426,6 +502,7 @@ vi.mock('@/composables/axios', async () => {
 function mountView() {
   return mount(ViewView, {
     global: {
+      plugins: [PrimeVue, ToastService],
       stubs: {
         PageHeader: {
           template: '<h1><slot /></h1>',
@@ -444,6 +521,12 @@ function mountView() {
         Dialog: {
           template: '<div><slot /></div>',
         },
+        Select: {
+          template: '<select />',
+        },
+        RiskCreateForm: {
+          template: '<div>RiskCreateForm</div>',
+        },
         Message: {
           template: '<div><slot /></div>',
         },
@@ -514,10 +597,15 @@ describe('Evidence ViewView', () => {
     refs.history.value = structuredClone(historyItems);
     refs.compliance.value = structuredClone(complianceHistory);
     refs.heartbeat.value = structuredClone(heartbeatHistory);
+    refs.risksResponse = structuredClone(evidenceRisks);
+    refs.risks.value = structuredClone(evidenceRisks);
+    refs.sspsResponse = structuredClone(sspList);
+    refs.ssps.value = structuredClone(sspList);
     refs.loading.value = false;
     refs.error.value = null;
     refs.signatureError.value = null;
     refs.verifyError.value = null;
+    refs.risksError.value = null;
     refs.route.params.id = 'evidence-1';
     refs.route.query = {
       filter: 'recent',
@@ -527,6 +615,8 @@ describe('Evidence ViewView', () => {
     };
     executeVerify.mockClear();
     routerPush.mockClear();
+    loadEvidenceRisks.mockClear();
+    loadSsps.mockClear();
   });
 
   it('renders the evidence detail tabs with overview as the default tab', async () => {
@@ -541,6 +631,7 @@ describe('Evidence ViewView', () => {
     expect(tabTexts).toEqual([
       'Overview',
       'Metadata',
+      'Risks',
       'Media',
       'Signature',
       'History',
@@ -572,6 +663,91 @@ describe('Evidence ViewView', () => {
     expect(wrapper.text()).toContain('Internal resource reference:');
   });
 
