Change state of applicability

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/components/__generated__/SnapshotBannerQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<c2504ebd6a90f696d2068c03294d0c53>>
+ * @generated SignedSource<<a62993ad367f0d977f346e507dd6b572>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type SnapshotBannerQuery$variables = {
   snapshotId: string;
 };

apps/console/src/components/form/StateOfApplicabilityControlsField.tsx

@@ -0,0 +1,518 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Field,
+  Select,
+  Option,
+  Checkbox,
+  Textarea,
+  Spinner,
+  Button,
+  IconChevronDown,
+  IconChevronUp,
+  IconTrashCan,
+  IconPlusLarge,
+} from "@probo/ui";
+import { Suspense, useState, useMemo, useEffect } from "react";
+import { Controller, type Control, type UseFormSetValue, type FieldValues, type Path, type PathValue } from "react-hook-form";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "relay-runtime";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { StateOfApplicabilityControlsFieldFrameworksQuery } from "./__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql";
+import type { StateOfApplicabilityControlsFieldFrameworkControlsQuery } from "./__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql";
+
+const frameworksQuery = graphql`
+  query StateOfApplicabilityControlsFieldFrameworksQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        frameworks(first: 100) {
+          edges {
+            node {
+              id
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+const frameworkControlsQuery = graphql`
+  query StateOfApplicabilityControlsFieldFrameworkControlsQuery(
+    $frameworkId: ID!
+  ) {
+    framework: node(id: $frameworkId) {
+      ... on Framework {
+        id
+        controls(first: 500, orderBy: { field: SECTION_TITLE, direction: ASC }) {
+          edges {
+            node {
+              id
+              sectionTitle
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+type ControlSelection = {
+  controlId: string;
+  state: "EXCLUDED" | "IMPLEMENTED" | "NOT_IMPLEMENTED";
+  exclusionJustification?: string;
+};
+
+type FrameworkData = {
+  id: string;
+  name: string;
+  controls: Array<{
+    id: string;
+    sectionTitle: string;
+    name: string;
+  }>;
+};
+
+type Props<T extends FieldValues = FieldValues> = {
+  control: Control<T>;
+  setValue: UseFormSetValue<T>;
+  name: string;
+  initialControls?: ControlSelection[];
+  initialFrameworkIds?: Set<string>;
+};
+
+export function StateOfApplicabilityControlsField<T extends FieldValues = FieldValues>({ control, setValue, name, initialControls, initialFrameworkIds }: Props<T>) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+
+  // Initialize form value with initialControls
+  useEffect(() => {
+    if (initialControls && initialControls.length > 0) {
+      setValue(name as Path<T>, initialControls as PathValue<T, Path<T>>);
+    }
+  }, [initialControls, setValue, name]);
+
+  // Initialize framework selection from initialFrameworkIds
+  const [selectedFrameworkIds, setSelectedFrameworkIds] = useState<Set<string>>(initialFrameworkIds || new Set());
+  const [expandedFrameworks, setExpandedFrameworks] = useState<Set<string>>(initialFrameworkIds || new Set());
+  const [frameworkDataMap, setFrameworkDataMap] = useState<Map<string, FrameworkData>>(new Map());
+  const [newFrameworkId, setNewFrameworkId] = useState<string>("");
+
+  // Update framework selection when initialFrameworkIds changes
+  useEffect(() => {
+    if (initialFrameworkIds) {
+      setSelectedFrameworkIds(initialFrameworkIds);
+      setExpandedFrameworks(initialFrameworkIds);
+    }
+  }, [initialFrameworkIds]);
+
+  const addFramework = (frameworkId: string) => {
+    if (!frameworkId || selectedFrameworkIds.has(frameworkId)) return;
+    setSelectedFrameworkIds(new Set([...selectedFrameworkIds, frameworkId]));
+    setExpandedFrameworks(new Set([...expandedFrameworks, frameworkId]));
+    setNewFrameworkId("");
+  };
+
+  const removeFramework = (frameworkId: string) => {
+    const newSet = new Set(selectedFrameworkIds);
+    newSet.delete(frameworkId);
+    setSelectedFrameworkIds(newSet);
+
+    const newExpanded = new Set(expandedFrameworks);
+    newExpanded.delete(frameworkId);
+    setExpandedFrameworks(newExpanded);
+
+    const newMap = new Map(frameworkDataMap);
+    newMap.delete(frameworkId);
+    setFrameworkDataMap(newMap);
+  };
+
+  const toggleFramework = (frameworkId: string) => {
+    const newExpanded = new Set(expandedFrameworks);
+    if (newExpanded.has(frameworkId)) {
+      newExpanded.delete(frameworkId);
+    } else {
+      newExpanded.add(frameworkId);
+    }
+    setExpandedFrameworks(newExpanded);
+  };
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <h4 className="font-medium text-txt-primary mb-4">
+          {__("Select Controls")}
+        </h4>
+
+        <div className="space-y-3">
+          <Field label={__("Add Framework")}>
+            <Suspense fallback={<Select variant="editor" disabled placeholder={__("Loading...")} />}>
+              <FrameworkSelect
+                organizationId={organizationId}
+                selectedFrameworkIds={selectedFrameworkIds}
+                value={newFrameworkId}
+                onValueChange={setNewFrameworkId}
+                onAdd={addFramework}
+              />
+            </Suspense>
+          </Field>
+
+          {Array.from(selectedFrameworkIds).map((frameworkId) => (
+            <Suspense
+              key={frameworkId}
+              fallback={
+                <div className="flex items-center justify-center py-8">
+                  <Spinner />
+                </div>
+              }
+            >
+              <FrameworkSection
+                frameworkId={frameworkId}
+                isExpanded={expandedFrameworks.has(frameworkId)}
+                onToggle={() => toggleFramework(frameworkId)}
+                onRemove={() => removeFramework(frameworkId)}
+                control={control}
+                name={name}
+                frameworkDataMap={frameworkDataMap}
+                setFrameworkDataMap={setFrameworkDataMap}
+              />
+            </Suspense>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function FrameworkSelect({
+  organizationId,
+  selectedFrameworkIds,
+  value,
+  onValueChange,
+  onAdd,
+}: {
+  organizationId: string;
+  selectedFrameworkIds: Set<string>;
+  value: string;
+  onValueChange: (value: string) => void;
+  onAdd: (frameworkId: string) => void;
+}) {
+  const { __ } = useTranslate();
+  const data = useLazyLoadQuery<StateOfApplicabilityControlsFieldFrameworksQuery>(
+    frameworksQuery,
+    { organizationId },
+    { fetchPolicy: "network-only" }
+  );
+  const frameworks: Array<{ id: string; name: string }> =
+    (data?.organization && "frameworks" in data.organization && data.organization.frameworks?.edges
+      ?.map((edge) => edge.node)
+      .filter((node): node is NonNullable<typeof node> => node !== null)) || [];
+
+  const availableFrameworks = frameworks.filter(
+    (framework: { id: string; name: string }) => !selectedFrameworkIds.has(framework.id)
+  );
+
+  return (
+    <div className="flex gap-2">
+      <Select
+        variant="editor"
+        placeholder={__("Select a framework")}
+        onValueChange={onValueChange}
+        value={value}
+        className="flex-1"
+      >
+        {availableFrameworks.map((framework: { id: string; name: string }) => (
+          <Option key={framework.id} value={framework.id}>
+            {framework.name}
+          </Option>
+        ))}
+      </Select>
+      <Button
+        type="button"
+        variant="secondary"
+        icon={IconPlusLarge}
+        onClick={() => onAdd(value)}
+        disabled={!value || selectedFrameworkIds.has(value)}
+      >
+        {__("Add")}
+      </Button>
+    </div>
+  );
+}
+
+function FrameworkSection<T extends FieldValues = FieldValues>({
+  frameworkId,
+  isExpanded,
+  onToggle,
+  onRemove,
+  control,
+  name,
+  frameworkDataMap,
+  setFrameworkDataMap,
+}: {
+  frameworkId: string;
+  isExpanded: boolean;
+  onToggle: () => void;
+  onRemove: () => void;
+  control: Control<T>;
+  name: string;
+  frameworkDataMap: Map<string, FrameworkData>;
+  setFrameworkDataMap: React.Dispatch<React.SetStateAction<Map<string, FrameworkData>>>;
+}) {
+  const { __ } = useTranslate();
+  const data = useLazyLoadQuery<StateOfApplicabilityControlsFieldFrameworkControlsQuery>(
+    frameworkControlsQuery,
+    { frameworkId },
+    { fetchPolicy: "network-only" }
+  );
+
+  const framework = data?.framework && "controls" in data.framework ? data.framework : null;
+  const frameworkName: string = framework && "name" in framework && typeof framework.name === "string" ? framework.name : "";
+  const controls: Array<{ id: string; sectionTitle: string; name: string }> = useMemo(
+    () =>
+      (framework?.controls?.edges
+        ?.map((edge) => edge.node)
+        .filter((node): node is NonNullable<typeof node> => node !== null)) ?? [],
+    [framework]
+  );
+
+  useEffect(() => {
+    if (framework && !frameworkDataMap.has(frameworkId)) {
+      setFrameworkDataMap((prev) => {
+        const newMap = new Map(prev);
+        newMap.set(frameworkId, {
+          id: frameworkId,
+          name: frameworkName,
+          controls,
+        });
+        return newMap;
+      });
+    }
+  }, [framework, frameworkId, frameworkName, controls, frameworkDataMap, setFrameworkDataMap]);
+
+  const cachedData = frameworkDataMap.get(frameworkId);
+  const displayName: string = cachedData?.name || frameworkName;
+  const displayControls: Array<{ id: string; sectionTitle: string; name: string }> = cachedData?.controls || controls;
+
+  return (
+    <div className="border border-border-low rounded-lg">
+      <div className="flex items-center justify-between p-4">
+        <button
+          type="button"
+          onClick={onToggle}
+          className="flex items-center gap-2 flex-1 text-left hover:bg-subtle -m-4 p-4 rounded-lg"
+        >
+          {isExpanded ? (
+            <IconChevronUp size={16} className="text-txt-tertiary" />
+          ) : (
+            <IconChevronDown size={16} className="text-txt-tertiary" />
+          )}
+          <span className="font-medium text-txt-primary">{displayName}</span>
+          <span className="text-sm text-txt-tertiary">
+            ({displayControls.length} {__("controls")})
+          </span>
+        </button>
+        <Button
+          type="button"
+          variant="secondary"
+          icon={IconTrashCan}
+          onClick={onRemove}
+          className="ml-2"
+        >
+          {__("Remove")}
+        </Button>
+      </div>
+
+      {isExpanded && (
+        <div className="border-t border-border-low">
+          <Controller
+            control={control}
+            name={name as Path<T>}
+            render={({ field }) => {
+              const selectedControls: ControlSelection[] = (Array.isArray(field.value) ? field.value : []) as ControlSelection[];
+              const selectedControlIds = new Set(
+                selectedControls.map((c: ControlSelection) => c.controlId)
+              );
+
+              const toggleControl = (controlId: string) => {
+                const isSelected = selectedControlIds.has(controlId);
+                if (isSelected) {
+                  field.onChange(
+                    selectedControls.filter((c: ControlSelection) => c.controlId !== controlId)
+                  );
+                } else {
+                  field.onChange([
+                    ...selectedControls,
+                    {
+                      controlId,
+                      state: "IMPLEMENTED" as const,
+                      exclusionJustification: undefined,
+                    },
+                  ]);
+                }
+              };
+
+              const updateControlState = (
+                controlId: string,
+                state: "EXCLUDED" | "IMPLEMENTED" | "NOT_IMPLEMENTED"
+              ) => {
+                field.onChange(
+                  selectedControls.map((c: ControlSelection) =>
+                    c.controlId === controlId ? { ...c, state } : c
+                  )
+                );
+              };
+
+              const updateJustification = (
+                controlId: string,
+                exclusionJustification: string
+              ) => {
+                field.onChange(
+                  selectedControls.map((c: ControlSelection) =>
+                    c.controlId === controlId
+                      ? { ...c, exclusionJustification }
+                      : c
+                  )
+                );
+              };
+
+              const getControlState = (controlId: string) => {
+                const selected = selectedControls.find((c: ControlSelection) => c.controlId === controlId);
+                return selected?.state || "IMPLEMENTED";
+              };
+
+              const getExclusionJustification = (controlId: string) => {
+                const selected = selectedControls.find((c: ControlSelection) => c.controlId === controlId);
+                return selected?.exclusionJustification || "";
+              };
+
+              const selectAll = () => {
+                const newSelectedControls: ControlSelection[] = [...selectedControls];
+                displayControls.forEach((ctrl) => {
+                  if (!selectedControlIds.has(ctrl.id)) {
+                    newSelectedControls.push({
+                      controlId: ctrl.id,
+                      state: "IMPLEMENTED" as const,
+                      exclusionJustification: undefined,
+                    });
+                  }
+                });
+                field.onChange(newSelectedControls);
+              };
+
+              const deselectAll = () => {
+                const controlIdsToRemove = new Set(displayControls.map((ctrl) => ctrl.id));
+                const newSelectedControls = selectedControls.filter(
+                  (c: ControlSelection) => !controlIdsToRemove.has(c.controlId)
+                );
+                field.onChange(newSelectedControls);
+              };
+
+              const allSelected = displayControls.length > 0 && displayControls.every((ctrl) => selectedControlIds.has(ctrl.id));
+
+              return (
+                <div className="p-4 space-y-4">
+                  {displayControls.length > 0 && (
+                    <div className="flex justify-end">
+                      <Button
+                        type="button"
+                        variant="quaternary"
+                        onClick={allSelected ? deselectAll : selectAll}
+                        className="text-xs h-7 min-h-7"
+                      >
+                        {allSelected ? __("Deselect All") : __("Select All")}
+                      </Button>
+                    </div>
+                  )}
+                  <div className="border border-border-low rounded-lg max-h-96 overflow-y-auto">
+                    {displayControls.length === 0 ? (
+                      <div className="p-4 text-center text-txt-tertiary">
+                        {__("No controls found in this framework")}
+                      </div>
+                    ) : (
+                      <div className="divide-y divide-border-low">
+                        {displayControls.map((ctrl) => {
+                          const isSelected = selectedControlIds.has(ctrl.id);
+                          const state = getControlState(ctrl.id);
+                          const exclusionJustification = getExclusionJustification(
+                            ctrl.id
+                          );
+
+                          return (
+                            <div key={ctrl.id} className="p-4 space-y-3">
+                              <div className="flex items-start gap-3">
+                                <Checkbox
+                                  checked={isSelected}
+                                  onChange={() => toggleControl(ctrl.id)}
+                                />
+                                <div className="flex-1 min-w-0">
+                                  <div className="font-medium">
+                                    {ctrl.sectionTitle}: {ctrl.name}
+                                  </div>
+                                </div>
+                              </div>
+
+                              {isSelected && (
+                                <div className="ml-7 space-y-2">
+                                  <Field label={__("State")}>
+                                    <Select
+                                      variant="editor"
+                                      value={state}
+                                      onValueChange={(value) =>
+                                        updateControlState(
+                                          ctrl.id,
+                                          value as
+                                            | "EXCLUDED"
+                                            | "IMPLEMENTED"
+                                            | "NOT_IMPLEMENTED"
+                                        )
+                                      }
+                                      className="w-full"
+                                    >
+                                      <Option value="IMPLEMENTED">
+                                        {__("Implemented")}
+                                      </Option>
+                                      <Option value="NOT_IMPLEMENTED">
+                                        {__("Not Implemented")}
+                                      </Option>
+                                      <Option value="EXCLUDED">
+                                        {__("Excluded")}
+                                      </Option>
+                                    </Select>
+                                  </Field>
+
+                                  {state === "EXCLUDED" || state === "NOT_IMPLEMENTED" && (
+                                    <Field label={__("Justification")}>
+                                      <Textarea
+                                        value={exclusionJustification}
+                                        onChange={(e) =>
+                                          updateJustification(
+                                            ctrl.id,
+                                            e.target.value
+                                          )
+                                        }
+                                        placeholder={__(
+                                          "Reason for exclusion"
+                                        )}
+                                        autogrow
+                                      />
+                                    </Field>
+                                  )}
+                                </div>
+                              )}
+                            </div>
+                          );
+                        })}
+                      </div>
+                    )}
+                  </div>
+                </div>
+              );
+            }}
+          />
+        </div>
+      )}
+    </div>
+  );
+}

apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql.ts

@@ -0,0 +1,197 @@
+/**
+ * @generated SignedSource<<760a4c9ef58d487ab996d36a6cf1aa21>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery$variables = {
+  frameworkId: string;
+};
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery$data = {
+  readonly framework: {
+    readonly controls?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+          readonly sectionTitle: string;
+        };
+      }>;
+    };
+    readonly id?: string;
+  };
+};
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery = {
+  response: StateOfApplicabilityControlsFieldFrameworkControlsQuery$data;
+  variables: StateOfApplicabilityControlsFieldFrameworkControlsQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "frameworkId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "frameworkId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "first",
+      "value": 500
+    },
+    {
+      "kind": "Literal",
+      "name": "orderBy",
+      "value": {
+        "direction": "ASC",
+        "field": "SECTION_TITLE"
+      }
+    }
+  ],
+  "concreteType": "ControlConnection",
+  "kind": "LinkedField",
+  "name": "controls",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "ControlEdge",
+      "kind": "LinkedField",
+      "name": "edges",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "Control",
+          "kind": "LinkedField",
+          "name": "node",
+          "plural": false,
+          "selections": [
+            (v2/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "sectionTitle",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "name",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": "controls(first:500,orderBy:{\"direction\":\"ASC\",\"field\":\"SECTION_TITLE\"})"
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "selections": [
+      {
+        "alias": "framework",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/)
+            ],
+            "type": "Framework",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "selections": [
+      {
+        "alias": "framework",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/)
+            ],
+            "type": "Framework",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "4e57853f9452f6167ef9dd2521f0b998",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsFieldFrameworkControlsQuery(\n  $frameworkId: ID!\n) {\n  framework: node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      controls(first: 500, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n        edges {\n          node {\n            id\n            sectionTitle\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "2817a6951ce5ad1efdee9951636916ff";
+
+export default node;

apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql.ts

@@ -0,0 +1,172 @@
+/**
+ * @generated SignedSource<<09147ad036a4ae9295cd5fc5242f6ee7>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityControlsFieldFrameworksQuery$variables = {
+  organizationId: string;
+};
+export type StateOfApplicabilityControlsFieldFrameworksQuery$data = {
+  readonly organization: {
+    readonly frameworks?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+        };
+      }>;
+    };
+  };
+};
+export type StateOfApplicabilityControlsFieldFrameworksQuery = {
+  response: StateOfApplicabilityControlsFieldFrameworksQuery$data;
+  variables: StateOfApplicabilityControlsFieldFrameworksQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 100
+        }
+      ],
+      "concreteType": "FrameworkConnection",
+      "kind": "LinkedField",
+      "name": "frameworks",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "FrameworkEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "Framework",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": "frameworks(first:100)"
+    }
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v3/*: any*/),
+          (v2/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "88fe75a1aeca2c9971693ed79bf82afe",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsFieldFrameworksQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      frameworks(first: 100) {\n        edges {\n          node {\n            id\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "5a0adc0c46445f40980fdb8edb8122ce";
+
+export default node;

apps/console/src/components/snapshots/__generated__/LinkedSnapshotsCardFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<0b0392559fe2c7b5b92bec1b1131f9c6>>
+ * @generated SignedSource<<18ad235cee2891b222acb016b8986050>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type LinkedSnapshotsCardFragment$data = {
   readonly createdAt: any;

apps/console/src/components/snapshots/__generated__/LinkedSnapshotsDialogFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<21edb2424074940efad82c63929642c8>>
+ * @generated SignedSource<<4b2fe0335336a1c3888d8da35ffd8e58>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type LinkedSnapshotsDialogFragment$data = {
   readonly id: string;

apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityCard.tsx

@@ -0,0 +1,248 @@
+import { graphql } from "relay-runtime";
+import {
+  Card,
+  IconPlusLarge,
+  Button,
+  Tr,
+  Td,
+  Table,
+  Thead,
+  Tbody,
+  Th,
+  IconChevronDown,
+  IconTrashCan,
+  TrButton,
+  Badge,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import type { LinkedStatesOfApplicabilityCardFragment$key } from "./__generated__/LinkedStatesOfApplicabilityCardFragment.graphql";
+import { useFragment } from "react-relay";
+import { useMemo, useState, useEffect } from "react";
+import { sprintf } from "@probo/helpers";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import { LinkedStatesOfApplicabilityDialog } from "./LinkedStatesOfApplicabilityDialog";
+import clsx from "clsx";
+
+const linkedStateOfApplicabilityFragment = graphql`
+  fragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {
+    id
+    stateOfApplicabilityId
+    controlId
+    stateOfApplicability {
+      id
+      name
+    }
+    applicability
+    justification
+  }
+`;
+
+type AttachMutation<Params> = (p: {
+  variables: {
+    input: {
+      stateOfApplicabilityId: string;
+      applicability: boolean;
+      justification: string | null;
+    } & Params;
+    connections: string[];
+  };
+}) => void;
+
+type DetachMutation = (p: {
+  variables: {
+    input: {
+      stateOfApplicabilityId: string;
+      controlId: string;
+    };
+    connections: string[];
+  };
+}) => void;
+
+type Props<Params> = {
+  statesOfApplicability: readonly (LinkedStatesOfApplicabilityCardFragment$key & { id: string })[];
+  params: Params;
+  disabled?: boolean;
+  connectionId: string;
+  onAttach: AttachMutation<Params>;
+  onDetach: DetachMutation;
+  variant?: "card" | "table";
+  readOnly?: boolean;
+};
+
+export function LinkedStatesOfApplicabilityCard<Params>(props: Props<Params>) {
+  const { __ } = useTranslate();
+
+  const [limit, setLimit] = useState<number | null>(
+    props.variant === "card" ? 4 : null
+  );
+
+  const [linkedInfo, setLinkedInfo] = useState<{ stateOfApplicabilityId: string; controlId: string }[]>([]);
+
+  const statesOfApplicability = useMemo(() => {
+    return limit ? props.statesOfApplicability.slice(0, limit) : props.statesOfApplicability;
+  }, [props.statesOfApplicability, limit]);
+
+  const showMoreButton = limit !== null && props.statesOfApplicability.length > limit;
+  const variant = props.variant ?? "table";
+
+  const linkedData = linkedInfo;
+
+  const onAttach = (stateOfApplicabilityId: string, applicability: boolean, justification: string | null) => {
+    props.onAttach({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          applicability,
+          justification,
+          ...props.params,
+        },
+        connections: [props.connectionId],
+      },
+    });
+  };
+
+  const onDetach = (stateOfApplicabilityId: string, controlId: string) => {
+    props.onDetach({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          controlId,
+        },
+        connections: [props.connectionId],
+      },
+    });
+  };
+
+  const Wrapper = variant === "card" ? Card : "div";
+
+  return (
+    <Wrapper padded className="space-y-[10px]">
+      {props.statesOfApplicability.map((soa, idx) => (
+        <LinkedInfoExtractor
+          key={idx}
+          fragment={soa}
+          onExtracted={(info) => {
+            setLinkedInfo(prev => {
+              const exists = prev.some(p =>
+                p.stateOfApplicabilityId === info.stateOfApplicabilityId &&
+                p.controlId === info.controlId
+              );
+              return exists ? prev : [...prev, info];
+            });
+          }}
+        />
+      ))}
+      {variant === "card" && (
+        <div className="flex justify-between">
+          <div className="text-lg font-semibold">{__("States of Applicability")}</div>
+          {!props.readOnly && (
+            <LinkedStatesOfApplicabilityDialog
+              connectionId={props.connectionId}
+              disabled={props.disabled}
+              linkedStatesOfApplicability={linkedData}
+              onLink={onAttach}
+              onUnlink={onDetach}
+            >
+              <Button variant="tertiary" icon={IconPlusLarge}>
+                {__("Link state of applicability")}
+              </Button>
+            </LinkedStatesOfApplicabilityDialog>
+          )}
+        </div>
+      )}
+      <Table className={clsx(variant === "card" && "bg-invert")}>
+        <Thead>
+          <Tr>
+            <Th>{__("Name")}</Th>
+            <Th>{__("Applicability")}</Th>
+            <Th>{__("Justification")}</Th>
+            {!props.readOnly && <Th></Th>}
+          </Tr>
+        </Thead>
+        <Tbody>
+          {statesOfApplicability.length === 0 && (
+            <Tr>
+              <Td colSpan={props.readOnly ? 3 : 4} className="text-center text-txt-secondary">
+                {__("No states of applicability linked")}
+              </Td>
+            </Tr>
+          )}
+          {statesOfApplicability.map((soa) => (
+            <StateOfApplicabilityRow key={soa.id} stateOfApplicability={soa} onClick={onDetach} readOnly={props.readOnly} />
+          ))}
+          {variant === "table" && !props.readOnly && (
+            <LinkedStatesOfApplicabilityDialog
+              connectionId={props.connectionId}
+              disabled={props.disabled}
+              linkedStatesOfApplicability={linkedData}
+              onLink={onAttach}
+              onUnlink={onDetach}
+            >
+              <TrButton colspan={4} icon={IconPlusLarge}>
+                {__("Link state of applicability")}
+              </TrButton>
+            </LinkedStatesOfApplicabilityDialog>
+          )}
+        </Tbody>
+      </Table>
+      {showMoreButton && (
+        <Button
+          variant="tertiary"
+          icon={IconChevronDown}
+          onClick={() => setLimit(null)}
+        >
+          {sprintf(__("Show %d more"), props.statesOfApplicability.length - limit!)}
+        </Button>
+      )}
+    </Wrapper>
+  );
+}
+
+function LinkedInfoExtractor(props: {
+  fragment: LinkedStatesOfApplicabilityCardFragment$key;
+  onExtracted: (info: { stateOfApplicabilityId: string; controlId: string }) => void;
+}) {
+  const data = useFragment(linkedStateOfApplicabilityFragment, props.fragment);
+
+  useEffect(() => {
+    props.onExtracted({
+      stateOfApplicabilityId: data.stateOfApplicabilityId,
+      controlId: data.controlId,
+    });
+  }, [data.stateOfApplicabilityId, data.controlId, props.onExtracted]);
+
+  return null;
+}
+
+function StateOfApplicabilityRow(props: {
+  stateOfApplicability: LinkedStatesOfApplicabilityCardFragment$key & { id: string };
+  onClick: (stateOfApplicabilityId: string, controlId: string) => void;
+  readOnly?: boolean;
+}) {
+  const soa = useFragment(linkedStateOfApplicabilityFragment, props.stateOfApplicability);
+  const organizationId = useOrganizationId();
+  const { __ } = useTranslate();
+
+  return (
+    <Tr to={`/organizations/${organizationId}/states-of-applicability/${soa.stateOfApplicabilityId}`}>
+      <Td>{soa.stateOfApplicability.name}</Td>
+      <Td>
+        <Badge variant={soa.applicability ? "success" : "danger"}>
+          {soa.applicability ? __("Applicable") : __("Not Applicable")}
+        </Badge>
+      </Td>
+      <Td>{soa.justification || "-"}</Td>
+      {!props.readOnly && (
+        <Td noLink width={50} className="text-end">
+          <Button
+            variant="secondary"
+            onClick={() => props.onClick(soa.stateOfApplicabilityId, soa.controlId)}
+            icon={IconTrashCan}
+          >
+            {__("Unlink")}
+          </Button>
+        </Td>
+      )}
+    </Tr>
+  );
+}

apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityDialog.tsx

@@ -0,0 +1,180 @@
+import { useTranslate } from "@probo/i18n";
+import { Dialog, DialogContent, DialogFooter, Button, Checkbox, Textarea, Badge } from "@probo/ui";
+import { Suspense, useState, useRef } from "react";
+import type { ReactNode } from "react";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "relay-runtime";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { LinkedStatesOfApplicabilityDialogQuery } from "./__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql";
+
+const query = graphql`
+  query LinkedStatesOfApplicabilityDialogQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        statesOfApplicability(first: 100) {
+          edges {
+            node {
+              id
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+type LinkedSOAInfo = {
+  stateOfApplicabilityId: string;
+  controlId: string;
+};
+
+type Props = {
+  children: ReactNode;
+  connectionId: string;
+  disabled?: boolean;
+  linkedStatesOfApplicability: readonly LinkedSOAInfo[];
+  onLink: (stateOfApplicabilityId: string, applicability: boolean, justification: string | null) => void;
+  onUnlink: (stateOfApplicabilityId: string, controlId: string) => void;
+};
+
+export function LinkedStatesOfApplicabilityDialog({ children, ...props }: Props) {
+  const dialogRef = useRef<{ open: () => void; close: () => void }>(null);
+
+  return (
+    <Dialog ref={dialogRef} trigger={children} title="Link State of Applicability">
+      <Suspense fallback={<div>Loading...</div>}>
+        <LinkedStatesOfApplicabilityDialogContent {...props} onClose={() => dialogRef.current?.close()} />
+      </Suspense>
+    </Dialog>
+  );
+}
+
+function LinkedStatesOfApplicabilityDialogContent(props: Omit<Props, "children"> & { onClose: () => void }) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const [selectedSOA, setSelectedSOA] = useState<{ id: string; name: string } | null>(null);
+  const [applicability, setApplicability] = useState(true);
+  const [justification, setJustification] = useState("");
+
+  const data = useLazyLoadQuery<LinkedStatesOfApplicabilityDialogQuery>(query, {
+    organizationId,
+  }, { fetchPolicy: "network-only" });
+
+  const linkedSOAIds = new Set(props.linkedStatesOfApplicability.map((soa) => soa.stateOfApplicabilityId));
+  const linkedSOAMap = new Map(props.linkedStatesOfApplicability.map((soa) => [soa.stateOfApplicabilityId, soa]));
+  const statesOfApplicability = data.organization?.statesOfApplicability?.edges.map((edge) => edge.node) ?? [];
+
+  const handleSelectSOA = (soa: { id: string; name: string }) => {
+    setSelectedSOA(soa);
+    setApplicability(true);
+    setJustification("");
+  };
+
+  const handleLink = () => {
+    if (selectedSOA) {
+      props.onLink(selectedSOA.id, applicability, justification.trim() || null);
+      props.onClose();
+    }
+  };
+
+  const handleUnlink = (stateOfApplicabilityId: string) => {
+    const linkedSOA = linkedSOAMap.get(stateOfApplicabilityId);
+    if (linkedSOA) {
+      props.onUnlink(linkedSOA.stateOfApplicabilityId, linkedSOA.controlId);
+    }
+  };
+
+  return (
+    <>
+      <DialogContent padded className="space-y-4">
+        {statesOfApplicability.length === 0 ? (
+          <div className="flex flex-col items-center justify-center py-12 text-center">
+            <div className="text-txt-secondary text-base mb-2">
+              {__("No states of applicability available")}
+            </div>
+            <div className="text-txt-tertiary text-sm">
+              {__("Create a state of applicability first to link it to this control")}
+            </div>
+          </div>
+        ) : !selectedSOA ? (
+          <div className="space-y-2">
+            <div className="text-sm font-medium mb-2">{__("Select a state of applicability:")}</div>
+            {statesOfApplicability.map((soa) => {
+              const isLinked = linkedSOAIds.has(soa.id);
+              return (
+                <div
+                  key={soa.id}
+                  className={`border border-border-low rounded-lg p-3 flex items-center justify-between ${!isLinked ? 'hover:bg-hover cursor-pointer' : ''}`}
+                  onClick={() => !isLinked && handleSelectSOA(soa)}
+                >
+                  <div className="font-medium">{soa.name}</div>
+                  {isLinked ? (
+                    <div className="flex items-center gap-2" onClick={(e) => e.stopPropagation()}>
+                      <Badge variant="success">{__("Linked")}</Badge>
+                      <Button
+                        variant="danger"
+                        onClick={() => handleUnlink(soa.id)}
+                        disabled={props.disabled}
+                      >
+                        {__("Unlink")}
+                      </Button>
+                    </div>
+                  ) : null}
+                </div>
+              );
+            })}
+          </div>
+        ) : (
+          <div className="space-y-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <div className="text-sm text-txt-secondary mb-1">{__("Selected:")}</div>
+                <div className="text-lg font-medium">{selectedSOA.name}</div>
+              </div>
+              <Button variant="tertiary" onClick={() => setSelectedSOA(null)}>
+                {__("Change")}
+              </Button>
+            </div>
+
+            <div className="border-t border-border-low pt-4 space-y-3">
+              <label className="flex items-center gap-2 cursor-pointer">
+                <Checkbox
+                  checked={applicability}
+                  onChange={(checked) => setApplicability(checked)}
+                />
+                <span className="font-medium">{__("Applicable")}</span>
+              </label>
+
+              <div>
+                <label className="text-sm font-medium mb-1 block">
+                  {__("Justification (optional)")}
+                </label>
+                <Textarea
+                  placeholder={__("Add a justification...")}
+                  value={justification}
+                  onChange={(e) => setJustification(e.target.value)}
+                  rows={3}
+                />
+              </div>
+            </div>
+          </div>
+        )}
+      </DialogContent>
+      <DialogFooter exitLabel={__("Close")}>
+        {selectedSOA ? (
+          <>
+            <Button variant="secondary" onClick={() => setSelectedSOA(null)}>
+              {__("Back")}
+            </Button>
+            <Button variant="primary" onClick={handleLink} disabled={props.disabled}>
+              {__("Link")}
+            </Button>
+          </>
+        ) : (
+          <></>
+        )}
+      </DialogFooter>
+    </>
+  );
+}

apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityCardFragment.graphql.ts

