From cf1dadc0b5b07da35a0cd7d2cc6cbfaa51cc7970 Mon Sep 17 00:00:00 2001
From: Sacha Al Himdani <sacha@getprobo.com>
Date: Mon, 16 Mar 2026 19:24:34 +0100
Subject: [PATCH] Add implemented state and justification to controls

Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
---
 .../console/src/hooks/graph/FrameworkGraph.ts |   3 +
 .../frameworks/FrameworkControlPage.tsx       |  24 +++
 .../dialogs/FrameworkControlDialog.tsx        |  50 ++++--
 .../AddApplicabilityStatementDialog.tsx       |   2 +
 .../tabs/StateOfApplicabilityControlsTab.tsx  | 147 +++++++-----------
 e2e/console/control_test.go                   |  21 +++
 e2e/console/mapping_test.go                   |   4 +
 e2e/console/rbac_test.go                      |   6 +-
 e2e/internal/factory/factory.go               |  15 ++
 pkg/cmd/control/create/create.go              |  38 +++--
 pkg/cmd/control/update/update.go              |  40 +++--
 pkg/coredata/control.go                       |  92 ++++++++---
 pkg/coredata/control_implementation_state.go  |  66 ++++++++
 pkg/coredata/migrations/20260316T120000Z.sql  |   5 +
 pkg/docgen/generator.go                       |  26 ++--
 pkg/docgen/soa_template.html                  |  72 +++++++--
 pkg/probo/control_service.go                  |  80 +++++++---
 pkg/probo/framework_service.go                |  38 +++--
 pkg/probo/state_of_applicability_service.go   |  20 ++-
 pkg/server/api/console/v1/schema.graphql      |  20 +++
 pkg/server/api/console/v1/types/control.go    |  14 +-
 pkg/server/api/console/v1/v1_resolver.go      |  24 +--
 pkg/server/api/mcp/v1/schema.resolvers.go     |  28 +++-
 pkg/server/api/mcp/v1/specification.yaml      |  42 +++++
 pkg/server/api/mcp/v1/types/control.go        |  19 ++-
 25 files changed, 663 insertions(+), 233 deletions(-)
 create mode 100644 pkg/coredata/control_implementation_state.go
 create mode 100644 pkg/coredata/migrations/20260316T120000Z.sql

diff --git a/apps/console/src/hooks/graph/FrameworkGraph.ts b/apps/console/src/hooks/graph/FrameworkGraph.ts
index fed43088e..c384cd5cd 100644
--- a/apps/console/src/hooks/graph/FrameworkGraph.ts
+++ b/apps/console/src/hooks/graph/FrameworkGraph.ts
@@ -103,6 +103,9 @@ export const frameworkControlNodeQuery = graphql`
         name
         sectionTitle
         description
+        bestPractice
+        implemented
+        notImplementedJustification
         canUpdate: permission(action: "core:control:update")
         canDelete: permission(action: "core:control:delete")
         canCreateMeasureMapping: permission(
diff --git a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
index 186a73c5b..88021e882 100644
--- a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
+++ b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
@@ -3,7 +3,9 @@ import { promisifyMutation } from "@probo/helpers";
 import { useTranslate } from "@probo/i18n";
 import {
   ActionDropdown,
+  Badge,
   Button,
+  Card,
   DropdownItem,
   IconPencil,
   IconTrashCan,
@@ -354,6 +356,28 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             {control.description}
           </div>
         )}
+        <Card padded className="mb-6 mt-6">
+          <div className="space-y-3">
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-txt-secondary">{__("Best Practice")}</span>
+              <Badge variant={control.bestPractice ? "success" : "neutral"} size="sm">
+                {control.bestPractice ? __("Yes") : __("No")}
+              </Badge>
+            </div>
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-txt-secondary">{__("Implemented")}</span>
+              <Badge variant={control.implemented === "IMPLEMENTED" ? "success" : "warning"} size="sm">
+                {control.implemented === "IMPLEMENTED" ? __("Implemented") : __("Not Implemented")}
+              </Badge>
+            </div>
+            {control.implemented === "NOT_IMPLEMENTED" && control.notImplementedJustification && (
+              <div>
+                <span className="text-xs text-txt-secondary">{__("Justification for non-implementation")}</span>
+                <div className="text-sm mt-0.5 whitespace-pre-wrap">{control.notImplementedJustification}</div>
+              </div>
+            )}
+          </div>
+        </Card>
         <div className="mb-4">
           <LinkedMeasuresCard
             variant="card"
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
index 66bad56fa..f453839ee 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
@@ -34,6 +34,8 @@ const controlFragment = graphql`
         description
         sectionTitle
         bestPractice
+        implemented
+        notImplementedJustification
     }
 `;
 
@@ -67,6 +69,8 @@ const schema = z.object({
   description: z.string().optional().nullable(),
   sectionTitle: z.string(),
   bestPractice: z.boolean(),
+  implemented: z.enum(["IMPLEMENTED", "NOT_IMPLEMENTED"]),
+  notImplementedJustification: z.string().optional().nullable(),
 });
 
 export function FrameworkControlDialog(props: Props) {
@@ -91,6 +95,8 @@ export function FrameworkControlDialog(props: Props) {
       description: frameworkControl?.description ?? "",
       sectionTitle: frameworkControl?.sectionTitle ?? "",
       bestPractice: frameworkControl?.bestPractice ?? true,
+      implemented: frameworkControl?.implemented ?? "IMPLEMENTED",
+      notImplementedJustification: frameworkControl?.notImplementedJustification ?? "",
     }),
     [frameworkControl],
   );
@@ -105,10 +111,10 @@ export function FrameworkControlDialog(props: Props) {
   }, [defaultValues, reset]);
 
   const bestPracticeValue = watch("bestPractice");
+  const implementedValue = watch("implemented");
 