+  it('lists associated risks with their SSP names in the risks tab', async () => {
+    const wrapper = mountView();
+    await flushPromises();
+
+    await clickButtonByText(wrapper, 'Risks');
+
+    expect(loadEvidenceRisks).toHaveBeenCalledWith(
+      '/api/evidence/evidence-1/risks',
+    );
+    expect(wrapper.text()).toContain('Unencrypted storage bucket');
+    expect(wrapper.text()).toContain('Production SSP');
+    expect(wrapper.text()).toContain('Manual review overdue');
+    expect(wrapper.text()).toContain('Staging SSP');
+    expect(wrapper.text()).toContain('Auto-generated');
+
+    const riskLink = wrapper.find(
+      '[data-to*="system-security-plan-risk-detail"]',
+    );
+    expect(riskLink.exists()).toBe(true);
+    expect(riskLink.attributes('data-to')).toContain('"riskId":"risk-1"');
+    // Scoped to the risk's own SSP, not the active one, so cross-SSP risks resolve.
+    expect(riskLink.attributes('data-to')).toContain('"id":"ssp-1"');
+  });
+
+  it('does not fetch risks until the risks tab is opened', async () => {
+    mountView();
+    await flushPromises();
+
+    expect(loadEvidenceRisks).not.toHaveBeenCalled();
+  });
+
+  it('shows an error and retries the fetch after a failed risks load', async () => {
+    refs.risksError.value = new Error('boom');
+
+    const wrapper = mountView();
+    await flushPromises();
+    await clickButtonByText(wrapper, 'Risks');
+
+    expect(loadEvidenceRisks).toHaveBeenCalledTimes(1);
+    expect(wrapper.text()).toContain(
+      'Failed to load risks for this evidence record.',
+    );
+
+    // Recover: a failed load must not mark the UUID as loaded, so leaving and
+    // returning to the Risks tab retries the fetch.
+    refs.risksError.value = null;
+    await clickButtonByText(wrapper, 'Overview');
+    await clickButtonByText(wrapper, 'Risks');
+
+    expect(loadEvidenceRisks).toHaveBeenCalledTimes(2);
+    expect(wrapper.text()).toContain('Unencrypted storage bucket');
+  });
+
+  it('shows an empty state when no risks are associated', async () => {
+    refs.risksResponse = [];
+
+    const wrapper = mountView();
+    await flushPromises();
+    await clickButtonByText(wrapper, 'Risks');
+
+    expect(wrapper.text()).toContain(
+      'No risks are associated with this evidence record.',
+    );
+  });
+
+  it('blocks risk association when the evidence has no stream uuid', async () => {
+    refs.evidenceResponse = {
+      ...structuredClone(baseEvidence),
+      uuid: '00000000-0000-0000-0000-000000000000',
+    };
+    refs.evidence.value = structuredClone(refs.evidenceResponse);
+
+    const wrapper = mountView();
+    await flushPromises();
+    await clickButtonByText(wrapper, 'Risks');
+
+    expect(wrapper.text()).toContain('has no stream identifier');
+    expect(loadEvidenceRisks).not.toHaveBeenCalled();
+
+    const createButton = wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Create Risk');
+    expect(createButton?.attributes('disabled')).toBeDefined();
+  });
+
   it('renders unsafe metadata links as plain text instead of clickable anchors', async () => {
     refs.evidenceResponse = {
       ...structuredClone(baseEvidence),
diff --git a/src/views/evidence/partial/EvidenceForm.vue b/src/views/evidence/partial/EvidenceForm.vue
index f8931aae..406aad80 100644
--- a/src/views/evidence/partial/EvidenceForm.vue
+++ b/src/views/evidence/partial/EvidenceForm.vue
@@ -1,147 +1,255 @@
 <template>
-  <div
-    class="mt-4 bg-white dark:bg-slate-900 rounded-md border border-ccf-300 dark:border-slate-700 p-8"
-  >
-    <form @submit.prevent="handleSubmit">
-      <div class="flex">
+  <form class="mt-4 space-y-6" @submit.prevent="handleSubmit">
+    <PageCard>
+      <h3 class="text-lg font-semibold text-zinc-700 dark:text-slate-200">
+        Details
+      </h3>
+      <div class="mt-4 space-y-4">
         <div>
-          <div class="mb-2">
-            <label for="uuid">UUID</label>
-            <div class="flex items-center place-items-stretch" v-if="!updating">
-              <InputText
-                v-model="evidence.uuid"
-                class="rounded-r-none border-r-0"
+          <label
+            for="title"
+            class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+          >
+            Title
+          </label>
+          <InputText
+            id="title"
+            v-model="evidence.title"
+            required
+            class="mt-1 block w-full"
+            placeholder="Evidence title"
+          />
+        </div>
+        <div>
+          <label
+            for="description"
+            class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+          >
+            Description
+          </label>
+          <Textarea
+            id="description"
+            v-model="evidence.description"
+            rows="3"
+            class="mt-1 block w-full"
+            placeholder="What does this evidence demonstrate?"
+          />
+        </div>
+        <div class="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <div>
+            <label
+              for="status"
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Status
+            </label>
+            <div class="mt-1">
+              <SelectButton
+                v-model="status.state"
+                :options="['satisfied', 'not-satisfied', 'in-progress']"
+                required
               />
-              <TertiaryButton
-                type="button"
-                @click="generateUuid"
-                class="py-3 rounded-l-none"
-                ><BIconArrowRepeat
-              /></TertiaryButton>
-            </div>
-            <div class="flex items-center place-items-stretch" v-else>
-              <div
-                class="flex items-center bg-gray-100 dark:bg-slate-800 border border-gray-300 dark:border-slate-700 rounded-md px-3 py-2"
-              >
-                <span
-                  class="text-sm text-gray-600 dark:text-slate-400 font-mono"
-                  >{{ evidence.uuid }}</span
-                >
-              </div>
             </div>
           </div>
-          <div class="mb-2">
-            <label for="title">Title</label>
+          <div>
+            <label
+              for="reason"
+              class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+            >
+              Reason
+            </label>
             <InputText
-              id="title"
-              v-model="evidence.title"
-              required
-              class="block"
+              id="reason"
+              v-model="status.reason"
+              class="mt-1 block w-full"
+              placeholder="Why is the status what it is?"
             />
           </div>
-          <div class="mb-2">
-            <label for="description">Description</label>
-            <Textarea
-              id="description"
-              v-model="evidence.description"
-              class="block"
+        </div>
+      </div>
+
+      <div class="mt-6 border-t border-ccf-300 pt-4 dark:border-slate-700">
+        <div class="flex items-center justify-between gap-2">
+          <h4 class="text-sm font-semibold text-zinc-700 dark:text-slate-200">
+            Labels
+          </h4>
+          <SecondaryButton
+            v-if="!updating"
+            size="small"
+            type="button"
+            @click="addLabel"
+          >
+            Add
+          </SecondaryButton>
+        </div>
+        <p class="mt-1 text-sm text-gray-600 dark:text-slate-400">
+          Labels make evidence searchable and drive control matching.
+        </p>
+
+        <div v-if="!updating" class="mt-3 flex flex-col gap-y-2">
+          <div
+            v-for="(label, index) in labels"
+            :key="index"
+            class="flex items-center justify-start gap-1"
+          >
+            <InputText
+              v-model="label.name"
+              placeholder="Label name"
+              size="small"
             />
+            <InputText
+              v-model="label.value"
+              placeholder="Label value"
+              size="small"
+            />
+            <TertiaryButton
+              type="button"
+              class="!px-1"
+              @click="removeLabel(index)"
+              aria-label="Remove label"
+            >
+              <BIconX />
+            </TertiaryButton>
           </div>
-          <div class="mb-2">
-            <label for="start">Start Date</label>
-            <div>
-              <DatePicker
-                v-model="evidence.start"
-                placeholder="Select start date"
-                required
-                date-format="yy-mm-dd"
-                :max-date="
-                  evidence.end ? new Date(evidence.end) : new Date(Date.now())
-                "
-              />
-            </div>
-          </div>
-          <div class="mb-2">
-            <label for="end">End Date</label>
-            <div>
-              <DatePicker
-                v-model="evidence.end"
-                placeholder="Select end date"
-                required
-                date-format="yy-mm-dd"
-                :min-date="
-                  evidence.start
-                    ? new Date(evidence.start)
-                    : new Date(Date.now())
-                "
-                :max-date="new Date(Date.now())"
-              />
-              <div v-if="dateValidationError" class="text-red-500 text-sm mt-1">
-                {{ dateValidationError }}
-              </div>
-            </div>
-          </div>
-          <div class="mb-2">
-            <label for="status">Status</label>
-            <div>
-              <SelectButton
-                v-model="status.state"
-                :options="['satisfied', 'not-satisfied', 'in-progress']"
-                required
-              />
-            </div>
-          </div>
-          <div class="mb-2">
-            <label for="reason">Reason</label>
-            <div>
-              <InputText id="reason" v-model="status.reason" />
-            </div>
+          <p
+            v-if="!labels.length"
+            class="text-sm text-gray-600 dark:text-slate-400"
+          >
+            No labels added.
+          </p>
+        </div>
+        <div v-else class="mt-3">
+          <LabelList v-if="labels.length" :labels="labels" show-all />
+          <p v-else class="text-sm text-gray-600 dark:text-slate-400">
+            No labels on this evidence.
+          </p>
+        </div>
+      </div>
+
+      <div class="mt-6 border-t border-ccf-300 pt-4 dark:border-slate-700">
+        <h4 class="text-sm font-semibold text-zinc-700 dark:text-slate-200">
+          Attachments
+        </h4>
+        <div
+          v-if="backmatterResources.length"
+          class="mt-3 flex flex-col gap-y-2"
+        >
+          <div
+            v-for="matter in backmatterResources"
+            :key="matter.uuid"
+            class="rounded-md border border-ccf-300 px-3 py-2 text-sm text-gray-900 dark:border-slate-700 dark:text-slate-200"
+          >
+            {{ matter.title }}
           </div>
-          <div class="mb-2" v-if="!updating">
-            <div class="flex items-center gap-2 mb-2">
-              <p>Labels</p>
-              <secondary-button size="small" type="button" @click="addLabel"
-                >Add</secondary-button
-              >
-            </div>
+        </div>
+        <p v-else class="mt-3 text-sm text-gray-600 dark:text-slate-400">
+          No files attached.
+        </p>
+        <div class="mt-3">
+          <Base64FileUpload @uploaded="onUpload" />
+        </div>
+      </div>
+    </PageCard>
 