@@ -0,0 +1,100 @@
+/**
+ * @generated SignedSource<<fa19c3e1b91d31188625e48b8b6db7e9>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type LinkedStatesOfApplicabilityCardFragment$data = {
+  readonly applicability: boolean;
+  readonly controlId: string;
+  readonly id: string;
+  readonly justification: string | null | undefined;
+  readonly stateOfApplicability: {
+    readonly id: string;
+    readonly name: string;
+  };
+  readonly stateOfApplicabilityId: string;
+  readonly " $fragmentType": "LinkedStatesOfApplicabilityCardFragment";
+};
+export type LinkedStatesOfApplicabilityCardFragment$key = {
+  readonly " $data"?: LinkedStatesOfApplicabilityCardFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+};
+
+const node: ReaderFragment = (function(){
+var v0 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": null,
+  "name": "LinkedStatesOfApplicabilityCardFragment",
+  "selections": [
+    (v0/*: any*/),
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "stateOfApplicabilityId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "controlId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "StateOfApplicability",
+      "kind": "LinkedField",
+      "name": "stateOfApplicability",
+      "plural": false,
+      "selections": [
+        (v0/*: any*/),
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "applicability",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "justification",
+      "storageKey": null
+    }
+  ],
+  "type": "StateOfApplicabilityControl",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "b9a9922b27f277a769025f11b0829bdc";
+
+export default node;

apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql.ts

@@ -0,0 +1,172 @@
+/**
+ * @generated SignedSource<<a49fb511ab396ea46b199b2ae08edfff>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type LinkedStatesOfApplicabilityDialogQuery$variables = {
+  organizationId: string;
+};
+export type LinkedStatesOfApplicabilityDialogQuery$data = {
+  readonly organization: {
+    readonly statesOfApplicability?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+        };
+      }>;
+    };
+  };
+};
+export type LinkedStatesOfApplicabilityDialogQuery = {
+  response: LinkedStatesOfApplicabilityDialogQuery$data;
+  variables: LinkedStatesOfApplicabilityDialogQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 100
+        }
+      ],
+      "concreteType": "StateOfApplicabilityConnection",
+      "kind": "LinkedField",
+      "name": "statesOfApplicability",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "StateOfApplicabilityEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "StateOfApplicability",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": "statesOfApplicability(first:100)"
+    }
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v3/*: any*/),
+          (v2/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "b36c3216f309865885892fce0d52eac9",
+    "id": null,
+    "metadata": {},
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "operationKind": "query",
+    "text": "query LinkedStatesOfApplicabilityDialogQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      statesOfApplicability(first: 100) {\n        edges {\n          node {\n            id\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "a6ed2cd0171d834480319779e11fce99";
+
+export default node;

apps/console/src/hooks/graph/FrameworkGraph.ts

@@ -100,6 +100,16 @@ export const frameworkControlNodeQuery = graphql`
         status
         exclusionJustification
         ...FrameworkControlDialogFragment
+        stateOfApplicabilityControls(first: 100)
+          @connection(key: "FrameworkGraphControl_stateOfApplicabilityControls") {
+          __id
+          edges {
+            node {
+              id
+              ...LinkedStatesOfApplicabilityCardFragment
+            }
+          }
+        }
         measures(first: 100)
           @connection(key: "FrameworkGraphControl_measures") {
           __id
@@ -130,6 +140,16 @@ export const frameworkControlNodeQuery = graphql`
             }
           }
         }
+        obligations(first: 100)
+          @connection(key: "FrameworkGraphControl_obligations") {
+          __id
+          edges {
+            node {
+              id
+              ...LinkedObligationsCardFragment
+            }
+          }
+        }
         snapshots(first: 100)
           @connection(key: "FrameworkGraphControl_snapshots") {
           __id

apps/console/src/hooks/graph/ObligationGraph.ts

@@ -29,6 +29,7 @@ export const obligationNodeQuery = graphql`
         requirement
         actionsToBeImplemented
         regulator
+        type
         lastReviewDate
         dueDate
         status
@@ -61,6 +62,7 @@ export const createObligationMutation = graphql`
           requirement
           actionsToBeImplemented
           regulator
+          type
           lastReviewDate
           dueDate
           status
@@ -85,6 +87,7 @@ export const updateObligationMutation = graphql`
         requirement
         actionsToBeImplemented
         regulator
+        type
         lastReviewDate
         dueDate
         status
@@ -151,6 +154,7 @@ export const useCreateObligation = (connectionId: string) => {
     requirement?: string;
     actionsToBeImplemented?: string;
     regulator?: string;
+    type: string;
     ownerId: string;
     lastReviewDate?: string;
     dueDate?: string;
@@ -172,6 +176,7 @@ export const useCreateObligation = (connectionId: string) => {
           requirement: input.requirement,
           actionsToBeImplemented: input.actionsToBeImplemented,
           regulator: input.regulator,
+          type: input.type,
           ownerId: input.ownerId,
           lastReviewDate: input.lastReviewDate,
           dueDate: input.dueDate,
@@ -194,6 +199,7 @@ export const useUpdateObligation = () => {
     requirement?: string;
     actionsToBeImplemented?: string;
     regulator?: string;
+    type?: string;
     ownerId?: string;
     lastReviewDate?: string | null;
     dueDate?: string | null;

apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts

@@ -0,0 +1,235 @@
+import { graphql } from "relay-runtime";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "./__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import type { StateOfApplicabilityGraphPaginatedFragment$key } from "./__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql";
+import {
+  useMutation,
+  usePaginationFragment,
+  usePreloadedQuery,
+  type PreloadedQuery,
+} from "react-relay";
+import { useConfirm, useToast } from "@probo/ui";
+import type { StateOfApplicabilityGraphDeleteMutation } from "./__generated__/StateOfApplicabilityGraphDeleteMutation.graphql";
+import {
+  promisifyMutation,
+  sprintf,
+  formatError,
+  type GraphQLError,
+} from "@probo/helpers";
+import { useTranslate } from "@probo/i18n";
+
+export const paginatedStateOfApplicabilityQuery = graphql`
+  query StateOfApplicabilityGraphPaginatedQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        id
+        ...StateOfApplicabilityGraphPaginatedFragment
+      }
+    }
+  }
+`;
+
+export const paginatedStateOfApplicabilityFragment = graphql`
+  fragment StateOfApplicabilityGraphPaginatedFragment on Organization
+  @refetchable(queryName: "StateOfApplicabilityListQuery")
+  @argumentDefinitions(
+    first: { type: "Int", defaultValue: 50 }
+    order: {
+      type: "StateOfApplicabilityOrder"
+      defaultValue: { direction: DESC, field: CREATED_AT }
+    }
+    after: { type: "CursorKey", defaultValue: null }
+    before: { type: "CursorKey", defaultValue: null }
+    last: { type: "Int", defaultValue: null }
+    filter: { type: "StateOfApplicabilityFilter", defaultValue: { snapshotId: null } }
+  ) {
+    statesOfApplicability(
+      first: $first
+      after: $after
+      last: $last
+      before: $before
+      orderBy: $order
+      filter: $filter
+    ) @connection(key: "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability") {
+      __id
+      edges {
+        node {
+          id
+          name
+          sourceId
+          snapshotId
+          createdAt
+          updatedAt
+          controlsInfo: controls(first: 0) {
+            totalCount
+          }
+        }
+      }
+    }
+  }
+`;
+
+export function useStateOfApplicabilityQuery(
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>,
+) {
+  const data = usePreloadedQuery(paginatedStateOfApplicabilityQuery, queryRef);
+  const pagination = usePaginationFragment(
+    paginatedStateOfApplicabilityFragment,
+    data.organization as StateOfApplicabilityGraphPaginatedFragment$key,
+  );
+  const statesOfApplicability = pagination.data.statesOfApplicability?.edges.map((edge) => edge.node);
+  return {
+    ...pagination,
+    statesOfApplicability,
+    connectionId: pagination.data.statesOfApplicability.__id,
+  };
+}
+
+export const deleteStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphDeleteMutation(
+    $input: DeleteStateOfApplicabilityInput!
+    $connections: [ID!]!
+  ) {
+    deleteStateOfApplicability(input: $input) {
+      deletedStateOfApplicabilityId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
+export const StateOfApplicabilityConnectionKey = "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability";
+
+export const useDeleteStateOfApplicability = (
+  stateOfApplicability: { id?: string; name?: string },
+  connectionId: string,
+  onSuccess?: () => void,
+) => {
+  const [mutate] = useMutation<StateOfApplicabilityGraphDeleteMutation>(deleteStateOfApplicabilityMutation);
+  const confirm = useConfirm();
+  const { toast } = useToast();
+  const { __ } = useTranslate();
+
+  return () => {
+    if (!stateOfApplicability.id || !stateOfApplicability.name) {
+      return alert(__("Failed to delete state of applicability: missing id or name"));
+    }
+    confirm(
+      () =>
+        promisifyMutation(mutate)({
+          variables: {
+            input: {
+              stateOfApplicabilityId: stateOfApplicability.id!,
+            },
+            connections: [connectionId],
+          },
+        })
+          .then(() => {
+            onSuccess?.();
+          })
+          .catch((error) => {
+            toast({
+              title: __("Error"),
+              description: formatError(
+                __("Failed to delete state of applicability"),
+                error as GraphQLError,
+              ),
+              variant: "error",
+            });
+          }),
+      {
+        message: sprintf(
+          __(
+            'This will permanently delete "%s". This action cannot be undone.',
+          ),
+          stateOfApplicability.name,
+        ),
+      },
+    );
+  };
+};
+
+export const createStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphCreateMutation(
+    $input: CreateStateOfApplicabilityInput!
+    $connections: [ID!]!
+  ) {
+    createStateOfApplicability(input: $input) {
+      stateOfApplicabilityEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          name
+          sourceId
+          snapshotId
+          createdAt
+          updatedAt
+        }
+      }
+    }
+  }
+`;
+
+export const updateStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphUpdateMutation(
+    $input: UpdateStateOfApplicabilityInput!
+  ) {
+    updateStateOfApplicability(input: $input) {
+      stateOfApplicability {
+        id
+        name
+        sourceId
+        snapshotId
+        createdAt
+        updatedAt
+        owner {
+          id
+          fullName
+        }
+      }
+    }
+  }
+`;
+
+export const stateOfApplicabilityNodeQuery = graphql`
+  query StateOfApplicabilityGraphNodeQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        name
+        sourceId
+        snapshotId
+        createdAt
+        updatedAt
+        organization {
+          id
+        }
+        owner {
+          id
+          fullName
+        }
+        ...StateOfApplicabilityControlsTabFragment
+      }
+    }
+  }
+`;
+
+export const stateOfApplicabilityForEditQuery = graphql`
+  query StateOfApplicabilityGraphForEditQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        name
+        controls(first: 1000, orderBy: { field: SECTION_TITLE, direction: ASC }) {
+          edges {
+            node {
+              id
+              sectionTitle
+              name
+              framework {
+                id
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;

apps/console/src/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<54b072cf5a78b17f86e5fc810cac517a>>
+ * @generated SignedSource<<ec1b843d1afb3a82c747b8580b528fda>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -47,6 +47,15 @@ export type FrameworkGraphControlNodeQuery$data = {
       }>;
     };
     readonly name?: string;
+    readonly obligations?: {
+      readonly __id: string;
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly " $fragmentSpreads": FragmentRefs<"LinkedObligationsCardFragment">;
+        };
+      }>;
+    };
     readonly sectionTitle?: string;
     readonly snapshots?: {
       readonly __id: string;
@@ -57,6 +66,15 @@ export type FrameworkGraphControlNodeQuery$data = {
         };
       }>;
     };
+    readonly stateOfApplicabilityControls?: {
+      readonly __id: string;
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+        };
+      }>;
+    };
     readonly status?: ControlStatus;
     readonly " $fragmentSpreads": FragmentRefs<"FrameworkControlDialogFragment">;
   };
@@ -181,14 +199,18 @@ v12 = [
     "value": 100
   }
 ],
-v13 = {
+v13 = [
+  (v2/*: any*/),
+  (v3/*: any*/)
+],
+v14 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "state",
   "storageKey": null
 },
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -224,6 +246,49 @@ return {
                 "kind": "FragmentSpread",
                 "name": "FrameworkControlDialogFragment"
               },
+              {
+                "alias": "stateOfApplicabilityControls",
+                "args": null,
+                "concreteType": "StateOfApplicabilityControlConnection",
+                "kind": "LinkedField",
+                "name": "__FrameworkGraphControl_stateOfApplicabilityControls_connection",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityControlEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicabilityControl",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "args": null,
+                            "kind": "FragmentSpread",
+                            "name": "LinkedStatesOfApplicabilityCardFragment"
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": null
+              },
               {
                 "alias": "measures",
                 "args": null,
@@ -353,6 +418,49 @@ return {
                 ],
                 "storageKey": null
               },
+              {
+                "alias": "obligations",
+                "args": null,
+                "concreteType": "ObligationConnection",
+                "kind": "LinkedField",
+                "name": "__FrameworkGraphControl_obligations_connection",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "ObligationEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Obligation",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "args": null,
+                            "kind": "FragmentSpread",
+                            "name": "LinkedObligationsCardFragment"
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": null
+              },
               {
                 "alias": "snapshots",
                 "args": null,
@@ -431,6 +539,98 @@ return {
               (v5/*: any*/),
               (v6/*: any*/),
               (v7/*: any*/),
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "bestPractice",
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "concreteType": "StateOfApplicabilityControlConnection",
+                "kind": "LinkedField",
+                "name": "stateOfApplicabilityControls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityControlEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicabilityControl",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "stateOfApplicabilityId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "controlId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "concreteType": "StateOfApplicability",
+                            "kind": "LinkedField",
+                            "name": "stateOfApplicability",
+                            "plural": false,
+                            "selections": (v13/*: any*/),
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "applicability",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "justification",
+                            "storageKey": null
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": "stateOfApplicabilityControls(first:100)"
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "FrameworkGraphControl_stateOfApplicabilityControls",
+                "kind": "LinkedHandle",
+                "name": "stateOfApplicabilityControls"
+              },
               {
                 "alias": null,
                 "args": (v12/*: any*/),
@@ -457,7 +657,7 @@ return {
                         "selections": [
                           (v2/*: any*/),
                           (v3/*: any*/),
-                          (v13/*: any*/),
+                          (v14/*: any*/),
                           (v8/*: any*/)
                         ],
                         "storageKey": null
@@ -512,7 +712,7 @@ return {
                             "name": "title",
                             "storageKey": null
                           },
-                          (v14/*: any*/),
+                          (v15/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -609,8 +809,8 @@ return {
                         "selections": [
                           (v2/*: any*/),
                           (v3/*: any*/),
+                          (v15/*: any*/),
                           (v14/*: any*/),
-                          (v13/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -632,10 +832,7 @@ return {
                             "kind": "LinkedField",
                             "name": "framework",
                             "plural": false,
-                            "selections": [
-                              (v2/*: any*/),
-                              (v3/*: any*/)
-                            ],
+                            "selections": (v13/*: any*/),
                             "storageKey": null
                           },
                           (v8/*: any*/)
@@ -660,6 +857,94 @@ return {
                 "kind": "LinkedHandle",
                 "name": "audits"
               },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "concreteType": "ObligationConnection",
+                "kind": "LinkedField",
+                "name": "obligations",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "ObligationEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Obligation",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "requirement",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "area",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "source",
+                            "storageKey": null
+                          },
+                          (v6/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "concreteType": "People",
+                            "kind": "LinkedField",
+                            "name": "owner",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fullName",
+                                "storageKey": null
+                              },
+                              (v2/*: any*/)
+                            ],
+                            "storageKey": null
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": "obligations(first:100)"
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "FrameworkGraphControl_obligations",
+                "kind": "LinkedHandle",
+                "name": "obligations"
+              },
               {
                 "alias": null,
                 "args": (v12/*: any*/),
@@ -694,7 +979,7 @@ return {
                             "name": "type",
                             "storageKey": null
                           },
-                          (v14/*: any*/),
+                          (v15/*: any*/),
                           (v8/*: any*/)
                         ],
                         "storageKey": null
@@ -727,10 +1012,19 @@ return {
     ]
   },
   "params": {
-    "cacheID": "2ce9eb2cbe052019e86b2d0baecfb6f0",
+    "cacheID": "f7773b474bf5f22e9a7075c685839001",
     "id": null,
     "metadata": {
       "connection": [
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "node",
+            "stateOfApplicabilityControls"
+          ]
+        },
         {
           "count": null,
           "cursor": null,
@@ -758,6 +1052,15 @@ return {
             "audits"
           ]
         },
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "node",
+            "obligations"
+          ]
+        },
         {
           "count": null,
           "cursor": null,
@@ -771,11 +1074,11 @@ return {
     },
     "name": "FrameworkGraphControlNodeQuery",
     "operationKind": "query",
-    "text": "query FrameworkGraphControlNodeQuery(\n  $controlId: ID!\n) {\n  node(id: $controlId) {\n    __typename\n    ... on Control {\n      id\n      name\n      sectionTitle\n      description\n      status\n      exclusionJustification\n      ...FrameworkControlDialogFragment\n      measures(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedMeasuresCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedDocumentsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedAuditsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      snapshots(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedSnapshotsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n\nfragment LinkedAuditsCardFragment on Audit {\n  id\n  name\n  createdAt\n  state\n  validFrom\n  validUntil\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment LinkedMeasuresCardFragment on Measure {\n  id\n  name\n  state\n}\n\nfragment LinkedSnapshotsCardFragment on Snapshot {\n  id\n  name\n  description\n  type\n  createdAt\n}\n"
+    "text": "query FrameworkGraphControlNodeQuery(\n  $controlId: ID!\n) {\n  node(id: $controlId) {\n    __typename\n    ... on Control {\n      id\n      name\n      sectionTitle\n      description\n      status\n      exclusionJustification\n      ...FrameworkControlDialogFragment\n      stateOfApplicabilityControls(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedStatesOfApplicabilityCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      measures(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedMeasuresCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedDocumentsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedAuditsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      obligations(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedObligationsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      snapshots(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedSnapshotsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n\nfragment LinkedAuditsCardFragment on Audit {\n  id\n  name\n  createdAt\n  state\n  validFrom\n  validUntil\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment LinkedMeasuresCardFragment on Measure {\n  id\n  name\n  state\n}\n\nfragment LinkedObligationsCardFragment on Obligation {\n  id\n  requirement\n  area\n  source\n  status\n  owner {\n    fullName\n    id\n  }\n}\n\nfragment LinkedSnapshotsCardFragment on Snapshot {\n  id\n  name\n  description\n  type\n  createdAt\n}\n\nfragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {\n  id\n  stateOfApplicabilityId\n  controlId\n  stateOfApplicability {\n    id\n    name\n  }\n  applicability\n  justification\n}\n"
   }
 };
 })();
 
-(node as any).hash = "afc4bbbce8d8b3cd57ac2bf77db58e55";
+(node as any).hash = "b28838e3c3c4cdd68906247d129799c8";
 
 export default node;

apps/console/src/hooks/graph/__generated__/FrameworkGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6fcc115e1ab6df38ede8756968ae7a6a>>
+ * @generated SignedSource<<43528dc19e67fdeca407f5081e6252b9>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -210,6 +210,13 @@ return {
                             "kind": "ScalarField",
                             "name": "exclusionJustification",
                             "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "bestPractice",
+                            "storageKey": null
                           }
                         ],
                         "storageKey": null
@@ -242,12 +249,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "68c09567aff1176075300c645f5d117d",
+    "cacheID": "5af3d5c9f8d466c5d6a78d7bd5da70d1",
     "id": null,
     "metadata": {},
     "name": "FrameworkGraphNodeQuery",
     "operationKind": "query",
-    "text": "query FrameworkGraphNodeQuery(\n  $frameworkId: ID!\n) {\n  node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      name\n      ...FrameworkDetailPageFragment\n    }\n    id\n  }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n  id\n  name\n  description\n  lightLogoURL\n  darkLogoURL\n  organization {\n    name\n    id\n  }\n  controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        sectionTitle\n        name\n        status\n        exclusionJustification\n      }\n    }\n  }\n}\n"
+    "text": "query FrameworkGraphNodeQuery(\n  $frameworkId: ID!\n) {\n  node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      name\n      ...FrameworkDetailPageFragment\n    }\n    id\n  }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n  id\n  name\n  description\n  lightLogoURL\n  darkLogoURL\n  organization {\n    name\n    id\n  }\n  controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        sectionTitle\n        name\n        status\n        exclusionJustification\n        bestPractice\n      }\n    }\n  }\n}\n"
   }
 };
 })();

apps/console/src/hooks/graph/__generated__/ObligationGraphCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6c659dc34af3bc7107a55d45f49075b5>>
+ * @generated SignedSource<<46f875946badbe73d5c1ab10f442763d>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type CreateObligationInput = {
   actionsToBeImplemented?: string | null | undefined;
   area?: string | null | undefined;
@@ -21,6 +22,7 @@ export type CreateObligationInput = {
   requirement?: string | null | undefined;
   source?: string | null | undefined;
   status: ObligationStatus;
+  type: ObligationType;
 };
 export type ObligationGraphCreateMutation$variables = {
   connections: ReadonlyArray<string>;
@@ -44,6 +46,7 @@ export type ObligationGraphCreateMutation$data = {
         readonly requirement: string | null | undefined;
         readonly source: string | null | undefined;
         readonly status: ObligationStatus;
+        readonly type: ObligationType;
       };
     };
   };
@@ -130,6 +133,13 @@ v4 = {
           "name": "regulator",
           "storageKey": null
         },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "type",
+          "storageKey": null
+        },
         {
           "alias": null,
           "args": null,
@@ -249,16 +259,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "76eae037102523c7378b07856332c9ff",
+    "cacheID": "495da8600659a64f5d59ed86a56c8762",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphCreateMutation",
     "operationKind": "mutation",
-    "text": "mutation ObligationGraphCreateMutation(\n  $input: CreateObligationInput!\n) {\n  createObligation(input: $input) {\n    obligationEdge {\n      node {\n        id\n        area\n        source\n        requirement\n        actionsToBeImplemented\n        regulator\n        lastReviewDate\n        dueDate\n        status\n        owner {\n          id\n          fullName\n        }\n        createdAt\n      }\n    }\n  }\n}\n"
+    "text": "mutation ObligationGraphCreateMutation(\n  $input: CreateObligationInput!\n) {\n  createObligation(input: $input) {\n    obligationEdge {\n      node {\n        id\n        area\n        source\n        requirement\n        actionsToBeImplemented\n        regulator\n        type\n        lastReviewDate\n        dueDate\n        status\n        owner {\n          id\n          fullName\n        }\n        createdAt\n      }\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "f3d8ddbef3566e26b3fe65543d93d07d";
+(node as any).hash = "e28cc6399325e7288ce7a71d3400acdb";
 
 export default node;

apps/console/src/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<d1b09bb9cf9c608b8b3ac1c2b55a109a>>
+ * @generated SignedSource<<3542cd7b93f38df062a93a1b9e325ff3>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type ObligationGraphNodeQuery$variables = {
   obligationId: string;
 };
@@ -35,6 +36,7 @@ export type ObligationGraphNodeQuery$data = {
     readonly source?: string | null | undefined;
     readonly sourceId?: string | null | undefined;
     readonly status?: ObligationStatus;
+    readonly type?: ObligationType;
     readonly updatedAt?: any;
   };
 };
@@ -118,24 +120,31 @@ v10 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "lastReviewDate",
+  "name": "type",
   "storageKey": null
 },
 v11 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "dueDate",
+  "name": "lastReviewDate",
   "storageKey": null
 },
 v12 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "status",
+  "name": "dueDate",
   "storageKey": null
 },
 v13 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "status",
+  "storageKey": null
+},
+v14 = {
   "alias": null,
   "args": null,
   "concreteType": "People",
@@ -154,7 +163,7 @@ v13 = {
   ],
   "storageKey": null
 },
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "concreteType": "Organization",
@@ -173,14 +182,14 @@ v14 = {
   ],
   "storageKey": null
 },
-v15 = {
+v16 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "createdAt",
   "storageKey": null
 },
-v16 = {
+v17 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -219,7 +228,8 @@ return {
               (v13/*: any*/),
               (v14/*: any*/),
               (v15/*: any*/),
-              (v16/*: any*/)
+              (v16/*: any*/),
+              (v17/*: any*/)
             ],
             "type": "Obligation",
             "abstractKey": null
@@ -269,7 +279,8 @@ return {
               (v13/*: any*/),
               (v14/*: any*/),
               (v15/*: any*/),
-              (v16/*: any*/)
+              (v16/*: any*/),
+              (v17/*: any*/)
             ],
             "type": "Obligation",
             "abstractKey": null
@@ -280,16 +291,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "6fd1c9d6e9f9a5baa60e4d270fc16db7",
+    "cacheID": "049eff8ed7a7476c04d09b64c061c3a6",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphNodeQuery",
     "operationKind": "query",
-    "text": "query ObligationGraphNodeQuery(\n  $obligationId: ID!\n) {\n  node(id: $obligationId) {\n    __typename\n    ... on Obligation {\n      id\n      snapshotId\n      sourceId\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
+    "text": "query ObligationGraphNodeQuery(\n  $obligationId: ID!\n) {\n  node(id: $obligationId) {\n    __typename\n    ... on Obligation {\n      id\n      snapshotId\n      sourceId\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      type\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "ddefa1f2514f429a8ff174646bccf254";
+(node as any).hash = "c50090bdd31fc24e0fdb067677999f77";
 
 export default node;

apps/console/src/hooks/graph/__generated__/ObligationGraphUpdateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<2fb713ad39d2976a25e4fee57edec2f3>>
+ * @generated SignedSource<<879c7bec9540c7d9e46eecb2fd5243d7>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type UpdateObligationInput = {
   actionsToBeImplemented?: string | null | undefined;
   area?: string | null | undefined;
@@ -21,6 +22,7 @@ export type UpdateObligationInput = {
   requirement?: string | null | undefined;
   source?: string | null | undefined;
   status?: ObligationStatus | null | undefined;
+  type?: ObligationType | null | undefined;
 };
 export type ObligationGraphUpdateMutation$variables = {
   input: UpdateObligationInput;
@@ -41,6 +43,7 @@ export type ObligationGraphUpdateMutation$data = {
       readonly requirement: string | null | undefined;
       readonly source: string | null | undefined;
       readonly status: ObligationStatus;
+      readonly type: ObligationType;
       readonly updatedAt: any;
     };
   };
@@ -124,6 +127,13 @@ v2 = [
             "name": "regulator",
             "storageKey": null
           },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "type",
+            "storageKey": null
+          },
           {
             "alias": null,
             "args": null,
@@ -196,16 +206,16 @@ return {
     "selections": (v2/*: any*/)
   },
   "params": {
-    "cacheID": "e42654b0cfd6ebeb8c78e8ec2f62c9c7",
+    "cacheID": "f9c2c73fd39c2d25eb6aa8d9e6670652",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphUpdateMutation",
     "operationKind": "mutation",
-    "text": "mutation ObligationGraphUpdateMutation(\n  $input: UpdateObligationInput!\n) {\n  updateObligation(input: $input) {\n    obligation {\n      id\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      updatedAt\n    }\n  }\n}\n"
+    "text": "mutation ObligationGraphUpdateMutation(\n  $input: UpdateObligationInput!\n) {\n  updateObligation(input: $input) {\n    obligation {\n      id\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      type\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      updatedAt\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "68013ca15f0e4eaaa0b1ef877b4f528c";
+(node as any).hash = "07663daac0c8341a570a0bf3a41c8b77";
 
 export default node;

apps/console/src/hooks/graph/__generated__/SnapshotGraphCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<11dd6f7de6693a626306b674bb8cc4f0>>
+ * @generated SignedSource<<2307fb5807f0d42458650cfaf8ebdbba>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type CreateSnapshotInput = {
   description?: string | null | undefined;
   name: string;

apps/console/src/hooks/graph/__generated__/SnapshotGraphNodeQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<d6dc9bf5a6c36f140bb864def22c0134>>
+ * @generated SignedSource<<0b5ef79fa213c96a316a4e0a94afade8>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type SnapshotGraphNodeQuery$variables = {
   snapshotId: string;
 };

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql.ts

@@ -0,0 +1,200 @@
+/**
+ * @generated SignedSource<<3a91be997803d4a28d0db40aebe53f25>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityInput = {
+  name: string;
+  organizationId: string;
+  ownerId: string;
+};
+export type StateOfApplicabilityGraphCreateMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphCreateMutation$data = {
+  readonly createStateOfApplicability: {
+    readonly stateOfApplicabilityEdge: {
+      readonly node: {
+        readonly createdAt: any;
+        readonly id: string;
+        readonly name: string;
+        readonly snapshotId: string | null | undefined;
+        readonly sourceId: string | null | undefined;
+        readonly updatedAt: any;
+      };
+    };
+  };
+};
+export type StateOfApplicabilityGraphCreateMutation = {
+  response: StateOfApplicabilityGraphCreateMutation$data;
+  variables: StateOfApplicabilityGraphCreateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "StateOfApplicabilityEdge",
+  "kind": "LinkedField",
+  "name": "stateOfApplicabilityEdge",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "StateOfApplicability",
+      "kind": "LinkedField",
+      "name": "node",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "sourceId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "snapshotId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "createdAt",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "updatedAt",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "stateOfApplicabilityEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "c1a3721f591bc17ed455a326eb9edead",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphCreateMutation(\n  $input: CreateStateOfApplicabilityInput!\n) {\n  createStateOfApplicability(input: $input) {\n    stateOfApplicabilityEdge {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "294d4fe89f8cbbbb4b8170a46dd3cd7a";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphDeleteMutation.graphql.ts

@@ -0,0 +1,132 @@
+/**
+ * @generated SignedSource<<deb6f38f36dc011d0fc4fc060303a57a>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityInput = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphDeleteMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphDeleteMutation$data = {
+  readonly deleteStateOfApplicability: {
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type StateOfApplicabilityGraphDeleteMutation = {
+  response: StateOfApplicabilityGraphDeleteMutation$data;
+  variables: StateOfApplicabilityGraphDeleteMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedStateOfApplicabilityId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "197a2ed2b48d43372e16deae6e9b98c2",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphDeleteMutation(\n  $input: DeleteStateOfApplicabilityInput!\n) {\n  deleteStateOfApplicability(input: $input) {\n    deletedStateOfApplicabilityId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "92ec928d4ad0fe7ff4ae78ad9f1f329a";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphForEditQuery.graphql.ts

@@ -0,0 +1,218 @@
+/**
+ * @generated SignedSource<<9e7f481aa8c95332bc03c3974a6752f8>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityGraphForEditQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphForEditQuery$data = {
+  readonly node: {
+    readonly controls?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly framework: {
+            readonly id: string;
+            readonly name: string;
+          };
+          readonly id: string;
+          readonly name: string;
+          readonly sectionTitle: string;
+        };
+      }>;
+    };
+    readonly id?: string;
+    readonly name?: string;
+  };
+};
+export type StateOfApplicabilityGraphForEditQuery = {
+  response: StateOfApplicabilityGraphForEditQuery$data;
+  variables: StateOfApplicabilityGraphForEditQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "name",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "first",
+      "value": 1000
+    },
+    {
+      "kind": "Literal",
+      "name": "orderBy",
+      "value": {
+        "direction": "ASC",
+        "field": "SECTION_TITLE"
+      }
+    }
+  ],
+  "concreteType": "ControlConnection",
+  "kind": "LinkedField",
+  "name": "controls",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "ControlEdge",
+      "kind": "LinkedField",
+      "name": "edges",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "Control",
+          "kind": "LinkedField",
+          "name": "node",
+          "plural": false,
+          "selections": [
+            (v2/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "sectionTitle",
+              "storageKey": null
+            },
+            (v3/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "Framework",
+              "kind": "LinkedField",
+              "name": "framework",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                (v3/*: any*/)
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": "controls(first:1000,orderBy:{\"direction\":\"ASC\",\"field\":\"SECTION_TITLE\"})"
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/),
+              (v4/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/),
+              (v4/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "b6b5490aa177e6e7e8339060eac14a9c",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphForEditQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      controls(first: 1000, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n        edges {\n          node {\n            id\n            sectionTitle\n            name\n            framework {\n              id\n              name\n            }\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e89010d6f8d66b9df856280a59d5f0c8";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql.ts

@@ -0,0 +1,343 @@
+/**
+ * @generated SignedSource<<d96c71d40860ec6fc2e2ac8a5ab992f8>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphNodeQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphNodeQuery$data = {
+  readonly node: {
+    readonly createdAt?: any;
+    readonly id?: string;
+    readonly name?: string;
+    readonly organization?: {
+      readonly id: string;
+    } | null | undefined;
+    readonly owner?: {
+      readonly fullName: string;
+      readonly id: string;
+    };
+    readonly snapshotId?: string | null | undefined;
+    readonly sourceId?: string | null | undefined;
+    readonly updatedAt?: any;
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+  };
+};
+export type StateOfApplicabilityGraphNodeQuery = {
+  response: StateOfApplicabilityGraphNodeQuery$data;
+  variables: StateOfApplicabilityGraphNodeQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "name",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "sourceId",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "snapshotId",
+  "storageKey": null
+},
+v6 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "createdAt",
+  "storageKey": null
+},
+v7 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "updatedAt",
+  "storageKey": null
+},
+v8 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "Organization",
+  "kind": "LinkedField",
+  "name": "organization",
+  "plural": false,
+  "selections": [
+    (v2/*: any*/)
+  ],
+  "storageKey": null
+},
+v9 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "People",
+  "kind": "LinkedField",
+  "name": "owner",
+  "plural": false,
+  "selections": [
+    (v2/*: any*/),
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "fullName",
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/),
+              (v4/*: any*/),
+              (v5/*: any*/),
+              (v6/*: any*/),
+              (v7/*: any*/),
+              (v8/*: any*/),
+              (v9/*: any*/),
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "StateOfApplicabilityControlsTabFragment"
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/),
+              (v4/*: any*/),
+              (v5/*: any*/),
+              (v6/*: any*/),
+              (v7/*: any*/),
+              (v8/*: any*/),
+              (v9/*: any*/),
+              {
+                "alias": "controlsInfo",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "first",
+                    "value": 0
+                  }
+                ],
+                "concreteType": "ControlConnection",
+                "kind": "LinkedField",
+                "name": "controls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "totalCount",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": "controls(first:0)"
+              },
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "AvailableStateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "availableControls",
+                "plural": true,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "sectionTitle",
+                    "storageKey": null
+                  },
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkName",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "organizationId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "regulatory",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "contractual",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "riskAssessment",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "2c2c6535c53d2073bd41b39771d1afd9",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphNodeQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      organization {\n        id\n      }\n      owner {\n        id\n        fullName\n      }\n      ...StateOfApplicabilityControlsTabFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "88e882f3c0f529cc7224eb19a91191cf";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql.ts

@@ -0,0 +1,301 @@
+/**
+ * @generated SignedSource<<28b9e5609f5d7c082c209bf839533d45>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphPaginatedFragment$data = {
+  readonly id: string;
+  readonly statesOfApplicability: {
+    readonly __id: string;
+    readonly edges: ReadonlyArray<{
+      readonly node: {
+        readonly controlsInfo: {
+          readonly totalCount: number;
+        };
+        readonly createdAt: any;
+        readonly id: string;
+        readonly name: string;
+        readonly snapshotId: string | null | undefined;
+        readonly sourceId: string | null | undefined;
+        readonly updatedAt: any;
+      };
+    }>;
+  };
+  readonly " $fragmentType": "StateOfApplicabilityGraphPaginatedFragment";
+};
+export type StateOfApplicabilityGraphPaginatedFragment$key = {
+  readonly " $data"?: StateOfApplicabilityGraphPaginatedFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+};
+
+import StateOfApplicabilityListQuery_graphql from './StateOfApplicabilityListQuery.graphql';
+
+const node: ReaderFragment = (function(){
+var v0 = [
+  "statesOfApplicability"
+],
+v1 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "after"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "before"
+    },
+    {
+      "defaultValue": {
+        "snapshotId": null
+      },
+      "kind": "LocalArgument",
+      "name": "filter"
+    },
+    {
+      "defaultValue": 50,
+      "kind": "LocalArgument",
+      "name": "first"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "last"
+    },
+    {
+      "defaultValue": {
+        "direction": "DESC",
+        "field": "CREATED_AT"
+      },
+      "kind": "LocalArgument",
+      "name": "order"
+    }
+  ],
+  "kind": "Fragment",
+  "metadata": {
+    "connection": [
+      {
+        "count": null,
+        "cursor": null,
+        "direction": "bidirectional",
+        "path": (v0/*: any*/)
+      }
+    ],
+    "refetch": {
+      "connection": {
+        "forward": {
+          "count": "first",
+          "cursor": "after"
+        },
+        "backward": {
+          "count": "last",
+          "cursor": "before"
+        },
+        "path": (v0/*: any*/)
+      },
+      "fragmentPathInResult": [
+        "node"
+      ],
+      "operation": StateOfApplicabilityListQuery_graphql,
+      "identifierInfo": {
+        "identifierField": "id",
+        "identifierQueryVariableName": "id"
+      }
+    }
+  },
+  "name": "StateOfApplicabilityGraphPaginatedFragment",
+  "selections": [
+    {
+      "alias": "statesOfApplicability",
+      "args": [
+        {
+          "kind": "Variable",
+          "name": "filter",
+          "variableName": "filter"
+        },
+        {
+          "kind": "Variable",
+          "name": "orderBy",
+          "variableName": "order"
+        }
+      ],
+      "concreteType": "StateOfApplicabilityConnection",
+      "kind": "LinkedField",
+      "name": "__StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability_connection",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "StateOfApplicabilityEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "StateOfApplicability",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v1/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "sourceId",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "snapshotId",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "createdAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "updatedAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": "controlsInfo",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "first",
+                      "value": 0
+                    }
+                  ],
+                  "concreteType": "ControlConnection",
+                  "kind": "LinkedField",
+                  "name": "controls",
+                  "plural": false,
+                  "selections": [
+                    {
+                      "alias": null,
+                      "args": null,
+                      "kind": "ScalarField",
+                      "name": "totalCount",
+                      "storageKey": null
+                    }
+                  ],
+                  "storageKey": "controls(first:0)"
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "__typename",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "cursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "PageInfo",
+          "kind": "LinkedField",
+          "name": "pageInfo",
+          "plural": false,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "endCursor",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasNextPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasPreviousPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "startCursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "kind": "ClientExtension",
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "__id",
+              "storageKey": null
+            }
+          ]
+        }
+      ],
+      "storageKey": null
+    },
+    (v1/*: any*/)
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql.ts