   const onSubmit = async (data: z.infer<typeof schema>) => {
     if (frameworkControl) {
-      // Update the control
       await mutate({
         variables: {
           input: {
@@ -117,11 +123,12 @@ export function FrameworkControlDialog(props: Props) {
             description: data.description || null,
             sectionTitle: data.sectionTitle,
             bestPractice: data.bestPractice,
+            implemented: data.implemented,
+            notImplementedJustification: data.implemented === "IMPLEMENTED" ? null : (data.notImplementedJustification || null),
           },
         },
       });
     } else {
-      // Create a new control
       await mutate({
         variables: {
           input: {
@@ -130,6 +137,8 @@ export function FrameworkControlDialog(props: Props) {
             description: data.description || null,
             sectionTitle: data.sectionTitle,
             bestPractice: data.bestPractice ?? true,
+            implemented: data.implemented ?? "IMPLEMENTED",
+            notImplementedJustification: data.implemented === "IMPLEMENTED" ? null : (data.notImplementedJustification || null),
           },
           connections: [props.connectionId!],
         },
@@ -167,7 +176,7 @@ export function FrameworkControlDialog(props: Props) {
             id="title"
             required
             variant="title"
-            placeholder={__("Document title")}
+            placeholder={__("Control name")}
             {...register("name")}
           />
           <Textarea
@@ -177,14 +186,33 @@ export function FrameworkControlDialog(props: Props) {
             placeholder={__("Add description")}
             {...register("description")}
           />
-          <label className="flex items-center gap-2 cursor-pointer">
-            <Checkbox
-              checked={bestPracticeValue}
-              onChange={checked =>
-                setValue("bestPractice", checked)}
-            />
-            <span className="text-sm">{__("Best Practice")}</span>
-          </label>
+          <div className="border border-border-low rounded-xl p-3 space-y-3 mt-4">
+            <label className="flex items-center gap-2 cursor-pointer">
+              <Checkbox
+                checked={bestPracticeValue}
+                onChange={checked =>
+                  setValue("bestPractice", checked)}
+              />
+              <span className="text-sm">{__("Best Practice")}</span>
+            </label>
+            <label className="flex items-center gap-2 cursor-pointer">
+              <Checkbox
+                checked={implementedValue === "IMPLEMENTED"}
+                onChange={checked =>
+                  setValue("implemented", checked ? "IMPLEMENTED" : "NOT_IMPLEMENTED")}
+              />
+              <span className="text-sm">{__("Implemented")}</span>
+            </label>
+            {implementedValue === "NOT_IMPLEMENTED" && (
+              <Textarea
+                id="notImplementedJustification"
+                variant="ghost"
+                autogrow
+                placeholder={__("Justification for non-implementation")}
+                {...register("notImplementedJustification")}
+              />
+            )}
+          </div>
         </DialogContent>
         <DialogFooter>
           <Button type="submit" disabled={isMutating}>
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/AddApplicabilityStatementDialog.tsx b/apps/console/src/pages/organizations/states-of-applicability/dialogs/AddApplicabilityStatementDialog.tsx
index 79f021082..fb584fa9a 100644
--- a/apps/console/src/pages/organizations/states-of-applicability/dialogs/AddApplicabilityStatementDialog.tsx
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/AddApplicabilityStatementDialog.tsx
@@ -79,6 +79,8 @@ const createApplicabilityStatementMutation = graphql`
                         sectionTitle
                         name
                         bestPractice
+                        implemented
+                        notImplementedJustification
                         regulatory
                         contractual
                         riskAssessment
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx
index 560c47765..32bb04249 100644
--- a/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx
@@ -71,6 +71,8 @@ export const controlsFragment = graphql`
                         sectionTitle
                         name
                         bestPractice
+                        implemented
+                        notImplementedJustification
                         regulatory
                         contractual
                         riskAssessment
@@ -135,6 +137,8 @@ export default function StateOfApplicabilityControlsTab({
     applicability: edge.node.applicability,
     justification: edge.node.justification,
     bestPractice: edge.node.control.bestPractice,
+    implemented: edge.node.control.implemented,
+    notImplementedJustification: edge.node.control.notImplementedJustification,
     regulatory: edge.node.control.regulatory,
     contractual: edge.node.control.contractual,
     riskAssessment: edge.node.control.riskAssessment,
@@ -204,29 +208,19 @@ export default function StateOfApplicabilityControlsTab({
           </div>
         )}
 