-            <div class="flex flex-col gap-y-1">
-              <div
-                v-for="(label, index) in labels"
-                :key="index"
-                class="flex items-center justify-start"
-              >
-                <InputText
-                  v-model="label.name"
-                  placeholder="Label name"
-                  size="small"
-                />
-                <InputText
-                  v-model="label.value"
-                  placeholder="Label value"
-                  size="small"
-                />
-                <TertiaryButton
-                  type="button"
-                  class="!px-1 ml-1"
-                  @click="removeLabel(index)"
-                  aria-label="Remove label"
-                >
-                  <BIconX />
-                </TertiaryButton>
-              </div>
-            </div>
+    <PageCard>
+      <h3 class="text-lg font-semibold text-zinc-700 dark:text-slate-200">
+        Collection Window &amp; Expiry
+      </h3>
+      <div class="mt-4 grid grid-cols-1 gap-4 md:grid-cols-3">
+        <div>
+          <label
+            for="start"
+            class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+          >
+            Start Date
+          </label>
+          <div class="mt-1">
+            <DatePicker
+              v-model="evidence.start"
+              placeholder="Select start date"
+              required
+              date-format="yy-mm-dd"
+              :max-date="
+                evidence.end ? new Date(evidence.end) : new Date(Date.now())
+              "
+            />
           </div>
         </div>
         <div>
-          <div>
-            <div v-for="matter in backmatterResources" :key="matter.uuid">
-              {{ matter.title }}
-            </div>
+          <label
+            for="end"
+            class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+          >
+            End Date
+          </label>
+          <div class="mt-1">
+            <DatePicker
+              v-model="evidence.end"
+              placeholder="Select end date"
+              required
+              date-format="yy-mm-dd"
+              :min-date="
+                evidence.start ? new Date(evidence.start) : new Date(Date.now())
+              "
+              :max-date="new Date(Date.now())"
+            />
           </div>
-          <Base64FileUpload @uploaded="onUpload" />
         </div>
+        <div>
+          <label
+            for="expires"
+            class="text-xs uppercase tracking-wide text-gray-500 dark:text-slate-400"
+          >
+            Expiry Date
+          </label>
+          <div class="mt-1">
+            <DatePicker
+              v-model="evidence.expires"
+              placeholder="Server default if empty"
+              date-format="yy-mm-dd"
+              :min-date="
+                evidence.end ? new Date(evidence.end) : new Date(Date.now())
+              "
+              show-button-bar
+            />
+          </div>
+          <p class="mt-1 text-xs text-gray-500 dark:text-slate-400">
+            When this evidence stops being valid. Left empty, the server applies
+            its default expiry.
+          </p>
+        </div>
+      </div>
+      <div v-if="dateValidationError" class="mt-2 text-sm text-red-500">
+        {{ dateValidationError }}
+      </div>
+    </PageCard>
+
+    <PageCard>
+      <h3 class="text-lg font-semibold text-zinc-700 dark:text-slate-200">
+        Properties
+      </h3>
+      <div class="mt-4">
+        <PropsEditor v-model="propsList" />
       </div>
+    </PageCard>
+
+    <PageCard>
+      <h3 class="text-lg font-semibold text-zinc-700 dark:text-slate-200">
+        Links
+      </h3>
+      <p class="mt-1 text-sm text-gray-600 dark:text-slate-400">
+        External references, or internal
+        <code class="rounded bg-slate-100 px-1 text-xs dark:bg-slate-800"
+          >#resource</code
+        >
+        references to attachments. Uploaded files appear here automatically.
+      </p>
+      <div class="mt-4">
+        <LinksEditor v-model="linksList" />
+      </div>
+    </PageCard>
+
+    <div class="flex justify-end">
       <primary-button
         type="submit"
         :disabled="!isFormValid || !can(RESOURCES.EVIDENCE, submitAction)"
@@ -149,10 +257,10 @@
           value: permissionTooltip(RESOURCES.EVIDENCE, submitAction),
           disabled: can(RESOURCES.EVIDENCE, submitAction),
         }"
-        >{{ props.updating ? 'Update' : 'Create' }} Evidence</primary-button
+        >{{ props.updating ? 'Re-submit' : 'Create' }} Evidence</primary-button
       >
-    </form>
-  </div>
+    </div>
+  </form>
 </template>
 