@@ -0,0 +1,318 @@
+/**
+ * @generated SignedSource<<1c22107bf5691e7764aa30352d99631e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphPaginatedQuery$variables = {
+  organizationId: string;
+};
+export type StateOfApplicabilityGraphPaginatedQuery$data = {
+  readonly organization: {
+    readonly id?: string;
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+  };
+};
+export type StateOfApplicabilityGraphPaginatedQuery = {
+  response: StateOfApplicabilityGraphPaginatedQuery$data;
+  variables: StateOfApplicabilityGraphPaginatedQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v4 = [
+  {
+    "kind": "Literal",
+    "name": "filter",
+    "value": {
+      "snapshotId": null
+    }
+  },
+  {
+    "kind": "Literal",
+    "name": "first",
+    "value": 50
+  },
+  {
+    "kind": "Literal",
+    "name": "orderBy",
+    "value": {
+      "direction": "DESC",
+      "field": "CREATED_AT"
+    }
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "StateOfApplicabilityGraphPaginatedFragment"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v4/*: any*/),
+                "concreteType": "StateOfApplicabilityConnection",
+                "kind": "LinkedField",
+                "name": "statesOfApplicability",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicability",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "sourceId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "snapshotId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": "controlsInfo",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "first",
+                                "value": 0
+                              }
+                            ],
+                            "concreteType": "ControlConnection",
+                            "kind": "LinkedField",
+                            "name": "controls",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "totalCount",
+                                "storageKey": null
+                              }
+                            ],
+                            "storageKey": "controls(first:0)"
+                          },
+                          (v3/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": "statesOfApplicability(filter:{\"snapshotId\":null},first:50,orderBy:{\"direction\":\"DESC\",\"field\":\"CREATED_AT\"})"
+              },
+              {
+                "alias": null,
+                "args": (v4/*: any*/),
+                "filters": [
+                  "orderBy",
+                  "filter"
+                ],
+                "handle": "connection",
+                "key": "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability",
+                "kind": "LinkedHandle",
+                "name": "statesOfApplicability"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "c5f5cb61622ba5e4309521002c23a530",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphPaginatedQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      ...StateOfApplicabilityGraphPaginatedFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment on Organization {\n  statesOfApplicability(first: 50, orderBy: {direction: DESC, field: CREATED_AT}, filter: {snapshotId: null}) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e5eb3f251055f7dd34f7af30251226ca";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphUpdateMutation.graphql.ts

@@ -0,0 +1,171 @@
+/**
+ * @generated SignedSource<<fe37fa58e9c374383c4f59dac08aed39>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type UpdateStateOfApplicabilityInput = {
+  id: string;
+  name?: string | null | undefined;
+  ownerId?: string | null | undefined;
+};
+export type StateOfApplicabilityGraphUpdateMutation$variables = {
+  input: UpdateStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphUpdateMutation$data = {
+  readonly updateStateOfApplicability: {
+    readonly stateOfApplicability: {
+      readonly createdAt: any;
+      readonly id: string;
+      readonly name: string;
+      readonly owner: {
+        readonly fullName: string;
+        readonly id: string;
+      };
+      readonly snapshotId: string | null | undefined;
+      readonly sourceId: string | null | undefined;
+      readonly updatedAt: any;
+    };
+  };
+};
+export type StateOfApplicabilityGraphUpdateMutation = {
+  response: StateOfApplicabilityGraphUpdateMutation$data;
+  variables: StateOfApplicabilityGraphUpdateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v2 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UpdateStateOfApplicabilityPayload",
+    "kind": "LinkedField",
+    "name": "updateStateOfApplicability",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "StateOfApplicability",
+        "kind": "LinkedField",
+        "name": "stateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v1/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "sourceId",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "snapshotId",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "updatedAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "People",
+            "kind": "LinkedField",
+            "name": "owner",
+            "plural": false,
+            "selections": [
+              (v1/*: any*/),
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "fullName",
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "selections": (v2/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "selections": (v2/*: any*/)
+  },
+  "params": {
+    "cacheID": "609bd562b84162f2807ee89b3c3273aa",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphUpdateMutation(\n  $input: UpdateStateOfApplicabilityInput!\n) {\n  updateStateOfApplicability(input: $input) {\n    stateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      owner {\n        id\n        fullName\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e8810210629ef7fad113616c06f141ee";
+
+export default node;

apps/console/src/hooks/graph/__generated__/StateOfApplicabilityListQuery.graphql.ts

@@ -0,0 +1,399 @@
+/**
+ * @generated SignedSource<<e0d47d3fdb15b30f904396b7bcd1328f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type OrderDirection = "ASC" | "DESC";
+export type StateOfApplicabilityOrderField = "CREATED_AT" | "NAME";
+export type StateOfApplicabilityFilter = {
+  snapshotId?: string | null | undefined;
+};
+export type StateOfApplicabilityOrder = {
+  direction: OrderDirection;
+  field: StateOfApplicabilityOrderField;
+};
+export type StateOfApplicabilityListQuery$variables = {
+  after?: any | null | undefined;
+  before?: any | null | undefined;
+  filter?: StateOfApplicabilityFilter | null | undefined;
+  first?: number | null | undefined;
+  id: string;
+  last?: number | null | undefined;
+  order?: StateOfApplicabilityOrder | null | undefined;
+};
+export type StateOfApplicabilityListQuery$data = {
+  readonly node: {
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+  };
+};
+export type StateOfApplicabilityListQuery = {
+  response: StateOfApplicabilityListQuery$data;
+  variables: StateOfApplicabilityListQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "after"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "before"
+},
+v2 = {
+  "defaultValue": {
+    "snapshotId": null
+  },
+  "kind": "LocalArgument",
+  "name": "filter"
+},
+v3 = {
+  "defaultValue": 50,
+  "kind": "LocalArgument",
+  "name": "first"
+},
+v4 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "id"
+},
+v5 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "last"
+},
+v6 = {
+  "defaultValue": {
+    "direction": "DESC",
+    "field": "CREATED_AT"
+  },
+  "kind": "LocalArgument",
+  "name": "order"
+},
+v7 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "id"
+  }
+],
+v8 = {
+  "kind": "Variable",
+  "name": "after",
+  "variableName": "after"
+},
+v9 = {
+  "kind": "Variable",
+  "name": "before",
+  "variableName": "before"
+},
+v10 = {
+  "kind": "Variable",
+  "name": "filter",
+  "variableName": "filter"
+},
+v11 = {
+  "kind": "Variable",
+  "name": "first",
+  "variableName": "first"
+},
+v12 = {
+  "kind": "Variable",
+  "name": "last",
+  "variableName": "last"
+},
+v13 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v14 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v15 = [
+  (v8/*: any*/),
+  (v9/*: any*/),
+  (v10/*: any*/),
+  (v11/*: any*/),
+  (v12/*: any*/),
+  {
+    "kind": "Variable",
+    "name": "orderBy",
+    "variableName": "order"
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v4/*: any*/),
+      (v5/*: any*/),
+      (v6/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityListQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v7/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "args": [
+              (v8/*: any*/),
+              (v9/*: any*/),
+              (v10/*: any*/),
+              (v11/*: any*/),
+              (v12/*: any*/),
+              {
+                "kind": "Variable",
+                "name": "order",
+                "variableName": "order"
+              }
+            ],
+            "kind": "FragmentSpread",
+            "name": "StateOfApplicabilityGraphPaginatedFragment"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v5/*: any*/),
+      (v6/*: any*/),
+      (v4/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityListQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v7/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v13/*: any*/),
+          (v14/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v15/*: any*/),
+                "concreteType": "StateOfApplicabilityConnection",
+                "kind": "LinkedField",
+                "name": "statesOfApplicability",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicability",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v14/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "sourceId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "snapshotId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": "controlsInfo",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "first",
+                                "value": 0
+                              }
+                            ],
+                            "concreteType": "ControlConnection",
+                            "kind": "LinkedField",
+                            "name": "controls",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "totalCount",
+                                "storageKey": null
+                              }
+                            ],
+                            "storageKey": "controls(first:0)"
+                          },
+                          (v13/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v15/*: any*/),
+                "filters": [
+                  "orderBy",
+                  "filter"
+                ],
+                "handle": "connection",
+                "key": "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability",
+                "kind": "LinkedHandle",
+                "name": "statesOfApplicability"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "d3227559321509a2a525848a0e26e20b",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityListQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $filter: StateOfApplicabilityFilter = {snapshotId: null}\n  $first: Int = 50\n  $last: Int = null\n  $order: StateOfApplicabilityOrder = {direction: DESC, field: CREATED_AT}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityGraphPaginatedFragment_4cFWzS\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment_4cFWzS on Organization {\n  statesOfApplicability(first: $first, after: $after, last: $last, before: $before, orderBy: $order, filter: $filter) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+
+export default node;

apps/console/src/layouts/MainLayout.tsx

@@ -22,6 +22,7 @@ import {
   IconInboxEmpty,
   IconKey,
   IconListStack,
+  IconPageCheck,
   IconLock,
   IconMagnifyingGlass,
   IconMedal,
@@ -231,6 +232,13 @@ function MainLayoutContent({
               to={`${prefix}/rights-requests`}
             />
           )}
+          {isAuthorized("Organization", "listStatesOfApplicability") && (
+            <SidebarItem
+              label={__("States of Applicability")}
+              icon={IconPageCheck}
+              to={`${prefix}/states-of-applicability`}
+            />
+          )}
           {isAuthorized("Organization", "listSnapshots") && (
             <SidebarItem
               label={__("Snapshots")}

apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx

@@ -21,7 +21,9 @@ import { useNavigate, useOutletContext } from "react-router";
 import { useOrganizationId } from "/hooks/useOrganizationId";
 import { LinkedDocumentsCard } from "/components/documents/LinkedDocumentsCard";
 import { LinkedAuditsCard } from "/components/audits/LinkedAuditsCard";
+import { LinkedObligationsCard } from "/components/obligations/LinkedObligationsCard";
 import { LinkedSnapshotsCard } from "/components/snapshots/LinkedSnapshotsCard";
+import { LinkedStatesOfApplicabilityCard } from "/components/states-of-applicability/LinkedStatesOfApplicabilityCard";
 import { FrameworkControlDialog } from "./dialogs/FrameworkControlDialog";
 import { promisifyMutation } from "@probo/helpers";
 import type { FrameworkGraphControlNodeQuery } from "/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql";
@@ -30,6 +32,35 @@ import type { FrameworkDetailPageFragment$data } from "./__generated__/Framework
 import { use } from "react";
 import { PermissionsContext } from "/providers/PermissionsContext";
 
+const attachStateOfApplicabilityMutation = graphql`
+  mutation FrameworkControlPageAttachStateOfApplicabilityMutation(
+    $input: CreateStateOfApplicabilityControlMappingInput!
+    $connections: [ID!]!
+  ) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          ...LinkedStatesOfApplicabilityCardFragment
+        }
+      }
+    }
+  }
+`;
+
+const detachStateOfApplicabilityMutation = graphql`
+  mutation FrameworkControlPageDetachStateOfApplicabilityMutation(
+    $input: DeleteStateOfApplicabilityControlMappingInput!
+    $connections: [ID!]!
+  ) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
 const attachMeasureMutation = graphql`
   mutation FrameworkControlPageAttachMutation(
     $input: CreateControlMeasureMappingInput!
@@ -111,6 +142,33 @@ const detachAuditMutation = graphql`
   }
 `;
 
+const attachObligationMutation = graphql`
+  mutation FrameworkControlPageAttachObligationMutation(
+    $input: CreateControlObligationMappingInput!
+    $connections: [ID!]!
+  ) {
+    createControlObligationMapping(input: $input) {
+      obligationEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          ...LinkedObligationsCardFragment
+        }
+      }
+    }
+  }
+`;
+
+const detachObligationMutation = graphql`
+  mutation FrameworkControlPageDetachObligationMutation(
+    $input: DeleteControlObligationMappingInput!
+    $connections: [ID!]!
+  ) {
+    deleteControlObligationMapping(input: $input) {
+      deletedObligationId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
 const attachSnapshotMutation = graphql`
   mutation FrameworkControlPageAttachSnapshotMutation(
     $input: CreateControlSnapshotMappingInput!
@@ -168,16 +226,24 @@ export default function FrameworkControlPage({ queryRef }: Props) {
   const confirm = useConfirm();
   const navigate = useNavigate();
   const { isAuthorized } = use(PermissionsContext);
+  const [detachStateOfApplicability, isDetachingStateOfApplicability] = useMutation(detachStateOfApplicabilityMutation);
+  const [attachStateOfApplicability, isAttachingStateOfApplicability] = useMutation(attachStateOfApplicabilityMutation);
   const [detachMeasure, isDetachingMeasure] = useMutation(detachMeasureMutation);
   const [attachMeasure, isAttachingMeasure] = useMutation(attachMeasureMutation);
   const [detachDocument, isDetachingDocument] = useMutation(detachDocumentMutation);
   const [attachDocument, isAttachingDocument] = useMutation(attachDocumentMutation);
   const [detachAudit, isDetachingAudit] = useMutation(detachAuditMutation);
   const [attachAudit, isAttachingAudit] = useMutation(attachAuditMutation);
+  const [detachObligation, isDetachingObligation] = useMutation(detachObligationMutation);
+  const [attachObligation, isAttachingObligation] = useMutation(attachObligationMutation);
   const [detachSnapshot, isDetachingSnapshot] = useMutation(detachSnapshotMutation);
   const [attachSnapshot, isAttachingSnapshot] = useMutation(attachSnapshotMutation);
   const [deleteControl] = useMutation(deleteControlMutation);
 
+  const canLinkStateOfApplicability = isAuthorized("Control", "createStateOfApplicabilityControlMapping");
+  const canUnlinkStateOfApplicability = isAuthorized("Control", "deleteStateOfApplicabilityControlMapping");
+  const statesOfApplicabilityReadOnly = !canLinkStateOfApplicability && !canUnlinkStateOfApplicability;
+
   const canLinkMeasure = isAuthorized("Control", "createControlMeasureMapping");
   const canUnlinkMeasure = isAuthorized("Control", "deleteControlMeasureMapping");
   const measuresReadOnly = !canLinkMeasure && !canUnlinkMeasure;
@@ -190,6 +256,10 @@ export default function FrameworkControlPage({ queryRef }: Props) {
   const canUnlinkAudit = isAuthorized("Control", "deleteControlAuditMapping");
   const auditsReadOnly = !canLinkAudit && !canUnlinkAudit;
 
+  const canLinkObligation = isAuthorized("Control", "createControlObligationMapping");
+  const canUnlinkObligation = isAuthorized("Control", "deleteControlObligationMapping");
+  const obligationsReadOnly = !canLinkObligation && !canUnlinkObligation;
+
   const canLinkSnapshot = isAuthorized("Control", "createControlSnapshotMapping");
   const canUnlinkSnapshot = isAuthorized("Control", "deleteControlSnapshotMapping");
   const snapshotsReadOnly = !canLinkSnapshot && !canUnlinkSnapshot;
@@ -278,20 +348,20 @@ export default function FrameworkControlPage({ queryRef }: Props) {
         </div>
       </div>
 
-      {control.status === "EXCLUDED" && (
-        <div className="bg-danger border border-border-danger rounded-lg p-4">
-          <div className="flex items-center gap-2 mb-2">
-            <div className="font-medium text-txt-danger">
-              {__("This control is excluded")}
-            </div>
-          </div>
-          <div className="text-sm">
-            <strong>{__("Justification:")}</strong> {control.exclusionJustification || __("No justification provided")}
-          </div>
-        </div>
-      )}
       <div className={control.status === "EXCLUDED" ? "opacity-60" : ""}>
         <div className="text-base mb-4">{control.name}</div>
+        <div className="mb-4">
+          <LinkedStatesOfApplicabilityCard
+            variant="card"
+            statesOfApplicability={control.stateOfApplicabilityControls?.edges.map((edge) => edge.node) ?? []}
+            params={{ controlId: control.id }}
+            connectionId={control.stateOfApplicabilityControls?.__id ?? ""}
+            onAttach={withErrorHandling(attachStateOfApplicability, __("Failed to link state of applicability"))}
+            onDetach={withErrorHandling(detachStateOfApplicability, __("Failed to unlink state of applicability"))}
+            disabled={isAttachingStateOfApplicability || isDetachingStateOfApplicability}
+            readOnly={statesOfApplicabilityReadOnly}
+          />
+        </div>
         <div className="mb-4">
           <LinkedMeasuresCard
             variant="card"
@@ -328,6 +398,18 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             readOnly={auditsReadOnly}
           />
         </div>
+        <div className="mb-4">
+          <LinkedObligationsCard
+            variant="card"
+            obligations={control.obligations?.edges.map((edge) => edge.node) ?? []}
+            params={{ controlId: control.id }}
+            connectionId={control.obligations?.__id ?? ""}
+            onAttach={withErrorHandling(attachObligation, __("Failed to link obligation"))}
+            onDetach={withErrorHandling(detachObligation, __("Failed to unlink obligation"))}
+            disabled={isAttachingObligation || isDetachingObligation}
+            readOnly={obligationsReadOnly}
+          />
+        </div>
         <div className="mb-4">
           <LinkedSnapshotsCard
             variant="card"

apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx

@@ -53,6 +53,7 @@ const frameworkDetailFragment = graphql`
           name
           status
           exclusionJustification
+          bestPractice
         }
       }
     }

apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachObligationMutation.graphql.ts

@@ -0,0 +1,235 @@
+/**
+ * @generated SignedSource<<b06f8ea18b076203f2e1ab8bae17d45f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type CreateControlObligationMappingInput = {
+  controlId: string;
+  obligationId: string;
+};
+export type FrameworkControlPageAttachObligationMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateControlObligationMappingInput;
+};
+export type FrameworkControlPageAttachObligationMutation$data = {
+  readonly createControlObligationMapping: {
+    readonly obligationEdge: {
+      readonly node: {
+        readonly id: string;
+        readonly " $fragmentSpreads": FragmentRefs<"LinkedObligationsCardFragment">;
+      };
+    };
+  };
+};
+export type FrameworkControlPageAttachObligationMutation = {
+  response: FrameworkControlPageAttachObligationMutation$data;
+  variables: FrameworkControlPageAttachObligationMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "createControlObligationMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "ObligationEdge",
+            "kind": "LinkedField",
+            "name": "obligationEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "Obligation",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "args": null,
+                    "kind": "FragmentSpread",
+                    "name": "LinkedObligationsCardFragment"
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "createControlObligationMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "ObligationEdge",
+            "kind": "LinkedField",
+            "name": "obligationEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "Obligation",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "requirement",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "area",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "source",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "status",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "People",
+                    "kind": "LinkedField",
+                    "name": "owner",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "fullName",
+                        "storageKey": null
+                      },
+                      (v3/*: any*/)
+                    ],
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "obligationEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "e5dce8dc0bc03faa0e4d42696c76b59d",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageAttachObligationMutation(\n  $input: CreateControlObligationMappingInput!\n) {\n  createControlObligationMapping(input: $input) {\n    obligationEdge {\n      node {\n        id\n        ...LinkedObligationsCardFragment\n      }\n    }\n  }\n}\n\nfragment LinkedObligationsCardFragment on Obligation {\n  id\n  requirement\n  area\n  source\n  status\n  owner {\n    fullName\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "3c4bfe48fd9db37ce70cecd890d7248a";
+
+export default node;

apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachStateOfApplicabilityMutation.graphql.ts

@@ -0,0 +1,237 @@
+/**
+ * @generated SignedSource<<6798ad28a0faeedef40b1b0a89f7563e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly id: string;
+        readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+      };
+    };
+  };
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation = {
+  response: FrameworkControlPageAttachStateOfApplicabilityMutation$data;
+  variables: FrameworkControlPageAttachStateOfApplicabilityMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "args": null,
+                    "kind": "FragmentSpread",
+                    "name": "LinkedStatesOfApplicabilityCardFragment"
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicability",
+                    "kind": "LinkedField",
+                    "name": "stateOfApplicability",
+                    "plural": false,
+                    "selections": [
+                      (v3/*: any*/),
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "name",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "stateOfApplicabilityControlEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "205bc4f133e268c943ef9df9881350f0",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageAttachStateOfApplicabilityMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        id\n        ...LinkedStatesOfApplicabilityCardFragment\n      }\n    }\n  }\n}\n\nfragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {\n  id\n  stateOfApplicabilityId\n  controlId\n  stateOfApplicability {\n    id\n    name\n  }\n  applicability\n  justification\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "8da7bd1e22eb2eaf857a4e97cea47e90";
+
+export default node;

apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachObligationMutation.graphql.ts

@@ -0,0 +1,133 @@
+/**
+ * @generated SignedSource<<b1b8d1f4c0dc579cacc0434be9b36259>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteControlObligationMappingInput = {
+  controlId: string;
+  obligationId: string;
+};
+export type FrameworkControlPageDetachObligationMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteControlObligationMappingInput;
+};
+export type FrameworkControlPageDetachObligationMutation$data = {
+  readonly deleteControlObligationMapping: {
+    readonly deletedObligationId: string;
+  };
+};
+export type FrameworkControlPageDetachObligationMutation = {
+  response: FrameworkControlPageDetachObligationMutation$data;
+  variables: FrameworkControlPageDetachObligationMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedObligationId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteControlObligationMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteControlObligationMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedObligationId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "90f4a67d3a22217cc62841266c5a0450",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageDetachObligationMutation(\n  $input: DeleteControlObligationMappingInput!\n) {\n  deleteControlObligationMapping(input: $input) {\n    deletedObligationId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "92da0169c3d421a658aa560b4e5ba1c8";
+
+export default node;

apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachStateOfApplicabilityMutation.graphql.ts

@@ -0,0 +1,153 @@
+/**
+ * @generated SignedSource<<b5ac3d2a6151aa858185089d6d979a34>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation = {
+  response: FrameworkControlPageDetachStateOfApplicabilityMutation$data;
+  variables: FrameworkControlPageDetachStateOfApplicabilityMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedControlId",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityControlId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v4/*: any*/),
+          (v5/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v4/*: any*/),
+          (v5/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedStateOfApplicabilityControlId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "f0ec8162516546b2cdd221c0c9832908",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageDetachStateOfApplicabilityMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "f1a4efbd039ed9f457905903df50a160";
+
+export default node;

apps/console/src/pages/organizations/frameworks/__generated__/FrameworkDetailPageFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<1da75e11f49e841800329ded9f67a1d4>>
+ * @generated SignedSource<<1c21fa202a0315a19517c79eb93932f3>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,6 +16,7 @@ export type FrameworkDetailPageFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
+        readonly bestPractice: boolean;
         readonly exclusionJustification: string | null | undefined;
         readonly id: string;
         readonly name: string;
@@ -155,6 +156,13 @@ return {
                   "kind": "ScalarField",
                   "name": "exclusionJustification",
                   "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "bestPractice",
+                  "storageKey": null
                 }
               ],
               "storageKey": null
@@ -183,6 +191,6 @@ return {
 };
 })();
 
-(node as any).hash = "34a82531b8812ee16e75eb035bc739e8";
+(node as any).hash = "e7be231a4f5cbad12945d2ca627cc442";
 
 export default node;

apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx

@@ -6,8 +6,8 @@ import {
   DialogFooter,
   Input,
   Textarea,
-  Option,
   useDialogRef,
+  Checkbox,
 } from "@probo/ui";
 import type { ReactNode } from "react";
 import { useTranslate } from "@probo/i18n";
@@ -17,7 +17,6 @@ import type { FrameworkControlDialogFragment$key } from "./__generated__/Framewo
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { z } from "zod";
 import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
-import { ControlledSelect } from "/components/form/ControlledField";
 import { useEffect, useMemo } from "react";
 
 type Props = {
@@ -35,6 +34,7 @@ const controlFragment = graphql`
     sectionTitle
     status
     exclusionJustification
+    bestPractice
   }
 `;
 
@@ -67,16 +67,7 @@ const schema = z.object({
   name: z.string(),
   description: z.string().optional().nullable(),
   sectionTitle: z.string(),
-  status: z.enum(["INCLUDED", "EXCLUDED"]),
-  exclusionJustification: z.string().optional(),
-}).refine((data) => {
-  if (data.status === "EXCLUDED") {
-    return data.exclusionJustification && data.exclusionJustification.trim().length > 0;
-  }
-  return true;
-}, {
-  message: "Exclusion justification is required when status is excluded",
-  path: ["exclusionJustification"],
+  bestPractice: z.boolean(),
 });
 
 export function FrameworkControlDialog(props: Props) {
@@ -92,11 +83,10 @@ export function FrameworkControlDialog(props: Props) {
     name: frameworkControl?.name ?? "",
     description: frameworkControl?.description ?? "",
     sectionTitle: frameworkControl?.sectionTitle ?? "",
-    status: frameworkControl?.status ?? "INCLUDED",
-    exclusionJustification: frameworkControl?.exclusionJustification ?? "",
+    bestPractice: frameworkControl?.bestPractice ?? true,
   }), [frameworkControl]);
 
-  const { control, handleSubmit, register, reset, watch } = useFormWithSchema(schema, {
+  const { handleSubmit, register, reset, watch, setValue } = useFormWithSchema(schema, {
     defaultValues,
   });
 
@@ -104,8 +94,7 @@ export function FrameworkControlDialog(props: Props) {
     reset(defaultValues);
   }, [defaultValues, reset]);
 
-  const statusValue = watch("status");
-  const showExclusionJustification = statusValue === "EXCLUDED";
+  const bestPracticeValue = watch("bestPractice");
 
   const onSubmit = handleSubmit(async (data) => {
     if (frameworkControl) {
@@ -117,8 +106,7 @@ export function FrameworkControlDialog(props: Props) {
             name: data.name,
             description: data.description || null,
             sectionTitle: data.sectionTitle,
-            status: data.status,
-            exclusionJustification: data.status === "EXCLUDED" ? data.exclusionJustification : null,
+            bestPractice: data.bestPractice,
           },
         },
       });
@@ -131,8 +119,7 @@ export function FrameworkControlDialog(props: Props) {
             name: data.name,
             description: data.description || null,
             sectionTitle: data.sectionTitle,
-            status: data.status,
-            exclusionJustification: data.status === "EXCLUDED" ? data.exclusionJustification : null,
+            bestPractice: data.bestPractice ?? true,
           },
           connections: [props.connectionId!],
         },
@@ -178,23 +165,13 @@ export function FrameworkControlDialog(props: Props) {
             placeholder={__("Add description")}
             {...register("description")}
           />
-          <ControlledSelect
-            control={control}
-            name="status"
-            placeholder={__("Select status")}
-          >
-            <Option value="INCLUDED">{__("Included")}</Option>
-            <Option value="EXCLUDED">{__("Excluded")}</Option>
-          </ControlledSelect>
-          {showExclusionJustification && (
-            <Textarea
-              required
-              id="exclusionJustification"
-              variant="bordered"
-              placeholder={__("Reason for exclusion")}
-              {...register("exclusionJustification")}
+          <label className="flex items-center gap-2 cursor-pointer">
+            <Checkbox
+              checked={bestPracticeValue}
+              onChange={(checked) => setValue("bestPractice", checked)}
             />
-          )}
+            <span className="text-sm">{__("Best Practice")}</span>
+          </label>
         </DialogContent>
         <DialogFooter>
           <Button type="submit" disabled={isMutating}>

apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<7985268ac23df51ae6187b72c4f33d83>>
+ * @generated SignedSource<<35c2c66dca0c895c7abca2b0f4917a68>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ConcreteRequest } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 export type CreateControlInput = {
+  bestPractice: boolean;
   description?: string | null | undefined;
   exclusionJustification?: string | null | undefined;
   frameworkId: string;
@@ -181,6 +182,13 @@ return {
                     "kind": "ScalarField",
                     "name": "exclusionJustification",
                     "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
                   }
                 ],
                 "storageKey": null
@@ -210,12 +218,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "3df2d5a0a51c774ccf711423e947093d",
+    "cacheID": "81df1f9c65937d3e387edffc6e9a28ac",
     "id": null,
     "metadata": {},
     "name": "FrameworkControlDialogCreateMutation",
     "operationKind": "mutation",
-    "text": "mutation FrameworkControlDialogCreateMutation(\n  $input: CreateControlInput!\n) {\n  createControl(input: $input) {\n    controlEdge {\n      node {\n        ...FrameworkControlDialogFragment\n        id\n      }\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n"
+    "text": "mutation FrameworkControlDialogCreateMutation(\n  $input: CreateControlInput!\n) {\n  createControl(input: $input) {\n    controlEdge {\n      node {\n        ...FrameworkControlDialogFragment\n        id\n      }\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n"
   }
 };
 })();

apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<67703eb04d68c2798f5549ed6d948339>>
+ * @generated SignedSource<<3a62e5f931a990d83caca02ab629b0c0>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ReaderFragment } from 'relay-runtime';
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 import { FragmentRefs } from "relay-runtime";
 export type FrameworkControlDialogFragment$data = {
+  readonly bestPractice: boolean;
   readonly description: string | null | undefined;
   readonly exclusionJustification: string | null | undefined;
   readonly id: string;
@@ -72,12 +73,19 @@ const node: ReaderFragment = {
       "kind": "ScalarField",
       "name": "exclusionJustification",
       "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "bestPractice",
+      "storageKey": null
     }
   ],
   "type": "Control",
   "abstractKey": null
 };
 
-(node as any).hash = "856a8302abf15737b6a4d4316b77f8cc";
+(node as any).hash = "481f75ce8c525c1fa12517ef173ad868";
 
 export default node;

apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogUpdateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<7d04994d5cabbbfc12f82754e8da0d83>>
+ * @generated SignedSource<<7ee3c72e16fa86d6c006c004e4f93c95>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ConcreteRequest } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 export type UpdateControlInput = {
+  bestPractice?: boolean | null | undefined;
   description?: string | null | undefined;
   exclusionJustification?: string | null | undefined;
   id: string;
@@ -150,6 +151,13 @@ return {
                 "kind": "ScalarField",
                 "name": "exclusionJustification",
                 "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "bestPractice",
+                "storageKey": null
               }
             ],
             "storageKey": null
@@ -160,12 +168,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "cee79ce9185400bad478453c44930dd6",
+    "cacheID": "374c69b33dd6e94dec75829fe0777f58",
     "id": null,
     "metadata": {},
     "name": "FrameworkControlDialogUpdateMutation",
     "operationKind": "mutation",
-    "text": "mutation FrameworkControlDialogUpdateMutation(\n  $input: UpdateControlInput!\n) {\n  updateControl(input: $input) {\n    control {\n      ...FrameworkControlDialogFragment\n      id\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n"
+    "text": "mutation FrameworkControlDialogUpdateMutation(\n  $input: UpdateControlInput!\n) {\n  updateControl(input: $input) {\n    control {\n      ...FrameworkControlDialogFragment\n      id\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n"
   }
 };
 })();

apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx

@@ -32,7 +32,7 @@ import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { Controller } from "react-hook-form";
 import { formatError, type GraphQLError } from "@probo/helpers";
 import z from "zod";
-import { getObligationStatusVariant, getObligationStatusLabel, formatDatetime, getObligationStatusOptions, validateSnapshotConsistency } from "@probo/helpers";
+import { getObligationStatusVariant, getObligationStatusLabel, formatDatetime, getObligationStatusOptions, getObligationTypeOptions, validateSnapshotConsistency } from "@probo/helpers";
 import { SnapshotBanner } from "/components/SnapshotBanner";
 import type { ObligationGraphNodeQuery } from "/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql";
 import { use } from "react";
@@ -44,6 +44,7 @@ const updateObligationSchema = z.object({
   requirement: z.string().optional(),
   actionsToBeImplemented: z.string().optional(),
   regulator: z.string().optional(),
+  type: z.enum(["LEGAL", "CONTRACTUAL"]),
   lastReviewDate: z.string().optional(),
   dueDate: z.string().optional(),
   status: z.enum(["NON_COMPLIANT", "PARTIALLY_COMPLIANT", "COMPLIANT"]),
@@ -68,6 +69,7 @@ export default function ObligationDetailsPage(props: Props) {
 
   const updateObligation = useUpdateObligation();
   const statusOptions = getObligationStatusOptions(__);
+  const typeOptions = getObligationTypeOptions(__);
 
   const connectionId = ConnectionHandler.getConnectionID(
     organizationId,
@@ -88,6 +90,7 @@ export default function ObligationDetailsPage(props: Props) {
         requirement: obligation?.requirement || "",
         actionsToBeImplemented: obligation?.actionsToBeImplemented || "",
         regulator: obligation?.regulator || "",
+        type: obligation?.type ?? "LEGAL",
         lastReviewDate: obligation?.lastReviewDate
           ? new Date(obligation.lastReviewDate).toISOString().split("T")[0]
           : "",
@@ -109,6 +112,7 @@ export default function ObligationDetailsPage(props: Props) {
         requirement: formData.requirement || undefined,
         actionsToBeImplemented: formData.actionsToBeImplemented || undefined,
         regulator: formData.regulator || undefined,
+        type: formData.type,
         lastReviewDate: formatDatetime(formData.lastReviewDate) ?? null,
         dueDate: formatDatetime(formData.dueDate) ?? null,
         status: formData.status,
@@ -247,6 +251,29 @@ export default function ObligationDetailsPage(props: Props) {
                 disabled={isSnapshotMode}
               />
             </Field>
+
+            <Field label={__("Type")} error={formState.errors.type?.message}>
+              <Controller
+                control={control}
+                name="type"
+                render={({ field }) => (
+                  <Select
+                    variant="editor"
+                    placeholder={__("Select type")}
+                    onValueChange={field.onChange}
+                    value={field.value}
+                    className="w-full"
+                    disabled={isSnapshotMode}
+                  >
+                    {typeOptions.map((option) => (
+                      <Option key={option.value} value={option.value}>
+                        {option.label}
+                      </Option>
+                    ))}
+                  </Select>
+                )}
+              />
+            </Field>
           </div>
 