-        <Table>
+        <Table className="table-fixed w-full">
           <Thead>
             <Tr>
-              <Th className="w-32">{__("Framework")}</Th>
-              <Th>{__("Control")}</Th>
-              <Th className="w-28 text-center">
-                {__("Applicability")}
-              </Th>
-              <Th className="min-w-48">{__("Justification")}</Th>
-              <Th className="w-24 text-center">
-                {__("Regulatory")}
-              </Th>
-              <Th className="w-24 text-center">
-                {__("Contractual")}
-              </Th>
-              <Th className="w-32 text-center">
-                {__("Best Practice")}
-              </Th>
-              <Th className="w-36 text-center">
-                {__("Risk Assessment")}
-              </Th>
+              <Th className="w-[10%]">{__("Framework")}</Th>
+              <Th className="w-[20%]">{__("Control")}</Th>
+              <Th className="w-[15%]">{__("Applicability")}</Th>
+              <Th className="w-[15%]">{__("Implemented")}</Th>
+              <Th className="w-[8%]">{__("Regulatory")}</Th>
+              <Th className="w-[8%]">{__("Contractual")}</Th>
+              <Th className="w-[8%]">{__("Best Practice")}</Th>
+              <Th className="w-[8%]">{__("Risk Assessment")}</Th>
               {(canUpdate || canDelete) && (
-                <Th className="w-12"></Th>
+                <Th className="w-[4%]"></Th>
               )}
             </Tr>
           </Thead>
@@ -250,103 +244,82 @@ export default function StateOfApplicabilityControlsTab({
                   {control.frameworkName}
                 </Td>
                 <Td>
-                  <div className="space-y-1">
-                    <div className="text-xs font-medium text-txt-tertiary">
+                  <div className="space-y-0.5">
+                    <div className="text-xs text-txt-tertiary">
                       {control.sectionTitle}
                     </div>
-                    <div className="text-sm">
+                    <div className="text-xs">
                       {control.name}
                     </div>
                   </div>
                 </Td>
                 <Td>
-                  <div className="flex justify-center">
+                  <div className="space-y-1">
                     {control.applicability !== null
                       ? (
                           <Badge
-                            variant={
-                              control.applicability
-                                ? "success"
-                                : "danger"
-                            }
+                            variant={control.applicability ? "success" : "danger"}
                             size="sm"
                           >
-                            {control.applicability
-                              ? __("Yes")
-                              : __("No")}
+                            {control.applicability ? __("Yes") : __("No")}
                           </Badge>
                         )
                       : (
-                          <span className="text-txt-tertiary">
-                            -
-                          </span>
+                          <span className="text-txt-tertiary">-</span>
                         )}
-                  </div>
-                </Td>
-                <Td>
-                  <div className="text-sm text-txt-secondary line-clamp-2">
-                    {control.justification || (
-                      <span className="text-txt-tertiary italic">
-                        -
-                      </span>
+                    {control.justification && (
+                      <p className="text-xs text-txt-secondary break-words">
+                        {control.justification}
+                      </p>
                     )}
                   </div>
                 </Td>
                 <Td>
-                  <div className="flex justify-center">
-                    {control.applicability === false
-                      ? <span className="text-txt-tertiary">-</span>
-                      : (
+                  {control.applicability === false
+                    ? <span className="text-txt-tertiary">-</span>
+                    : (
+                        <div className="space-y-1">
                           <Badge
-                            variant={control.regulatory ? "success" : "danger"}
+                            variant={control.implemented === "IMPLEMENTED" ? "success" : "danger"}
                             size="sm"
                           >
-                            {control.regulatory ? __("Yes") : __("No")}
+                            {control.implemented === "IMPLEMENTED" ? __("Yes") : __("No")}
                           </Badge>
-                        )}
-                  </div>
+                          {control.implemented === "NOT_IMPLEMENTED" && control.notImplementedJustification && (
+                            <p className="text-xs text-txt-secondary break-words">
+                              {control.notImplementedJustification}
+                            </p>
+                          )}
+                        </div>
+                      )}
                 </Td>
                 <Td>
-                  <div className="flex justify-center">
-                    {control.applicability === false
-                      ? <span className="text-txt-tertiary">-</span>
-                      : (
-                          <Badge
-                            variant={control.contractual ? "success" : "danger"}
-                            size="sm"
-                          >
-                            {control.contractual ? __("Yes") : __("No")}
-                          </Badge>
-                        )}
-                  </div>
+                  {control.applicability === false
+                    ? <span className="text-txt-tertiary">-</span>
+                    : control.regulatory
+                      ? <Badge variant="success" size="sm">{__("Yes")}</Badge>
+                      : <Badge variant="danger" size="sm">{__("No")}</Badge>}
                 </Td>
                 <Td>
-                  <div className="flex justify-center">
-                    {control.applicability === false
-                      ? <span className="text-txt-tertiary">-</span>
-                      : (
-                          <Badge
-                            variant={control.bestPractice ? "success" : "danger"}
-                            size="sm"
-                          >
-                            {control.bestPractice ? __("Yes") : __("No")}
-                          </Badge>
-                        )}
-                  </div>
+                  {control.applicability === false
+                    ? <span className="text-txt-tertiary">-</span>
+                    : control.contractual
+                      ? <Badge variant="success" size="sm">{__("Yes")}</Badge>
+                      : <Badge variant="danger" size="sm">{__("No")}</Badge>}
                 </Td>
                 <Td>
-                  <div className="flex justify-center">
-                    {control.applicability === false
-                      ? <span className="text-txt-tertiary">-</span>
-                      : (
-                          <Badge
-                            variant={control.riskAssessment ? "success" : "danger"}
-                            size="sm"
-                          >
-                            {control.riskAssessment ? __("Yes") : __("No")}
-                          </Badge>
-                        )}
-                  </div>
+                  {control.applicability === false
+                    ? <span className="text-txt-tertiary">-</span>
+                    : control.bestPractice
+                      ? <Badge variant="success" size="sm">{__("Yes")}</Badge>
+                      : <Badge variant="danger" size="sm">{__("No")}</Badge>}
+                </Td>
+                <Td>
+                  {control.applicability === false
+                    ? <span className="text-txt-tertiary">-</span>
+                    : control.riskAssessment
+                      ? <Badge variant="success" size="sm">{__("Yes")}</Badge>
+                      : <Badge variant="danger" size="sm">{__("No")}</Badge>}
                 </Td>
                 {(canUpdate || canDelete) && (
                   <Td noLink className="text-end">
diff --git a/e2e/console/control_test.go b/e2e/console/control_test.go
index 9ce80e456..611b237fb 100644
--- a/e2e/console/control_test.go
+++ b/e2e/console/control_test.go
@@ -64,6 +64,7 @@ func TestControl_Create(t *testing.T) {
 				"name":         "Information Security Policies",
 				"description":  "Policies for information security",
 				"bestPractice": true,
+				"implemented":  "IMPLEMENTED",
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -269,6 +270,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"bestPractice": true,
+					"implemented":  "IMPLEMENTED",
 				},
 			},
 			wantError: true,
@@ -281,6 +283,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"bestPractice": true,
+					"implemented":  "IMPLEMENTED",
 				},
 			},
 			wantError: true,
@@ -293,6 +296,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"description":  "Test",
 					"bestPractice": true,
+					"implemented":  "IMPLEMENTED",
 				},
 			},
 			wantError: true,
@@ -305,6 +309,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"sectionTitle": "Section 1",
 					"bestPractice": true,
+					"implemented":  "IMPLEMENTED",
 				},
 			},
 			wantError: true,
@@ -317,6 +322,20 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"description":  "Test",
 					"sectionTitle": "Section 1",
+					"implemented":  "IMPLEMENTED",
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing implemented should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -404,6 +423,7 @@ func TestControl_OmittableDescription(t *testing.T) {
 			"description":  "Initial description",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -568,6 +588,7 @@ func TestControl_SubResolvers(t *testing.T) {
 			"description":  "Test description",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &controlResult)
 	require.NoError(t, err)
diff --git a/e2e/console/mapping_test.go b/e2e/console/mapping_test.go
index db0c25969..b3486252a 100644
--- a/e2e/console/mapping_test.go
+++ b/e2e/console/mapping_test.go
@@ -83,6 +83,7 @@ func TestControlMeasureMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control for mapping",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -362,6 +363,7 @@ func TestControlDocumentMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -503,6 +505,7 @@ func TestControlAuditMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -640,6 +643,7 @@ func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
diff --git a/e2e/console/rbac_test.go b/e2e/console/rbac_test.go
index b1fdbf8fc..c2b58234d 100644
--- a/e2e/console/rbac_test.go
+++ b/e2e/console/rbac_test.go
@@ -384,7 +384,7 @@ func TestRBAC(t *testing.T) {
 			client: owner,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "bestPractice": true}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "bestPractice": true, "implemented": "IMPLEMENTED"}}
 			},
 			shouldAllow: true,
 		},
@@ -394,7 +394,7 @@ func TestRBAC(t *testing.T) {
 			client: admin,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "bestPractice": true}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "bestPractice": true, "implemented": "IMPLEMENTED"}}
 			},
 			shouldAllow: true,
 		},
@@ -404,7 +404,7 @@ func TestRBAC(t *testing.T) {
 			client: viewer,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "bestPractice": true}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "bestPractice": true, "implemented": "IMPLEMENTED"}}
 			},
 			shouldAllow: false,
 		},
diff --git a/e2e/internal/factory/factory.go b/e2e/internal/factory/factory.go
index d9de38bce..6bcc3eab1 100644
--- a/e2e/internal/factory/factory.go
+++ b/e2e/internal/factory/factory.go
@@ -252,6 +252,11 @@ func CreateControl(c *testutil.Client, frameworkID string, attrs ...Attrs) strin
 		"description":  a.getString("description", "Test control description"),
 		"sectionTitle": a.getString("sectionTitle", fmt.Sprintf("Section %s", gofakeit.LetterN(3))),
 		"bestPractice": a.getBool("bestPractice", true),
+		"implemented":  a.getString("implemented", "IMPLEMENTED"),
+	}
+
+	if justification := a.getStringPtr("notImplementedJustification"); justification != nil {
+		input["notImplementedJustification"] = *justification
 	}
 
 	var result struct {
@@ -495,6 +500,16 @@ func (b *ControlBuilder) WithBestPractice(bestPractice bool) *ControlBuilder {
 	return b
 }
 