 <script lang="ts" setup>
@@ -162,15 +270,20 @@ import type {
   EvidenceStatus,
 } from '@/stores/evidence';
 import { ref, computed } from 'vue';
-import type { BackMatterResource, Base64 } from '@/oscal';
-import { v4 as uuidv4 } from 'uuid';
+import type { BackMatterResource, Base64, Link, Property } from '@/oscal';
+import { uuid } from '@/utils/uuid';
 import DatePicker from '@/volt/DatePicker.vue';
 import Textarea from '@/volt/Textarea.vue';
 import InputText from '@/volt/InputText.vue';
 import SelectButton from '@/volt/SelectButton.vue';
 import TertiaryButton from '@/volt/TertiaryButton.vue';
-import { BIconArrowRepeat, BIconX } from 'bootstrap-icons-vue';
+import SecondaryButton from '@/volt/SecondaryButton.vue';
+import { BIconX } from 'bootstrap-icons-vue';
 import Base64FileUpload from '@/components/Base64FileUpload.vue';
+import PageCard from '@/components/PageCard.vue';
+import LabelList from '@/components/LabelList.vue';
+import PropsEditor from '@/components/forms/PropsEditor.vue';
+import LinksEditor from '@/components/forms/LinksEditor.vue';
 import { usePermissions } from '@/composables/usePermissions';
 import { RESOURCES, ACTIONS } from '@/constants/permissions';
 