           <div className="grid grid-cols-1 md:grid-cols-2 gap-4">

apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx

@@ -21,7 +21,7 @@ import { useCreateObligation } from "../../../../hooks/graph/ObligationGraph";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { Controller } from "react-hook-form";
 import { formatError, type GraphQLError } from "@probo/helpers";
-import { formatDatetime, getObligationStatusOptions } from "@probo/helpers";
+import { formatDatetime, getObligationStatusOptions, getObligationTypeOptions } from "@probo/helpers";
 
 const schema = z.object({
   area: z.string().optional(),
@@ -29,6 +29,7 @@ const schema = z.object({
   requirement: z.string().optional(),
   actionsToBeImplemented: z.string().optional(),
   regulator: z.string().optional(),
+  type: z.enum(["LEGAL", "CONTRACTUAL"]),
   ownerId: z.string().min(1, "Owner is required"),
   lastReviewDate: z.string().optional(),
   dueDate: z.string().optional(),
@@ -54,6 +55,7 @@ export function CreateObligationDialog({
 
   const createObligation = useCreateObligation(connection || "");
   const statusOptions = getObligationStatusOptions(__);
+  const typeOptions = getObligationTypeOptions(__);
 
   const { register, handleSubmit, formState, reset, control } = useFormWithSchema(schema, {
     defaultValues: {
@@ -62,6 +64,7 @@ export function CreateObligationDialog({
       requirement: "",
       actionsToBeImplemented: "",
       regulator: "",
+      type: "LEGAL" as const,
       ownerId: "",
       lastReviewDate: "",
       dueDate: "",
@@ -78,6 +81,7 @@ export function CreateObligationDialog({
         requirement: formData.requirement || undefined,
         actionsToBeImplemented: formData.actionsToBeImplemented || undefined,
         regulator: formData.regulator || undefined,
+        type: formData.type,
         ownerId: formData.ownerId,
         lastReviewDate: formatDatetime(formData.lastReviewDate),
         dueDate: formatDatetime(formData.dueDate),
@@ -169,6 +173,31 @@ export function CreateObligationDialog({
               placeholder={__("Enter regulator")}
               error={formState.errors.regulator?.message}
             />
+
+            <Field label={__("Type")}>
+              <Controller
+                control={control}
+                name="type"
+                render={({ field }) => (
+                  <Select
+                    variant="editor"
+                    placeholder={__("Select type")}
+                    onValueChange={field.onChange}
+                    value={field.value}
+                    className="w-full"
+                  >
+                    {typeOptions.map((option) => (
+                      <Option key={option.value} value={option.value}>
+                        {option.label}
+                      </Option>
+                    ))}
+                  </Select>
+                )}
+              />
+              {formState.errors.type && (
+                <p className="text-sm text-red-500 mt-1">{formState.errors.type.message}</p>
+              )}
+            </Field>
           </div>
 
           <div className="grid grid-cols-2 gap-4">

apps/console/src/pages/organizations/snapshots/__generated__/SnapshotsPageFragment.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<79d48ab0fd5b269022244b0777eac279>>
+ * @generated SignedSource<<e9e261236245bcf1724038c76fe9918c>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type SnapshotsPageFragment$data = {
   readonly snapshots: {

apps/console/src/pages/organizations/snapshots/dialog/__generated__/SnapshotFormDialogCreateMutation.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<4a28eec1f25c5d290bc070a534042521>>
+ * @generated SignedSource<<d0a4f2beac754ba3a7865f227b9d6aae>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type CreateSnapshotInput = {
   description?: string | null | undefined;
   name: string;

apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx

@@ -0,0 +1,364 @@
+import { useNavigate, useParams } from "react-router";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import {
+  ActionDropdown,
+  Breadcrumb,
+  DropdownItem,
+  IconTrashCan,
+  IconArrowDown,
+  PageHeader,
+  Card,
+  Button,
+  IconPencil,
+  IconCheckmark1,
+  IconCrossLargeX,
+  Input,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import {
+  ConnectionHandler,
+  graphql,
+  type PreloadedQuery,
+  usePreloadedQuery,
+} from "react-relay";
+import type {
+  StateOfApplicabilityGraphNodeQuery,
+} from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+import type { StateOfApplicabilityDetailPageExportMutation } from "./__generated__/StateOfApplicabilityDetailPageExportMutation.graphql";
+import {
+  StateOfApplicabilityConnectionKey,
+  stateOfApplicabilityNodeQuery,
+  useDeleteStateOfApplicability,
+  updateStateOfApplicabilityMutation,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import { use, useState, Suspense } from "react";
+import { PermissionsContext } from "/providers/PermissionsContext";
+import { usePageTitle } from "@probo/hooks";
+import { formatDate, validateSnapshotConsistency } from "@probo/helpers";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { z } from "zod";
+import StateOfApplicabilityControlsTab from "./tabs/StateOfApplicabilityControlsTab";
+import { SnapshotBanner } from "/components/SnapshotBanner";
+import { PeopleSelectField } from "/components/form/PeopleSelectField";
+
+const exportStateOfApplicabilityPDFMutation = graphql`
+  mutation StateOfApplicabilityDetailPageExportMutation($input: ExportStateOfApplicabilityPDFInput!) {
+    exportStateOfApplicabilityPDF(input: $input) {
+      data
+    }
+  }
+`;
+
+type Props = {
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphNodeQuery>;
+};
+
+export default function StateOfApplicabilityDetailPage(props: Props) {
+  const { stateOfApplicabilityId, snapshotId } = useParams<{ stateOfApplicabilityId: string; snapshotId?: string }>();
+  const organizationId = useOrganizationId();
+  const data = usePreloadedQuery(stateOfApplicabilityNodeQuery, props.queryRef);
+  const stateOfApplicability = data.node;
+  const { __ } = useTranslate();
+  const navigate = useNavigate();
+  const { isAuthorized } = use(PermissionsContext);
+  const isSnapshotMode = Boolean(snapshotId);
+
+  if (!stateOfApplicabilityId || !stateOfApplicability) {
+    throw new Error(
+      "Cannot load state of applicability detail page without stateOfApplicabilityId parameter",
+    );
+  }
+
+  validateSnapshotConsistency(stateOfApplicability, snapshotId);
+
+  const connectionId = ConnectionHandler.getConnectionID(
+    organizationId,
+    StateOfApplicabilityConnectionKey,
+  );
+
+  const deleteStateOfApplicability = useDeleteStateOfApplicability(
+    stateOfApplicability,
+    connectionId,
+    () => navigate(`/organizations/${organizationId}/states-of-applicability`),
+  );
+
+  usePageTitle(stateOfApplicability.name || __("State of Applicability"));
+
+  const [isEditingName, setIsEditingName] = useState(false);
+  const [isEditingOwner, setIsEditingOwner] = useState(false);
+  const [updateStateOfApplicability, isUpdating] = useMutationWithToasts(
+    updateStateOfApplicabilityMutation,
+    {
+      successMessage: __("State of Applicability updated successfully."),
+      errorMessage: __("Failed to update State of Applicability"),
+    }
+  );
+
+  const canUpdate = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+  const canDelete = !isSnapshotMode && isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
+
+  const [exportStateOfApplicabilityPDF, isExporting] = useMutationWithToasts<StateOfApplicabilityDetailPageExportMutation>(
+    exportStateOfApplicabilityPDFMutation,
+    {
+      successMessage: __("State of Applicability exported successfully."),
+      errorMessage: __("Failed to export State of Applicability"),
+    }
+  );
+
+  const handleExport = () => {
+    if (!stateOfApplicability.id) return;
+
+    exportStateOfApplicabilityPDF({
+      variables: {
+        input: {
+          stateOfApplicabilityId: stateOfApplicability.id,
+        },
+      },
+      onCompleted: (data) => {
+        if (data.exportStateOfApplicabilityPDF?.data) {
+          const link = window.document.createElement("a");
+          link.href = data.exportStateOfApplicabilityPDF.data;
+          link.download = `${stateOfApplicability.name || "state-of-applicability"}.pdf`;
+          window.document.body.appendChild(link);
+          link.click();
+          window.document.body.removeChild(link);
+        }
+      },
+    });
+  };
+
+  const nameSchema = z.object({
+    name: z.string().min(1, __("Name is required")),
+  });
+
+  const ownerSchema = z.object({
+    ownerId: z.string().min(1, __("Owner is required")),
+  });
+
+  const { register: registerName, handleSubmit: handleSubmitName, reset: resetName } = useFormWithSchema(
+    nameSchema,
+    {
+      defaultValues: {
+        name: stateOfApplicability.name || "",
+      },
+    }
+  );
+
+  const { control: controlOwner, handleSubmit: handleSubmitOwner, reset: resetOwner } = useFormWithSchema(
+    ownerSchema,
+    {
+      defaultValues: {
+        ownerId: stateOfApplicability.owner?.id || "",
+      },
+    }
+  );
+
+  const handleUpdateName = handleSubmitName((data) => {
+    if (!stateOfApplicability.id) return;
+
+    updateStateOfApplicability({
+      variables: {
+        input: {
+          id: stateOfApplicability.id,
+          name: data.name,
+        },
+      },
+      onSuccess: () => {
+        setIsEditingName(false);
+        resetName({ name: data.name });
+      },
+    });
+  });
+
+  const handleUpdateOwner = handleSubmitOwner((data) => {
+    if (!stateOfApplicability.id) return;
+
+    updateStateOfApplicability({
+      variables: {
+        input: {
+          id: stateOfApplicability.id,
+          ownerId: data.ownerId,
+        },
+      },
+      onSuccess: () => {
+        setIsEditingOwner(false);
+        resetOwner({ ownerId: data.ownerId });
+      },
+    });
+  });
+
+  const handleCancelNameEdit = () => {
+    setIsEditingName(false);
+    resetName({
+      name: stateOfApplicability.name || "",
+    });
+  };
+
+  const handleCancelOwnerEdit = () => {
+    setIsEditingOwner(false);
+    resetOwner({
+      ownerId: stateOfApplicability.owner?.id || "",
+    });
+  };
+
+  const listUrl = snapshotId
+    ? `/organizations/${organizationId}/snapshots/${snapshotId}/states-of-applicability`
+    : `/organizations/${organizationId}/states-of-applicability`;
+
+  return (
+    <div className="space-y-6">
+      {snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
+      <Breadcrumb
+        items={[
+          {
+            label: __("States of Applicability"),
+            to: listUrl,
+          },
+          {
+            label: stateOfApplicability.name || __("State of Applicability detail"),
+          },
+        ]}
+      />
+
+      <PageHeader
+        title={
+          isEditingName && canUpdate ? (
+            <div className="flex items-center gap-2">
+              <Input
+                {...registerName("name")}
+                variant="title"
+                className="flex-1"
+                autoFocus
+                onKeyDown={(e) => {
+                  if (e.key === "Escape") {
+                    handleCancelNameEdit();
+                  }
+                  if (e.key === "Enter" && e.ctrlKey) {
+                    handleUpdateName();
+                  }
+                }}
+              />
+              <Button
+                variant="quaternary"
+                icon={IconCheckmark1}
+                onClick={handleUpdateName}
+                disabled={isUpdating}
+              />
+              <Button
+                variant="quaternary"
+                icon={IconCrossLargeX}
+                onClick={handleCancelNameEdit}
+              />
+            </div>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span>{stateOfApplicability.name || ""}</span>
+              {canUpdate && (
+                <Button
+                  variant="quaternary"
+                  icon={IconPencil}
+                  onClick={() => setIsEditingName(true)}
+                />
+              )}
+            </div>
+          )
+        }
+      >
+        <Button
+          variant="secondary"
+          icon={IconArrowDown}
+          onClick={handleExport}
+          disabled={isExporting}
+        >
+          {__("Export")}
+        </Button>
+        {canDelete && (
+          <ActionDropdown variant="secondary">
+            <DropdownItem variant="danger" icon={IconTrashCan} onClick={deleteStateOfApplicability}>
+              {__("Delete")}
+            </DropdownItem>
+          </ActionDropdown>
+        )}
+      </PageHeader>
+
+      <div className="space-y-6">
+        <div className="space-y-4">
+          <h2 className="text-base font-medium">{__("Details")}</h2>
+          <Card className="space-y-4" padded>
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Owner")}
+                </div>
+                {isEditingOwner && canUpdate ? (
+                  <div className="flex items-center gap-2">
+                    <Suspense fallback={<div>{__("Loading...")}</div>}>
+                      <PeopleSelectField
+                        organizationId={organizationId}
+                        control={controlOwner}
+                        name="ownerId"
+                      />
+                    </Suspense>
+                    <Button
+                      variant="quaternary"
+                      icon={IconCheckmark1}
+                      onClick={handleUpdateOwner}
+                      disabled={isUpdating}
+                    />
+                    <Button
+                      variant="quaternary"
+                      icon={IconCrossLargeX}
+                      onClick={handleCancelOwnerEdit}
+                    />
+                  </div>
+                ) : (
+                  <div className="flex items-center gap-2">
+                    <div className="text-sm text-txt-primary">
+                      {stateOfApplicability.owner?.fullName || "-"}
+                    </div>
+                    {canUpdate && (
+                      <Button
+                        variant="quaternary"
+                        icon={IconPencil}
+                        onClick={() => setIsEditingOwner(true)}
+                      />
+                    )}
+                  </div>
+                )}
+              </div>
+            </div>
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Created at")}
+                </div>
+                <div className="text-sm text-txt-primary">
+                  {formatDate(stateOfApplicability.createdAt)}
+                </div>
+              </div>
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Updated at")}
+                </div>
+                <div className="text-sm text-txt-primary">
+                  {formatDate(stateOfApplicability.updatedAt)}
+                </div>
+              </div>
+            </div>
+          </Card>
+        </div>
+
+        {stateOfApplicability.id && (
+          <div className="space-y-4">
+            <h2 className="text-base font-medium">{__("Controls")}</h2>
+            <StateOfApplicabilityControlsTab
+              stateOfApplicability={stateOfApplicability as typeof stateOfApplicability & { id: string }}
+              isSnapshotMode={isSnapshotMode}
+            />
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}

apps/console/src/pages/organizations/states-of-applicability/StatesOfApplicabilityPage.tsx

@@ -0,0 +1,192 @@
+import {
+  Button,
+  IconPlusLarge,
+  PageHeader,
+  Card,
+  Thead,
+  Tbody,
+  Tr,
+  Th,
+  Td,
+  ActionDropdown,
+  DropdownItem,
+  IconTrashCan,
+  Table,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import { type PreloadedQuery } from "react-relay";
+import {
+  useStateOfApplicabilityQuery,
+  useDeleteStateOfApplicability,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphPaginatedFragment$data } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql";
+import type { NodeOf } from "/types";
+import { usePageTitle } from "@probo/hooks";
+import { CreateStateOfApplicabilityDialog } from "./dialogs/CreateStateOfApplicabilityDialog";
+import { PermissionsContext } from "/providers/PermissionsContext";
+import { use, useEffect } from "react";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import { formatDate } from "@probo/helpers";
+import { useParams } from "react-router";
+import { SnapshotBanner } from "/components/SnapshotBanner";
+
+type StateOfApplicability = NodeOf<
+  StateOfApplicabilityGraphPaginatedFragment$data["statesOfApplicability"]
+>;
+
+export default function StatesOfApplicabilityPage({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>;
+}) {
+  const { __ } = useTranslate();
+  const { isAuthorized } = use(PermissionsContext);
+  const { snapshotId } = useParams<{ snapshotId?: string }>();
+  const isSnapshotMode = Boolean(snapshotId);
+  const {
+    statesOfApplicability,
+    connectionId,
+    hasNext,
+    loadNext,
+    isLoadingNext,
+    refetch,
+  } = useStateOfApplicabilityQuery(queryRef);
+
+  usePageTitle(__("States of Applicability"));
+
+  // Refetch with snapshot filter when in snapshot mode
+  useEffect(() => {
+    if (snapshotId) {
+      refetch({ filter: { snapshotId } }, { fetchPolicy: 'store-or-network' });
+    }
+  }, [snapshotId, refetch]);
+
+  const hasAnyAction = !isSnapshotMode &&
+    isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
+
+  return (
+    <div className="space-y-6">
+      {snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
+      <PageHeader
+        title={__("States of Applicability")}
+        description={__(
+          "Manage states of applicability for your organization's frameworks.",
+        )}
+      >
+        {!isSnapshotMode && isAuthorized("Organization", "createStateOfApplicability") && (
+          <CreateStateOfApplicabilityDialog connectionId={connectionId}>
+            <Button icon={IconPlusLarge}>
+              {__("Add state of applicability")}
+            </Button>
+          </CreateStateOfApplicabilityDialog>
+        )}
+      </PageHeader>
+
+      {statesOfApplicability && statesOfApplicability.length > 0 ? (
+        <Card>
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>{__("Name")}</Th>
+                <Th>{__("Created at")}</Th>
+                <Th>{__("Controls")}</Th>
+                {hasAnyAction && <Th>{__("Actions")}</Th>}
+              </Tr>
+            </Thead>
+            <Tbody>
+              {statesOfApplicability.map((soa) => (
+                <StateOfApplicabilityRow
+                  key={soa.id}
+                  stateOfApplicability={soa}
+                  connectionId={connectionId}
+                  hasAnyAction={hasAnyAction}
+                />
+              ))}
+            </Tbody>
+          </Table>
+
+          {hasNext && (
+            <div className="p-4 border-t">
+              <Button
+                variant="secondary"
+                onClick={() => loadNext(50)}
+                disabled={isLoadingNext}
+              >
+                {isLoadingNext ? __("Loading...") : __("Load more")}
+              </Button>
+            </div>
+          )}
+        </Card>
+      ) : (
+        <Card padded>
+          <div className="text-center py-12">
+            <h3 className="text-lg font-semibold mb-2">
+              {__("No states of applicability yet")}
+            </h3>
+            <p className="text-txt-tertiary mb-4">
+              {__("Create your first state of applicability to get started.")}
+            </p>
+          </div>
+        </Card>
+      )}
+    </div>
+  );
+}
+
+function StateOfApplicabilityRow({
+  stateOfApplicability,
+  connectionId,
+  hasAnyAction,
+}: {
+  stateOfApplicability: StateOfApplicability;
+  connectionId: string;
+  hasAnyAction: boolean;
+}) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const { snapshotId } = useParams<{ snapshotId?: string }>();
+  const deleteStateOfApplicability = useDeleteStateOfApplicability(
+    stateOfApplicability,
+    connectionId,
+  );
+  const { isAuthorized } = use(PermissionsContext);
+
+  const detailUrl = snapshotId
+    ? `/organizations/${organizationId}/snapshots/${snapshotId}/states-of-applicability/${stateOfApplicability.id}`
+    : `/organizations/${organizationId}/states-of-applicability/${stateOfApplicability.id}`;
+
+  return (
+    <Tr to={detailUrl}>
+      <Td>{stateOfApplicability.name}</Td>
+      <Td>
+        <time dateTime={stateOfApplicability.createdAt}>
+          {formatDate(stateOfApplicability.createdAt)}
+        </time>
+      </Td>
+      <Td>{stateOfApplicability.controlsInfo?.totalCount ?? 0}</Td>
+      {hasAnyAction && (
+        <Td noLink width={50} className="text-end">
+          <ActionDropdown>
+            {isAuthorized(
+              "StateOfApplicability",
+              "deleteStateOfApplicability",
+            ) && (
+              <DropdownItem
+                icon={IconTrashCan}
+                variant="danger"
+                onSelect={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  deleteStateOfApplicability();
+                }}
+              >
+                {__("Delete")}
+              </DropdownItem>
+            )}
+          </ActionDropdown>
+        </Td>
+      )}
+    </Tr>
+  );
+}

apps/console/src/pages/organizations/states-of-applicability/__generated__/StateOfApplicabilityDetailPageExportMutation.graphql.ts

@@ -0,0 +1,92 @@
+/**
+ * @generated SignedSource<<9dc238538172b956fb81954024522ee1>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type ExportStateOfApplicabilityPDFInput = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityDetailPageExportMutation$variables = {
+  input: ExportStateOfApplicabilityPDFInput;
+};
+export type StateOfApplicabilityDetailPageExportMutation$data = {
+  readonly exportStateOfApplicabilityPDF: {
+    readonly data: string;
+  };
+};
+export type StateOfApplicabilityDetailPageExportMutation = {
+  response: StateOfApplicabilityDetailPageExportMutation$data;
+  variables: StateOfApplicabilityDetailPageExportMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "ExportStateOfApplicabilityPDFPayload",
+    "kind": "LinkedField",
+    "name": "exportStateOfApplicabilityPDF",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "data",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "dbc24d23ab71abb76f95b114f86f200d",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityDetailPageExportMutation(\n  $input: ExportStateOfApplicabilityPDFInput!\n) {\n  exportStateOfApplicabilityPDF(input: $input) {\n    data\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "36be308a451ada118c2bcc9c3b0c0a2b";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/dialogs/CreateStateOfApplicabilityDialog.tsx

@@ -0,0 +1,110 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Field,
+  useDialogRef,
+} from "@probo/ui";
+import type { ReactNode } from "react";
+import { useNavigate } from "react-router";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import z from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { createStateOfApplicabilityMutation } from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphCreateMutation } from "/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql";
+import { PeopleSelectField } from "/components/form/PeopleSelectField";
+import { Suspense } from "react";
+
+type Props = {
+  children: ReactNode;
+  connectionId: string;
+};
+
+const schema = z.object({
+  name: z.string().min(1),
+  ownerId: z.string().min(1),
+});
+
+export function CreateStateOfApplicabilityDialog({
+  children,
+  connectionId,
+}: Props) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const navigate = useNavigate();
+  const { control, register, handleSubmit, reset } = useFormWithSchema(schema, {
+    defaultValues: {
+      name: "",
+      ownerId: "",
+    },
+  });
+  const ref = useDialogRef();
+
+  const [mutate, isMutating] = useMutationWithToasts<StateOfApplicabilityGraphCreateMutation>(
+    createStateOfApplicabilityMutation,
+    {
+      successMessage: __("State of applicability created successfully."),
+      errorMessage: __("Failed to create state of applicability"),
+    },
+  );
+
+  const onSubmit = handleSubmit((data) => {
+    mutate({
+      variables: {
+        input: {
+          name: data.name,
+          organizationId,
+          ownerId: data.ownerId,
+        },
+        connections: [connectionId],
+      },
+      onCompleted: (response) => {
+        reset();
+        ref.current?.close();
+        const stateOfApplicabilityId = response.createStateOfApplicability.stateOfApplicabilityEdge.node.id;
+        navigate(`/organizations/${organizationId}/states-of-applicability/${stateOfApplicabilityId}`);
+      },
+    });
+  });
+
+  return (
+    <Dialog
+      ref={ref}
+      trigger={children}
+      title={
+        <Breadcrumb
+          items={[__("States of Applicability"), __("New State of Applicability")]}
+        />
+      }
+    >
+      <form onSubmit={onSubmit}>
+        <DialogContent padded className="space-y-4">
+          <Field
+            label={__("Name")}
+            {...register("name")}
+            type="text"
+            required
+          />
+          <Field label={__("Owner")}>
+            <Suspense fallback={<div>{__("Loading...")}</div>}>
+              <PeopleSelectField
+                organizationId={organizationId}
+                control={control}
+                name="ownerId"
+              />
+            </Suspense>
+          </Field>
+        </DialogContent>
+        <DialogFooter>
+          <Button disabled={isMutating} type="submit">
+            {__("Create")}
+          </Button>
+        </DialogFooter>
+      </form>
+    </Dialog>
+  );
+}

apps/console/src/pages/organizations/states-of-applicability/dialogs/EditControlDialog.tsx

@@ -0,0 +1,176 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Field,
+  Select,
+  Option,
+  Textarea,
+  useDialogRef,
+  Badge,
+} from "@probo/ui";
+import { forwardRef, useImperativeHandle, useState } from "react";
+import { graphql } from "react-relay";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { z } from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+
+const linkControlMutation = graphql`
+  mutation EditControlDialogLinkMutation($input: CreateStateOfApplicabilityControlMappingInput!) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge {
+        node {
+          stateOfApplicabilityId
+          controlId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+export type EditControlDialogRef = {
+  open: (control: {
+    stateOfApplicabilityId: string;
+    controlId: string;
+    sectionTitle: string;
+    name: string;
+    frameworkName: string;
+    applicability: boolean;
+    justification: string | null;
+  }) => void;
+};
+
+const schema = z.object({
+  applicability: z.boolean(),
+  justification: z.string().optional(),
+});
+
+export const EditControlDialog = forwardRef<EditControlDialogRef, { onSuccess?: () => void }>(
+  ({ onSuccess }, ref) => {
+    const { __ } = useTranslate();
+    const dialogRef = useDialogRef();
+    const [control, setControl] = useState<{
+      stateOfApplicabilityId: string;
+      controlId: string;
+      sectionTitle: string;
+      name: string;
+      frameworkName: string;
+      applicability: boolean;
+      justification: string | null;
+    } | null>(null);
+
+    const [linkMutate, isLinking] = useMutationWithToasts(linkControlMutation, {
+      successMessage: __("Control updated successfully."),
+      errorMessage: __("Failed to update control"),
+    });
+
+    const { register, handleSubmit, setValue, watch } = useFormWithSchema(schema, {
+      defaultValues: {
+        applicability: true,
+        justification: "",
+      },
+    });
+    const applicability = watch("applicability");
+
+    useImperativeHandle(ref, () => ({
+      open: (ctrl) => {
+        setControl(ctrl);
+        setValue("applicability", ctrl.applicability);
+        setValue("justification", ctrl.justification || "");
+        dialogRef.current?.open();
+      },
+    }));
+
+    const onSubmit = handleSubmit((data) => {
+      if (!control) return;
+
+      linkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId: control.stateOfApplicabilityId,
+            controlId: control.controlId,
+            applicability: data.applicability,
+            justification: !data.applicability ? data.justification || null : null,
+          },
+        },
+        onSuccess: () => {
+          dialogRef.current?.close();
+          setControl(null);
+          onSuccess?.();
+        },
+        updater: (store) => {
+          const stateOfApplicability = store.get(control.stateOfApplicabilityId);
+          if (stateOfApplicability) {
+            stateOfApplicability.invalidateRecord();
+          }
+        },
+      });
+    });
+
+    return (
+      <Dialog
+        ref={dialogRef}
+        className="max-w-lg"
+        title={
+          <Breadcrumb
+            items={[__("States of Applicability"), __("Edit Control")]}
+          />
+        }
+      >
+        {control ? (
+          <form onSubmit={onSubmit}>
+            <DialogContent padded className="space-y-4">
+              <div className="space-y-2">
+                <div className="text-sm font-medium text-txt-secondary">
+                  {control.frameworkName}
+                </div>
+                <div className="flex items-center gap-2">
+                  <Badge size="md">{control.sectionTitle}</Badge>
+                  <span className="text-base font-medium text-txt-primary">{control.name}</span>
+                </div>
+              </div>
+
+              <Field label={__("Applicability")}>
+                <Select
+                  variant="editor"
+                  value={applicability ? "yes" : "no"}
+                  onValueChange={(value) => setValue("applicability", value === "yes")}
+                >
+                  <Option value="yes">{__("Yes")}</Option>
+                  <Option value="no">{__("No")}</Option>
+                </Select>
+              </Field>
+
+              {!applicability && (
+                <Field label={__("Justification")}>
+                  <Textarea
+                    {...register("justification")}
+                    placeholder={__("Reason for non-applicability")}
+                    autogrow
+                  />
+                </Field>
+              )}
+            </DialogContent>
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="secondary"
+                onClick={() => dialogRef.current?.close()}
+              >
+                {__("Cancel")}
+              </Button>
+              <Button type="submit" disabled={isLinking}>
+                {__("Save")}
+              </Button>
+            </DialogFooter>
+          </form>
+        ) : null}
+      </Dialog>
+    );
+  }
+);

apps/console/src/pages/organizations/states-of-applicability/dialogs/LinkControlDialog.tsx

@@ -0,0 +1,385 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Select,
+  Option,
+  Textarea,
+  useDialogRef,
+  Spinner,
+  Badge,
+  Input,
+  IconMagnifyingGlass,
+  IconChevronDown,
+  IconChevronUp,
+  IconCheckmark1,
+} from "@probo/ui";
+import { forwardRef, useImperativeHandle, useState, Suspense, useMemo } from "react";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "react-relay";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+
+const linkControlQuery = graphql`
+  query LinkControlDialogQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        availableControls {
+          controlId
+          sectionTitle
+          name
+          frameworkId
+          frameworkName
+          organizationId
+          stateOfApplicabilityId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+const linkControlMutation = graphql`
+  mutation LinkControlDialogLinkMutation($input: CreateStateOfApplicabilityControlMappingInput!) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge {
+        node {
+          stateOfApplicabilityId
+          controlId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+const unlinkControlMutation = graphql`
+  mutation LinkControlDialogUnlinkMutation($input: DeleteStateOfApplicabilityControlMappingInput!) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId
+    }
+  }
+`;
+
+export type LinkControlDialogRef = {
+  open: (stateOfApplicabilityId: string, onUpdate?: () => void) => void;
+};
+
+type Control = {
+  controlId: string;
+  sectionTitle: string;
+  name: string;
+  frameworkId: string;
+  frameworkName: string;
+  organizationId: string;
+  stateOfApplicabilityId: string | null;
+  applicability: boolean | null;
+  justification: string | null;
+};
+
+function ControlRow({
+  control,
+  stateOfApplicabilityId,
+  isLinked,
+  onUpdate,
+}: {
+  control: Control;
+  stateOfApplicabilityId: string;
+  isLinked: boolean;
+  onUpdate?: () => void;
+}) {
+  const { __ } = useTranslate();
+  const [selectedState, setSelectedState] = useState<string>(() => {
+    if (!isLinked) return "not-linked";
+    return control.applicability ? "applicable" : "not-applicable";
+  });
+  const [justification, setJustification] = useState(
+    control.justification || ""
+  );
+  const [showJustification, setShowJustification] = useState(false);
+
+  const [linkMutate, isLinking] = useMutationWithToasts(linkControlMutation, {
+    successMessage: __("Control updated successfully."),
+    errorMessage: __("Failed to update control"),
+  });
+
+  const [unlinkMutate, isUnlinking] = useMutationWithToasts(unlinkControlMutation, {
+    successMessage: __("Control removed successfully."),
+    errorMessage: __("Failed to remove control"),
+  });
+
+  const handleStateChange = (newState: string) => {
+    setSelectedState(newState);
+
+    if (newState === "not-linked") {
+      unlinkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId,
+            controlId: control.controlId,
+          },
+        },
+        onSuccess: () => {
+          setShowJustification(false);
+          onUpdate?.();
+        },
+      });
+    } else if (newState === "applicable") {
+      setShowJustification(false);
+      linkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId,
+            controlId: control.controlId,
+            applicability: true,
+            justification: null,
+          },
+        },
+        onSuccess: () => {
+          onUpdate?.();
+        },
+      });
+    } else if (newState === "not-applicable") {
+      setShowJustification(true);
+      setJustification(control.justification || "");
+    }
+  };
+
+  const handleSaveJustification = () => {
+    linkMutate({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          controlId: control.controlId,
+          applicability: false,
+          justification: justification || null,
+        },
+      },
+      onSuccess: () => {
+        setShowJustification(false);
+        onUpdate?.();
+      },
+    });
+  };
+
+  return (
+    <div className="p-4 border-b border-border-low">
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex-1 min-w-0">
+          <div className="flex items-center gap-2">
+            <Badge size="md">{control.sectionTitle}</Badge>
+            <span className="text-sm font-medium text-txt-primary">{control.name}</span>
+          </div>
+          {isLinked && control.applicability !== null && !showJustification && control.justification && (
+            <div className="mt-2 text-sm text-txt-secondary">
+              {control.justification}
+            </div>
+          )}
+        </div>
+        <div className="flex items-start gap-2">
+          <Select
+            variant="editor"
+            value={selectedState}
+            onValueChange={handleStateChange}
+            disabled={isLinking || isUnlinking}
+            className="w-48"
+          >
+            <Option value="not-linked">
+              {__("Not Linked")}
+            </Option>
+            <Option value="applicable">
+              {__("Applicable")}
+            </Option>
+            <Option value="not-applicable">
+              {__("Not Applicable")}
+            </Option>
+          </Select>
+        </div>
+      </div>
+      {showJustification && (
+        <div className="mt-3 flex items-start gap-2">
+          <Textarea
+            value={justification}
+            onChange={(e) => setJustification(e.target.value)}
+            placeholder={__("Reason for non-applicability")}
+            className="flex-1"
+            autogrow
+          />
+          <Button
+            variant="primary"
+            icon={IconCheckmark1}
+            onClick={handleSaveJustification}
+            disabled={isLinking}
+            aria-label={__("Save")}
+          />
+        </div>
+      )}
+    </div>
+  );
+}
+
+function LinkControlDialogContent({
+  stateOfApplicabilityId,
+  onUpdate,
+}: {
+  stateOfApplicabilityId: string;
+  onUpdate?: () => void;
+}) {
+  const { __ } = useTranslate();
+  const [search, setSearch] = useState("");
+  const [collapsedFrameworks, setCollapsedFrameworks] = useState<Set<string>>(new Set());
+  const data = useLazyLoadQuery(
+    linkControlQuery,
+    { stateOfApplicabilityId },
+    { fetchPolicy: "store-or-network" }
+  ) as {
+    node: {
+      availableControls?: Control[];
+    } | null;
+  };
+
+  const filteredControls = useMemo(() => {
+    const controls = data.node?.availableControls || [];
+    if (!search) return controls;
+    const lowerSearch = search.toLowerCase();
+    return controls.filter(
+      (c) =>
+        c.name.toLowerCase().includes(lowerSearch) ||
+        c.sectionTitle.toLowerCase().includes(lowerSearch) ||
+        c.frameworkName.toLowerCase().includes(lowerSearch)
+    );
+  }, [data.node?.availableControls, search]);
+
+  const groupedControls = useMemo(() => {
+    const groups: Record<string, Record<string, Control[]>> = {};
+    filteredControls.forEach((control) => {
+      if (!groups[control.frameworkName]) {
+        groups[control.frameworkName] = {};
+      }
+      if (!groups[control.frameworkName][control.sectionTitle]) {
+        groups[control.frameworkName][control.sectionTitle] = [];
+      }
+      groups[control.frameworkName][control.sectionTitle].push(control);
+    });
+    return groups;
+  }, [filteredControls]);
+
+  const toggleFramework = (frameworkName: string) => {
+    setCollapsedFrameworks((prev) => {
+      const newSet = new Set(prev);
+      if (newSet.has(frameworkName)) {
+        newSet.delete(frameworkName);
+      } else {
+        newSet.add(frameworkName);
+      }
+      return newSet;
+    });
+  };
+
+  return (
+    <>
+      <DialogContent className="p-0">
+        <div className="sticky top-0 bg-level-2 p-4 border-b border-border-low z-10">
+          <Input
+            icon={IconMagnifyingGlass}
+            placeholder={__("Search controls...")}
+            onValueChange={setSearch}
+          />
+        </div>
+        <div className="max-h-[60vh] overflow-y-auto">
+          {filteredControls.length === 0 ? (
+            <div className="p-8 text-center text-txt-secondary">
+              {__("No controls found")}
+            </div>
+          ) : (
+            Object.entries(groupedControls).map(([frameworkName, sections]) => {
+              const isCollapsed = collapsedFrameworks.has(frameworkName);
+              return (
+                <div key={frameworkName}>
+                  <div className="sticky top-0 bg-level-1 px-4 py-2 border-b border-border-low z-10 flex items-center justify-between">
+                    <h3 className="text-sm font-semibold text-txt-primary">{frameworkName}</h3>
+                    <Button
+                      variant="tertiary"
+                      icon={isCollapsed ? IconChevronDown : IconChevronUp}
+                      onClick={() => toggleFramework(frameworkName)}
+                      aria-label={isCollapsed ? __("Expand") : __("Collapse")}
+                    />
+                  </div>
+                  {!isCollapsed && Object.entries(sections).map(([sectionTitle, sectionControls]) => (
+                    <div key={`${frameworkName}-${sectionTitle}`}>
+                      {sectionControls.map((control) => (
+                        <ControlRow
+                          key={control.controlId}
+                          control={control}
+                          stateOfApplicabilityId={stateOfApplicabilityId}
+                          isLinked={control.stateOfApplicabilityId !== null}
+                          onUpdate={onUpdate}
+                        />
+                      ))}
+                    </div>
+                  ))}
+                </div>
+              );
+            })
+          )}
+        </div>
+      </DialogContent>
+      <DialogFooter exitLabel={__("Close")}></DialogFooter>
+    </>
+  );
+}
+
+export const LinkControlDialog = forwardRef<LinkControlDialogRef>((_props, ref) => {
+  const { __ } = useTranslate();
+  const dialogRef = useDialogRef();
+  const [stateOfApplicabilityId, setStateOfApplicabilityId] = useState<string | null>(null);
+  const [onUpdateCallback, setOnUpdateCallback] = useState<(() => void) | undefined>(undefined);
+
+  useImperativeHandle(ref, () => ({
+    open: (soaId: string, callback?: () => void) => {
+      setStateOfApplicabilityId(soaId);
+      setOnUpdateCallback(() => callback);
+      dialogRef.current?.open();
+    },
+  }), [dialogRef]);
+
+  const handleClose = () => {
+    setStateOfApplicabilityId(null);
+    setOnUpdateCallback(undefined);
+  };
+
+  return (
+    <Dialog
+      ref={dialogRef}
+      className="max-w-3xl"
+      title={
+        <Breadcrumb
+          items={[__("States of Applicability"), __("Add Controls")]}
+        />
+      }
+      onClose={handleClose}
+    >
+      {stateOfApplicabilityId ? (
+        <Suspense
+          fallback={
+            <DialogContent padded className="flex items-center justify-center py-8">
+              <Spinner />
+            </DialogContent>
+          }
+        >
+          <LinkControlDialogContent
+            stateOfApplicabilityId={stateOfApplicabilityId}
+            onUpdate={onUpdateCallback}
+          />
+        </Suspense>
+      ) : null}
+    </Dialog>
+  );
+});

apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/EditControlDialogLinkMutation.graphql.ts