+func (b *ControlBuilder) WithImplemented(implemented string) *ControlBuilder {
+	b.attrs["implemented"] = implemented
+	return b
+}
+
+func (b *ControlBuilder) WithNotImplementedJustification(justification string) *ControlBuilder {
+	b.attrs["notImplementedJustification"] = justification
+	return b
+}
+
 func (b *ControlBuilder) Create() string {
 	return CreateControl(b.client, b.frameworkID, b.attrs)
 }
diff --git a/pkg/cmd/control/create/create.go b/pkg/cmd/control/create/create.go
index b11305ee6..bf6b93d3d 100644
--- a/pkg/cmd/control/create/create.go
+++ b/pkg/cmd/control/create/create.go
@@ -33,6 +33,8 @@ mutation($input: CreateControlInput!) {
         name
         description
         bestPractice
+        implemented
+        notImplementedJustification
       }
     }
   }
@@ -43,11 +45,13 @@ type createResponse struct {
 	CreateControl struct {
 		ControlEdge struct {
 			Node struct {
-				ID           string  `json:"id"`
-				SectionTitle string  `json:"sectionTitle"`
-				Name         string  `json:"name"`
-				Description  *string `json:"description"`
-				BestPractice bool    `json:"bestPractice"`
+				ID                          string  `json:"id"`
+				SectionTitle                string  `json:"sectionTitle"`
+				Name                        string  `json:"name"`
+				Description                 *string `json:"description"`
+				BestPractice                bool    `json:"bestPractice"`
+				Implemented                 string  `json:"implemented"`
+				NotImplementedJustification *string `json:"notImplementedJustification"`
 			} `json:"node"`
 		} `json:"controlEdge"`
 	} `json:"createControl"`
@@ -55,11 +59,13 @@ type createResponse struct {
 
 func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	var (
-		flagFramework    string
-		flagSectionTitle string
-		flagName         string
-		flagDescription  string
-		flagBestPractice bool
+		flagFramework                   string
+		flagSectionTitle                string
+		flagName                        string
+		flagDescription                 string
+		flagBestPractice                bool
+		flagNotImplemented              bool
+		flagNotImplementedJustification string
 	)
 
 	cmd := &cobra.Command{
@@ -86,17 +92,27 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 				cfg.HTTPTimeoutDuration(),
 			)
 
+			implemented := "IMPLEMENTED"
+			if flagNotImplemented {
+				implemented = "NOT_IMPLEMENTED"
+			}
+
 			input := map[string]any{
 				"frameworkId":  flagFramework,
 				"sectionTitle": flagSectionTitle,
 				"name":         flagName,
 				"bestPractice": flagBestPractice,
+				"implemented":  implemented,
 			}
 
 			if flagDescription != "" {
 				input["description"] = flagDescription
 			}
 
+			if flagNotImplemented && flagNotImplementedJustification != "" {
+				input["notImplementedJustification"] = flagNotImplementedJustification
+			}
+
 			data, err := client.Do(
 				createMutation,
 				map[string]any{"input": input},
@@ -127,6 +143,8 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().StringVar(&flagName, "name", "", "Control name (required)")
 	cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
 	cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
+	cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
+	cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
 
 	_ = cmd.MarkFlagRequired("framework")
 	_ = cmd.MarkFlagRequired("section-title")
diff --git a/pkg/cmd/control/update/update.go b/pkg/cmd/control/update/update.go
index 4e6b020fb..9ffbf7d90 100644
--- a/pkg/cmd/control/update/update.go
+++ b/pkg/cmd/control/update/update.go
@@ -32,6 +32,8 @@ mutation($input: UpdateControlInput!) {
       name
       description
       bestPractice
+      implemented
+      notImplementedJustification
     }
   }
 }
@@ -40,21 +42,25 @@ mutation($input: UpdateControlInput!) {
 type updateResponse struct {
 	UpdateControl struct {
 		Control struct {
-			ID           string  `json:"id"`
-			SectionTitle string  `json:"sectionTitle"`
-			Name         string  `json:"name"`
-			Description  *string `json:"description"`
-			BestPractice bool    `json:"bestPractice"`
+			ID                          string  `json:"id"`
+			SectionTitle                string  `json:"sectionTitle"`
+			Name                        string  `json:"name"`
+			Description                 *string `json:"description"`
+			BestPractice                bool    `json:"bestPractice"`
+			Implemented                 string  `json:"implemented"`
+			NotImplementedJustification *string `json:"notImplementedJustification"`
 		} `json:"control"`
 	} `json:"updateControl"`
 }
 
 func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 	var (
-		flagSectionTitle string
-		flagName         string
-		flagDescription  string
-		flagBestPractice bool
+		flagSectionTitle                string
+		flagName                        string
+		flagDescription                 string
+		flagBestPractice                bool
+		flagNotImplemented              bool
+		flagNotImplementedJustification string
 	)
 
 	cmd := &cobra.Command{
@@ -99,6 +105,20 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 			if cmd.Flags().Changed("best-practice") {
 				input["bestPractice"] = flagBestPractice
 			}
+			if cmd.Flags().Changed("not-implemented") {
+				if flagNotImplemented {
+					input["implemented"] = "NOT_IMPLEMENTED"
+				} else {
+					input["implemented"] = "IMPLEMENTED"
+				}
+			}
+			if cmd.Flags().Changed("not-implemented-justification") {
+				if flagNotImplementedJustification == "" {
+					input["notImplementedJustification"] = nil
+				} else {
+					input["notImplementedJustification"] = flagNotImplementedJustification
+				}
+			}
 
 			if len(input) == 1 {
 				return fmt.Errorf("at least one field must be specified for update")
@@ -133,6 +153,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().StringVar(&flagName, "name", "", "Control name")
 	cmd.Flags().StringVar(&flagDescription, "description", "", "Control description")
 	cmd.Flags().BoolVar(&flagBestPractice, "best-practice", false, "Mark as best practice")
+	cmd.Flags().BoolVar(&flagNotImplemented, "not-implemented", false, "Mark as not implemented")
+	cmd.Flags().StringVar(&flagNotImplementedJustification, "not-implemented-justification", "", "Justification for non-implementation")
 
 	return cmd
 }
diff --git a/pkg/coredata/control.go b/pkg/coredata/control.go
index f130bd381..82d305cb2 100644
--- a/pkg/coredata/control.go
+++ b/pkg/coredata/control.go
@@ -30,15 +30,17 @@ import (
 
 type (
 	Control struct {
-		ID             gid.GID   `db:"id"`
-		OrganizationID gid.GID   `db:"organization_id"`
-		SectionTitle   string    `db:"section_title"`
-		FrameworkID    gid.GID   `db:"framework_id"`
-		Name           string    `db:"name"`
-		Description    *string   `db:"description"`
-		BestPractice   bool      `db:"best_practice"`
-		CreatedAt      time.Time `db:"created_at"`
-		UpdatedAt      time.Time `db:"updated_at"`
+		ID                          gid.GID                    `db:"id"`
+		OrganizationID              gid.GID                    `db:"organization_id"`
+		SectionTitle                string                     `db:"section_title"`
+		FrameworkID                 gid.GID                    `db:"framework_id"`
+		Name                        string                     `db:"name"`
+		Description                 *string                    `db:"description"`
+		BestPractice                bool                       `db:"best_practice"`
+		Implemented                 ControlImplementationState `db:"implemented"`
+		NotImplementedJustification *string                    `db:"not_implemented_justification"`
+		CreatedAt                   time.Time                  `db:"created_at"`
+		UpdatedAt                   time.Time                  `db:"updated_at"`
 	}
 