@@ -189,9 +302,10 @@ const backmatterResources = ref<BackMatterResource[]>(
   props.backmatterResources || [],
 );
 // Interface for form data with Date objects for DatePicker compatibility
-interface EvidenceFormData extends Omit<Evidence, 'start' | 'end'> {
+interface EvidenceFormData extends Omit<Evidence, 'start' | 'end' | 'expires'> {
   start?: Date;
   end?: Date;
+  expires?: Date;
 }
 
 const evidence = ref<Partial<EvidenceFormData>>({
@@ -199,13 +313,27 @@ const evidence = ref<Partial<EvidenceFormData>>({
   // Convert ISO strings to Date objects for DatePicker
   start: props.evidence?.start ? new Date(props.evidence.start) : undefined,
   end: props.evidence?.end ? new Date(props.evidence.end) : undefined,
-  uuid: props.evidence?.uuid || uuidv4(),
+  expires: props.evidence?.expires
+    ? new Date(props.evidence.expires)
+    : undefined,
+  // The stream UUID stays hidden: generated once on create, preserved on
+  // re-submission so revisions accumulate in the same evidence stream.
+  uuid: props.evidence?.uuid || uuid(),
 });
 const status = ref<EvidenceStatus>({
   state: props.evidence?.status?.state || '',
   reason: props.evidence?.status?.reason || '',
 });
 const labels = ref<EvidenceLabel[]>(props.evidence?.labels || []);
+// Clone each element (not just the outer array): PropsEditor/LinksEditor bind
+// v-model onto these objects, so aliasing props.evidence.props/links would mutate
+// the fetched source data before the user submits or cancels.
+const propsList = ref<Property[]>(
+  (props.evidence?.props ?? []).map((prop) => ({ ...prop })),
+);
+const linksList = ref<Link[]>(
+  (props.evidence?.links ?? []).map((link) => ({ ...link })),
+);
 
 // Date validation
 const dateValidationError = computed(() => {
@@ -222,6 +350,9 @@ const dateValidationError = computed(() => {
   if (startDate > endDate) {
     return 'End date must be after start date';
   }
+  if (evidence.value.expires && evidence.value.expires < endDate) {
+    return 'Expiry date must be after the end date';
+  }
   return null;
 });
 
@@ -243,21 +374,24 @@ function handleSubmit() {
     ...evidence.value,
     start: evidence.value.start?.toISOString(),
     end: evidence.value.end?.toISOString(),
+    expires: evidence.value.expires?.toISOString(),
+    props: propsList.value.filter((prop) => prop.name || prop.value),
+    links: linksList.value.filter((link) => link.href),
   };
 
   emit('submit', evidenceToSubmit, labels.value, status.value);
 }
 
 function onUpload(file: File, base64: Base64) {
-  const id = uuidv4();
+  const id = uuid();
   backmatterResources.value.push({
     uuid: id,
     title: file.name,
     description: '',
     base64: base64,
   });
-  evidence.value.links = [
-    ...(evidence.value.links || []),
+  linksList.value = [
+    ...linksList.value,
     {
       href: `#${id}`,
       rel: `reference`,
@@ -273,8 +407,4 @@ function addLabel() {
 function removeLabel(index: number) {
   labels.value.splice(index, 1);
 }
-
-function generateUuid() {
-  evidence.value.uuid = uuidv4();
-}
 </script>
diff --git a/src/views/lineage/LineageGraphView.vue b/src/views/lineage/LineageGraphView.vue
index 3c227a11..27748e8d 100644
--- a/src/views/lineage/LineageGraphView.vue
+++ b/src/views/lineage/LineageGraphView.vue
@@ -9,7 +9,12 @@ import { nodeCardClass, nodeDetailRoute } from '@/components/lineage/nodeMeta';
 import { useLineage } from '@/composables/useLineage';
 import type { LineageNode } from '@/composables/useLineage/types';
 import { useLineageScopeStore } from '@/stores/lineageScope';
-import { COLUMN_PAGE_SIZE, worstFirst } from './ranking';
+import {
+  COLUMN_PAGE_SIZE,
+  worstFirst,
+  structuralNodes as structuralNodesOf,
+  riskGroups as riskGroupsOf,
+} from './ranking';
 