@@ -0,0 +1,194 @@
+/**
+ * @generated SignedSource<<100330ea65f9914591271a9a1f78fd2e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type EditControlDialogLinkMutation$variables = {
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type EditControlDialogLinkMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly applicability: boolean;
+        readonly controlId: string;
+        readonly justification: string | null | undefined;
+        readonly stateOfApplicabilityId: string;
+      };
+    };
+  };
+};
+export type EditControlDialogLinkMutation = {
+  response: EditControlDialogLinkMutation$data;
+  variables: EditControlDialogLinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "stateOfApplicabilityId",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "controlId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "applicability",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "justification",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "EditControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/)
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "EditControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "id",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "e15d97ea6b798532fb82fc577cbccd64",
+    "id": null,
+    "metadata": {},
+    "name": "EditControlDialogLinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation EditControlDialogLinkMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        stateOfApplicabilityId\n        controlId\n        applicability\n        justification\n        id\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e7a83ce3daa0051a0b2bb03b0429f2c4";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogLinkMutation.graphql.ts

@@ -0,0 +1,194 @@
+/**
+ * @generated SignedSource<<ab6168a4560a52cdd137c9090c37dacc>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogLinkMutation$variables = {
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type LinkControlDialogLinkMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly applicability: boolean;
+        readonly controlId: string;
+        readonly justification: string | null | undefined;
+        readonly stateOfApplicabilityId: string;
+      };
+    };
+  };
+};
+export type LinkControlDialogLinkMutation = {
+  response: LinkControlDialogLinkMutation$data;
+  variables: LinkControlDialogLinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "stateOfApplicabilityId",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "controlId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "applicability",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "justification",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/)
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "id",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "59e215d4f18e0429cbf813aae4db8c94",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogLinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation LinkControlDialogLinkMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        stateOfApplicabilityId\n        controlId\n        applicability\n        justification\n        id\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "47757e096c6beeba6be6290a2154f841";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogQuery.graphql.ts

@@ -0,0 +1,211 @@
+/**
+ * @generated SignedSource<<feca91fd2418eba0f5714a2c76346d08>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type LinkControlDialogQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogQuery$data = {
+  readonly node: {
+    readonly availableControls?: ReadonlyArray<{
+      readonly applicability: boolean | null | undefined;
+      readonly controlId: string;
+      readonly frameworkId: string;
+      readonly frameworkName: string;
+      readonly justification: string | null | undefined;
+      readonly name: string;
+      readonly organizationId: string;
+      readonly sectionTitle: string;
+      readonly stateOfApplicabilityId: string | null | undefined;
+    }>;
+    readonly id?: string;
+  };
+};
+export type LinkControlDialogQuery = {
+  response: LinkControlDialogQuery$data;
+  variables: LinkControlDialogQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "AvailableStateOfApplicabilityControl",
+  "kind": "LinkedField",
+  "name": "availableControls",
+  "plural": true,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "controlId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "sectionTitle",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "frameworkId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "frameworkName",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "organizationId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "stateOfApplicabilityId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "applicability",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "justification",
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "a0d70e15a1236fe0e8626e685ea16a15",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogQuery",
+    "operationKind": "query",
+    "text": "query LinkControlDialogQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      availableControls {\n        controlId\n        sectionTitle\n        name\n        frameworkId\n        frameworkName\n        organizationId\n        stateOfApplicabilityId\n        applicability\n        justification\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "26daf3c064517bdbbf025da7ce5fc30f";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogUnlinkMutation.graphql.ts

@@ -0,0 +1,109 @@
+/**
+ * @generated SignedSource<<3bb4d04e228ac7dbda8ebfb8b7c2567f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogUnlinkMutation$variables = {
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type LinkControlDialogUnlinkMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type LinkControlDialogUnlinkMutation = {
+  response: LinkControlDialogUnlinkMutation$data;
+  variables: LinkControlDialogUnlinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+    "kind": "LinkedField",
+    "name": "deleteStateOfApplicabilityControlMapping",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedControlId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityControlId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogUnlinkMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogUnlinkMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "766d15d5071197ed2907d876caf37995",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogUnlinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation LinkControlDialogUnlinkMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "a184d521b495bf3ff76796530e9eb0e1";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx

@@ -0,0 +1,267 @@
+import { graphql, useRefetchableFragment } from "react-relay";
+import { Badge, Table, Tbody, Td, Th, Thead, Tr, Button, IconPlusLarge, IconPencil, IconTrashCan, ActionDropdown, DropdownItem } from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { StateOfApplicabilityControlsTabFragment$key } from "./__generated__/StateOfApplicabilityControlsTabFragment.graphql";
+import { Suspense, useMemo, useRef } from "react";
+import { LinkControlDialog, type LinkControlDialogRef } from "../dialogs/LinkControlDialog";
+import { EditControlDialog, type EditControlDialogRef } from "../dialogs/EditControlDialog";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { use } from "react";
+import { PermissionsContext } from "/providers/PermissionsContext";
+
+export const controlsFragment = graphql`
+  fragment StateOfApplicabilityControlsTabFragment on StateOfApplicability
+  @refetchable(queryName: "StateOfApplicabilityControlsTabRefetchQuery") {
+    id
+    controlsInfo: controls(first: 0) {
+      totalCount
+    }
+    availableControls {
+      controlId
+      sectionTitle
+      name
+      frameworkId
+      frameworkName
+      organizationId
+      stateOfApplicabilityId
+      applicability
+      justification
+      bestPractice
+      regulatory
+      contractual
+      riskAssessment
+    }
+  }
+`;
+
+const unlinkControlMutation = graphql`
+  mutation StateOfApplicabilityControlsTabUnlinkMutation($input: DeleteStateOfApplicabilityControlMappingInput!) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId
+    }
+  }
+`;
+
+export default function StateOfApplicabilityControlsTab({
+  stateOfApplicability,
+  isSnapshotMode = false,
+}: {
+  stateOfApplicability: StateOfApplicabilityControlsTabFragment$key & { id: string };
+  isSnapshotMode?: boolean;
+}) {
+  const { __ } = useTranslate();
+  const [data, refetch] = useRefetchableFragment(controlsFragment, stateOfApplicability);
+  const organizationId = useOrganizationId();
+  const manageDialogRef = useRef<LinkControlDialogRef>(null);
+  const editDialogRef = useRef<EditControlDialogRef>(null);
+  const { isAuthorized } = use(PermissionsContext);
+
+  const linkedControls = useMemo(
+    () => (data.availableControls || []).filter((c) => c.stateOfApplicabilityId !== null),
+    [data.availableControls]
+  );
+
+  const [unlinkControl, isUnlinking] = useMutationWithToasts(
+    unlinkControlMutation,
+    {
+      successMessage: __("Control removed successfully."),
+      errorMessage: __("Failed to remove control"),
+    },
+  );
+
+  const canLink = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+  const canUnlink = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+
+  const handleOpenManageDialog = () => {
+    manageDialogRef.current?.open(data.id, () => {
+      refetch({}, { fetchPolicy: "store-and-network" });
+    });
+  };
+
+  const handleOpenEditDialog = (control: {
+    controlId: string;
+    sectionTitle: string;
+    name: string;
+    frameworkName: string;
+    applicability: boolean;
+    justification: string | null;
+  }) => {
+    editDialogRef.current?.open({
+      stateOfApplicabilityId: data.id,
+      controlId: control.controlId,
+      sectionTitle: control.sectionTitle,
+      name: control.name,
+      frameworkName: control.frameworkName,
+      applicability: control.applicability,
+      justification: control.justification,
+    });
+  };
+
+  const handleUnlink = (controlId: string) => {
+    unlinkControl({
+      variables: {
+        input: {
+          stateOfApplicabilityId: data.id,
+          controlId,
+        },
+      },
+      onSuccess: () => {
+        refetch({}, { fetchPolicy: "network-only" });
+      },
+    });
+  };
+
+  return (
+    <>
+      <div className="space-y-4">
+        {canLink && (
+          <div className="flex justify-end">
+            <Button
+              icon={IconPlusLarge}
+              onClick={handleOpenManageDialog}
+            >
+              {__("Add Controls")}
+            </Button>
+          </div>
+        )}
+
+        <Table>
+          <Thead>
+            <Tr>
+              <Th className="w-32">{__("Framework")}</Th>
+              <Th>{__("Control")}</Th>
+              <Th className="w-28 text-center">{__("Applicability")}</Th>
+              <Th className="min-w-48">{__("Justification")}</Th>
+              <Th className="w-24 text-center">{__("Regulatory")}</Th>
+              <Th className="w-24 text-center">{__("Contractual")}</Th>
+              <Th className="w-32 text-center">{__("Best Practice")}</Th>
+              <Th className="w-36 text-center">{__("Risk Assessment")}</Th>
+              {(canLink || canUnlink) && <Th className="w-12"></Th>}
+            </Tr>
+          </Thead>
+          <Tbody>
+            {linkedControls.length === 0 && (
+              <Tr>
+                <Td colSpan={canLink || canUnlink ? 9 : 8} className="text-center text-txt-secondary py-12">
+                  {__("No controls linked")}
+                </Td>
+              </Tr>
+            )}
+            {linkedControls.map((control) => (
+              <Tr
+                key={control.controlId}
+                to={`/organizations/${organizationId}/frameworks/${control.frameworkId}/controls/${control.controlId}`}
+              >
+                <Td className="font-medium text-txt-secondary">{control.frameworkName}</Td>
+                <Td>
+                  <div className="space-y-1">
+                    <div className="text-xs font-medium text-txt-tertiary">{control.sectionTitle}</div>
+                    <div className="text-sm">{control.name}</div>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    {control.applicability !== null ? (
+                      <Badge variant={control.applicability ? "success" : "danger"} size="sm">
+                        {control.applicability ? __("Yes") : __("No")}
+                      </Badge>
+                    ) : (
+                      <span className="text-txt-tertiary">-</span>
+                    )}
+                  </div>
+                </Td>
+                <Td>
+                  <div className="text-sm text-txt-secondary line-clamp-2">
+                    {control.justification || <span className="text-txt-tertiary italic">-</span>}
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.regulatory ? "success" : "danger"} size="sm">
+                      {control.regulatory ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.contractual ? "success" : "danger"} size="sm">
+                      {control.contractual ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.bestPractice ? "success" : "danger"} size="sm">
+                      {control.bestPractice ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.riskAssessment ? "success" : "danger"} size="sm">
+                      {control.riskAssessment ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                {(canLink || canUnlink) && (
+                  <Td noLink className="text-end">
+                    <ActionDropdown>
+                      {canLink && (
+                        <DropdownItem
+                          icon={IconPencil}
+                          onClick={(e) => {
+                            e.preventDefault();
+                            e.stopPropagation();
+                            if (typeof control.applicability === 'boolean') {
+                              handleOpenEditDialog({
+                                controlId: control.controlId,
+                                sectionTitle: control.sectionTitle,
+                                name: control.name,
+                                frameworkName: control.frameworkName,
+                                applicability: control.applicability,
+                                justification: control.justification ?? null,
+                              });
+                            }
+                          }}
+                        >
+                          {__("Edit")}
+                        </DropdownItem>
+                      )}
+                      {canUnlink && (
+                        <DropdownItem
+                          icon={IconTrashCan}
+                          variant="danger"
+                          onClick={(e) => {
+                            e.preventDefault();
+                            e.stopPropagation();
+                            handleUnlink(control.controlId);
+                          }}
+                          disabled={isUnlinking}
+                        >
+                          {__("Remove")}
+                        </DropdownItem>
+                      )}
+                    </ActionDropdown>
+                  </Td>
+                )}
+              </Tr>
+            ))}
+          </Tbody>
+        </Table>
+      </div>
+
+      <Suspense fallback={null}>
+        <LinkControlDialog ref={manageDialogRef} />
+        <EditControlDialog
+          ref={editDialogRef}
+          onSuccess={() => {
+            refetch({}, { fetchPolicy: "network-only" });
+          }}
+        />
+      </Suspense>
+    </>
+  );
+}

apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityOverviewTab.tsx

@@ -0,0 +1,51 @@
+import { useOutletContext } from "react-router";
+import { Card, Field } from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { formatDate } from "@probo/helpers";
+import type { StateOfApplicabilityGraphNodeQuery$data } from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+
+type StateOfApplicabilityNode = NonNullable<StateOfApplicabilityGraphNodeQuery$data["node"]>;
+
+export default function StateOfApplicabilityOverviewTab() {
+  const { stateOfApplicability } = useOutletContext<{
+    stateOfApplicability: StateOfApplicabilityNode;
+  }>();
+  const { __ } = useTranslate();
+
+  return (
+    <div className="space-y-4">
+      <h2 className="text-base font-medium">{__("State of Applicability details")}</h2>
+      <Card className="space-y-4" padded>
+        <Field
+          label={__("Name")}
+          value={stateOfApplicability.name}
+          disabled
+        />
+        {stateOfApplicability.sourceId && (
+          <Field
+            label={__("Source")}
+            value={stateOfApplicability.sourceId}
+            disabled
+          />
+        )}
+        {stateOfApplicability.snapshotId && (
+          <Field
+            label={__("Snapshot")}
+            value={stateOfApplicability.snapshotId}
+            disabled
+          />
+        )}
+        <Field
+          label={__("Created at")}
+          value={formatDate(stateOfApplicability.createdAt)}
+          disabled
+        />
+        <Field
+          label={__("Updated at")}
+          value={formatDate(stateOfApplicability.updatedAt)}
+          disabled
+        />
+      </Card>
+    </div>
+  );
+}

apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabFragment.graphql.ts

@@ -0,0 +1,200 @@
+/**
+ * @generated SignedSource<<306449631752d4277aa96b77601e2d8f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityControlsTabFragment$data = {
+  readonly availableControls: ReadonlyArray<{
+    readonly applicability: boolean | null | undefined;
+    readonly bestPractice: boolean;
+    readonly contractual: boolean;
+    readonly controlId: string;
+    readonly frameworkId: string;
+    readonly frameworkName: string;
+    readonly justification: string | null | undefined;
+    readonly name: string;
+    readonly organizationId: string;
+    readonly regulatory: boolean;
+    readonly riskAssessment: boolean;
+    readonly sectionTitle: string;
+    readonly stateOfApplicabilityId: string | null | undefined;
+  }>;
+  readonly controlsInfo: {
+    readonly totalCount: number;
+  };
+  readonly id: string;
+  readonly " $fragmentType": "StateOfApplicabilityControlsTabFragment";
+};
+export type StateOfApplicabilityControlsTabFragment$key = {
+  readonly " $data"?: StateOfApplicabilityControlsTabFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+};
+
+import StateOfApplicabilityControlsTabRefetchQuery_graphql from './StateOfApplicabilityControlsTabRefetchQuery.graphql';
+
+const node: ReaderFragment = {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": {
+    "refetch": {
+      "connection": null,
+      "fragmentPathInResult": [
+        "node"
+      ],
+      "operation": StateOfApplicabilityControlsTabRefetchQuery_graphql,
+      "identifierInfo": {
+        "identifierField": "id",
+        "identifierQueryVariableName": "id"
+      }
+    }
+  },
+  "name": "StateOfApplicabilityControlsTabFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "id",
+      "storageKey": null
+    },
+    {
+      "alias": "controlsInfo",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 0
+        }
+      ],
+      "concreteType": "ControlConnection",
+      "kind": "LinkedField",
+      "name": "controls",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "totalCount",
+          "storageKey": null
+        }
+      ],
+      "storageKey": "controls(first:0)"
+    },
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "AvailableStateOfApplicabilityControl",
+      "kind": "LinkedField",
+      "name": "availableControls",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "controlId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "sectionTitle",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "frameworkId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "frameworkName",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "organizationId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "stateOfApplicabilityId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "applicability",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "justification",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "bestPractice",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "regulatory",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "contractual",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "riskAssessment",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "type": "StateOfApplicability",
+  "abstractKey": null
+};
+
+(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabRefetchQuery.graphql.ts

@@ -0,0 +1,247 @@
+/**
+ * @generated SignedSource<<06d34888ed5b3e0d66f2159e1a916196>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityControlsTabRefetchQuery$variables = {
+  id: string;
+};
+export type StateOfApplicabilityControlsTabRefetchQuery$data = {
+  readonly node: {
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+  };
+};
+export type StateOfApplicabilityControlsTabRefetchQuery = {
+  response: StateOfApplicabilityControlsTabRefetchQuery$data;
+  variables: StateOfApplicabilityControlsTabRefetchQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "id"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "id"
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "args": null,
+            "kind": "FragmentSpread",
+            "name": "StateOfApplicabilityControlsTabFragment"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": "controlsInfo",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "first",
+                    "value": 0
+                  }
+                ],
+                "concreteType": "ControlConnection",
+                "kind": "LinkedField",
+                "name": "controls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "totalCount",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": "controls(first:0)"
+              },
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "AvailableStateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "availableControls",
+                "plural": true,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "sectionTitle",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "name",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkName",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "organizationId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "regulatory",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "contractual",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "riskAssessment",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "50874b763d9f2cfc01d097ec9b68ec82",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsTabRefetchQuery(\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityControlsTabFragment\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+
+export default node;

apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabUnlinkMutation.graphql.ts

@@ -0,0 +1,109 @@
+/**
+ * @generated SignedSource<<a9742800c22e683eb17d46d52b7d6aa5>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation$variables = {
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation = {
+  response: StateOfApplicabilityControlsTabUnlinkMutation$data;
+  variables: StateOfApplicabilityControlsTabUnlinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+    "kind": "LinkedField",
+    "name": "deleteStateOfApplicabilityControlMapping",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedControlId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityControlId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "6bf3ac32bd032b215e3e4f48100353d7",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityControlsTabUnlinkMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "b8c3e0ca44bde75468fcfab09151854d";
+
+export default node;

apps/console/src/routes.tsx

@@ -35,6 +35,7 @@ import { snapshotsRoutes } from "./routes/snapshotsRoutes.ts";
 import { continualImprovementRoutes } from "./routes/continualImprovementRoutes.ts";
 import { rightsRequestRoutes } from "./routes/rightsRequestRoutes.ts";
 import { processingActivityRoutes } from "./routes/processingActivityRoutes.ts";
+import { statesOfApplicabilityRoutes } from "./routes/statesOfApplicabilityRoutes.ts";
 import { lazy } from "@probo/react-lazy";
 import { loaderFromQueryLoader, routeFromAppRoute, withQueryRef, type AppRoute } from "@probo/routes";
 import { employeeDocumentsQuery } from "./pages/organizations/employee/EmployeeDocumentsPage";
@@ -227,8 +228,9 @@ const routes = [
       ...continualImprovementRoutes,
       ...rightsRequestRoutes,
       ...processingActivityRoutes,
-      ...snapshotsRoutes,
+      ...statesOfApplicabilityRoutes,
       ...trustCenterRoutes,
+      ...snapshotsRoutes,
       {
         path: "*",
         Component: PageError,

apps/console/src/routes/statesOfApplicabilityRoutes.ts

@@ -0,0 +1,70 @@
+import { lazy } from "@probo/react-lazy";
+import { loadQuery } from "react-relay";
+import { relayEnvironment } from "/providers/RelayProviders";
+import { PageSkeleton } from "/components/skeletons/PageSkeleton.tsx";
+import {
+  paginatedStateOfApplicabilityQuery,
+  stateOfApplicabilityNodeQuery,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import type { StateOfApplicabilityGraphNodeQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+import { loaderFromQueryLoader, withQueryRef, type AppRoute } from "@probo/routes";
+
+export const statesOfApplicabilityRoutes = [
+  {
+    path: "states-of-applicability",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ organizationId }) =>
+      loadQuery<StateOfApplicabilityGraphPaginatedQuery>(
+        relayEnvironment,
+        paginatedStateOfApplicabilityQuery,
+        { organizationId: organizationId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StatesOfApplicabilityPage")),
+    ),
+  },
+  {
+    path: "snapshots/:snapshotId/states-of-applicability",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ organizationId }) =>
+      loadQuery<StateOfApplicabilityGraphPaginatedQuery>(
+        relayEnvironment,
+        paginatedStateOfApplicabilityQuery,
+        { organizationId: organizationId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StatesOfApplicabilityPage")),
+    ),
+  },
+  {
+    path: "states-of-applicability/:stateOfApplicabilityId",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ stateOfApplicabilityId }) =>
+      loadQuery<StateOfApplicabilityGraphNodeQuery>(
+        relayEnvironment,
+        stateOfApplicabilityNodeQuery,
+        { stateOfApplicabilityId: stateOfApplicabilityId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage")),
+    ),
+  },
+  {
+    path: "snapshots/:snapshotId/states-of-applicability/:stateOfApplicabilityId",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ stateOfApplicabilityId }) =>
+      loadQuery<StateOfApplicabilityGraphNodeQuery>(
+        relayEnvironment,
+        stateOfApplicabilityNodeQuery,
+        { stateOfApplicabilityId: stateOfApplicabilityId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage")),
+    ),
+  },
+] satisfies AppRoute[];

e2e/console/control_test.go

@@ -66,6 +66,7 @@ func TestControl_Create(t *testing.T) {
 				"name":         "Information Security Policies",
 				"description":  "Policies for information security",
 				"status":       "INCLUDED",
+				"bestPractice": true,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -112,6 +113,7 @@ func TestControl_Create(t *testing.T) {
 				"description":            "Cryptography controls",
 				"status":                 "EXCLUDED",
 				"exclusionJustification": "Not applicable - no cryptographic data processing",
+				"bestPractice":           false,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -356,6 +358,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -368,6 +371,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -376,10 +380,11 @@ func TestControl_RequiredFields(t *testing.T) {
 			name: "Missing sectionTitle should fail",
 			variables: map[string]any{
 				"input": map[string]any{
-					"frameworkId": frameworkID,
-					"name":        "Test Control",
-					"description": "Test",
-					"status":      "INCLUDED",
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -392,6 +397,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"description":  "Test",
 					"sectionTitle": "Section 1",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -404,6 +410,20 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing bestPractice should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
 				},
 			},
 			wantError: true,
@@ -417,6 +437,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INVALID_STATUS",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -504,6 +525,7 @@ func TestControl_OmittableDescription(t *testing.T) {
 			"description":  "Initial description",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -668,6 +690,7 @@ func TestControl_SubResolvers(t *testing.T) {
 			"description":  "Test description",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &controlResult)
 	require.NoError(t, err)
@@ -881,6 +904,7 @@ func TestControl_ExclusionJustification(t *testing.T) {
 				"sectionTitle":           "Section 1",
 				"status":                 "EXCLUDED",
 				"exclusionJustification": "Not applicable to our business",
+				"bestPractice":           false,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -919,6 +943,7 @@ func TestControl_ExclusionJustification(t *testing.T) {
 				"description":  "Test",
 				"sectionTitle": "Section 2",
 				"status":       "INCLUDED",
+				"bestPractice": true,
 			},
 		}, &createResult)
 		require.NoError(t, err)

e2e/console/mapping_test.go

@@ -83,6 +83,7 @@ func TestControlMeasureMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control for mapping",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -362,6 +363,7 @@ func TestControlDocumentMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -503,6 +505,7 @@ func TestControlAuditMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -640,6 +643,7 @@ func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -897,6 +901,7 @@ func TestRiskObligationMapping_CreateDelete(t *testing.T) {
 			"requirement":    "Obligation for Risk Mapping",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createObligationResult)
 	require.NoError(t, err)

e2e/console/obligation_test.go

@@ -69,6 +69,7 @@ func TestObligation_Create(t *testing.T) {
 			"regulator":      "ICO",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &result)
 	require.NoError(t, err)
@@ -115,6 +116,7 @@ func TestObligation_Update(t *testing.T) {
 			"area":           "Original Area",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -191,6 +193,7 @@ func TestObligation_Delete(t *testing.T) {
 			"area":           "Obligation to Delete",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -256,6 +259,7 @@ func TestObligation_List(t *testing.T) {
 				"area":           area,
 				"ownerId":        peopleID,
 				"status":         "NON_COMPLIANT",
+				"type":           "LEGAL",
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -342,6 +346,7 @@ func TestObligation_StatusValues(t *testing.T) {
 					"area":           "Status Test " + status,
 					"ownerId":        peopleID,
 					"status":         status,
+					"type":           "LEGAL",
 				},
 			}, &result)
 			require.NoError(t, err)

e2e/console/rbac_test.go

@@ -413,7 +413,7 @@ func TestRBAC(t *testing.T) {
 			client: owner,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: true,
 		},
@@ -423,7 +423,7 @@ func TestRBAC(t *testing.T) {
 			client: admin,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: true,
 		},
@@ -433,7 +433,7 @@ func TestRBAC(t *testing.T) {
 			client: viewer,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: false,
 		},

e2e/internal/factory/factory.go

@@ -218,6 +218,7 @@ func CreateControl(c *testutil.Client, frameworkID string, attrs ...Attrs) strin
 		"description":  a.getString("description", "Test control description"),
 		"sectionTitle": a.getString("sectionTitle", fmt.Sprintf("Section %s", gofakeit.LetterN(3))),
 		"status":       a.getString("status", "INCLUDED"),
+		"bestPractice": a.getBool("bestPractice", true),
 	}
 
 	var result struct {
@@ -389,9 +390,9 @@ func CreatePeople(c *testutil.Client, attrs ...Attrs) string {
 	`
 
 	input := map[string]any{
-		"organizationId":          c.GetOrganizationID().String(),
+		"organizationId":           c.GetOrganizationID().String(),
 		"fullName":                 a.getString("fullName", SafeName("Person")),
-		"primaryEmailAddress":     a.getString("primaryEmailAddress", SafeEmail()),
+		"primaryEmailAddress":      a.getString("primaryEmailAddress", SafeEmail()),
 		"additionalEmailAddresses": a.getSlice("additionalEmailAddresses", []string{}),
 		"kind":                     a.getString("kind", "EMPLOYEE"),
 	}
@@ -498,6 +499,11 @@ func (b *ControlBuilder) WithStatus(status string) *ControlBuilder {
 	return b
 }
 
+func (b *ControlBuilder) WithBestPractice(bestPractice bool) *ControlBuilder {
+	b.attrs["bestPractice"] = bestPractice
+	return b
+}
+
 func (b *ControlBuilder) Create() string {
 	return CreateControl(b.client, b.frameworkID, b.attrs)
 }

packages/helpers/src/index.ts

@@ -52,6 +52,10 @@ export {
     getObligationStatusLabel,
     getObligationStatusOptions,
 } from "./obligationStatus";
+export {
+    getObligationTypeLabel,
+    getObligationTypeOptions,
+} from "./obligationType";
 export {
     getTrustCenterVisibilityVariant,
     getTrustCenterVisibilityLabel,

packages/helpers/src/obligationType.ts

@@ -0,0 +1,29 @@
+type Translator = (s: string) => string;
+
+export type ObligationType = "LEGAL" | "CONTRACTUAL";
+
+export const obligationTypes = [
+  "LEGAL",
+  "CONTRACTUAL",
+] as const;
+
+export const getObligationTypeLabel = (type: ObligationType) => {
+  switch (type) {
+    case "LEGAL":
+      return "Legal";
+    case "CONTRACTUAL":
+      return "Contractual";
+    default:
+      return type;
+  }
+};
+
+export function getObligationTypeOptions(__: Translator) {
+  return obligationTypes.map((type) => ({
+    value: type,
+    label: __({
+      "LEGAL": "Legal",
+      "CONTRACTUAL": "Contractual",
+    }[type]),
+  }));
+}

packages/helpers/src/snapshots.ts

@@ -9,6 +9,7 @@ export const snapshotTypes = [
   "OBLIGATIONS",
   "CONTINUAL_IMPROVEMENTS",
   "PROCESSING_ACTIVITIES",
+  "STATES_OF_APPLICABILITY",
 ] as const;
 
 export function getSnapshotTypeLabel(__: Translator, type: string | null | undefined) {
@@ -33,6 +34,8 @@ export function getSnapshotTypeLabel(__: Translator, type: string | null | undef
       return __("Continual Improvements");
     case "PROCESSING_ACTIVITIES":
       return __("Processing Activities");
+    case "STATES_OF_APPLICABILITY":
+      return __("States of Applicability");
     default:
       return __("Unknown");
   }
@@ -56,6 +59,8 @@ export function getSnapshotTypeUrlPath(type?: string): string {
       return "/continual-improvements";
     case "PROCESSING_ACTIVITIES":
       return "/processing-activities";
+    case "STATES_OF_APPLICABILITY":
+      return "/states-of-applicability";
     default:
       return "";
   }

pkg/authz/permissions.go

@@ -103,6 +103,7 @@ const (
 	ActionListMeetings                Action = "listMeetings"
 	ActionListMembers                 Action = "listMembers"
 	ActionListNonconformities         Action = "listNonconformities"
+	ActionListStatesOfApplicability   Action = "listStatesOfApplicability"
 	ActionListObligations             Action = "listObligations"
 	ActionListPeople                  Action = "listPeople"
 	ActionListProcessingActivities    Action = "listProcessingActivities"
@@ -120,43 +121,46 @@ const (
 	ActionListSignableDocuments       Action = "listSignableDocuments"
 	ActionListSignableDocumentVersion Action = "listSignableDocumentVersion"
 
-	ActionCreateAsset                          Action = "createAsset"
-	ActionCreateAudit                          Action = "createAudit"
-	ActionCreateContinualImprovement           Action = "createContinualImprovement"
-	ActionCreateRightsRequest                  Action = "createRightsRequest"
-	ActionCreateControl                        Action = "createControl"
-	ActionCreateControlAuditMapping            Action = "createControlAuditMapping"
-	ActionCreateControlDocumentMapping         Action = "createControlDocumentMapping"
-	ActionCreateControlMeasureMapping          Action = "createControlMeasureMapping"
-	ActionCreateControlSnapshotMapping         Action = "createControlSnapshotMapping"
-	ActionCreateCustomDomain                   Action = "createCustomDomain"
-	ActionCreateDatum                          Action = "createDatum"
-	ActionCreateDocument                       Action = "createDocument"
-	ActionCreateDraftDocumentVersion           Action = "createDraftDocumentVersion"
-	ActionCreateFramework                      Action = "createFramework"
-	ActionCreateMeasure                        Action = "createMeasure"
-	ActionCreateMeeting                        Action = "createMeeting"
-	ActionCreateNonconformity                  Action = "createNonconformity"
-	ActionCreateObligation                     Action = "createObligation"
-	ActionCreatePeople                         Action = "createPeople"
-	ActionCreateProcessingActivity             Action = "createProcessingActivity"
-	ActionCreateDataProtectionImpactAssessment Action = "createDataProtectionImpactAssessment"
-	ActionCreateTransferImpactAssessment       Action = "createTransferImpactAssessment"
-	ActionCreateRisk                           Action = "createRisk"
-	ActionCreateRiskDocumentMapping            Action = "createRiskDocumentMapping"
-	ActionCreateRiskMeasureMapping             Action = "createRiskMeasureMapping"
-	ActionCreateRiskObligationMapping          Action = "createRiskObligationMapping"
-	ActionCreateSAMLConfiguration              Action = "createSAMLConfiguration"
-	ActionCreateSnapshot                       Action = "createSnapshot"
-	ActionCreateTask                           Action = "createTask"
-	ActionCreateTrustCenter                    Action = "createTrustCenter"
-	ActionCreateTrustCenterAccess              Action = "createTrustCenterAccess"
-	ActionCreateTrustCenterFile                Action = "createTrustCenterFile"
-	ActionCreateTrustCenterReference           Action = "createTrustCenterReference"
-	ActionCreateVendor                         Action = "createVendor"
-	ActionCreateVendorContact                  Action = "createVendorContact"
-	ActionCreateVendorRiskAssessment           Action = "createVendorRiskAssessment"
-	ActionCreateVendorService                  Action = "createVendorService"
+	ActionCreateAsset                              Action = "createAsset"
+	ActionCreateAudit                              Action = "createAudit"
+	ActionCreateContinualImprovement               Action = "createContinualImprovement"
+	ActionCreateRightsRequest                      Action = "createRightsRequest"
+	ActionCreateControl                            Action = "createControl"
+	ActionCreateControlAuditMapping                Action = "createControlAuditMapping"
+	ActionCreateControlObligationMapping           Action = "createControlObligationMapping"
+	ActionCreateControlDocumentMapping             Action = "createControlDocumentMapping"
+	ActionCreateControlMeasureMapping              Action = "createControlMeasureMapping"
+	ActionCreateControlSnapshotMapping             Action = "createControlSnapshotMapping"
+	ActionCreateStateOfApplicabilityControlMapping Action = "createStateOfApplicabilityControlMapping"
+	ActionCreateCustomDomain                       Action = "createCustomDomain"
+	ActionCreateDatum                              Action = "createDatum"
+	ActionCreateDocument                           Action = "createDocument"
+	ActionCreateDraftDocumentVersion               Action = "createDraftDocumentVersion"
+	ActionCreateFramework                          Action = "createFramework"
+	ActionCreateMeasure                            Action = "createMeasure"
+	ActionCreateMeeting                            Action = "createMeeting"
+	ActionCreateNonconformity                      Action = "createNonconformity"
+	ActionCreateObligation                         Action = "createObligation"
+	ActionCreatePeople                             Action = "createPeople"
+	ActionCreateProcessingActivity                 Action = "createProcessingActivity"
+	ActionCreateStateOfApplicability               Action = "createStateOfApplicability"
+	ActionCreateDataProtectionImpactAssessment     Action = "createDataProtectionImpactAssessment"
+	ActionCreateTransferImpactAssessment           Action = "createTransferImpactAssessment"
+	ActionCreateRisk                               Action = "createRisk"
+	ActionCreateRiskDocumentMapping                Action = "createRiskDocumentMapping"
+	ActionCreateRiskMeasureMapping                 Action = "createRiskMeasureMapping"
+	ActionCreateRiskObligationMapping              Action = "createRiskObligationMapping"
+	ActionCreateSAMLConfiguration                  Action = "createSAMLConfiguration"
+	ActionCreateSnapshot                           Action = "createSnapshot"
+	ActionCreateTask                               Action = "createTask"
+	ActionCreateTrustCenter                        Action = "createTrustCenter"
+	ActionCreateTrustCenterAccess                  Action = "createTrustCenterAccess"
+	ActionCreateTrustCenterFile                    Action = "createTrustCenterFile"
+	ActionCreateTrustCenterReference               Action = "createTrustCenterReference"
+	ActionCreateVendor                             Action = "createVendor"
+	ActionCreateVendorContact                      Action = "createVendorContact"
+	ActionCreateVendorRiskAssessment               Action = "createVendorRiskAssessment"
+	ActionCreateVendorService                      Action = "createVendorService"
 