 	Controls []*Control
@@ -131,6 +133,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -149,6 +153,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
@@ -240,6 +246,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -258,6 +266,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
@@ -355,6 +365,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -379,6 +391,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
@@ -458,6 +472,8 @@ SELECT
     name,
     description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
     created_at,
     updated_at
 FROM
@@ -552,6 +568,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -570,6 +588,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
@@ -616,6 +636,8 @@ SELECT
     name,
     description,
     best_practice,
+    implemented,
+    not_implemented_justification,
     created_at,
     updated_at
 FROM
@@ -664,6 +686,8 @@ SELECT
     name,
     description,
     best_practice,
+    implemented,
+    not_implemented_justification,
     created_at,
     updated_at
 FROM
@@ -712,6 +736,8 @@ INSERT INTO
         name,
         description,
         best_practice,
+        implemented,
+        not_implemented_justification,
         created_at,
         updated_at
     )
@@ -724,22 +750,26 @@ VALUES (
     @name,
     @description,
 	@best_practice,
+	@implemented,
+	@not_implemented_justification,
     @created_at,
     @updated_at
 );
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":       scope.GetTenantID(),
-		"control_id":      c.ID,
-		"organization_id": c.OrganizationID,
-		"framework_id":    c.FrameworkID,
-		"section_title":   c.SectionTitle,
-		"name":            c.Name,
-		"description":     c.Description,
-		"best_practice":   c.BestPractice,
-		"created_at":      c.CreatedAt,
-		"updated_at":      c.UpdatedAt,
+		"tenant_id":                     scope.GetTenantID(),
+		"control_id":                    c.ID,
+		"organization_id":               c.OrganizationID,
+		"framework_id":                  c.FrameworkID,
+		"section_title":                 c.SectionTitle,
+		"name":                          c.Name,
+		"description":                   c.Description,
+		"best_practice":                 c.BestPractice,
+		"implemented":                   c.Implemented,
+		"not_implemented_justification": c.NotImplementedJustification,
+		"created_at":                    c.CreatedAt,
+		"updated_at":                    c.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
 
@@ -789,6 +819,8 @@ UPDATE controls SET
     description = @description,
     section_title = @section_title,
 	best_practice = @best_practice,
+	implemented = @implemented,
+	not_implemented_justification = @not_implemented_justification,
     updated_at = @updated_at
 WHERE %s
     AND id = @control_id
@@ -796,12 +828,14 @@ WHERE %s
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"control_id":    c.ID,
-		"name":          c.Name,
-		"description":   c.Description,
-		"section_title": c.SectionTitle,
-		"best_practice": c.BestPractice,
-		"updated_at":    c.UpdatedAt,
+		"control_id":                    c.ID,
+		"name":                          c.Name,
+		"description":                   c.Description,
+		"section_title":                 c.SectionTitle,
+		"best_practice":                 c.BestPractice,
+		"implemented":                   c.Implemented,
+		"not_implemented_justification": c.NotImplementedJustification,
+		"updated_at":                    c.UpdatedAt,
 	}
 
 	maps.Copy(args, scope.SQLArguments())
@@ -839,6 +873,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -857,6 +893,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
@@ -906,6 +944,8 @@ WITH ctrl AS (
 		c.name,
 		c.description,
 		c.best_practice,
+		c.implemented,
+		c.not_implemented_justification,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -924,6 +964,8 @@ SELECT
 	name,
 	description,
 	best_practice,
+	implemented,
+	not_implemented_justification,
 	created_at,
 	updated_at
 FROM
diff --git a/pkg/coredata/control_implementation_state.go b/pkg/coredata/control_implementation_state.go
new file mode 100644
index 000000000..36c4a3a7d
--- /dev/null
+++ b/pkg/coredata/control_implementation_state.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type (
+	ControlImplementationState string
+)
+
+const (
+	ControlImplementationStateImplemented    ControlImplementationState = "IMPLEMENTED"
+	ControlImplementationStateNotImplemented ControlImplementationState = "NOT_IMPLEMENTED"
+)
+
+func (s ControlImplementationState) IsValid() bool {
+	switch s {
+	case ControlImplementationStateImplemented, ControlImplementationStateNotImplemented:
+		return true
+	}
+	return false
+}
+
+func (s ControlImplementationState) String() string {
+	return string(s)
+}
+
+func (s ControlImplementationState) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
+}
+
+func (s *ControlImplementationState) UnmarshalText(data []byte) error {
+	val := ControlImplementationState(data)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid ControlImplementationState value: %q", string(data))
+	}
+	*s = val
+	return nil
+}
+
+func (s *ControlImplementationState) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for ControlImplementationState, expected string got %T", value)
+	}
+	return s.UnmarshalText([]byte(val))
+}
+
+func (s ControlImplementationState) Value() (driver.Value, error) {
+	return s.String(), nil
+}
diff --git a/pkg/coredata/migrations/20260316T120000Z.sql b/pkg/coredata/migrations/20260316T120000Z.sql
new file mode 100644
index 000000000..aa443717e
--- /dev/null
+++ b/pkg/coredata/migrations/20260316T120000Z.sql
@@ -0,0 +1,5 @@
+-- Add implemented state and not_implemented_justification columns to controls table
+CREATE TYPE control_implementation_state AS ENUM ('IMPLEMENTED', 'NOT_IMPLEMENTED');
+ALTER TABLE controls ADD COLUMN implemented control_implementation_state NOT NULL DEFAULT 'IMPLEMENTED';
+ALTER TABLE controls ADD COLUMN not_implemented_justification text;
+ALTER TABLE controls ALTER COLUMN implemented DROP DEFAULT;
diff --git a/pkg/docgen/generator.go b/pkg/docgen/generator.go
index ff0513eca..e120e35f3 100644
--- a/pkg/docgen/generator.go
+++ b/pkg/docgen/generator.go
@@ -65,6 +65,12 @@ var (
 			}
 			return "no"
 		},
+		"derefString": func(s *string) string {
+			if s == nil {
+				return ""
+			}
+			return *s
+		},
 		"boolToYesNoDash": func(b *bool) string {
 			if b == nil {
 				return "-"
@@ -312,15 +318,17 @@ type (
 	}
 
