diff --git a/apps/console/src/components/__generated__/SnapshotBannerQuery.graphql.ts b/apps/console/src/components/__generated__/SnapshotBannerQuery.graphql.ts
index ca9633707..42d8cfdec 100644
--- a/apps/console/src/components/__generated__/SnapshotBannerQuery.graphql.ts
+++ b/apps/console/src/components/__generated__/SnapshotBannerQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<c2504ebd6a90f696d2068c03294d0c53>>
+ * @generated SignedSource<<a62993ad367f0d977f346e507dd6b572>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type SnapshotBannerQuery$variables = {
   snapshotId: string;
 };
diff --git a/apps/console/src/components/form/StateOfApplicabilityControlsField.tsx b/apps/console/src/components/form/StateOfApplicabilityControlsField.tsx
new file mode 100644
index 000000000..e37ff243d
--- /dev/null
+++ b/apps/console/src/components/form/StateOfApplicabilityControlsField.tsx
@@ -0,0 +1,518 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Field,
+  Select,
+  Option,
+  Checkbox,
+  Textarea,
+  Spinner,
+  Button,
+  IconChevronDown,
+  IconChevronUp,
+  IconTrashCan,
+  IconPlusLarge,
+} from "@probo/ui";
+import { Suspense, useState, useMemo, useEffect } from "react";
+import { Controller, type Control, type UseFormSetValue, type FieldValues, type Path, type PathValue } from "react-hook-form";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "relay-runtime";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { StateOfApplicabilityControlsFieldFrameworksQuery } from "./__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql";
+import type { StateOfApplicabilityControlsFieldFrameworkControlsQuery } from "./__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql";
+
+const frameworksQuery = graphql`
+  query StateOfApplicabilityControlsFieldFrameworksQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        frameworks(first: 100) {
+          edges {
+            node {
+              id
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+const frameworkControlsQuery = graphql`
+  query StateOfApplicabilityControlsFieldFrameworkControlsQuery(
+    $frameworkId: ID!
+  ) {
+    framework: node(id: $frameworkId) {
+      ... on Framework {
+        id
+        controls(first: 500, orderBy: { field: SECTION_TITLE, direction: ASC }) {
+          edges {
+            node {
+              id
+              sectionTitle
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+type ControlSelection = {
+  controlId: string;
+  state: "EXCLUDED" | "IMPLEMENTED" | "NOT_IMPLEMENTED";
+  exclusionJustification?: string;
+};
+
+type FrameworkData = {
+  id: string;
+  name: string;
+  controls: Array<{
+    id: string;
+    sectionTitle: string;
+    name: string;
+  }>;
+};
+
+type Props<T extends FieldValues = FieldValues> = {
+  control: Control<T>;
+  setValue: UseFormSetValue<T>;
+  name: string;
+  initialControls?: ControlSelection[];
+  initialFrameworkIds?: Set<string>;
+};
+
+export function StateOfApplicabilityControlsField<T extends FieldValues = FieldValues>({ control, setValue, name, initialControls, initialFrameworkIds }: Props<T>) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+
+  // Initialize form value with initialControls
+  useEffect(() => {
+    if (initialControls && initialControls.length > 0) {
+      setValue(name as Path<T>, initialControls as PathValue<T, Path<T>>);
+    }
+  }, [initialControls, setValue, name]);
+
+  // Initialize framework selection from initialFrameworkIds
+  const [selectedFrameworkIds, setSelectedFrameworkIds] = useState<Set<string>>(initialFrameworkIds || new Set());
+  const [expandedFrameworks, setExpandedFrameworks] = useState<Set<string>>(initialFrameworkIds || new Set());
+  const [frameworkDataMap, setFrameworkDataMap] = useState<Map<string, FrameworkData>>(new Map());
+  const [newFrameworkId, setNewFrameworkId] = useState<string>("");
+
+  // Update framework selection when initialFrameworkIds changes
+  useEffect(() => {
+    if (initialFrameworkIds) {
+      setSelectedFrameworkIds(initialFrameworkIds);
+      setExpandedFrameworks(initialFrameworkIds);
+    }
+  }, [initialFrameworkIds]);
+
+  const addFramework = (frameworkId: string) => {
+    if (!frameworkId || selectedFrameworkIds.has(frameworkId)) return;
+    setSelectedFrameworkIds(new Set([...selectedFrameworkIds, frameworkId]));
+    setExpandedFrameworks(new Set([...expandedFrameworks, frameworkId]));
+    setNewFrameworkId("");
+  };
+
+  const removeFramework = (frameworkId: string) => {
+    const newSet = new Set(selectedFrameworkIds);
+    newSet.delete(frameworkId);
+    setSelectedFrameworkIds(newSet);
+
+    const newExpanded = new Set(expandedFrameworks);
+    newExpanded.delete(frameworkId);
+    setExpandedFrameworks(newExpanded);
+
+    const newMap = new Map(frameworkDataMap);
+    newMap.delete(frameworkId);
+    setFrameworkDataMap(newMap);
+  };
+
+  const toggleFramework = (frameworkId: string) => {