 	ActionUpdateAsset                            Action = "updateAsset"
 	ActionUpdateAudit                            Action = "updateAudit"
@@ -175,6 +179,7 @@ const (
 	ActionUpdateOrganization                     Action = "updateOrganization"
 	ActionUpdatePeople                           Action = "updatePeople"
 	ActionUpdateProcessingActivity               Action = "updateProcessingActivity"
+	ActionUpdateStateOfApplicability             Action = "updateStateOfApplicability"
 	ActionUpdateDataProtectionImpactAssessment   Action = "updateDataProtectionImpactAssessment"
 	ActionUpdateTransferImpactAssessment         Action = "updateTransferImpactAssessment"
 	ActionUpdateRisk                             Action = "updateRisk"
@@ -190,50 +195,53 @@ const (
 	ActionUpdateVendorDataPrivacyAgreement       Action = "updateVendorDataPrivacyAgreement"
 	ActionUpdateVendorService                    Action = "updateVendorService"
 
-	ActionDeleteAsset                            Action = "deleteAsset"
-	ActionDeleteAudit                            Action = "deleteAudit"
-	ActionDeleteAuditReport                      Action = "deleteAuditReport"
-	ActionDeleteContinualImprovement             Action = "deleteContinualImprovement"
-	ActionDeleteRightsRequest                    Action = "deleteRightsRequest"
-	ActionDeleteControl                          Action = "deleteControl"
-	ActionDeleteControlAuditMapping              Action = "deleteControlAuditMapping"
-	ActionDeleteControlDocumentMapping           Action = "deleteControlDocumentMapping"
-	ActionDeleteControlMeasureMapping            Action = "deleteControlMeasureMapping"
-	ActionDeleteControlSnapshotMapping           Action = "deleteControlSnapshotMapping"
-	ActionDeleteCustomDomain                     Action = "deleteCustomDomain"
-	ActionDeleteDatum                            Action = "deleteDatum"
-	ActionDeleteDocument                         Action = "deleteDocument"
-	ActionDeleteDraftDocumentVersion             Action = "deleteDraftDocumentVersion"
-	ActionDeleteEvidence                         Action = "deleteEvidence"
-	ActionDeleteFramework                        Action = "deleteFramework"
-	ActionDeleteInvitation                       Action = "deleteInvitation"
-	ActionDeleteMeasure                          Action = "deleteMeasure"
-	ActionDeleteMeeting                          Action = "deleteMeeting"
-	ActionDeleteNonconformity                    Action = "deleteNonconformity"
-	ActionDeleteObligation                       Action = "deleteObligation"
-	ActionDeleteOrganization                     Action = "deleteOrganization"
-	ActionDeleteOrganizationHorizontalLogo       Action = "deleteOrganizationHorizontalLogo"
-	ActionDeletePeople                           Action = "deletePeople"
-	ActionDeleteProcessingActivity               Action = "deleteProcessingActivity"
-	ActionDeleteDataProtectionImpactAssessment   Action = "deleteDataProtectionImpactAssessment"
-	ActionDeleteTransferImpactAssessment         Action = "deleteTransferImpactAssessment"
-	ActionDeleteRisk                             Action = "deleteRisk"
-	ActionDeleteRiskDocumentMapping              Action = "deleteRiskDocumentMapping"
-	ActionDeleteRiskMeasureMapping               Action = "deleteRiskMeasureMapping"
-	ActionDeleteRiskObligationMapping            Action = "deleteRiskObligationMapping"
-	ActionDeleteSAMLConfiguration                Action = "deleteSAMLConfiguration"
-	ActionDeleteSnapshot                         Action = "deleteSnapshot"
-	ActionDeleteTask                             Action = "deleteTask"
-	ActionDeleteTrustCenterAccess                Action = "deleteTrustCenterAccess"
-	ActionDeleteTrustCenterFile                  Action = "deleteTrustCenterFile"
-	ActionDeleteTrustCenterNDA                   Action = "deleteTrustCenterNDA"
-	ActionDeleteTrustCenterReference             Action = "deleteTrustCenterReference"
-	ActionDeleteVendor                           Action = "deleteVendor"
-	ActionDeleteVendorBusinessAssociateAgreement Action = "deleteVendorBusinessAssociateAgreement"
-	ActionDeleteVendorComplianceReport           Action = "deleteVendorComplianceReport"
-	ActionDeleteVendorContact                    Action = "deleteVendorContact"
-	ActionDeleteVendorDataPrivacyAgreement       Action = "deleteVendorDataPrivacyAgreement"
-	ActionDeleteVendorService                    Action = "deleteVendorService"
+	ActionDeleteAsset                              Action = "deleteAsset"
+	ActionDeleteAudit                              Action = "deleteAudit"
+	ActionDeleteAuditReport                        Action = "deleteAuditReport"
+	ActionDeleteContinualImprovement               Action = "deleteContinualImprovement"
+	ActionDeleteRightsRequest                      Action = "deleteRightsRequest"
+	ActionDeleteControl                            Action = "deleteControl"
+	ActionDeleteControlAuditMapping                Action = "deleteControlAuditMapping"
+	ActionDeleteControlObligationMapping           Action = "deleteControlObligationMapping"
+	ActionDeleteControlDocumentMapping             Action = "deleteControlDocumentMapping"
+	ActionDeleteControlMeasureMapping              Action = "deleteControlMeasureMapping"
+	ActionDeleteControlSnapshotMapping             Action = "deleteControlSnapshotMapping"
+	ActionDeleteStateOfApplicabilityControlMapping Action = "deleteStateOfApplicabilityControlMapping"
+	ActionDeleteCustomDomain                       Action = "deleteCustomDomain"
+	ActionDeleteDatum                              Action = "deleteDatum"
+	ActionDeleteDocument                           Action = "deleteDocument"
+	ActionDeleteDraftDocumentVersion               Action = "deleteDraftDocumentVersion"
+	ActionDeleteEvidence                           Action = "deleteEvidence"
+	ActionDeleteFramework                          Action = "deleteFramework"
+	ActionDeleteInvitation                         Action = "deleteInvitation"
+	ActionDeleteMeasure                            Action = "deleteMeasure"
+	ActionDeleteMeeting                            Action = "deleteMeeting"
+	ActionDeleteNonconformity                      Action = "deleteNonconformity"
+	ActionDeleteObligation                         Action = "deleteObligation"
+	ActionDeleteOrganization                       Action = "deleteOrganization"
+	ActionDeleteOrganizationHorizontalLogo         Action = "deleteOrganizationHorizontalLogo"
+	ActionDeletePeople                             Action = "deletePeople"
+	ActionDeleteProcessingActivity                 Action = "deleteProcessingActivity"
+	ActionDeleteStateOfApplicability               Action = "deleteStateOfApplicability"
+	ActionDeleteDataProtectionImpactAssessment     Action = "deleteDataProtectionImpactAssessment"
+	ActionDeleteTransferImpactAssessment           Action = "deleteTransferImpactAssessment"
+	ActionDeleteRisk                               Action = "deleteRisk"
+	ActionDeleteRiskDocumentMapping                Action = "deleteRiskDocumentMapping"
+	ActionDeleteRiskMeasureMapping                 Action = "deleteRiskMeasureMapping"
+	ActionDeleteRiskObligationMapping              Action = "deleteRiskObligationMapping"
+	ActionDeleteSAMLConfiguration                  Action = "deleteSAMLConfiguration"
+	ActionDeleteSnapshot                           Action = "deleteSnapshot"
+	ActionDeleteTask                               Action = "deleteTask"
+	ActionDeleteTrustCenterAccess                  Action = "deleteTrustCenterAccess"
+	ActionDeleteTrustCenterFile                    Action = "deleteTrustCenterFile"
+	ActionDeleteTrustCenterNDA                     Action = "deleteTrustCenterNDA"
+	ActionDeleteTrustCenterReference               Action = "deleteTrustCenterReference"
+	ActionDeleteVendor                             Action = "deleteVendor"
+	ActionDeleteVendorBusinessAssociateAgreement   Action = "deleteVendorBusinessAssociateAgreement"
+	ActionDeleteVendorComplianceReport             Action = "deleteVendorComplianceReport"
+	ActionDeleteVendorContact                      Action = "deleteVendorContact"
+	ActionDeleteVendorDataPrivacyAgreement         Action = "deleteVendorDataPrivacyAgreement"
+	ActionDeleteVendorService                      Action = "deleteVendorService"
 
 	ActionAcceptInvitation                         Action = "acceptInvitation"
 	ActionAssessVendor                             Action = "assessVendor"
@@ -315,16 +323,17 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionConfirmEmail:                             NonEmployeeRoles,
 		ActionAcceptInvitation:                         NonEmployeeRoles,
 
-		ActionListTrustCenterFiles:   CoreRoles,
-		ActionGetTrustCenter:         CoreRoles,
-		ActionMemberships:            CoreRoles,
-		ActionListMembers:            CoreRoles,
-		ActionListInvitations:        CoreRoles,
-		ActionListSlackConnections:   CoreRoles,
-		ActionGetCustomDomain:        CoreRoles,
-		ActionListSAMLConfigurations: CoreRoles,
-		ActionListMeetings:           CoreRoles,
-		ActionListTasks:              CoreRoles,
+		ActionListTrustCenterFiles:      CoreRoles,
+		ActionGetTrustCenter:            CoreRoles,
+		ActionMemberships:               CoreRoles,
+		ActionListMembers:               CoreRoles,
+		ActionListInvitations:           CoreRoles,
+		ActionListSlackConnections:      CoreRoles,
+		ActionGetCustomDomain:           CoreRoles,
+		ActionListSAMLConfigurations:    CoreRoles,
+		ActionListMeetings:              CoreRoles,
+		ActionListStatesOfApplicability: NonEmployeeRoles,
+		ActionListTasks:                 CoreRoles,
 
 		ActionUpdateOrganization:               EditRoles,
 		ActionDeleteOrganizationHorizontalLogo: EditRoles,
@@ -339,6 +348,7 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionCreateMeasure:                    EditRoles,
 		ActionImportMeasure:                    EditRoles,
 		ActionCreateMeeting:                    EditRoles,
+		ActionCreateStateOfApplicability:       EditRoles,
 		ActionCreateTask:                       EditRoles,
 		ActionCreateRisk:                       EditRoles,
 		ActionCreateDocument:                   EditRoles,
@@ -498,23 +508,32 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionExportFramework:                       EditRoles,
 	},
 	coredata.ControlEntityType: {
-		ActionGet:           NonEmployeeRoles,
-		ActionGetFramework:  NonEmployeeRoles,
-		ActionListMeasures:  NonEmployeeRoles,
-		ActionListDocuments: NonEmployeeRoles,
-		ActionListAudits:    NonEmployeeRoles,
-		ActionListSnapshots: NonEmployeeRoles,
+		ActionGet:                       NonEmployeeRoles,
+		ActionGetFramework:              NonEmployeeRoles,
+		ActionListMeasures:              NonEmployeeRoles,
+		ActionListDocuments:             NonEmployeeRoles,
+		ActionListAudits:                NonEmployeeRoles,
+		ActionListObligations:           NonEmployeeRoles,
+		ActionListSnapshots:             NonEmployeeRoles,
+		ActionListStatesOfApplicability: NonEmployeeRoles,
 
-		ActionUpdateControl:                EditRoles,
-		ActionDeleteControl:                EditRoles,
-		ActionCreateControlMeasureMapping:  EditRoles,
-		ActionCreateControlDocumentMapping: EditRoles,
-		ActionDeleteControlMeasureMapping:  EditRoles,
-		ActionDeleteControlDocumentMapping: EditRoles,
-		ActionCreateControlAuditMapping:    EditRoles,
-		ActionDeleteControlAuditMapping:    EditRoles,
-		ActionCreateControlSnapshotMapping: EditRoles,
-		ActionDeleteControlSnapshotMapping: EditRoles,
+		ActionUpdateControl:                            EditRoles,
+		ActionDeleteControl:                            EditRoles,
+		ActionCreateControlMeasureMapping:              EditRoles,
+		ActionCreateControlDocumentMapping:             EditRoles,
+		ActionDeleteControlMeasureMapping:              EditRoles,
+		ActionDeleteControlDocumentMapping:             EditRoles,
+		ActionCreateControlAuditMapping:                EditRoles,
+		ActionDeleteControlAuditMapping:                EditRoles,
+		ActionCreateControlObligationMapping:           EditRoles,
+		ActionDeleteControlObligationMapping:           EditRoles,
+		ActionCreateControlSnapshotMapping:             EditRoles,
+		ActionCreateStateOfApplicabilityControlMapping: EditRoles,
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
+		ActionDeleteControlSnapshotMapping:             EditRoles,
+	},
+	coredata.StateOfApplicabilityControlEntityType: {
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
 	},
 	coredata.MeasureEntityType: {
 		ActionListTasks: CoreRoles,
@@ -689,6 +708,7 @@ var Permissions = map[uint16]map[Action][]Role{
 	coredata.RightsRequestEntityType: {
 		ActionGet:             NonEmployeeRoles,
 		ActionGetOrganization: NonEmployeeRoles,
+		ActionListControls:    NonEmployeeRoles,
 
 		ActionUpdateRightsRequest: EditRoles,
 		ActionDeleteRightsRequest: EditRoles,
@@ -763,6 +783,16 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionUpdateMeeting: EditRoles,
 		ActionDeleteMeeting: EditRoles,
 	},
+	coredata.StateOfApplicabilityEntityType: {
+		ActionGet:             NonEmployeeRoles,
+		ActionGetOrganization: NonEmployeeRoles,
+		ActionListControls:    NonEmployeeRoles,
+		ActionTotalCount:      NonEmployeeRoles,
+
+		ActionUpdateStateOfApplicability:               EditRoles,
+		ActionDeleteStateOfApplicability:               EditRoles,
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
+	},
 }
 
 func GetPermissionsForAction(entityType uint16, action Action) []Role {

pkg/coredata/control.go

@@ -38,6 +38,7 @@ type (
 		Description            *string       `db:"description"`
 		Status                 ControlStatus `db:"status"`
 		ExclusionJustification *string       `db:"exclusion_justification"`
+		BestPractice           bool          `db:"best_practice"`
 		CreatedAt              time.Time     `db:"created_at"`
 		UpdatedAt              time.Time     `db:"updated_at"`
 	}
@@ -134,6 +135,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -153,6 +155,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -245,6 +248,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -264,6 +268,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -362,6 +367,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -387,6 +393,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -467,6 +474,7 @@ SELECT
     description,
     status,
 	exclusion_justification,
+	best_practice,
     created_at,
     updated_at
 FROM
@@ -562,6 +570,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -581,6 +590,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -628,6 +638,7 @@ SELECT
     description,
     status,
     exclusion_justification,
+    best_practice,
     created_at,
     updated_at
 FROM
@@ -677,6 +688,7 @@ SELECT
     description,
     status,
     exclusion_justification,
+    best_practice,
     created_at,
     updated_at
 FROM
@@ -726,6 +738,7 @@ INSERT INTO
         description,
         status,
         exclusion_justification,
+        best_practice,
         created_at,
         updated_at
     )
@@ -739,6 +752,7 @@ VALUES (
     @description,
 	@status,
 	@exclusion_justification,
+	@best_practice,
     @created_at,
     @updated_at
 );
@@ -754,6 +768,7 @@ VALUES (
 		"description":             c.Description,
 		"status":                  c.Status,
 		"exclusion_justification": c.ExclusionJustification,
+		"best_practice":           c.BestPractice,
 		"created_at":              c.CreatedAt,
 		"updated_at":              c.UpdatedAt,
 	}
@@ -808,6 +823,7 @@ UPDATE controls SET
     section_title = @section_title,
 	status = @status,
 	exclusion_justification = @exclusion_justification,
+	best_practice = @best_practice,
     updated_at = @updated_at
 WHERE %s
     AND id = @control_id
@@ -821,6 +837,7 @@ WHERE %s
 		"section_title":           c.SectionTitle,
 		"status":                  c.Status,
 		"exclusion_justification": c.ExclusionJustification,
+		"best_practice":           c.BestPractice,
 		"updated_at":              c.UpdatedAt,
 	}
 
@@ -905,6 +922,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -924,6 +942,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -1017,6 +1036,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -1036,6 +1056,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -1065,3 +1086,117 @@ WHERE %s
 
 	return nil
 }
+
+func (c *Controls) CountByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	filter *ControlFilter,
+) (int, error) {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.tenant_id,
+		c.search_vector
+	FROM
+		controls c
+	INNER JOIN
+		states_of_applicability_controls soac ON c.id = soac.control_id
+	WHERE
+		soac.state_of_applicability_id = @state_of_applicability_id
+)
+SELECT
+	COUNT(id)
+FROM
+	ctrl
+WHERE %s
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (c *Controls) LoadByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	cursor *page.Cursor[ControlOrderField],
+	filter *ControlFilter,
+) error {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.section_title,
+		c.framework_id,
+		c.organization_id,
+		c.tenant_id,
+		c.name,
+		c.description,
+		c.status,
+		c.exclusion_justification,
+		c.best_practice,
+		c.created_at,
+		c.updated_at,
+		c.search_vector
+	FROM
+		controls c
+	INNER JOIN
+		states_of_applicability_controls soac ON c.id = soac.control_id
+	WHERE
+		soac.state_of_applicability_id = @state_of_applicability_id
+)
+SELECT
+	id,
+	section_title,
+	framework_id,
+	organization_id,
+	name,
+	description,
+	status,
+	exclusion_justification,
+	best_practice,
+	created_at,
+	updated_at
+FROM
+	ctrl
+WHERE %s
+	AND %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	if err != nil {
+		return fmt.Errorf("cannot collect controls: %w", err)
+	}
+
+	*c = controls
+
+	return nil
+}

pkg/coredata/control_mesure.go

@@ -136,3 +136,56 @@ WHERE
 	*cms = controlMeasures
 	return nil
 }
+
+type ControlWithRisk struct {
+	ControlID gid.GID `db:"control_id"`
+}
+
+type ControlsWithRisk []*ControlWithRisk
+
+func (cwrs *ControlsWithRisk) LoadByControlIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlIDs []gid.GID,
+) error {
+	q := `
+WITH control_risks AS (
+	SELECT DISTINCT
+		cm.control_id,
+		rm.risk_id,
+		r.tenant_id
+	FROM
+		controls_measures cm
+	INNER JOIN
+		risks_measures rm ON cm.measure_id = rm.measure_id
+	INNER JOIN
+		risks r ON rm.risk_id = r.id
+	WHERE
+		cm.control_id = ANY(@control_ids)
+)
+SELECT DISTINCT
+	control_id
+FROM
+	control_risks
+WHERE
+	%s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_ids": controlIDs}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control risks: %w", err)
+	}
+
+	controlsWithRisk, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlWithRisk])
+	if err != nil {
+		return fmt.Errorf("cannot collect control risks: %w", err)
+	}
+
+	*cwrs = controlsWithRisk
+	return nil
+}

pkg/coredata/control_obligation.go

@@ -0,0 +1,221 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	ControlObligation struct {
+		ControlID    gid.GID   `db:"control_id"`
+		ObligationID gid.GID   `db:"obligation_id"`
+		CreatedAt    time.Time `db:"created_at"`
+	}
+
+	ControlObligations []*ControlObligation
+)
+
+func (co ControlObligation) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    controls_obligations (
+        control_id,
+        obligation_id,
+        tenant_id,
+        created_at
+    )
+VALUES (
+    @control_id,
+    @obligation_id,
+    @tenant_id,
+    @created_at
+)
+ON CONFLICT (control_id, obligation_id) DO NOTHING;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id":    co.ControlID,
+		"obligation_id": co.ObligationID,
+		"tenant_id":     scope.GetTenantID(),
+		"created_at":    co.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (co ControlObligation) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	obligationID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND control_id = @control_id
+    AND obligation_id = @obligation_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id":    controlID,
+		"obligation_id": obligationID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (cos *ControlObligations) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    obligation_id,
+    created_at
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND control_id = @control_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_obligations: %w", err)
+	}
+
+	controlObligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_obligations: %w", err)
+	}
+
+	*cos = controlObligations
+	return nil
+}
+
+func (cos *ControlObligations) LoadByObligationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	obligationID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    obligation_id,
+    created_at
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND obligation_id = @obligation_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"obligation_id": obligationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_obligations: %w", err)
+	}
+
+	controlObligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_obligations: %w", err)
+	}
+
+	*cos = controlObligations
+	return nil
+}
+
+type ControlObligationType struct {
+	ControlID gid.GID        `db:"control_id"`
+	Type      ObligationType `db:"type"`
+}
+
+type ControlObligationTypes []*ControlObligationType
+
+func (cots *ControlObligationTypes) LoadTypesByControlIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlIDs []gid.GID,
+) error {
+	q := `
+WITH control_obls AS (
+	SELECT
+		co.control_id,
+		o.type,
+		o.tenant_id
+	FROM
+		controls_obligations co
+	INNER JOIN
+		obligations o ON co.obligation_id = o.id
+	WHERE
+		co.control_id = ANY(@control_ids)
+)
+SELECT DISTINCT
+	control_id,
+	type
+FROM
+	control_obls
+WHERE
+	%s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_ids": controlIDs}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control obligations: %w", err)
+	}
+
+	controlObligationTypes, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligationType])
+	if err != nil {
+		return fmt.Errorf("cannot collect control obligations: %w", err)
+	}
+
+	*cots = controlObligationTypes
+	return nil
+}

pkg/coredata/entity_type_reg.go

@@ -70,6 +70,8 @@ const (
 	DataProtectionImpactAssessmentEntityType   uint16 = 46
 	TransferImpactAssessmentEntityType         uint16 = 47
 	RightsRequestEntityType                    uint16 = 48
+	StateOfApplicabilityEntityType             uint16 = 49
+	StateOfApplicabilityControlEntityType      uint16 = 50
 )
 
 type EntityInfo struct {
@@ -274,6 +276,14 @@ var entityRegistry = map[uint16]EntityInfo{
 		Model: "RightsRequest",
 		Table: "rights_requests",
 	},
+	StateOfApplicabilityEntityType: {
+		Model: "StateOfApplicability",
+		Table: "states_of_applicability",
+	},
+	StateOfApplicabilityControlEntityType: {
+		Model: "StateOfApplicabilityControl",
+		Table: "states_of_applicability_controls",
+	},
 }
 
 func EntityTable(entityType uint16) (string, bool) {

pkg/coredata/migrations/20260102T134633Z.sql

@@ -0,0 +1,161 @@
+CREATE TABLE states_of_applicability (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    source_id TEXT,
+    snapshot_id TEXT,
+    owner_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT states_of_applicability_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT states_of_applicability_snapshot_id_fkey
+        FOREIGN KEY (snapshot_id)
+        REFERENCES snapshots(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT states_of_applicability_owner_id_fkey
+        FOREIGN KEY (owner_id)
+        REFERENCES peoples(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX states_of_applicability_source_id_snapshot_id_uniq
+    ON states_of_applicability (source_id, snapshot_id)
+    WHERE snapshot_id IS NULL;
+
+CREATE UNIQUE INDEX states_of_applicability_name_organization_id_uniq
+    ON states_of_applicability (name, organization_id)
+    WHERE snapshot_id IS NULL;
+
+CREATE TABLE states_of_applicability_controls (
+    id TEXT PRIMARY KEY,
+    state_of_applicability_id TEXT NOT NULL REFERENCES states_of_applicability(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    control_id TEXT NOT NULL REFERENCES controls(id) ON DELETE RESTRICT ON UPDATE CASCADE,
+    organization_id TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    snapshot_id TEXT,
+    applicability BOOLEAN NOT NULL,
+    justification TEXT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT states_of_applicability_controls_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+    CONSTRAINT states_of_applicability_controls_snapshot_id_fkey
+        FOREIGN KEY (snapshot_id)
+        REFERENCES snapshots(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    UNIQUE (state_of_applicability_id, control_id)
+);
+
+ALTER TABLE controls ADD COLUMN best_practice BOOLEAN NOT NULL DEFAULT TRUE;
+ALTER TABLE controls ALTER COLUMN best_practice DROP DEFAULT;
+
+ALTER TYPE snapshots_type ADD VALUE 'STATES_OF_APPLICABILITY';
+
+CREATE TYPE obligation_type AS ENUM (
+    'LEGAL',
+    'CONTRACTUAL'
+);
+
+ALTER TABLE obligations ADD COLUMN type obligation_type NOT NULL DEFAULT 'LEGAL';
+ALTER TABLE obligations ALTER COLUMN type DROP DEFAULT;
+
+CREATE TABLE controls_obligations (
+    control_id TEXT NOT NULL REFERENCES controls(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    obligation_id TEXT NOT NULL REFERENCES obligations(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (control_id, obligation_id)
+);
+
+INSERT INTO states_of_applicability (
+    id,
+    tenant_id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+)
+SELECT
+    generate_gid(decode_base64_unpadded(f.tenant_id), 49) as id,
+    f.tenant_id,
+    f.organization_id,
+    f.name,
+    NULL as source_id,
+    NULL as snapshot_id,
+    (SELECT id FROM peoples WHERE tenant_id = f.tenant_id LIMIT 1) as owner_id,
+    NOW() as created_at,
+    NOW() as updated_at
+FROM frameworks f
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM states_of_applicability soa
+    WHERE soa.name = f.name
+    AND soa.snapshot_id IS NULL
+)
+AND EXISTS (
+    SELECT 1 FROM peoples WHERE tenant_id = f.tenant_id
+)
+AND EXISTS (
+    SELECT 1
+    FROM controls c
+    WHERE c.framework_id = f.id
+    AND (
+        c.status = 'EXCLUDED'
+        OR (c.exclusion_justification IS NOT NULL AND c.exclusion_justification != '')
+    )
+);
+
+INSERT INTO states_of_applicability_controls (
+    id,
+    state_of_applicability_id,
+    control_id,
+    organization_id,
+    tenant_id,
+    snapshot_id,
+    applicability,
+    justification,
+    created_at,
+    updated_at
+)
+SELECT
+    generate_gid(decode_base64_unpadded(c.tenant_id), 50) as id,
+    soa.id as state_of_applicability_id,
+    c.id as control_id,
+    c.organization_id,
+    c.tenant_id,
+    NULL as snapshot_id,
+    CASE
+        WHEN c.status = 'EXCLUDED' THEN FALSE
+        ELSE TRUE
+    END as applicability,
+    c.exclusion_justification,
+    NOW() as created_at,
+    NOW() as updated_at
+FROM frameworks f
+JOIN states_of_applicability soa ON soa.name = f.name AND soa.snapshot_id IS NULL
+JOIN controls c ON c.framework_id = f.id
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM states_of_applicability_controls soac
+    WHERE soac.state_of_applicability_id = soa.id
+    AND soac.control_id = c.id
+);

pkg/coredata/obligation.go

@@ -20,10 +20,10 @@ import (
 	"maps"
 	"time"
 
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
 )
 
 type (
@@ -39,6 +39,7 @@ type (
 		LastReviewDate         *time.Time       `db:"last_review_date"`
 		DueDate                *time.Time       `db:"due_date"`
 		Status                 ObligationStatus `db:"status"`
+		Type                   ObligationType   `db:"type"`
 		SnapshotID             *gid.GID         `db:"snapshot_id"`
 		SourceID               *gid.GID         `db:"source_id"`
 		CreatedAt              time.Time        `db:"created_at"`
@@ -84,6 +85,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	created_at,
 	updated_at
 FROM
@@ -216,6 +218,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -273,6 +276,7 @@ WITH obls AS (
 		o.last_review_date,
 		o.due_date,
 		o.status,
+		o.type,
 		o.snapshot_id,
 		o.source_id,
 		o.created_at,
@@ -298,6 +302,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -331,6 +336,131 @@ WHERE %s
 	return nil
 }
 
+func (os *Obligations) CountByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	filter *ObligationFilter,
+) (int, error) {
+	q := `
+WITH obls AS (
+	SELECT
+		o.id,
+		o.tenant_id,
+		o.snapshot_id
+	FROM
+		obligations o
+	INNER JOIN
+		controls_obligations co ON o.id = co.obligation_id
+	WHERE
+		co.control_id = @control_id
+)
+SELECT
+	COUNT(id)
+FROM
+	obls
+WHERE %s
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count obligations: %w", err)
+	}
+
+	return count, nil
+}
+
+func (os *Obligations) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[ObligationOrderField],
+	filter *ObligationFilter,
+) error {
+	q := `
+WITH obls AS (
+	SELECT
+		o.id,
+		o.organization_id,
+		o.area,
+		o.source,
+		o.requirement,
+		o.actions_to_be_implemented,
+		o.regulator,
+		o.owner_id,
+		o.last_review_date,
+		o.due_date,
+		o.status,
+		o.type,
+		o.snapshot_id,
+		o.source_id,
+		o.created_at,
+		o.updated_at,
+		o.tenant_id
+	FROM
+		obligations o
+	INNER JOIN
+		controls_obligations co ON o.id = co.obligation_id
+	WHERE
+		co.control_id = @control_id
+)
+SELECT
+	id,
+	organization_id,
+	area,
+	source,
+	requirement,
+	actions_to_be_implemented,
+	regulator,
+	owner_id,
+	last_review_date,
+	due_date,
+	status,
+	type,
+	snapshot_id,
+	source_id,
+	created_at,
+	updated_at
+FROM
+	obls
+WHERE %s
+	AND %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query obligations: %w", err)
+	}
+
+	obligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Obligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect obligations: %w", err)
+	}
+
+	*os = obligations
+
+	return nil
+}
+
 func (o *Obligation) Insert(
 	ctx context.Context,
 	conn pg.Conn,
@@ -350,6 +480,7 @@ INSERT INTO obligations (
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -367,6 +498,7 @@ INSERT INTO obligations (
 	@last_review_date,
 	@due_date,
 	@status,
+	@type,
 	@snapshot_id,
 	@source_id,
 	@created_at,
@@ -387,6 +519,7 @@ INSERT INTO obligations (
 		"last_review_date":          o.LastReviewDate,
 		"due_date":                  o.DueDate,
 		"status":                    o.Status,
+		"type":                      o.Type,
 		"snapshot_id":               o.SnapshotID,
 		"source_id":                 o.SourceID,
 		"created_at":                o.CreatedAt,
@@ -417,6 +550,7 @@ UPDATE obligations SET
 	last_review_date = @last_review_date,
 	due_date = @due_date,
 	status = @status,
+	type = @type,
 	updated_at = @updated_at
 WHERE
 	%s
@@ -437,6 +571,7 @@ WHERE
 		"last_review_date":          o.LastReviewDate,
 		"due_date":                  o.DueDate,
 		"status":                    o.Status,
+		"type":                      o.Type,
 		"updated_at":                o.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
@@ -492,6 +627,7 @@ INSERT INTO obligations (
 	last_review_date,
 	due_date,
 	status,
+	type,
 	created_at,
 	updated_at
 )
@@ -510,6 +646,7 @@ SELECT
 	o.last_review_date,
 	o.due_date,
 	o.status,
+	o.type,
 	o.created_at,
 	o.updated_at
 FROM obligations o

pkg/coredata/obligation_type.go

@@ -0,0 +1,64 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ObligationType string
+
+const (
+	ObligationTypeLegal       ObligationType = "LEGAL"
+	ObligationTypeContractual ObligationType = "CONTRACTUAL"
+)
+
+func ObligationTypes() []ObligationType {
+	return []ObligationType{
+		ObligationTypeLegal,
+		ObligationTypeContractual,
+	}
+}
+
+func (ot ObligationType) String() string {
+	return string(ot)
+}
+
+func (ot *ObligationType) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ObligationType: %T", value)
+	}
+
+	switch s {
+	case "LEGAL":
+		*ot = ObligationTypeLegal
+	case "CONTRACTUAL":
+		*ot = ObligationTypeContractual
+	default:
+		return fmt.Errorf("invalid ObligationType value: %q", s)
+	}
+	return nil
+}
+
+func (ot ObligationType) Value() (driver.Value, error) {
+	return ot.String(), nil
+}

pkg/coredata/snapshots_type.go

@@ -32,6 +32,7 @@ const (
 	SnapshotsTypeObligations           SnapshotsType = "OBLIGATIONS"
 	SnapshotsTypeContinualImprovements SnapshotsType = "CONTINUAL_IMPROVEMENTS"
 	SnapshotsTypeProcessingActivities  SnapshotsType = "PROCESSING_ACTIVITIES"
+	SnapshotsTypeStatesOfApplicability SnapshotsType = "STATES_OF_APPLICABILITY"
 )
 
 func SnapshotsTypes() []SnapshotsType {
@@ -41,6 +42,10 @@ func SnapshotsTypes() []SnapshotsType {
 		SnapshotsTypeAssets,
 		SnapshotsTypeData,
 		SnapshotsTypeNonconformities,
+		SnapshotsTypeObligations,
+		SnapshotsTypeContinualImprovements,
+		SnapshotsTypeProcessingActivities,
+		SnapshotsTypeStatesOfApplicability,
 	}
 }
 
@@ -76,6 +81,8 @@ func (st *SnapshotsType) Scan(value any) error {
 		*st = SnapshotsTypeContinualImprovements
 	case SnapshotsTypeProcessingActivities.String():
 		*st = SnapshotsTypeProcessingActivities
+	case SnapshotsTypeStatesOfApplicability.String():
+		*st = SnapshotsTypeStatesOfApplicability
 	default:
 		return fmt.Errorf("invalid SnapshotsType value: %q", s)
 	}

pkg/coredata/snapshottable.go

@@ -18,8 +18,8 @@ import (
 	"context"
 	"fmt"
 