 	ControlData struct {
-		FrameworkName  string
-		SectionTitle   string
-		Name           string
-		Applicability  *bool
-		Justification  *string
-		BestPractice   *bool
-		Regulatory     *bool
-		Contractual    *bool
-		RiskAssessment *bool
+		FrameworkName               string
+		SectionTitle                string
+		Name                        string
+		Applicability               *bool
+		Justification               *string
+		BestPractice                *bool
+		Implemented                 *string
+		NotImplementedJustification *string
+		Regulatory                  *bool
+		Contractual                 *bool
+		RiskAssessment              *bool
 	}
 )
 
diff --git a/pkg/docgen/soa_template.html b/pkg/docgen/soa_template.html
index 9ed432344..f52293306 100644
--- a/pkg/docgen/soa_template.html
+++ b/pkg/docgen/soa_template.html
@@ -297,15 +297,17 @@
                 <tr>
                     <th rowspan="2" style="width: 12%;">Framework</th>
                     <th rowspan="2" style="width: 24%;">Control</th>
-                    <th rowspan="2" style="width: 9%;">Applicability</th>
-                    <th rowspan="2" style="width: 17%;">Justification</th>
-                    <th colspan="4" style="width: 38%; text-align: center;">Justification for inclusion</th>
+                    <th rowspan="2" style="width: 8%;">Applicability</th>
+                    <th rowspan="2" style="width: 14%;">Justification for non-applicability</th>
+                    <th rowspan="2" style="width: 8%;">Implemented</th>
+                    <th rowspan="2" style="width: 10%;">Justification for non-implementation</th>
+                    <th colspan="4" style="width: 24%; text-align: center;">Justification for inclusion</th>
                 </tr>
                 <tr>
-                    <th style="width: 8%;">Regulatory</th>
-                    <th style="width: 8%;">Contractual</th>
-                    <th style="width: 10%;">Best Practice</th>
-                    <th style="width: 12%;">Risk Assessment</th>
+                    <th style="width: 6%;">Regulatory</th>
+                    <th style="width: 6%;">Contractual</th>
+                    <th style="width: 6%;">Best Practice</th>
+                    <th style="width: 6%;">Risk Assessment</th>
                 </tr>
             </thead>
             <tbody>
@@ -325,12 +327,37 @@
                             {{- end}}
                         </td>
                         <td>
-                            {{- if .Justification}}
+                            {{- $appStateJ := boolToYesNo .Applicability}}
+                            {{- if and (eq $appStateJ "no") .Justification}}
                             {{.Justification}}
                             {{- else}}
                             -
                             {{- end}}
                         </td>
+                        <td>
+                            {{- $appState := boolToYesNo .Applicability}}
+                            {{- if eq $appState "no"}}
+                            <span class="state-tag">-</span>
+                            {{- else if .Implemented}}
+                            {{- if eq (derefString .Implemented) "IMPLEMENTED"}}
+                            <span class="state-tag state-tag-success">Yes</span>
+                            {{- else}}
+                            <span class="state-tag state-tag-danger">No</span>
+                            {{- end}}
+                            {{- else}}
+                            <span class="state-tag">-</span>
+                            {{- end}}
+                        </td>
+                        <td>
+                            {{- $appState2 := boolToYesNo .Applicability}}
+                            {{- if eq $appState2 "no"}}
+                            -
+                            {{- else if and .Implemented (eq (derefString .Implemented) "NOT_IMPLEMENTED") .NotImplementedJustification}}
+                            {{.NotImplementedJustification}}
+                            {{- else}}
+                            -
+                            {{- end}}
+                        </td>
                         <td>{{boolToYesNoDash .Regulatory}}</td>
                         <td>{{boolToYesNoDash .Contractual}}</td>
                         <td>{{boolToYesNoDash .BestPractice}}</td>
@@ -383,7 +410,7 @@
         </div>
 
         <div class="annex-section">
-            <div class="annex-subsection-title">Justification</div>
+            <div class="annex-subsection-title">Justification for non-applicability</div>
             <ul class="annex-enum-list">
                 <li class="annex-enum-item">
                     <span class="annex-enum-description">Provides the rationale when a control is not applicable. This field is empty for applicable controls.</span>
@@ -391,6 +418,33 @@
             </ul>
         </div>
 
+        <div class="annex-section">
+            <div class="annex-subsection-title">Implemented</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">Yes:</span>
+                    <span class="annex-enum-description">The control has been implemented by the organization.</span>
+                </li>
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">No:</span>
+                    <span class="annex-enum-description">The control has not been implemented (with justification provided).</span>
+                </li>
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">-:</span>
+                    <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Justification for non-implementation</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">Provides the rationale when a control is not implemented. This field is empty for implemented controls or when the control is not applicable.</span>
+                </li>
+            </ul>
+        </div>
+
         <div class="annex-section">
             <div class="annex-subsection-title">Justification for inclusion</div>
             <div class="annex-enum-description" style="margin-bottom: 12px;">
diff --git a/pkg/probo/control_service.go b/pkg/probo/control_service.go
index 1febd288c..3085913ae 100644
--- a/pkg/probo/control_service.go
+++ b/pkg/probo/control_service.go
@@ -32,20 +32,24 @@ type (
 	}
 
 	CreateControlRequest struct {
-		ID           gid.GID
-		FrameworkID  gid.GID
-		Name         string
-		Description  *string
-		SectionTitle string
-		BestPractice bool
+		ID                          gid.GID
+		FrameworkID                 gid.GID
+		Name                        string
+		Description                 *string
+		SectionTitle                string
+		BestPractice                bool
+		Implemented                 coredata.ControlImplementationState
+		NotImplementedJustification *string
 	}
 
 	UpdateControlRequest struct {
-		ID           gid.GID
-		Name         *string
-		Description  **string
-		SectionTitle *string
-		BestPractice *bool
+		ID                          gid.GID
+		Name                        *string
+		Description                 **string
+		SectionTitle                *string
+		BestPractice                *bool
+		Implemented                 *coredata.ControlImplementationState
+		NotImplementedJustification **string
 	}
 )
 