 // One column = the (worst-first) children of a selected node, revealed 5 at a
 // time. columns[0] holds the roots. Selecting a box in column i drops everything
@@ -119,7 +124,7 @@ function showMore(colIndex: number) {
 
 function openDetails(node: LineageNode) {
   // Risk / evidence nodes have their own DetailViews; structural nodes use the drawer.
-  const route = nodeDetailRoute(node);
+  const route = nodeDetailRoute(node, scopeStore.scope.sspId);
   if (route) {
     router.push(route);
     return;
@@ -142,6 +147,16 @@ function shownNodes(col: Column): LineageNode[] {
   return col.nodes.slice(0, col.revealed);
 }
 
+// Non-risk boxes in a column, rendered individually as before.
+function structuralNodes(col: Column): LineageNode[] {
+  return structuralNodesOf(shownNodes(col));
+}
+
+// Risk boxes in a column, bucketed into one container per owning SSP.
+function riskGroups(col: Column) {
+  return riskGroupsOf(shownNodes(col));
+}
+
 // Filtering changes column height → the connector arrows may need to move.
 function onSearch() {
   nextTick().then(computeArrows);
@@ -283,7 +298,7 @@ watch(
           </p>
 
           <div
-            v-for="node in shownNodes(col)"
+            v-for="node in structuralNodes(col)"
             :key="node.key"
             :ref="(el) => setBoxRef(i, node.key, el)"
             class="cursor-pointer rounded-lg border border-l-4 border-surface-200 p-3 transition hover:shadow-md dark:border-surface-700"
@@ -312,6 +327,52 @@ watch(
             </div>
           </div>
 
+          <!-- Risk boxes, bucketed by owning SSP so cross-SSP risks under the
+               same control don't look like they belong to one plan. -->
+          <div
+            v-for="group in riskGroups(col)"
+            :key="`ssp:${group.sspId}`"
+            class="rounded-lg border border-dashed border-surface-300 p-2 dark:border-surface-600"
+          >
+            <div
+              class="mb-1.5 truncate text-[11px] font-semibold tracking-wide text-surface-500 uppercase dark:text-surface-400"
+              v-tooltip.top="group.sspTitle"
+            >
+              SSP: {{ group.sspTitle }}
+            </div>
+            <div class="flex flex-col gap-2">
+              <div
+                v-for="node in group.nodes"
+                :key="node.key"
+                :ref="(el) => setBoxRef(i, node.key, el)"
+                class="cursor-pointer rounded-lg border border-l-4 border-surface-200 p-3 transition hover:shadow-md dark:border-surface-700"
+                :class="[
+                  nodeCardClass(node),
+                  col.selectedKey === node.key
+                    ? 'ring-2 ring-primary ring-offset-1 dark:ring-offset-surface-900'
+                    : '',
+                ]"
+                @click="onBoxClick(i, node)"
+              >
+                <LineageNodeRow :node="node" card />
+                <div
+                  class="mt-1 flex items-center justify-between pl-5 text-xs text-surface-500 dark:text-surface-400"
+                >
+                  <span v-if="node.hasChildren"
+                    >{{ node.childrenCount }} children ›</span
+                  >
+                  <span v-else class="italic">leaf</span>
+                  <button
+                    class="rounded px-1.5 py-0.5 hover:bg-surface-200 dark:hover:bg-surface-700"
+                    @click.stop="openDetails(node)"
+                  >
+                    details
+                  </button>
+                </div>
+              </div>
+            </div>
+          </div>
+
           <button
             v-if="!col.query.trim() && col.nodes.length > col.revealed"
             class="mt-1 rounded-md border border-dashed border-surface-300 px-2 py-1.5 text-xs font-medium text-surface-600 hover:bg-surface-100 dark:border-surface-600 dark:text-surface-300 dark:hover:bg-surface-800"
diff --git a/src/views/lineage/LineageTreeView.vue b/src/views/lineage/LineageTreeView.vue
index 9584531d..e19b8584 100644
--- a/src/views/lineage/LineageTreeView.vue
+++ b/src/views/lineage/LineageTreeView.vue
@@ -63,7 +63,7 @@ async function onNodeExpand(node: LineageTreeNode) {
 