-	"go.probo.inc/probo/pkg/gid"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
 )
 
 type Snapshottable interface {
@@ -44,6 +44,8 @@ func GetSnapshottable(snapshotType SnapshotsType) (Snapshottable, error) {
 		return ProcessingActivities{}, nil
 	case SnapshotsTypeVendors:
 		return Vendors{}, nil
+	case SnapshotsTypeStatesOfApplicability:
+		return StatesOfApplicability{}, nil
 	default:
 		return nil, fmt.Errorf("unsupported snapshot type: %s", snapshotType)
 	}

pkg/coredata/state_of_applicability.go

@@ -0,0 +1,466 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicability struct {
+		ID             gid.GID   `db:"id"`
+		OrganizationID gid.GID   `db:"organization_id"`
+		Name           string    `db:"name"`
+		SourceID       *gid.GID  `db:"source_id"`
+		SnapshotID     *gid.GID  `db:"snapshot_id"`
+		OwnerID        gid.GID   `db:"owner_id"`
+		CreatedAt      time.Time `db:"created_at"`
+		UpdatedAt      time.Time `db:"updated_at"`
+	}
+
+	StatesOfApplicability []*StateOfApplicability
+
+	ErrStateOfApplicabilityNotFound struct {
+		Identifier string
+	}
+
+	ErrStateOfApplicabilityAlreadyExists struct {
+		message string
+	}
+)
+
+func (e ErrStateOfApplicabilityNotFound) Error() string {
+	return fmt.Sprintf("state of applicability not found: %s", e.Identifier)
+}
+
+func (e ErrStateOfApplicabilityAlreadyExists) Error() string {
+	return e.message
+}
+
+func (s StateOfApplicability) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey {
+	switch orderBy {
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	case StateOfApplicabilityOrderFieldName:
+		return page.NewCursorKey(s.ID, s.Name)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *StateOfApplicability) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND id = @state_of_applicability_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability: %w", err)
+	}
+
+	stateOfApplicability, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicability])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrStateOfApplicabilityNotFound{Identifier: stateOfApplicabilityID.String()}
+		}
+
+		return fmt.Errorf("cannot collect state_of_applicability: %w", err)
+	}
+
+	*s = stateOfApplicability
+	return nil
+}
+
+func (s *StatesOfApplicability) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[StateOfApplicabilityOrderField],
+	filter *StateOfApplicabilityFilter,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability: %w", err)
+	}
+
+	statesOfApplicability, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicability])
+	if err != nil {
+		return fmt.Errorf("cannot collect states_of_applicability: %w", err)
+	}
+
+	*s = statesOfApplicability
+	return nil
+}
+
+func (s *StatesOfApplicability) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	filter *StateOfApplicabilityFilter,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(*)
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id": organizationID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count states_of_applicability: %w", err)
+	}
+
+	return count, nil
+}
+
+func (s *StateOfApplicability) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability (
+        tenant_id,
+        id,
+        organization_id,
+        name,
+        source_id,
+        snapshot_id,
+        owner_id,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @tenant_id,
+    @state_of_applicability_id,
+    @organization_id,
+    @name,
+    @source_id,
+    @snapshot_id,
+    @owner_id,
+    @created_at,
+    @updated_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":                 scope.GetTenantID(),
+		"state_of_applicability_id": s.ID,
+		"organization_id":           s.OrganizationID,
+		"name":                      s.Name,
+		"source_id":                 s.SourceID,
+		"snapshot_id":               s.SnapshotID,
+		"owner_id":                  s.OwnerID,
+		"created_at":                s.CreatedAt,
+		"updated_at":                s.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityAlreadyExists{
+					message: fmt.Sprintf("state of applicability with name %q already exists", s.Name),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert state_of_applicability: %w", err)
+	}
+
+	return nil
+}
+
+func (s *StateOfApplicability) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE states_of_applicability
+SET
+    name = @name,
+    owner_id = @owner_id,
+    updated_at = @updated_at
+WHERE %s
+    AND id = @state_of_applicability_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": s.ID,
+		"name":                      s.Name,
+		"owner_id":                  s.OwnerID,
+		"updated_at":                s.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityAlreadyExists{
+					message: fmt.Sprintf("state of applicability with name %q already exists", s.Name),
+				}
+			}
+		}
+		return fmt.Errorf("cannot update state_of_applicability: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return &ErrStateOfApplicabilityNotFound{Identifier: s.ID.String()}
+	}
+
+	return nil
+}
+
+func (s *StateOfApplicability) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM states_of_applicability
+WHERE %s
+    AND id = @state_of_applicability_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": s.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete state_of_applicability: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return &ErrStateOfApplicabilityNotFound{Identifier: s.ID.String()}
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) Snapshot(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error {
+	if err := soas.insertStateOfApplicabilitySnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability snapshots: %w", err)
+	}
+
+	if err := soas.insertStateOfApplicabilityControlSnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability_control snapshots: %w", err)
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) insertStateOfApplicabilitySnapshots(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	snapshotID gid.GID,
+) error {
+	query := `
+INSERT INTO states_of_applicability (
+	id,
+	tenant_id,
+	organization_id,
+	name,
+	source_id,
+	snapshot_id,
+	owner_id,
+	created_at,
+	updated_at
+)
+SELECT
+	generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
+	@tenant_id,
+	soa.organization_id,
+	soa.name,
+	soa.id,
+	@snapshot_id,
+	soa.owner_id,
+	soa.created_at,
+	soa.updated_at
+FROM states_of_applicability soa
+WHERE %s
+	AND soa.organization_id = @organization_id
+	AND soa.snapshot_id IS NULL
+	`
+
+	query = fmt.Sprintf(query, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":                          scope.GetTenantID(),
+		"snapshot_id":                        snapshotID,
+		"organization_id":                    organizationID,
+		"state_of_applicability_entity_type": StateOfApplicabilityEntityType,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, query, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability snapshots: %w", err)
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) insertStateOfApplicabilityControlSnapshots(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	snapshotID gid.GID,
+) error {
+	query := `
+WITH source_soa AS (
+	SELECT id, organization_id
+	FROM states_of_applicability
+	WHERE %s
+		AND organization_id = @organization_id
+		AND snapshot_id IS NULL
+),
+snapshot_soa AS (
+	SELECT id, source_id
+	FROM states_of_applicability
+	WHERE snapshot_id = @snapshot_id
+)
+INSERT INTO states_of_applicability_controls (
+	id,
+	state_of_applicability_id,
+	control_id,
+	organization_id,
+	tenant_id,
+	snapshot_id,
+	applicability,
+	justification,
+	created_at,
+	updated_at
+)
+SELECT
+	generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
+	snapshot_soa.id,
+	soac.control_id,
+	soac.organization_id,
+	@tenant_id,
+	@snapshot_id,
+	soac.applicability,
+	soac.justification,
+	soac.created_at,
+	soac.updated_at
+FROM states_of_applicability_controls soac
+INNER JOIN source_soa
+	ON soac.state_of_applicability_id = source_soa.id
+INNER JOIN snapshot_soa
+	ON snapshot_soa.source_id = source_soa.id
+WHERE soac.snapshot_id IS NULL
+	`
+
+	query = fmt.Sprintf(query, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":       scope.GetTenantID(),
+		"snapshot_id":     snapshotID,
+		"organization_id": organizationID,
+		"state_of_applicability_control_entity_type": StateOfApplicabilityControlEntityType,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, query, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability_control snapshots: %w", err)
+	}
+
+	return nil
+}

pkg/coredata/state_of_applicability_control.go

@@ -0,0 +1,607 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityControl struct {
+		ID                     gid.GID   `db:"id"`
+		StateOfApplicabilityID gid.GID   `db:"state_of_applicability_id"`
+		ControlID              gid.GID   `db:"control_id"`
+		OrganizationID         gid.GID   `db:"organization_id"`
+		SnapshotID             *gid.GID  `db:"snapshot_id"`
+		Applicability          bool      `db:"applicability"`
+		Justification          *string   `db:"justification"`
+		CreatedAt              time.Time `db:"created_at"`
+		UpdatedAt              time.Time `db:"updated_at"`
+	}
+
+	StateOfApplicabilityControls []*StateOfApplicabilityControl
+
+	AvailableStateOfApplicabilityControl struct {
+		ControlID              gid.GID  `db:"control_id"`
+		SectionTitle           string   `db:"section_title"`
+		Name                   string   `db:"name"`
+		FrameworkID            gid.GID  `db:"framework_id"`
+		FrameworkName          string   `db:"framework_name"`
+		OrganizationID         gid.GID  `db:"organization_id"`
+		StateOfApplicabilityID *gid.GID `db:"state_of_applicability_id"`
+		Applicability          *bool    `db:"applicability"`
+		Justification          *string  `db:"justification"`
+		BestPractice           bool     `db:"best_practice"`
+		Regulatory             bool     `db:"regulatory"`
+		Contractual            bool     `db:"contractual"`
+		RiskAssessment         bool     `db:"risk_assessment"`
+	}
+
+	AvailableStateOfApplicabilityControls []*AvailableStateOfApplicabilityControl
+
+	ErrStateOfApplicabilityControlNotFound struct {
+		StateOfApplicabilityID gid.GID
+		ControlID              gid.GID
+	}
+
+	ErrStateOfApplicabilityControlAlreadyExists struct {
+		StateOfApplicabilityID gid.GID
+		ControlID              gid.GID
+	}
+)
+
+func (e ErrStateOfApplicabilityControlNotFound) Error() string {
+	return fmt.Sprintf("state of applicability control not found: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID)
+}
+
+func (e ErrStateOfApplicabilityControlAlreadyExists) Error() string {
+	return fmt.Sprintf("state of applicability control already exists: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID)
+}
+
+func (s StateOfApplicabilityControl) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey {
+	switch orderBy {
+	case StateOfApplicabilityOrderFieldName:
+		return page.NewCursorKey(s.ID, s.StateOfApplicabilityID)
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+) error {
+	q := `
+WITH current_soa AS (
+	SELECT id
+	FROM states_of_applicability
+	WHERE %s
+		AND id = @state_of_applicability_id
+		AND snapshot_id IS NULL
+)
+SELECT
+	soac.id,
+	soac.state_of_applicability_id,
+	soac.control_id,
+	soac.organization_id,
+	soac.snapshot_id,
+	soac.applicability,
+	soac.justification,
+	soac.created_at,
+	soac.updated_at
+FROM
+	states_of_applicability_controls soac
+INNER JOIN
+	current_soa ON soac.state_of_applicability_id = current_soa.id
+WHERE
+	soac.control_id = @control_id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+		"control_id":                controlID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+	}
+
+	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrStateOfApplicabilityControlNotFound{
+				StateOfApplicabilityID: stateOfApplicabilityID,
+				ControlID:              controlID,
+			}
+		}
+		return fmt.Errorf("cannot collect state of applicability control: %w", err)
+	}
+
+	*sac = control
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability_controls (
+        id,
+        state_of_applicability_id,
+        control_id,
+        organization_id,
+        tenant_id,
+        snapshot_id,
+        applicability,
+        justification,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @id,
+    @state_of_applicability_id,
+    @control_id,
+    @organization_id,
+    @tenant_id,
+    @snapshot_id,
+    @applicability,
+    @justification,
+    @created_at,
+    @updated_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                        sac.ID,
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"organization_id":           sac.OrganizationID,
+		"tenant_id":                 scope.GetTenantID(),
+		"snapshot_id":               sac.SnapshotID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"created_at":                sac.CreatedAt,
+		"updated_at":                sac.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityControlAlreadyExists{
+					StateOfApplicabilityID: sac.StateOfApplicabilityID,
+					ControlID:              sac.ControlID,
+				}
+			}
+		}
+
+		return fmt.Errorf("cannot insert state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE states_of_applicability_controls
+SET
+    applicability = @applicability,
+    justification = @justification,
+    updated_at = @updated_at
+WHERE %s
+    AND state_of_applicability_id = @state_of_applicability_id
+    AND control_id = @control_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"updated_at":                sac.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability_controls (
+        id,
+        state_of_applicability_id,
+        control_id,
+        organization_id,
+        tenant_id,
+        snapshot_id,
+        applicability,
+        justification,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @id,
+    @state_of_applicability_id,
+    @control_id,
+    @organization_id,
+    @tenant_id,
+    @snapshot_id,
+    @applicability,
+    @justification,
+    @created_at,
+    @updated_at
+)
+ON CONFLICT (state_of_applicability_id, control_id) DO UPDATE SET
+    applicability = EXCLUDED.applicability,
+    justification = EXCLUDED.justification,
+    updated_at = EXCLUDED.updated_at
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                        sac.ID,
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"organization_id":           sac.OrganizationID,
+		"tenant_id":                 scope.GetTenantID(),
+		"snapshot_id":               sac.SnapshotID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"created_at":                sac.CreatedAt,
+		"updated_at":                sac.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot upsert state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+WITH current_soa AS (
+	SELECT id
+	FROM states_of_applicability
+	WHERE %s
+		AND id = @state_of_applicability_id
+		AND snapshot_id IS NULL
+)
+DELETE FROM states_of_applicability_controls
+WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
+	AND control_id = @control_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (sacs *StateOfApplicabilityControls) LoadByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    state_of_applicability_id,
+    control_id,
+    organization_id,
+    snapshot_id,
+    applicability,
+    justification,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability_controls
+WHERE
+    %s
+    AND state_of_applicability_id = @state_of_applicability_id
+ORDER BY created_at ASC
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect states_of_applicability_controls: %w", err)
+	}
+
+	*sacs = controls
+	return nil
+}
+
+func (sacs *StateOfApplicabilityControls) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[StateOfApplicabilityOrderField],
+) error {
+	q := `
+WITH soac_ctrl AS (
+	SELECT
+		soac.id,
+		soac.state_of_applicability_id,
+		soac.control_id,
+		soac.organization_id,
+		soac.snapshot_id,
+		soac.applicability,
+		soac.justification,
+		soac.created_at,
+		soac.updated_at,
+		soac.tenant_id
+	FROM
+		states_of_applicability_controls soac
+	INNER JOIN
+		states_of_applicability soa ON soac.state_of_applicability_id = soa.id
+	WHERE
+		soac.control_id = @control_id
+		AND soa.snapshot_id IS NULL
+)
+SELECT
+	id,
+	state_of_applicability_id,
+	control_id,
+	organization_id,
+	snapshot_id,
+	applicability,
+	justification,
+	created_at,
+	updated_at
+FROM
+	soac_ctrl
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query state_of_applicability_controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect state_of_applicability_controls: %w", err)
+	}
+
+	*sacs = controls
+	return nil
+}
+
+func (sacs *StateOfApplicabilityControls) CountByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) (int, error) {
+	q := `
+WITH soac_ctrl AS (
+	SELECT
+		soac.id,
+		soac.organization_id,
+		soac.tenant_id
+	FROM
+		states_of_applicability_controls soac
+	WHERE
+		soac.control_id = @control_id
+)
+SELECT
+	COUNT(id)
+FROM
+	soac_ctrl
+WHERE
+	%s;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (acfs *AvailableStateOfApplicabilityControls) LoadAvailableByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+WITH soa_info AS (
+    SELECT
+        soa.organization_id,
+        soa.tenant_id AS soa_tenant_id
+    FROM states_of_applicability soa
+    WHERE soa.tenant_id = @tenant_id
+        AND soa.id = @state_of_applicability_id
+),
+filtered_controls AS (
+    SELECT
+        c.id AS control_id,
+        c.section_title,
+        c.name,
+        c.framework_id,
+        c.organization_id,
+        c.tenant_id,
+        c.best_practice
+    FROM controls c
+    WHERE %s
+),
+all_controls AS (
+    SELECT
+        fc.control_id,
+        fc.section_title,
+        fc.name,
+        fc.framework_id,
+        fc.organization_id,
+        fc.tenant_id,
+        f.name AS framework_name,
+        fc.best_practice
+    FROM filtered_controls fc
+    INNER JOIN frameworks f ON fc.framework_id = f.id
+    CROSS JOIN soa_info si
+    WHERE fc.organization_id = si.organization_id
+),
+existing_links AS (
+    SELECT
+        soac.control_id,
+        soac.state_of_applicability_id,
+        soac.applicability,
+        soac.justification
+    FROM states_of_applicability_controls soac
+    CROSS JOIN soa_info si
+    WHERE soac.tenant_id = si.soa_tenant_id
+        AND soac.state_of_applicability_id = @state_of_applicability_id
+),
+regulatory_controls AS (
+    SELECT DISTINCT co.control_id
+    FROM controls_obligations co
+    INNER JOIN obligations o ON o.id = co.obligation_id
+    CROSS JOIN soa_info si
+    WHERE co.tenant_id = si.soa_tenant_id
+        AND o.tenant_id = si.soa_tenant_id
+        AND o.type = 'LEGAL'
+),
+contractual_controls AS (
+    SELECT DISTINCT co.control_id
+    FROM controls_obligations co
+    INNER JOIN obligations o ON o.id = co.obligation_id
+    CROSS JOIN soa_info si
+    WHERE co.tenant_id = si.soa_tenant_id
+        AND o.tenant_id = si.soa_tenant_id
+        AND o.type = 'CONTRACTUAL'
+),
+risk_controls AS (
+    SELECT DISTINCT cm.control_id
+    FROM controls_measures cm
+    INNER JOIN risks_measures rm ON rm.measure_id = cm.measure_id
+    CROSS JOIN soa_info si
+    WHERE cm.tenant_id = si.soa_tenant_id
+        AND rm.tenant_id = si.soa_tenant_id
+)
+SELECT
+    ac.control_id,
+    ac.section_title,
+    ac.name,
+    ac.framework_id,
+    ac.organization_id,
+    ac.framework_name,
+    el.state_of_applicability_id,
+    el.applicability,
+    el.justification,
+    ac.best_practice,
+    CASE WHEN reg.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS regulatory,
+    CASE WHEN cont.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS contractual,
+    CASE WHEN risk.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS risk_assessment
+FROM all_controls ac
+LEFT JOIN existing_links el ON ac.control_id = el.control_id
+LEFT JOIN regulatory_controls reg ON reg.control_id = ac.control_id
+LEFT JOIN contractual_controls cont ON cont.control_id = ac.control_id
+LEFT JOIN risk_controls risk ON risk.control_id = ac.control_id
+ORDER BY ac.framework_name, ac.section_title, ac.name
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query available controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[AvailableStateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect available controls: %w", err)
+	}
+
+	*acfs = controls
+	return nil
+}

pkg/coredata/state_of_applicability_filter.go

@@ -0,0 +1,61 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"go.probo.inc/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+)
+
+type (
+	StateOfApplicabilityFilter struct {
+		snapshotID **gid.GID
+	}
+)
+
+func NewStateOfApplicabilityFilter(snapshotID **gid.GID) *StateOfApplicabilityFilter {
+	return &StateOfApplicabilityFilter{
+		snapshotID: snapshotID,
+	}
+}
+
+func (f *StateOfApplicabilityFilter) SQLArguments() pgx.StrictNamedArgs {
+	args := pgx.StrictNamedArgs{}
+
+	if f.snapshotID == nil {
+		args["has_snapshot_filter"] = false
+		args["filter_snapshot_id"] = nil
+	} else if *f.snapshotID == nil {
+		args["has_snapshot_filter"] = true
+		args["filter_snapshot_id"] = nil
+	} else {
+		args["has_snapshot_filter"] = true
+		args["filter_snapshot_id"] = **f.snapshotID
+	}
+
+	return args
+}
+
+func (f *StateOfApplicabilityFilter) SQLFragment() string {
+	return `
+CASE
+	WHEN @has_snapshot_filter::boolean = false THEN TRUE
+	WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NOT NULL THEN
+		snapshot_id = @filter_snapshot_id::text
+	WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NULL THEN
+		snapshot_id IS NULL
+	ELSE TRUE
+END`
+}

pkg/coredata/state_of_applicability_order_field.go

@@ -0,0 +1,62 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type (
+	StateOfApplicabilityOrderField string
+)
+
+const (
+	StateOfApplicabilityOrderFieldName      StateOfApplicabilityOrderField = "NAME"
+	StateOfApplicabilityOrderFieldCreatedAt StateOfApplicabilityOrderField = "CREATED_AT"
+)
+
+func (s StateOfApplicabilityOrderField) Column() string {
+	switch s {
+	case StateOfApplicabilityOrderFieldName:
+		return "name"
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return "created_at"
+	}
+	panic(fmt.Sprintf("unsupported order by: %s", s))
+}
+
+func (s StateOfApplicabilityOrderField) String() string {
+	return string(s)
+}
+
+func (s StateOfApplicabilityOrderField) IsValid() bool {
+	switch s {
+	case StateOfApplicabilityOrderFieldName, StateOfApplicabilityOrderFieldCreatedAt:
+		return true
+	}
+	return false
+}
+
+func (s StateOfApplicabilityOrderField) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
+}
+
+func (s *StateOfApplicabilityOrderField) UnmarshalText(text []byte) error {
+	*s = StateOfApplicabilityOrderField(text)
+	if !s.IsValid() {
+		return fmt.Errorf("%s is not a valid StateOfApplicabilityOrderField", string(text))
+	}
+	return nil
+}

pkg/docgen/generator.go

@@ -47,13 +47,34 @@ var (
 	//go:embed transfer_impact_assessments_template.html
 	transferImpactAssessmentsTemplateContent string
 
+	//go:embed soa_template.html
+	soaTemplateContent string
+
 	templateFuncs = template.FuncMap{
 		"now":                  func() time.Time { return time.Now() },
 		"eq":                   func(a, b any) bool { return a == b },
+		"add":                  func(a, b int) int { return a + b },
 		"string":               func(v fmt.Stringer) string { return v.String() },
 		"lower":                func(s string) string { return strings.ToLower(s) },
-		"add":                  func(a, b int) int { return a + b },
 		"classificationString": func(c Classification) string { return string(c) },
+		"boolToYesNo": func(b *bool) string {
+			if b == nil {
+				return ""
+			}
+			if *b {
+				return "yes"
+			}
+			return "no"
+		},
+		"boolToYesNoDash": func(b *bool) string {
+			if b == nil {
+				return "-"
+			}
+			if *b {
+				return "Yes"
+			}
+			return "No"
+		},
 		"formatContent": func(content string) template.HTML {
 			md := goldmark.New(
 				goldmark.WithExtensions(extension.Table),
@@ -176,6 +197,8 @@ var (
 	dataProtectionImpactAssessmentsTemplate = template.Must(template.New("dataProtectionImpactAssessments").Funcs(templateFuncs).Parse(dataProtectionImpactAssessmentsTemplateContent))
 
 	transferImpactAssessmentsTemplate = template.Must(template.New("transferImpactAssessments").Funcs(templateFuncs).Parse(transferImpactAssessmentsTemplateContent))
+
+	stateOfApplicabilityTemplate = template.Must(template.New("state-of-applicability").Funcs(templateFuncs).Parse(soaTemplateContent))
 )
 
 type (
@@ -264,6 +287,35 @@ type (
 		LocalLawRisk           *string
 		SupplementaryMeasures  *string
 	}
+
+	StateOfApplicabilityData struct {
+		Title                       string
+		OrganizationName            string
+		CreatedAt                   time.Time
+		TotalControls               int
+		FrameworkGroups             []FrameworkControlGroup
+		CompanyHorizontalLogoBase64 string
+		Version                     int
+		PublishedAt                 time.Time
+		Approver                    string
+	}
+
+	FrameworkControlGroup struct {
+		FrameworkName string
+		Controls      []ControlData
+	}
+
+	ControlData struct {
+		FrameworkName  string
+		SectionTitle   string
+		Name           string
+		Applicability  *bool
+		Justification  *string
+		BestPractice   bool
+		Regulatory     *bool
+		Contractual    *bool
+		RiskAssessment *bool
+	}
 )
 
 const (
@@ -308,3 +360,12 @@ func RenderTransferImpactAssessmentsTableHTML(data TransferImpactAssessmentTable
 
 	return buf.Bytes(), nil
 }
+
+func RenderStateOfApplicabilityHTML(data StateOfApplicabilityData) ([]byte, error) {
+	var buf bytes.Buffer
+	if err := stateOfApplicabilityTemplate.Execute(&buf, data); err != nil {
+		return nil, fmt.Errorf("cannot execute SOA template: %w", err)
+	}
+
+	return buf.Bytes(), nil
+}

pkg/docgen/generator_test.go

@@ -20,9 +20,9 @@ import (
 	"testing"
 	"time"
 
-	"go.probo.inc/probo/pkg/coredata"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
 )
 
 func TestRenderHTML(t *testing.T) {
@@ -198,6 +198,8 @@ func TestTemplateFunctions(t *testing.T) {
 		eqFunc := templateFuncs["eq"].(func(any, any) bool)
 		assert.True(t, eqFunc("test", "test"))
 		assert.False(t, eqFunc("test", "other"))
+		assert.True(t, eqFunc(0, 0))
+		assert.False(t, eqFunc(0, 1))
 	})
 
 	t.Run("lower function", func(t *testing.T) {

pkg/docgen/soa_template.html

@@ -0,0 +1,480 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>State of Applicability</title>
+    <style>
+        @page {
+            size: A4 landscape;
+            margin: 2.5cm;
+            @bottom-right {
+                content: "Page " counter(page) " of " counter(pages);
+                font-family: Arial, sans-serif;
+                font-size: 9pt;
+                color: #666;
+            }
+        }
+
+        body {
+            font-family: Arial, sans-serif;
+            font-size: 7.5pt;
+            line-height: 1.4;
+            color: #333;
+            margin: 0;
+            padding: 0;
+            background: white;
+        }
+
+        /* Cover page */
+        .cover-page {
+            page-break-after: always;
+        }
+
+        .company-header {
+            margin-bottom: 30px;
+            page-break-after: avoid;
+        }
+
+        .company-logo {
+            max-height: 50px;
+            max-width: 250px;
+            object-fit: contain;
+            display: block;
+        }
+
+        .export-title {
+            font-size: 22pt;
+            font-weight: normal;
+            color: #1a1a1a;
+            margin: 0 0 25px 0;
+            text-align: left;
+        }
+
+        .export-subtitle {
+            font-size: 18pt;
+            font-weight: normal;
+            color: #1a1a1a;
+            margin: 0 0 25px 0;
+            text-align: left;
+        }
+
+        .document-meta {
+            margin: 0 0 30px 0;
+            font-size: 9pt;
+        }
+
+        .meta-table {
+            width: 100%;
+            border-collapse: collapse;
+            border: 1px solid #333;
+        }
+
+        .meta-table td {
+            padding: 6px 8px;
+            border: 1px solid #333;
+            vertical-align: middle;
+        }
+
+        .meta-table td:first-child {
+            font-weight: 600;
+            width: 25%;
+            background: #f8f8f8;
+            color: #333;
+        }
+
+        .classification {
+            font-weight: bold;
+            text-transform: uppercase;
+        }
+
+        .purpose-section {
+            margin: 30px 0;
+            page-break-after: avoid;
+        }
+
+        .purpose-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .purpose-text {
+            font-size: 10pt;
+            color: #333;
+            line-height: 1.5;
+            text-align: justify;
+        }
+
+        /* Controls page */
+        .controls-page {
+            page-break-before: always;
+        }
+
+        .controls-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .controls-table {
+            width: 100%;
+            border-collapse: collapse;
+            font-size: 8pt;
+            margin-top: 10px;
+        }
+
+        .controls-table th,
+        .controls-table td {
+            padding: 5px 6px;
+            text-align: left;
+            border: 1px solid #ddd;
+            vertical-align: top;
+        }
+
+        .controls-table th {
+            background: #f5f5f5;
+            font-weight: bold;
+            color: #333;
+        }
+
+        .controls-table tr {
+            page-break-inside: avoid;
+        }
+
+        .section-tag {
+            display: inline-block;
+            background: #e0e0e0;
+            color: #333;
+            padding: 2px 5px;
+            border-radius: 3px;
+            font-size: 7pt;
+            font-weight: 500;
+            margin-right: 5px;
+        }
+
+        .state-tag {
+            display: inline-block;
+            padding: 2px 5px;
+            border-radius: 4px;
+            font-size: 8pt;
+            font-weight: 500;
+        }
+
+        .state-tag-success {
+            background: #eefadc;
+            color: #5d770d;
+        }
+
+        .state-tag-warning {
+            background: #fff4d5;
+            color: #ad5700;
+        }
+
+        .state-tag-danger {
+            background: #ffefef;
+            color: #cd2b31;
+        }
+
+        /* Annex page */
+        .annex-page {
+            page-break-before: always;
+        }
+
+        .annex-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .annex-section {
+            margin-bottom: 20px;
+        }
+
+        .annex-section-title {
+            font-size: 13pt;
+            font-weight: bold;
+            color: #000;
+            margin: 15px 0 10px 0;
+        }
+
+        .annex-subsection-title {
+            font-size: 10pt;
+            font-weight: bold;
+            color: #333;
+            margin: 12px 0 8px 0;
+        }
+
+        .annex-enum-list {
+            margin: 10px 0;
+            padding-left: 20px;
+        }
+
+        .annex-enum-item {
+            margin-bottom: 8px;
+            font-size: 10pt;
+            line-height: 1.5;
+        }
+
+        .annex-enum-name {
+            font-weight: 600;
+            color: #333;
+        }
+
+        .annex-enum-description {
+            color: #000;
+            margin-left: 5px;
+        }
+
+        /* Prevent bad page breaks */
+        h1, h2, h3, h4, h5, h6 {
+            page-break-after: avoid;
+            page-break-inside: avoid;
+        }
+
+        @media print {
+            body {
+                background: white;
+            }
+        }
+    </style>
+</head>
+<body>
+    <div class="cover-page">
+        <div class="company-header">
+            {{- if .CompanyHorizontalLogoBase64}}
+            {{imgTag .CompanyHorizontalLogoBase64 "Company Logo" "company-logo"}}
+            {{- end}}
+        </div>
+
+        <h1 class="export-title">State of Applicability</h1>
+        <h2 class="export-subtitle">{{.Title}}</h2>
+
+        <div class="document-meta">
+            <table class="meta-table">
+                <tr>
+                    <td>Classification</td>
+                    <td>
+                        <span class="classification">CONFIDENTIAL</span>
+                    </td>
+                </tr>
+                <tr>
+                    <td>Approver</td>
+                    <td>{{.Approver}}</td>
+                </tr>
+                <tr>
+                    <td>Version</td>
+                    <td>{{.Version}}</td>
+                </tr>
+                <tr>
+                    <td>Published</td>
+                    <td>{{.PublishedAt.Format "January 2, 2006"}}</td>
+                </tr>
+            </table>
+        </div>
+
+        <div class="purpose-section">
+            <div class="purpose-title">1. Purpose</div>
+            <div class="purpose-text">
+                This document provides a comprehensive overview of the state of applicability for controls within the organization.
+                It serves as a record of which controls are applicable or not applicable to the organization, along with their
+                relationships to regulatory requirements, contractual obligations, risk assessments, and best practices.
+            </div>
+        </div>
+    </div>
+
+    {{- if .FrameworkGroups}}
+    <div class="controls-page">
+        <h1 class="controls-title">2. Controls</h1>
+        <table class="controls-table">
+            <thead>
+                <tr>
+                    <th rowspan="2" style="width: 12%;">Framework</th>
+                    <th rowspan="2" style="width: 24%;">Control</th>
+                    <th rowspan="2" style="width: 9%;">Applicability</th>
+                    <th rowspan="2" style="width: 17%;">Justification</th>
+                    <th colspan="4" style="width: 38%; text-align: center;">Justification for inclusion</th>
+                </tr>
+                <tr>
+                    <th style="width: 8%;">Regulatory</th>
+                    <th style="width: 8%;">Contractual</th>
+                    <th style="width: 10%;">Best Practice</th>
+                    <th style="width: 12%;">Risk Assessment</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{- range $group := .FrameworkGroups}}
+                    {{- range $group.Controls}}
+                    <tr>
+                        <td>{{$group.FrameworkName}}</td>
+                        <td><span class="section-tag">{{.SectionTitle}}</span>{{.Name}}</td>
+                        <td>
+                            {{- $state := boolToYesNo .Applicability}}
+                            {{- if eq $state "yes"}}
+                            <span class="state-tag state-tag-success">Yes</span>
+                            {{- else if eq $state "no"}}
+                            <span class="state-tag state-tag-danger">No</span>
+                            {{- else}}
+                            <span class="state-tag">-</span>
+                            {{- end}}
+                        </td>
+                        <td>
+                            {{- if .Justification}}
+                            {{.Justification}}
+                            {{- else}}
+                            -
+                            {{- end}}
+                        </td>
+                        <td>{{boolToYesNoDash .Regulatory}}</td>
+                        <td>{{boolToYesNoDash .Contractual}}</td>
+                        <td>
+                            {{- if .Applicability}}
+                                {{- if and .Applicability .BestPractice}}
+                                Yes
+                                {{- else if .Applicability}}
+                                No
+                                {{- else}}
+                                -
+                                {{- end}}
+                            {{- else}}
+                            -
+                            {{- end}}
+                        </td>
+                        <td>{{boolToYesNoDash .RiskAssessment}}</td>
+                    </tr>
+                    {{- end}}
+                {{- end}}
+            </tbody>
+        </table>
+    </div>
+    {{- end}}
+
+    <div class="annex-page">
+        <h1 class="annex-title">3. Annexes</h1>
+
+        <div class="annex-section">
+            <div class="annex-section-title">3.1 Column Definitions</div>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Framework</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">The name of the compliance framework or standard to which the control belongs (e.g., ISO 27001, SOC 2, GDPR).</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Control</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">The specific control identifier and name within the framework, including its section reference.</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Applicability</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">Yes:</span>
+                    <span class="annex-enum-description">The control is applicable to the organization.</span>
+                </li>
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">No:</span>
+                    <span class="annex-enum-description">The control is not applicable to the organization (with justification provided).</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Justification</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">Provides the rationale when a control is not applicable. This field is empty for applicable controls.</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Justification for inclusion</div>
+            <div class="annex-enum-description" style="margin-bottom: 12px;">
+                For applicable controls, this section provides additional context on why the control is included, based on regulatory requirements, contractual obligations, best practices, or risk assessments.
+            </div>
+
+            <div style="margin-left: 20px;">
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Regulatory</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is linked to one or more legal or regulatory obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not associated with any legal or regulatory obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Contractual</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is linked to one or more contractual obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not associated with any contractual obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Best Practice</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is designated as a best practice recommendation.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not designated as a best practice.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Risk Assessment</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is associated with one or more identified risks through risk mitigation measures.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not currently associated with any identified risks.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</body>
+</html>

pkg/probo/control_service.go

@@ -39,6 +39,7 @@ type (
 		SectionTitle           string
 		Status                 *coredata.ControlStatus
 		ExclusionJustification *string
+		BestPractice           bool
 	}
 
 	UpdateControlRequest struct {
@@ -48,6 +49,7 @@ type (
 		SectionTitle           *string
 		Status                 *coredata.ControlStatus
 		ExclusionJustification *string
+		BestPractice           *bool
 	}
 )
 
@@ -587,6 +589,81 @@ func (s ControlService) DeleteAuditMapping(
 	return control, audit, nil
 }
 