@@ -56,6 +60,17 @@ func (ccr *CreateControlRequest) Validate() error {
 	v.Check(ccr.Name, "name", validator.Required(), validator.SafeTextNoNewLine(TitleMaxLength))
 	v.Check(ccr.Description, "description", validator.Required(), validator.SafeText(ContentMaxLength))
 	v.Check(ccr.SectionTitle, "section_title", validator.Required(), validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(ccr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
+
+	v.Check(
+		ccr.Implemented,
+		"implemented",
+		validator.Required(),
+		validator.OneOfSlice([]string{
+			string(coredata.ControlImplementationStateImplemented),
+			string(coredata.ControlImplementationStateNotImplemented),
+		}),
+	)
 
 	return v.Error()
 }
@@ -67,6 +82,15 @@ func (ucr *UpdateControlRequest) Validate() error {
 	v.Check(ucr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
 	v.Check(ucr.Description, "description", validator.SafeText(ContentMaxLength))
 	v.Check(ucr.SectionTitle, "section_title", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(ucr.NotImplementedJustification, "not_implemented_justification", validator.SafeText(ContentMaxLength))
+	v.Check(
+		ucr.Implemented,
+		"implemented",
+		validator.OneOfSlice([]string{
+			string(coredata.ControlImplementationStateImplemented),
+			string(coredata.ControlImplementationStateNotImplemented),
+		}),
+	)
 
 	return v.Error()
 }
@@ -830,15 +854,22 @@ func (s ControlService) Create(
 	now := time.Now()
 	framework := &coredata.Framework{}
 
+	notImplementedJustification := req.NotImplementedJustification
+	if req.Implemented == coredata.ControlImplementationStateImplemented {
+		notImplementedJustification = nil
+	}
+
 	control := &coredata.Control{
-		ID:           gid.New(s.svc.scope.GetTenantID(), coredata.ControlEntityType),
-		FrameworkID:  req.FrameworkID,
-		Name:         req.Name,
-		Description:  req.Description,
-		SectionTitle: req.SectionTitle,
-		BestPractice: req.BestPractice,
-		CreatedAt:    now,
-		UpdatedAt:    now,
+		ID:                          gid.New(s.svc.scope.GetTenantID(), coredata.ControlEntityType),
+		FrameworkID:                 req.FrameworkID,
+		Name:                        req.Name,
+		Description:                 req.Description,
+		SectionTitle:                req.SectionTitle,
+		BestPractice:                req.BestPractice,
+		Implemented:                 req.Implemented,
+		NotImplementedJustification: notImplementedJustification,
+		CreatedAt:                   now,
+		UpdatedAt:                   now,
 	}
 
 	err := s.svc.pg.WithTx(
@@ -915,6 +946,17 @@ func (s ControlService) Update(
 				control.BestPractice = *req.BestPractice
 			}
 
+			if req.Implemented != nil {
+				control.Implemented = *req.Implemented
+				if *req.Implemented == coredata.ControlImplementationStateImplemented {
+					control.NotImplementedJustification = nil
+				}
+			}
+
+			if req.NotImplementedJustification != nil && control.Implemented == coredata.ControlImplementationStateNotImplemented {
+				control.NotImplementedJustification = *req.NotImplementedJustification
+			}
+
 			control.UpdatedAt = time.Now()
 
 			return control.Update(ctx, conn, s.svc.scope)
diff --git a/pkg/probo/framework_service.go b/pkg/probo/framework_service.go
index 8358536e8..50b4aefa8 100644
--- a/pkg/probo/framework_service.go
+++ b/pkg/probo/framework_service.go
@@ -68,10 +68,12 @@ type (
 				Dark  string `json:"dark"`
 			} `json:"logo,omitempty"`
 			Controls []struct {
-				ID           string `json:"id"`
-				Name         string `json:"name"`
-				Description  string `json:"description"`
-				BestPractice *bool  `json:"best_practice,omitempty"`
+				ID                          string  `json:"id"`
+				Name                        string  `json:"name"`
+				Description                 string  `json:"description"`
+				BestPractice                *bool   `json:"best_practice,omitempty"`
+				Implemented                 string  `json:"implemented,omitempty"`
+				NotImplementedJustification *string `json:"not_implemented_justification,omitempty"`
 			} `json:"controls"`
 		}
 	}
@@ -573,16 +575,26 @@ func (s FrameworkService) Import(
 			if control.BestPractice != nil {
 				bestPractice = *control.BestPractice
 			}
+			implemented := coredata.ControlImplementationState(control.Implemented)
+			if !implemented.IsValid() {
+				implemented = coredata.ControlImplementationStateImplemented
+			}
+			var notImplementedJustification *string
+			if implemented == coredata.ControlImplementationStateNotImplemented {
+				notImplementedJustification = control.NotImplementedJustification
+			}
 			control := &coredata.Control{
-				ID:             controlID,
-				FrameworkID:    frameworkID,
-				OrganizationID: organization.ID,
-				SectionTitle:   control.ID,
-				Name:           control.Name,
-				Description:    &description,
-				BestPractice:   bestPractice,
-				CreatedAt:      now,
-				UpdatedAt:      now,
+				ID:                          controlID,
+				FrameworkID:                 frameworkID,
+				OrganizationID:              organization.ID,
+				SectionTitle:                control.ID,
+				Name:                        control.Name,
+				Description:                 &description,
+				BestPractice:                bestPractice,
+				Implemented:                 implemented,
+				NotImplementedJustification: notImplementedJustification,
+				CreatedAt:                   now,
+				UpdatedAt:                   now,
 			}
 
 			if err := control.Insert(ctx, tx, s.svc.scope); err != nil {
diff --git a/pkg/probo/state_of_applicability_service.go b/pkg/probo/state_of_applicability_service.go
index 39d2fac97..9146c9e9c 100644
--- a/pkg/probo/state_of_applicability_service.go
+++ b/pkg/probo/state_of_applicability_service.go
@@ -569,15 +569,23 @@ func (s StateOfApplicabilityService) ExportPDF(
 
 				applicability := stmt.Applicability
 
+				implemented := control.Implemented.String()
 				frameworkControlsMap[framework.Name] = append(
 					frameworkControlsMap[framework.Name],
 					docgen.ControlData{
-						FrameworkName:  framework.Name,
-						SectionTitle:   control.SectionTitle,
-						Name:           control.Name,
-						Applicability:  &applicability,
-						Justification:  stmt.Justification,
-						BestPractice:   bestPractice,
+						FrameworkName: framework.Name,
+						SectionTitle:  control.SectionTitle,
+						Name:          control.Name,
+						Applicability: &applicability,
+						Justification: stmt.Justification,
+						BestPractice:  bestPractice,
+						Implemented:   &implemented,
+						NotImplementedJustification: func() *string {
+							if control.Implemented == coredata.ControlImplementationStateImplemented {
+								return nil
+							}
+							return control.NotImplementedJustification
+						}(),
 						Regulatory:     regulatory,
 						Contractual:    contractual,
 						RiskAssessment: riskAssessment,
diff --git a/pkg/server/api/console/v1/schema.graphql b/pkg/server/api/console/v1/schema.graphql
index 006b1c51d..858797c10 100644
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -127,6 +127,20 @@ enum TrustCenterVisibility
         )
 }
 