 function onNodeSelect(node: LineageTreeNode) {
   // Risk / evidence nodes open their own DetailView; structural nodes use the drawer.
-  const route = nodeDetailRoute(node.data);
+  const route = nodeDetailRoute(node.data, scopeStore.scope.sspId);
   if (route) {
     router.push(route);
     return;
diff --git a/src/views/lineage/__tests__/LineageGraphView.spec.ts b/src/views/lineage/__tests__/LineageGraphView.spec.ts
new file mode 100644
index 00000000..1e7d758a
--- /dev/null
+++ b/src/views/lineage/__tests__/LineageGraphView.spec.ts
@@ -0,0 +1,122 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { mount, flushPromises } from '@vue/test-utils';
+import { createPinia, setActivePinia } from 'pinia';
+import type { LineageNode } from '@/composables/useLineage/types';
+
+const { fetchRootNodesMock } = vi.hoisted(() => ({
+  fetchRootNodesMock: vi.fn(),
+}));
+
+vi.mock('@/composables/useLineage', async () => {
+  const { ref } = await import('vue');
+  return {
+    useLineage: () => ({
+      fetchRoots: vi.fn(),
+      fetchChildren: vi.fn(),
+      fetchRootNodes: fetchRootNodesMock,
+      fetchChildNodes: vi.fn(),
+      clearCache: vi.fn(),
+      usingFixtures: ref(false),
+    }),
+  };
+});
+
+import LineageGraphView from '../LineageGraphView.vue';
+
+function baseFields() {
+  return {
+    compliance: {
+      totalControls: 0,
+      satisfied: 0,
+      notSatisfied: 0,
+      unknown: 0,
+      compliancePercent: 0,
+      assessedPercent: 0,
+    },
+    risk: {
+      openScoreSum: 0,
+      mutedScoreSum: 0,
+      counts: {
+        open: 0,
+        investigating: 0,
+        mitigatingPlanned: 0,
+        riskAccepted: 0,
+        mitigatingImplemented: 0,
+      },
+    },
+    linkage: {
+      policies: 0,
+      procedures: 0,
+      operationalControls: 0,
+      unmapped: false,
+      unanchored: false,
+    },
+    hasChildren: false,
+    childrenCount: 0,
+  };
+}
+
+function controlNode(title: string): LineageNode {
+  return {
+    ...baseFields(),
+    key: `control:${title}`,
+    nodeType: 'control',
+    title,
+  };
+}
+
+function riskNode(
+  title: string,
+  score: number,
+  sspId: string,
+  sspTitle: string,
+): LineageNode {
+  return {
+    ...baseFields(),
+    key: `risk:${title}`,
+    nodeType: 'risk',
+    title,
+    score,
+    sspId,
+    sspTitle,
+  };
+}
+
+describe('LineageGraphView risk grouping (smoke)', () => {
+  beforeEach(() => {
+    setActivePinia(createPinia());
+    fetchRootNodesMock.mockReset();
+  });
+
+  it('buckets risk nodes under an SSP container, leaving structural nodes ungrouped', async () => {
+    fetchRootNodesMock.mockResolvedValue([
+      controlNode('Access Control'),
+      riskNode('Credential leak', 16, 'ssp-1', 'Acme Production'),
+      riskNode('Stale access', 42, 'ssp-2', 'Globex Staging'),
+    ]);
+
+    const wrapper = mount(LineageGraphView, {
+      global: {
+        stubs: {
+          LineageScopeBar: true,
+          LineageViewSwitch: true,
+          LineageNodeDrawer: true,
+        },
+      },
+    });
+
+    await flushPromises();
+
+    const text = wrapper.text();
+    expect(text).toContain('SSP: Acme Production');
+    expect(text).toContain('SSP: Globex Staging');
+    expect(text).toContain('Access Control');
+    expect(text).toContain('Credential leak');
+    expect(text).toContain('Stale access');
+
+    // Worst-first: the higher-scored risk's SSP container renders before the other's.
+    expect(text.indexOf('SSP: Globex Staging')).toBeLessThan(
+      text.indexOf('SSP: Acme Production'),
+    );
+  });
+});
diff --git a/src/views/lineage/__tests__/ranking.spec.ts b/src/views/lineage/__tests__/ranking.spec.ts
index c6747f84..39aa05fb 100644
--- a/src/views/lineage/__tests__/ranking.spec.ts
+++ b/src/views/lineage/__tests__/ranking.spec.ts
@@ -1,5 +1,10 @@
 import { describe, it, expect } from 'vitest';
-import { worstFirst, COLUMN_PAGE_SIZE } from '../ranking';
+import {
+  worstFirst,
+  COLUMN_PAGE_SIZE,
+  structuralNodes,
+  riskGroups,
+} from '../ranking';
 import type { LineageNode } from '@/composables/useLineage/types';
 