+    const newExpanded = new Set(expandedFrameworks);
+    if (newExpanded.has(frameworkId)) {
+      newExpanded.delete(frameworkId);
+    } else {
+      newExpanded.add(frameworkId);
+    }
+    setExpandedFrameworks(newExpanded);
+  };
+
+  return (
+    <div className="space-y-4">
+      <div>
+        <h4 className="font-medium text-txt-primary mb-4">
+          {__("Select Controls")}
+        </h4>
+
+        <div className="space-y-3">
+          <Field label={__("Add Framework")}>
+            <Suspense fallback={<Select variant="editor" disabled placeholder={__("Loading...")} />}>
+              <FrameworkSelect
+                organizationId={organizationId}
+                selectedFrameworkIds={selectedFrameworkIds}
+                value={newFrameworkId}
+                onValueChange={setNewFrameworkId}
+                onAdd={addFramework}
+              />
+            </Suspense>
+          </Field>
+
+          {Array.from(selectedFrameworkIds).map((frameworkId) => (
+            <Suspense
+              key={frameworkId}
+              fallback={
+                <div className="flex items-center justify-center py-8">
+                  <Spinner />
+                </div>
+              }
+            >
+              <FrameworkSection
+                frameworkId={frameworkId}
+                isExpanded={expandedFrameworks.has(frameworkId)}
+                onToggle={() => toggleFramework(frameworkId)}
+                onRemove={() => removeFramework(frameworkId)}
+                control={control}
+                name={name}
+                frameworkDataMap={frameworkDataMap}
+                setFrameworkDataMap={setFrameworkDataMap}
+              />
+            </Suspense>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function FrameworkSelect({
+  organizationId,
+  selectedFrameworkIds,
+  value,
+  onValueChange,
+  onAdd,
+}: {
+  organizationId: string;
+  selectedFrameworkIds: Set<string>;
+  value: string;
+  onValueChange: (value: string) => void;
+  onAdd: (frameworkId: string) => void;
+}) {
+  const { __ } = useTranslate();
+  const data = useLazyLoadQuery<StateOfApplicabilityControlsFieldFrameworksQuery>(
+    frameworksQuery,
+    { organizationId },
+    { fetchPolicy: "network-only" }
+  );
+  const frameworks: Array<{ id: string; name: string }> =
+    (data?.organization && "frameworks" in data.organization && data.organization.frameworks?.edges
+      ?.map((edge) => edge.node)
+      .filter((node): node is NonNullable<typeof node> => node !== null)) || [];
+
+  const availableFrameworks = frameworks.filter(
+    (framework: { id: string; name: string }) => !selectedFrameworkIds.has(framework.id)
+  );
+
+  return (
+    <div className="flex gap-2">
+      <Select
+        variant="editor"
+        placeholder={__("Select a framework")}
+        onValueChange={onValueChange}
+        value={value}
+        className="flex-1"
+      >
+        {availableFrameworks.map((framework: { id: string; name: string }) => (
+          <Option key={framework.id} value={framework.id}>
+            {framework.name}
+          </Option>
+        ))}
+      </Select>
+      <Button
+        type="button"
+        variant="secondary"
+        icon={IconPlusLarge}
+        onClick={() => onAdd(value)}
+        disabled={!value || selectedFrameworkIds.has(value)}
+      >
+        {__("Add")}
+      </Button>
+    </div>
+  );
+}
+
+function FrameworkSection<T extends FieldValues = FieldValues>({
+  frameworkId,
+  isExpanded,
+  onToggle,
+  onRemove,
+  control,
+  name,
+  frameworkDataMap,
+  setFrameworkDataMap,
+}: {
+  frameworkId: string;
+  isExpanded: boolean;
+  onToggle: () => void;
+  onRemove: () => void;
+  control: Control<T>;
+  name: string;
+  frameworkDataMap: Map<string, FrameworkData>;
+  setFrameworkDataMap: React.Dispatch<React.SetStateAction<Map<string, FrameworkData>>>;
+}) {
+  const { __ } = useTranslate();
+  const data = useLazyLoadQuery<StateOfApplicabilityControlsFieldFrameworkControlsQuery>(
+    frameworkControlsQuery,
+    { frameworkId },
+    { fetchPolicy: "network-only" }
+  );
+
+  const framework = data?.framework && "controls" in data.framework ? data.framework : null;
+  const frameworkName: string = framework && "name" in framework && typeof framework.name === "string" ? framework.name : "";
+  const controls: Array<{ id: string; sectionTitle: string; name: string }> = useMemo(
+    () =>
+      (framework?.controls?.edges
+        ?.map((edge) => edge.node)
+        .filter((node): node is NonNullable<typeof node> => node !== null)) ?? [],
+    [framework]
+  );
+
+  useEffect(() => {
+    if (framework && !frameworkDataMap.has(frameworkId)) {
+      setFrameworkDataMap((prev) => {
+        const newMap = new Map(prev);
+        newMap.set(frameworkId, {
+          id: frameworkId,
+          name: frameworkName,
+          controls,
+        });
+        return newMap;
+      });