+enum ControlImplementationState
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ControlImplementationState"
+    ) {
+    IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateImplemented"
+        )
+    NOT_IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateNotImplemented"
+        )
+}
+
 enum TrustCenterDocumentAccessStatus
     @goModel(
         model: "go.probo.inc/probo/pkg/coredata.TrustCenterDocumentAccessStatus"
@@ -2221,6 +2235,8 @@ type Control implements Node {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
     regulatory: Boolean! @goField(forceResolver: true)
     contractual: Boolean! @goField(forceResolver: true)
     riskAssessment: Boolean! @goField(forceResolver: true)
@@ -4468,6 +4484,8 @@ input CreateControlInput {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
 }
 
 input UpdateControlInput {
@@ -4476,6 +4494,8 @@ input UpdateControlInput {
     name: String
     description: String @goField(omittable: true)
     bestPractice: Boolean
+    implemented: ControlImplementationState
+    notImplementedJustification: String @goField(omittable: true)
 }
 
 input DeleteControlInput {
diff --git a/pkg/server/api/console/v1/types/control.go b/pkg/server/api/console/v1/types/control.go
index b36c89b8d..6e8235884 100644
--- a/pkg/server/api/console/v1/types/control.go
+++ b/pkg/server/api/console/v1/types/control.go
@@ -57,11 +57,13 @@ func NewControl(control *coredata.Control) *Control {
 		Framework: &Framework{
 			ID: control.FrameworkID,
 		},
-		SectionTitle: control.SectionTitle,
-		Name:         control.Name,
-		Description:  control.Description,
-		BestPractice: control.BestPractice,
-		CreatedAt:    control.CreatedAt,
-		UpdatedAt:    control.UpdatedAt,
+		SectionTitle:                control.SectionTitle,
+		Name:                        control.Name,
+		Description:                 control.Description,
+		BestPractice:                control.BestPractice,
+		Implemented:                 control.Implemented,
+		NotImplementedJustification: control.NotImplementedJustification,
+		CreatedAt:                   control.CreatedAt,
+		UpdatedAt:                   control.UpdatedAt,
 	}
 }
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 9e8e985ca..a89e78466 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -2945,11 +2945,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 	control, err := prb.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
-			FrameworkID:  input.FrameworkID,
-			Name:         input.Name,
-			Description:  input.Description,
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			FrameworkID:                 input.FrameworkID,
+			Name:                        input.Name,
+			Description:                 input.Description,
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: input.NotImplementedJustification,
 		},
 	)
 	if err != nil {
@@ -2977,11 +2979,13 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 	control, err := prb.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
-			ID:           input.ID,
-			Name:         input.Name,
-			Description:  gqlutils.UnwrapOmittable(input.Description),
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			ID:                          input.ID,
+			Name:                        input.Name,
+			Description:                 gqlutils.UnwrapOmittable(input.Description),
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
 		},
 	)
 
diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go
index 5881f0622..650763719 100644
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -1550,10 +1550,13 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
 	control, err := svc.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
-			FrameworkID:  input.FrameworkID,
-			Name:         input.Name,
-			Description:  input.Description,
-			SectionTitle: input.SectionTitle,
+			FrameworkID:                 input.FrameworkID,
+			Name:                        input.Name,
+			Description:                 input.Description,
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 coredata.ControlImplementationState(input.Implemented),
+			NotImplementedJustification: input.NotImplementedJustification,
 		},
 	)
 	if err != nil {
@@ -1570,13 +1573,22 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
 
 	svc := r.ProboService(ctx, input.ID)
 
+	var implemented *coredata.ControlImplementationState
+	if input.Implemented != nil {
+		v := coredata.ControlImplementationState(*input.Implemented)
+		implemented = &v
+	}
+
 	control, err := svc.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
-			ID:           input.ID,
-			Name:         input.Name,
-			Description:  UnwrapOmittable(input.Description),
-			SectionTitle: input.SectionTitle,
+			ID:                          input.ID,
+			Name:                        input.Name,
+			Description:                 UnwrapOmittable(input.Description),
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 implemented,
+			NotImplementedJustification: UnwrapOmittable(input.NotImplementedJustification),
 		},
 	)
 	if err != nil {
diff --git a/pkg/server/api/mcp/v1/specification.yaml b/pkg/server/api/mcp/v1/specification.yaml
index 197d225fc..e8157c470 100644
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -4219,6 +4219,8 @@ components:
         - framework_id
         - section_title
         - name
+        - best_practice
+        - implemented
         - created_at
         - updated_at
       properties:
@@ -4242,6 +4244,19 @@ components:
             - string
             - "null"
           description: Control description
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type:
+            - string
+            - "null"
+          description: Justification for non-implementation
         created_at:
           type: string
           format: date-time
@@ -4315,6 +4330,8 @@ components:
         - framework_id
         - section_title
         - name
+        - best_practice
+        - implemented
       properties:
         organization_id:
           $ref: "#/components/schemas/GID"
@@ -4331,6 +4348,19 @@ components:
         description:
           type: string
           description: Control description
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type:
+            - string
+            - "null"
+          description: Justification for non-implementation
 
     AddControlOutput:
       type: object
@@ -4358,6 +4388,18 @@ components:
           type: ["string", "null"]
           description: Control description
           go.probo.inc/mcpgen/omittable: true
+        best_practice:
+          type: boolean
+          description: Whether control is a best practice
+        implemented:
+          type: string
+          enum: [IMPLEMENTED, NOT_IMPLEMENTED]
+          description: Control implementation state
+          go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ControlImplementationState
+        not_implemented_justification:
+          type: ["string", "null"]
+          description: Justification for non-implementation
+          go.probo.inc/mcpgen/omittable: true
 
     UpdateControlOutput:
       type: object
diff --git a/pkg/server/api/mcp/v1/types/control.go b/pkg/server/api/mcp/v1/types/control.go
index 104c83880..83f519eff 100644
--- a/pkg/server/api/mcp/v1/types/control.go
+++ b/pkg/server/api/mcp/v1/types/control.go
@@ -20,14 +20,17 @@ import (
 
 func NewControl(c *coredata.Control) *Control {
 	return &Control{
-		ID:             c.ID,
-		OrganizationID: c.OrganizationID,
-		SectionTitle:   c.SectionTitle,
-		FrameworkID:    c.FrameworkID,
-		Name:           c.Name,
-		Description:    c.Description,
-		CreatedAt:      c.CreatedAt,
-		UpdatedAt:      c.UpdatedAt,
+		ID:                          c.ID,
+		OrganizationID:              c.OrganizationID,
+		SectionTitle:                c.SectionTitle,
+		FrameworkID:                 c.FrameworkID,
+		Name:                        c.Name,
+		Description:                 c.Description,
+		BestPractice:                c.BestPractice,
+		Implemented:                 ControlImplemented(c.Implemented),
+		NotImplementedJustification: c.NotImplementedJustification,
+		CreatedAt:                   c.CreatedAt,
+		UpdatedAt:                   c.UpdatedAt,
 	}
 }