+func (s ControlService) CreateObligationMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	obligationID gid.GID,
+) (*coredata.Control, *coredata.Obligation, error) {
+	control := &coredata.Control{}
+	obligation := &coredata.Obligation{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := obligation.LoadByID(ctx, conn, s.svc.scope, obligationID); err != nil {
+				return fmt.Errorf("cannot load obligation: %w", err)
+			}
+
+			controlObligation := &coredata.ControlObligation{
+				ControlID:    controlID,
+				ObligationID: obligationID,
+				CreatedAt:    time.Now(),
+			}
+
+			if err := controlObligation.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot create control obligation mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return control, obligation, nil
+}
+
+func (s ControlService) DeleteObligationMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	obligationID gid.GID,
+) (*coredata.Control, *coredata.Obligation, error) {
+	control := &coredata.Control{}
+	obligation := &coredata.Obligation{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := obligation.LoadByID(ctx, conn, s.svc.scope, obligationID); err != nil {
+				return fmt.Errorf("cannot load obligation: %w", err)
+			}
+
+			controlObligation := &coredata.ControlObligation{}
+			if err := controlObligation.Delete(ctx, conn, s.svc.scope, control.ID, obligation.ID); err != nil {
+				return fmt.Errorf("cannot delete control obligation mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot delete control obligation mapping: %w", err)
+	}
+
+	return control, obligation, nil
+}
+
 func (s ControlService) ListForAuditID(
 	ctx context.Context,
 	auditID gid.GID,
@@ -723,6 +800,63 @@ func (s ControlService) ListForSnapshotID(
 	return page.NewPage([]*coredata.Control(controls), cursor), nil
 }
 
+func (s ControlService) CountForStateOfApplicabilityID(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	filter *coredata.ControlFilter,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			controls := &coredata.Controls{}
+			count, err = controls.CountByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count controls: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, fmt.Errorf("cannot count controls: %w", err)
+	}
+
+	return count, nil
+}
+
+func (s ControlService) ListForStateOfApplicabilityID(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	cursor *page.Cursor[coredata.ControlOrderField],
+	filter *coredata.ControlFilter,
+) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
+	var controls coredata.Controls
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state of applicability: %w", err)
+			}
+			if err := controls.LoadByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, cursor, filter); err != nil {
+				return fmt.Errorf("cannot load controls: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage([]*coredata.Control(controls), cursor), nil
+}
+
 func (s ControlService) Create(
 	ctx context.Context,
 	req CreateControlRequest,
@@ -742,6 +876,7 @@ func (s ControlService) Create(
 		SectionTitle:           req.SectionTitle,
 		Status:                 *req.Status,
 		ExclusionJustification: req.ExclusionJustification,
+		BestPractice:           req.BestPractice,
 		CreatedAt:              now,
 		UpdatedAt:              now,
 	}
@@ -822,6 +957,10 @@ func (s ControlService) Update(
 			control.ExclusionJustification = req.ExclusionJustification
 		}
 
+		if req.BestPractice != nil {
+			control.BestPractice = *req.BestPractice
+		}
+
 		control.UpdatedAt = time.Now()
 
 		return control.Update(ctx, conn, s.svc.scope)

pkg/probo/data_protection_impact_assessment_service.go

@@ -329,9 +329,7 @@ func (s *DataProtectionImpactAssessmentService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {

pkg/probo/document_service.go

@@ -1640,9 +1640,7 @@ func exportDocumentPDF(
 	horizontalLogoBase64 := ""
 	if organization.HorizontalLogoFileID != nil {
 		fileRecord := &coredata.File{}
-		fileErr := svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-			return fileRecord.LoadByID(ctx, conn, scope, *organization.HorizontalLogoFileID)
-		})
+		fileErr := fileRecord.LoadByID(ctx, conn, scope, *organization.HorizontalLogoFileID)
 		if fileErr == nil {
 			base64Data, mimeType, logoErr := svc.fileManager.GetFileBase64(ctx, fileRecord)
 			if logoErr == nil {

pkg/probo/framework_service.go

@@ -72,9 +72,10 @@ type (
 				Dark  string `json:"dark"`
 			} `json:"logo,omitempty"`
 			Controls []struct {
-				ID          string `json:"id"`
-				Name        string `json:"name"`
-				Description string `json:"description"`
+				ID           string `json:"id"`
+				Name         string `json:"name"`
+				Description  string `json:"description"`
+				BestPractice *bool  `json:"best_practice,omitempty"`
 			} `json:"controls"`
 		}
 	}
@@ -572,6 +573,10 @@ func (s FrameworkService) Import(
 
 			now := time.Now()
 			description := control.Description
+			bestPractice := true
+			if control.BestPractice != nil {
+				bestPractice = *control.BestPractice
+			}
 			control := &coredata.Control{
 				ID:             controlID,
 				FrameworkID:    frameworkID,
@@ -580,6 +585,7 @@ func (s FrameworkService) Import(
 				Name:           control.Name,
 				Description:    &description,
 				Status:         coredata.ControlStatusIncluded,
+				BestPractice:   bestPractice,
 				CreatedAt:      now,
 				UpdatedAt:      now,
 			}

pkg/probo/obligation_service.go

@@ -41,7 +41,8 @@ type (
 		OwnerID                gid.GID
 		LastReviewDate         *time.Time
 		DueDate                *time.Time
-		Status                 *coredata.ObligationStatus
+		Status                 coredata.ObligationStatus
+		Type                   coredata.ObligationType
 	}
 
 	UpdateObligationRequest struct {
@@ -55,6 +56,7 @@ type (
 		LastReviewDate         **time.Time
 		DueDate                **time.Time
 		Status                 *coredata.ObligationStatus
+		Type                   *coredata.ObligationType
 	}
 )
 
@@ -69,6 +71,7 @@ func (cor *CreateObligationRequest) Validate() error {
 	v.Check(cor.Regulator, "regulator", validator.SafeText(TitleMaxLength))
 	v.Check(cor.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.PeopleEntityType))
 	v.Check(cor.Status, "status", validator.OneOfSlice(coredata.ObligationStatuses()))
+	v.Check(cor.Type, "type", validator.OneOfSlice(coredata.ObligationTypes()))
 
 	return v.Error()
 }
@@ -84,6 +87,7 @@ func (uor *UpdateObligationRequest) Validate() error {
 	v.Check(uor.Regulator, "regulator", validator.SafeText(NameMaxLength))
 	v.Check(uor.OwnerID, "owner_id", validator.GID(coredata.PeopleEntityType))
 	v.Check(uor.Status, "status", validator.OneOfSlice(coredata.ObligationStatuses()))
+	v.Check(uor.Type, "type", validator.OneOfSlice(coredata.ObligationTypes()))
 
 	return v.Error()
 }
@@ -133,7 +137,8 @@ func (s *ObligationService) Create(
 		OwnerID:                req.OwnerID,
 		LastReviewDate:         req.LastReviewDate,
 		DueDate:                req.DueDate,
-		Status:                 *req.Status,
+		Status:                 req.Status,
+		Type:                   req.Type,
 		CreatedAt:              now,
 		UpdatedAt:              now,
 	}
@@ -223,6 +228,10 @@ func (s *ObligationService) Update(
 				obligation.Status = *req.Status
 			}
 
+			if req.Type != nil {
+				obligation.Type = *req.Type
+			}
+
 			obligation.UpdatedAt = time.Now()
 
 			if err := obligation.Update(ctx, conn, s.svc.scope); err != nil {
@@ -290,6 +299,38 @@ func (s ObligationService) CountForOrganizationID(
 	return count, nil
 }
 
+func (s ObligationService) ListForControlID(
+	ctx context.Context,
+	controlID gid.GID,
+	cursor *page.Cursor[coredata.ObligationOrderField],
+	filter *coredata.ObligationFilter,
+) (*page.Page[*coredata.Obligation, coredata.ObligationOrderField], error) {
+	var obligations coredata.Obligations
+	control := &coredata.Control{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			err := obligations.LoadByControlID(ctx, conn, s.svc.scope, control.ID, cursor, filter)
+			if err != nil {
+				return fmt.Errorf("cannot load obligations: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(obligations, cursor), nil
+}
+
 func (s ObligationService) ListForOrganizationID(
 	ctx context.Context,
 	organizationID gid.GID,

pkg/probo/processing_activity_service.go

@@ -415,9 +415,7 @@ func (s *ProcessingActivityService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {

pkg/probo/service.go

@@ -117,6 +117,7 @@ type (
 		ProcessingActivities              *ProcessingActivityService
 		DataProtectionImpactAssessments   *DataProtectionImpactAssessmentService
 		TransferImpactAssessments         *TransferImpactAssessmentService
+		StatesOfApplicability            *StateOfApplicabilityService
 		Files                             *FileService
 		CustomDomains                     *CustomDomainService
 		SlackMessages                     *slack.SlackMessageService
@@ -264,6 +265,10 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 		svc:               tenantService,
 		html2pdfConverter: s.html2pdfConverter,
 	}
+	tenantService.StatesOfApplicability = &StateOfApplicabilityService{
+		svc:               tenantService,
+		html2pdfConverter: s.html2pdfConverter,
+	}
 	tenantService.Files = &FileService{svc: tenantService}
 	tenantService.CustomDomains = &CustomDomainService{
 		svc:           tenantService,

pkg/probo/state_of_applicability_service.go

@@ -0,0 +1,589 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/docgen"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/html2pdf"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type StateOfApplicabilityService struct {
+	svc               *TenantService
+	html2pdfConverter *html2pdf.Converter
+}
+
+type (
+	CreateStateOfApplicabilityRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		OwnerID        gid.GID
+	}
+
+	UpdateStateOfApplicabilityRequest struct {
+		StateOfApplicabilityID gid.GID
+		Name                   *string
+		OwnerID                *gid.GID
+	}
+)
+
+func (csr *CreateStateOfApplicabilityRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(csr.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
+	v.Check(csr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(csr.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.PeopleEntityType))
+
+	return v.Error()
+}
+
+func (usr *UpdateStateOfApplicabilityRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(usr.StateOfApplicabilityID, "state_of_applicability_id", validator.Required(), validator.GID(coredata.StateOfApplicabilityEntityType))
+	v.Check(usr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(usr.OwnerID, "owner_id", validator.GID(coredata.PeopleEntityType))
+
+	return v.Error()
+}
+
+func (s StateOfApplicabilityService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.StateOfApplicabilityOrderField],
+	filter *coredata.StateOfApplicabilityFilter,
+) (*page.Page[*coredata.StateOfApplicability, coredata.StateOfApplicabilityOrderField], error) {
+	var statesOfApplicability coredata.StatesOfApplicability
+	organization := &coredata.Organization{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			err := statesOfApplicability.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organization.ID,
+				cursor,
+				filter,
+			)
+			if err != nil {
+				return fmt.Errorf("cannot load states_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(statesOfApplicability, cursor), nil
+}
+
+func (s StateOfApplicabilityService) CountForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	filter *coredata.StateOfApplicabilityFilter,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			statesOfApplicability := &coredata.StatesOfApplicability{}
+			count, err = statesOfApplicability.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count states_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s StateOfApplicabilityService) Get(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) (*coredata.StateOfApplicability, error) {
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Create(
+	ctx context.Context,
+	req CreateStateOfApplicabilityRequest,
+) (*coredata.StateOfApplicability, error) {
+	if err := req.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	now := time.Now()
+	organization := &coredata.Organization{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID)
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load organization: %w", err)
+	}
+
+	stateOfApplicabilityID := gid.New(organization.ID.TenantID(), coredata.StateOfApplicabilityEntityType)
+	stateOfApplicability := &coredata.StateOfApplicability{
+		ID:             stateOfApplicabilityID,
+		OrganizationID: organization.ID,
+		Name:           req.Name,
+		OwnerID:        req.OwnerID,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Update(
+	ctx context.Context,
+	req UpdateStateOfApplicabilityRequest,
+) (*coredata.StateOfApplicability, error) {
+	if err := req.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, req.StateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state_of_applicability: %w", err)
+			}
+
+			if req.Name != nil {
+				stateOfApplicability.Name = *req.Name
+			}
+			if req.OwnerID != nil {
+				stateOfApplicability.OwnerID = *req.OwnerID
+			}
+
+			stateOfApplicability.UpdatedAt = time.Now()
+
+			if err := stateOfApplicability.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Delete(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) error {
+	stateOfApplicability := &coredata.StateOfApplicability{ID: stateOfApplicabilityID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state_of_applicability: %w", err)
+			}
+
+			if err := stateOfApplicability.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s StateOfApplicabilityService) ListAvailableControls(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) ([]*coredata.AvailableStateOfApplicabilityControl, error) {
+	var availableControls coredata.AvailableStateOfApplicabilityControls
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load available controls: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return availableControls, nil
+}
+
+func (s StateOfApplicabilityService) LinkControl(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+	applicability bool,
+	justification *string,
+) (*coredata.StateOfApplicabilityControl, error) {
+	stateOfApplicability := &coredata.StateOfApplicability{}
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot load state of applicability: %w", err)
+	}
+
+	now := time.Now()
+	control := &coredata.StateOfApplicabilityControl{
+		ID:                     gid.New(s.svc.scope.GetTenantID(), coredata.StateOfApplicabilityControlEntityType),
+		StateOfApplicabilityID: stateOfApplicabilityID,
+		ControlID:              controlID,
+		OrganizationID:         stateOfApplicability.OrganizationID,
+		Applicability:          applicability,
+		Justification:          justification,
+		CreatedAt:              now,
+		UpdatedAt:              now,
+	}
+
+	err = s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
+		return control.Upsert(ctx, conn, s.svc.scope)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return control, nil
+}
+
+func (s StateOfApplicabilityService) DeleteControlLink(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+) (gid.GID, error) {
+	control := &coredata.StateOfApplicabilityControl{}
+
+	err := s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
+		if err := control.LoadByStateOfApplicabilityIDAndControlID(ctx, conn, s.svc.scope, stateOfApplicabilityID, controlID); err != nil {
+			return err
+		}
+		return control.Delete(ctx, conn, s.svc.scope)
+	})
+	if err != nil {
+		return gid.GID{}, err
+	}
+
+	return control.ID, nil
+}
+
+func (s StateOfApplicabilityService) ListControlLinks(
+	ctx context.Context,
+	controlID gid.GID,
+	cursor *page.Cursor[coredata.StateOfApplicabilityOrderField],
+) (*page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField], error) {
+	var controls coredata.StateOfApplicabilityControls
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return controls.LoadByControlID(ctx, conn, s.svc.scope, controlID, cursor)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(controls, cursor), nil
+}
+
+func (s StateOfApplicabilityService) ExportPDF(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) ([]byte, error) {
+	var documentData docgen.StateOfApplicabilityData
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			stateOfApplicability := &coredata.StateOfApplicability{}
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state of applicability: %w", err)
+			}
+
+			organization := &coredata.Organization{}
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			owner := &coredata.People{}
+			if err := owner.LoadByID(ctx, conn, s.svc.scope, stateOfApplicability.OwnerID); err != nil {
+				return fmt.Errorf("cannot load owner: %w", err)
+			}
+
+			var availableControls coredata.AvailableStateOfApplicabilityControls
+			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load available controls: %w", err)
+			}
+
+			linkedControls := make([]*coredata.AvailableStateOfApplicabilityControl, 0)
+			for _, ctrl := range availableControls {
+				if ctrl.StateOfApplicabilityID != nil {
+					linkedControls = append(linkedControls, ctrl)
+				}
+			}
+
+			obligationsByControl := make(map[gid.GID][]coredata.ObligationType)
+			if len(linkedControls) > 0 {
+				controlIDs := make([]gid.GID, len(linkedControls))
+				for i, ctrl := range linkedControls {
+					controlIDs[i] = ctrl.ControlID
+				}
+
+				var controlObligationTypes coredata.ControlObligationTypes
+				if err := controlObligationTypes.LoadTypesByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
+					return fmt.Errorf("cannot load control obligations: %w", err)
+				}
+
+				for _, cot := range controlObligationTypes {
+					obligationsByControl[cot.ControlID] = append(obligationsByControl[cot.ControlID], cot.Type)
+				}
+			}
+
+			controlsWithRisks := make(map[gid.GID]bool)
+			if len(linkedControls) > 0 {
+				controlIDs := make([]gid.GID, len(linkedControls))
+				for i, ctrl := range linkedControls {
+					controlIDs[i] = ctrl.ControlID
+				}
+
+				var controlsWithRisk coredata.ControlsWithRisk
+				if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
+					return fmt.Errorf("cannot load controls with risks: %w", err)
+				}
+
+				for _, cwr := range controlsWithRisk {
+					controlsWithRisks[cwr.ControlID] = true
+				}
+			}
+
+			frameworkControlsMap := make(map[string][]docgen.ControlData)
+			frameworkOrder := []string{}
+
+			for _, ctrl := range linkedControls {
+				if _, exists := frameworkControlsMap[ctrl.FrameworkName]; !exists {
+					frameworkOrder = append(frameworkOrder, ctrl.FrameworkName)
+					frameworkControlsMap[ctrl.FrameworkName] = []docgen.ControlData{}
+				}
+
+				var regulatory *bool
+				var contractual *bool
+				var riskAssessment *bool
+
+				if ctrl.Applicability != nil && *ctrl.Applicability {
+					falseVal := false
+					trueVal := true
+
+					regulatory = &falseVal
+					contractual = &falseVal
+					riskAssessment = &falseVal
+
+					obligations := obligationsByControl[ctrl.ControlID]
+					for _, obligationType := range obligations {
+						if obligationType == coredata.ObligationTypeLegal {
+							regulatory = &trueVal
+						}
+						if obligationType == coredata.ObligationTypeContractual {
+							contractual = &trueVal
+						}
+					}
+
+					if controlsWithRisks[ctrl.ControlID] {
+						riskAssessment = &trueVal
+					}
+				}
+
+				frameworkControlsMap[ctrl.FrameworkName] = append(
+					frameworkControlsMap[ctrl.FrameworkName],
+					docgen.ControlData{
+						FrameworkName:  ctrl.FrameworkName,
+						SectionTitle:   ctrl.SectionTitle,
+						Name:           ctrl.Name,
+						Applicability:  ctrl.Applicability,
+						Justification:  ctrl.Justification,
+						BestPractice:   ctrl.BestPractice,
+						Regulatory:     regulatory,
+						Contractual:    contractual,
+						RiskAssessment: riskAssessment,
+					},
+				)
+			}
+
+			frameworkGroups := make([]docgen.FrameworkControlGroup, len(frameworkOrder))
+			for i, frameworkName := range frameworkOrder {
+				frameworkGroups[i] = docgen.FrameworkControlGroup{
+					FrameworkName: frameworkName,
+					Controls:      frameworkControlsMap[frameworkName],
+				}
+			}
+
+			var snapshots coredata.Snapshots
+			snapshotType := coredata.SnapshotsTypeStatesOfApplicability
+
+			var version int
+			var publishedAt time.Time
+
+			if stateOfApplicability.SnapshotID != nil {
+				snapshot := &coredata.Snapshot{}
+				if err := snapshot.LoadByID(ctx, conn, s.svc.scope, *stateOfApplicability.SnapshotID); err != nil {
+					return fmt.Errorf("cannot load snapshot: %w", err)
+				}
+				publishedAt = snapshot.CreatedAt
+				snapshotFilter := coredata.NewSnapshotFilter(&snapshotType).WithBeforeDate(&snapshot.CreatedAt)
+				snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID, snapshotFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
+				}
+				version = snapshotCount
+			} else {
+				publishedAt = time.Now()
+				snapshotFilter := coredata.NewSnapshotFilter(&snapshotType)
+				snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID, snapshotFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
+				}
+				version = snapshotCount + 1
+			}
+
+			horizontalLogoBase64 := ""
+			if organization.HorizontalLogoFileID != nil {
+				fileRecord := &coredata.File{}
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
+				if fileErr == nil {
+					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
+					if logoErr == nil {
+						horizontalLogoBase64 = fmt.Sprintf("data:%s;base64,%s", mimeType, base64Data)
+					}
+				}
+			}
+
+			documentData = docgen.StateOfApplicabilityData{
+				Title:                       stateOfApplicability.Name,
+				OrganizationName:            organization.Name,
+				CreatedAt:                   stateOfApplicability.CreatedAt,
+				TotalControls:               len(linkedControls),
+				FrameworkGroups:             frameworkGroups,
+				CompanyHorizontalLogoBase64: horizontalLogoBase64,
+				Version:                     version,
+				PublishedAt:                 publishedAt,
+				Approver:                    owner.FullName,
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	htmlData, err := docgen.RenderStateOfApplicabilityHTML(documentData)
+	if err != nil {
+		return nil, fmt.Errorf("cannot render HTML: %w", err)
+	}
+
+	cfg := html2pdf.RenderConfig{
+		PageFormat:      html2pdf.PageFormatA4,
+		Orientation:     html2pdf.OrientationPortrait,
+		MarginTop:       html2pdf.NewMarginInches(1.0),
+		MarginBottom:    html2pdf.NewMarginInches(1.0),
+		MarginLeft:      html2pdf.NewMarginInches(1.0),
+		MarginRight:     html2pdf.NewMarginInches(1.0),
+		PrintBackground: true,
+		Scale:           1.0,
+	}
+
+	pdfReader, err := s.html2pdfConverter.GeneratePDF(ctx, htmlData, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate PDF: %w", err)
+	}
+
+	pdfData, err := io.ReadAll(pdfReader)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read PDF data: %w", err)
+	}
+
+	return pdfData, nil
+}

pkg/probo/transfer_impact_assessment_service.go

@@ -329,9 +329,7 @@ func (s *TransferImpactAssessmentService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {

pkg/server/api/console/v1/schema.graphql

@@ -224,6 +224,14 @@ enum ObligationStatus
     @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant")
 }
 
+enum ObligationType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ObligationType") {
+  LEGAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeLegal")
+  CONTRACTUAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual")
+}
+
 enum ContinualImprovementStatus
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.ContinualImprovementStatus"
@@ -1235,6 +1243,10 @@ enum SnapshotsType
     @goEnum(
       value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeProcessingActivities"
     )
+  STATES_OF_APPLICABILITY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeStatesOfApplicability"
+    )
 }
 
 enum SnapshotOrderField
@@ -1567,6 +1579,10 @@ input DatumFilter {
   snapshotId: ID
 }
 
+input StateOfApplicabilityFilter {
+  snapshotId: ID
+}
+
 input NonconformityFilter {
   snapshotId: ID
 }
@@ -1715,6 +1731,15 @@ type Organization implements Node {
     orderBy: MeetingOrder
   ): MeetingConnection! @goField(forceResolver: true)
 
+  statesOfApplicability(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+    filter: StateOfApplicabilityFilter = { snapshotId: null }
+  ): StateOfApplicabilityConnection! @goField(forceResolver: true)
+
   measures(
     first: Int
     after: CursorKey
@@ -2072,6 +2097,7 @@ type Control implements Node
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 
   framework: Framework! @goField(forceResolver: true)
 
@@ -2101,6 +2127,15 @@ type Control implements Node
     orderBy: AuditOrder
   ): AuditConnection! @goField(forceResolver: true)
 
+  obligations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ObligationOrder
+    filter: ObligationFilter
+  ): ObligationConnection! @goField(forceResolver: true)
+
   snapshots(
     first: Int
     after: CursorKey
@@ -2109,6 +2144,14 @@ type Control implements Node
     orderBy: SnapshotOrder
   ): SnapshotConnection! @goField(forceResolver: true)
 
+  stateOfApplicabilityControls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+  ): StateOfApplicabilityControlConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2266,6 +2309,26 @@ type Meeting implements Node {
   updatedAt: Datetime!
 }
 
+type StateOfApplicability implements Node {
+  id: ID!
+  name: String!
+  sourceId: ID
+  snapshotId: ID
+  organization: Organization @goField(forceResolver: true)
+  owner: People! @goField(forceResolver: true)
+  controls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ControlOrder
+    filter: ControlFilter
+  ): ControlConnection! @goField(forceResolver: true)
+  availableControls: [AvailableStateOfApplicabilityControl!]! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Risk implements Node {
   id: ID!
   snapshotId: ID
@@ -2381,6 +2444,7 @@ type Obligation implements Node {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2835,6 +2899,20 @@ type MeetingEdge {
   node: Meeting!
 }
 
+type StateOfApplicabilityConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [StateOfApplicabilityEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityEdge {
+  cursor: CursorKey!
+  node: StateOfApplicability!
+}
+
 type RiskConnection
   @goModel(
     model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskConnection"
@@ -3191,12 +3269,24 @@ type Mutation {
   deleteControlDocumentMapping(
     input: DeleteControlDocumentMappingInput!
   ): DeleteControlDocumentMappingPayload!
+  createStateOfApplicabilityControlMapping(
+    input: CreateStateOfApplicabilityControlMappingInput!
+  ): CreateStateOfApplicabilityControlMappingPayload!
+  deleteStateOfApplicabilityControlMapping(
+    input: DeleteStateOfApplicabilityControlMappingInput!
+  ): DeleteStateOfApplicabilityControlMappingPayload!
   createControlAuditMapping(
     input: CreateControlAuditMappingInput!
   ): CreateControlAuditMappingPayload!
   deleteControlAuditMapping(
     input: DeleteControlAuditMappingInput!
   ): DeleteControlAuditMappingPayload!
+  createControlObligationMapping(
+    input: CreateControlObligationMappingInput!
+  ): CreateControlObligationMappingPayload!
+  deleteControlObligationMapping(
+    input: DeleteControlObligationMappingInput!
+  ): DeleteControlObligationMappingPayload!
   createControlSnapshotMapping(
     input: CreateControlSnapshotMappingInput!
   ): CreateControlSnapshotMappingPayload!
@@ -3269,6 +3359,19 @@ type Mutation {
   createMeeting(input: CreateMeetingInput!): CreateMeetingPayload!
   updateMeeting(input: UpdateMeetingInput!): UpdateMeetingPayload!
   deleteMeeting(input: DeleteMeetingInput!): DeleteMeetingPayload!
+  # StateOfApplicability mutations
+  createStateOfApplicability(
+    input: CreateStateOfApplicabilityInput!
+  ): CreateStateOfApplicabilityPayload!
+  updateStateOfApplicability(
+    input: UpdateStateOfApplicabilityInput!
+  ): UpdateStateOfApplicabilityPayload!
+  deleteStateOfApplicability(
+    input: DeleteStateOfApplicabilityInput!
+  ): DeleteStateOfApplicabilityPayload!
+  exportStateOfApplicabilityPDF(
+    input: ExportStateOfApplicabilityPDFInput!
+  ): ExportStateOfApplicabilityPDFPayload!
   publishDocumentVersion(
     input: PublishDocumentVersionInput!
   ): PublishDocumentVersionPayload!
@@ -3762,6 +3865,18 @@ input DeleteControlDocumentMappingInput {
   documentId: ID!
 }
 
+input CreateStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+input DeleteStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+}
+
 input CreateControlAuditMappingInput {
   controlId: ID!
   auditId: ID!
@@ -3772,6 +3887,16 @@ input DeleteControlAuditMappingInput {
   auditId: ID!
 }
 
+input CreateControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
+input DeleteControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
 input CreateControlSnapshotMappingInput {
   controlId: ID!
   snapshotId: ID!
@@ -3989,6 +4114,95 @@ input DeleteMeetingInput {
   meetingId: ID!
 }
 
+input CreateStateOfApplicabilityInput {
+  organizationId: ID!
+  name: String!
+  ownerId: ID!
+}
+
+input UpdateStateOfApplicabilityInput {
+  id: ID!
+  name: String
+  ownerId: ID
+}
+
+input StateOfApplicabilityControlInput {
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+type AvailableStateOfApplicabilityControl {
+  controlId: ID!
+  sectionTitle: String!
+  name: String!
+  frameworkId: ID!
+  frameworkName: String!
+  organizationId: ID!
+  stateOfApplicabilityId: ID
+  applicability: Boolean
+  justification: String
+  bestPractice: Boolean!
+  regulatory: Boolean!
+  contractual: Boolean!
+  riskAssessment: Boolean!
+}
+
+input DeleteStateOfApplicabilityInput {
+  stateOfApplicabilityId: ID!
+}
+
+
+type StateOfApplicabilityControl {
+  id: ID!
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
+  applicability: Boolean!
+  justification: String
+}
+
+type StateOfApplicabilityControlConnection @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlConnection") {
+  totalCount: Int!
+  edges: [StateOfApplicabilityControlEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityControlEdge @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlEdge") {
+  cursor: CursorKey!
+  node: StateOfApplicabilityControl!
+}
+
+input ExportStateOfApplicabilityPDFInput {
+  stateOfApplicabilityId: ID!
+}
+
+type ExportStateOfApplicabilityPDFPayload {
+  data: String!
+}
+
+input StateOfApplicabilityOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: StateOfApplicabilityOrderField!
+}
+
+enum StateOfApplicabilityOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderField"
+  ) {
+  NAME
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldName"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldCreatedAt"
+    )
+}
+
 input ConfirmEmailInput {
   token: String!
 }
@@ -4027,6 +4241,7 @@ input CreateControlInput {
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 }
 
 input UpdateControlInput {
@@ -4036,6 +4251,7 @@ input UpdateControlInput {
   description: String @goField(omittable: true)
   status: ControlStatus
   exclusionJustification: String
+  bestPractice: Boolean
 }
 
 input DeleteControlInput {
@@ -4119,6 +4335,7 @@ input CreateObligationInput {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
 }
 
 input UpdateObligationInput {
@@ -4132,6 +4349,7 @@ input UpdateObligationInput {
   lastReviewDate: Datetime @goField(omittable: true)
   dueDate: Datetime @goField(omittable: true)
   status: ObligationStatus
+  type: ObligationType
 }
 
 input DeleteObligationInput {
@@ -4501,6 +4719,16 @@ type DeleteControlDocumentMappingPayload {
   deletedDocumentId: ID!
 }
 
+type CreateStateOfApplicabilityControlMappingPayload {
+  stateOfApplicabilityControlEdge: StateOfApplicabilityControlEdge!
+}
+
+type DeleteStateOfApplicabilityControlMappingPayload {
+  deletedStateOfApplicabilityId: ID!
+  deletedControlId: ID!
+  deletedStateOfApplicabilityControlId: ID!
+}
+
 type CreateControlAuditMappingPayload {
   controlEdge: ControlEdge!
   auditEdge: AuditEdge!
@@ -4511,6 +4739,16 @@ type DeleteControlAuditMappingPayload {
   deletedAuditId: ID!
 }
 
+type CreateControlObligationMappingPayload {
+  controlEdge: ControlEdge!
+  obligationEdge: ObligationEdge!
+}
+
+type DeleteControlObligationMappingPayload {
+  deletedControlId: ID!
+  deletedObligationId: ID!
+}
+
 type CreateControlSnapshotMappingPayload {
   controlEdge: ControlEdge!
   snapshotEdge: SnapshotEdge!
@@ -4656,6 +4894,18 @@ type DeleteMeetingPayload {
   deletedMeetingId: ID!
 }
 
+type CreateStateOfApplicabilityPayload {
+  stateOfApplicabilityEdge: StateOfApplicabilityEdge!
+}
+
+type UpdateStateOfApplicabilityPayload {
+  stateOfApplicability: StateOfApplicability!
+}
+
+type DeleteStateOfApplicabilityPayload {
+  deletedStateOfApplicabilityId: ID!
+}
+
 type ConfirmEmailPayload {
   success: Boolean!
 }

pkg/server/api/console/v1/types/control.go

@@ -16,6 +16,7 @@ type Control struct {
 	Description            *string                `json:"description,omitempty"`
 	Status                 coredata.ControlStatus `json:"status"`
 	ExclusionJustification *string                `json:"exclusionJustification,omitempty"`
+	BestPractice           bool                   `json:"bestPractice"`
 	Framework              *Framework             `json:"framework"`
 	Measures               *MeasureConnection     `json:"measures"`
 	Documents              *DocumentConnection    `json:"documents"`
@@ -72,6 +73,7 @@ func NewControl(control *coredata.Control) *Control {
 		Description:            control.Description,
 		Status:                 control.Status,
 		ExclusionJustification: control.ExclusionJustification,
+		BestPractice:           control.BestPractice,
 		CreatedAt:              control.CreatedAt,
 		UpdatedAt:              control.UpdatedAt,
 	}

pkg/server/api/console/v1/types/state_of_applicability.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityOrderBy OrderBy[coredata.StateOfApplicabilityOrderField]
+
+	StateOfApplicabilityConnection struct {
+		TotalCount int
+		Edges      []*StateOfApplicabilityEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+		Filters  *coredata.StateOfApplicabilityFilter
+	}
+)
+
+func NewStateOfApplicabilityConnection(
+	p *page.Page[*coredata.StateOfApplicability, coredata.StateOfApplicabilityOrderField],
+	parentType any,
+	parentID gid.GID,
+	filters *coredata.StateOfApplicabilityFilter,
+) *StateOfApplicabilityConnection {
+	var edges = make([]*StateOfApplicabilityEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewStateOfApplicabilityEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &StateOfApplicabilityConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+		Filters:  filters,
+	}
+}
+
+func NewStateOfApplicabilityEdge(soa *coredata.StateOfApplicability, orderBy coredata.StateOfApplicabilityOrderField) *StateOfApplicabilityEdge {
+	return &StateOfApplicabilityEdge{
+		Cursor: soa.CursorKey(orderBy),
+		Node:   NewStateOfApplicability(soa),
+	}
+}
+
+func NewStateOfApplicability(soa *coredata.StateOfApplicability) *StateOfApplicability {
+	return &StateOfApplicability{
+		ID:         soa.ID,
+		Name:       soa.Name,
+		SourceID:   soa.SourceID,
+		SnapshotID: soa.SnapshotID,
+		CreatedAt:  soa.CreatedAt,
+		UpdatedAt:  soa.UpdatedAt,
+	}
+}

pkg/server/api/console/v1/types/state_of_applicability_control_connection.go

@@ -0,0 +1,76 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityControlConnection struct {
+		TotalCount int
+		Edges      []*StateOfApplicabilityControlEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+
+	StateOfApplicabilityControlEdge struct {
+		Cursor page.CursorKey
+		Node   *StateOfApplicabilityControl
+	}
+)
+
+func NewStateOfApplicabilityControlConnection(
+	p *page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField],
+	parentType any,
+	parentID gid.GID,
+) *StateOfApplicabilityControlConnection {
+	edges := make([]*StateOfApplicabilityControlEdge, len(p.Data))
+	for i, control := range p.Data {
+		edges[i] = NewStateOfApplicabilityControlEdge(control, p.Cursor.OrderBy.Field)
+	}
+
+	return &StateOfApplicabilityControlConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewStateOfApplicabilityControlEdge(
+	control *coredata.StateOfApplicabilityControl,
+	orderBy coredata.StateOfApplicabilityOrderField,
+) *StateOfApplicabilityControlEdge {
+	return &StateOfApplicabilityControlEdge{
+		Cursor: control.CursorKey(orderBy),
+		Node:   NewStateOfApplicabilityControl(control),
+	}
+}
+
+func NewStateOfApplicabilityControl(control *coredata.StateOfApplicabilityControl) *StateOfApplicabilityControl {
+	return &StateOfApplicabilityControl{
+		ID:                     control.ID,
+		StateOfApplicabilityID: control.StateOfApplicabilityID,
+		ControlID:              control.ControlID,
+		Applicability:          control.Applicability,
+		Justification:          control.Justification,
+	}
+}