 function node(
@@ -42,6 +47,22 @@ function node(
   };
 }
 
+function riskNode(
+  title: string,
+  score: number,
+  sspId?: string,
+  sspTitle?: string,
+): LineageNode {
+  return {
+    ...node(title, 0),
+    key: `risk:${title}`,
+    nodeType: 'risk',
+    score,
+    sspId,
+    sspTitle,
+  };
+}
+
 describe('worstFirst', () => {
   it('orders by highest open-risk score first', () => {
     const out = worstFirst([node('a', 5), node('b', 50), node('c', 20)]);
@@ -68,3 +89,44 @@ describe('worstFirst', () => {
     expect(COLUMN_PAGE_SIZE).toBe(5);
   });
 });
+
+describe('structuralNodes', () => {
+  it('excludes risk nodes, keeping everything else', () => {
+    const out = structuralNodes([
+      node('control-a', 5),
+      riskNode('risk-a', 10, 'ssp-1', 'SSP One'),
+      node('control-b', 5),
+    ]);
+    expect(out.map((n) => n.title)).toEqual(['control-a', 'control-b']);
+  });
+});
+
+describe('riskGroups', () => {
+  it('buckets risk nodes by sspId, ignoring non-risk nodes', () => {
+    const groups = riskGroups([
+      node('control-a', 5),
+      riskNode('risk-a', 10, 'ssp-1', 'SSP One'),
+      riskNode('risk-b', 20, 'ssp-2', 'SSP Two'),
+      riskNode('risk-c', 5, 'ssp-1', 'SSP One'),
+    ]);
+    expect(groups.map((g) => g.sspId)).toEqual(['ssp-2', 'ssp-1']);
+    expect(groups[1].nodes.map((n) => n.title)).toEqual(['risk-a', 'risk-c']);
+  });
+
+  it('orders groups worst-first by their worst member', () => {
+    const groups = riskGroups([
+      riskNode('low', 5, 'ssp-low', 'Low'),
+      riskNode('high', 50, 'ssp-high', 'High'),
+    ]);
+    expect(groups.map((g) => g.sspId)).toEqual(['ssp-high', 'ssp-low']);
+  });
+
+  it('falls back to "Unknown SSP" when a risk has no sspTitle', () => {
+    const groups = riskGroups([riskNode('risk-a', 10, 'ssp-1')]);
+    expect(groups[0].sspTitle).toBe('Unknown SSP');
+  });
+
+  it('returns an empty array when there are no risk nodes', () => {
+    expect(riskGroups([node('control-a', 5)])).toEqual([]);
+  });
+});
diff --git a/src/views/lineage/ranking.ts b/src/views/lineage/ranking.ts
index 7b2db8bd..244da606 100644
--- a/src/views/lineage/ranking.ts
+++ b/src/views/lineage/ranking.ts
@@ -23,3 +23,49 @@ export function worstFirst(nodes: LineageNode[]): LineageNode[] {
     return a.title.localeCompare(b.title);
   });
 }
+
+/** Non-risk nodes, rendered individually (unchanged from pre-grouping behavior). */
+export function structuralNodes(nodes: LineageNode[]): LineageNode[] {
+  return nodes.filter((n) => n.nodeType !== 'risk');
+}
+
+// A column of a control's children mixes structural/evidence nodes with risk
+// nodes (a control can be linked to risks across several SSPs). Risk nodes are
+// bucketed into one container per owning SSP so cross-SSP risks under the same
+// control don't read as belonging to one plan.
+export interface RiskGroup {
+  sspId: string;
+  sspTitle: string;
+  nodes: LineageNode[];
+}
+
+/**
+ * Group a column's risk nodes by their owning SSP (risk.sspId — a risk always
+ * has exactly one). Groups are worst-first by their worst member, matching the
+ * column's own ordering; nodes within a group keep the order they arrived in.
+ */
+export function riskGroups(nodes: LineageNode[]): RiskGroup[] {
+  const risks = nodes.filter((n) => n.nodeType === 'risk');
+  if (!risks.length) return [];
+  const order: string[] = [];
+  const groups = new Map<string, RiskGroup>();
+  for (const n of risks) {
+    const sspId = n.sspId ?? '';
+    if (!groups.has(sspId)) {
+      groups.set(sspId, {
+        sspId,
+        sspTitle: n.sspTitle || 'Unknown SSP',
+        nodes: [],
+      });
+      order.push(sspId);
+    }
+    groups.get(sspId)!.nodes.push(n);
+  }
+  return order
+    .map((id) => groups.get(id)!)
+    .sort(
+      (a, b) =>
+        Math.max(...b.nodes.map(nodeRankScore)) -
+        Math.max(...a.nodes.map(nodeRankScore)),
+    );
+}