+    }
+  }, [framework, frameworkId, frameworkName, controls, frameworkDataMap, setFrameworkDataMap]);
+
+  const cachedData = frameworkDataMap.get(frameworkId);
+  const displayName: string = cachedData?.name || frameworkName;
+  const displayControls: Array<{ id: string; sectionTitle: string; name: string }> = cachedData?.controls || controls;
+
+  return (
+    <div className="border border-border-low rounded-lg">
+      <div className="flex items-center justify-between p-4">
+        <button
+          type="button"
+          onClick={onToggle}
+          className="flex items-center gap-2 flex-1 text-left hover:bg-subtle -m-4 p-4 rounded-lg"
+        >
+          {isExpanded ? (
+            <IconChevronUp size={16} className="text-txt-tertiary" />
+          ) : (
+            <IconChevronDown size={16} className="text-txt-tertiary" />
+          )}
+          <span className="font-medium text-txt-primary">{displayName}</span>
+          <span className="text-sm text-txt-tertiary">
+            ({displayControls.length} {__("controls")})
+          </span>
+        </button>
+        <Button
+          type="button"
+          variant="secondary"
+          icon={IconTrashCan}
+          onClick={onRemove}
+          className="ml-2"
+        >
+          {__("Remove")}
+        </Button>
+      </div>
+
+      {isExpanded && (
+        <div className="border-t border-border-low">
+          <Controller
+            control={control}
+            name={name as Path<T>}
+            render={({ field }) => {
+              const selectedControls: ControlSelection[] = (Array.isArray(field.value) ? field.value : []) as ControlSelection[];
+              const selectedControlIds = new Set(
+                selectedControls.map((c: ControlSelection) => c.controlId)
+              );
+
+              const toggleControl = (controlId: string) => {
+                const isSelected = selectedControlIds.has(controlId);
+                if (isSelected) {
+                  field.onChange(
+                    selectedControls.filter((c: ControlSelection) => c.controlId !== controlId)
+                  );
+                } else {
+                  field.onChange([
+                    ...selectedControls,
+                    {
+                      controlId,
+                      state: "IMPLEMENTED" as const,
+                      exclusionJustification: undefined,
+                    },
+                  ]);
+                }
+              };
+
+              const updateControlState = (
+                controlId: string,
+                state: "EXCLUDED" | "IMPLEMENTED" | "NOT_IMPLEMENTED"
+              ) => {
+                field.onChange(
+                  selectedControls.map((c: ControlSelection) =>
+                    c.controlId === controlId ? { ...c, state } : c
+                  )
+                );
+              };
+
+              const updateJustification = (
+                controlId: string,
+                exclusionJustification: string
+              ) => {
+                field.onChange(
+                  selectedControls.map((c: ControlSelection) =>
+                    c.controlId === controlId
+                      ? { ...c, exclusionJustification }
+                      : c
+                  )
+                );
+              };
+
+              const getControlState = (controlId: string) => {
+                const selected = selectedControls.find((c: ControlSelection) => c.controlId === controlId);
+                return selected?.state || "IMPLEMENTED";
+              };
+
+              const getExclusionJustification = (controlId: string) => {
+                const selected = selectedControls.find((c: ControlSelection) => c.controlId === controlId);
+                return selected?.exclusionJustification || "";
+              };
+
+              const selectAll = () => {
+                const newSelectedControls: ControlSelection[] = [...selectedControls];
+                displayControls.forEach((ctrl) => {
+                  if (!selectedControlIds.has(ctrl.id)) {
+                    newSelectedControls.push({
+                      controlId: ctrl.id,
+                      state: "IMPLEMENTED" as const,
+                      exclusionJustification: undefined,
+                    });
+                  }
+                });
+                field.onChange(newSelectedControls);
+              };
+
+              const deselectAll = () => {
+                const controlIdsToRemove = new Set(displayControls.map((ctrl) => ctrl.id));
+                const newSelectedControls = selectedControls.filter(
+                  (c: ControlSelection) => !controlIdsToRemove.has(c.controlId)
+                );
+                field.onChange(newSelectedControls);
+              };
+
+              const allSelected = displayControls.length > 0 && displayControls.every((ctrl) => selectedControlIds.has(ctrl.id));
+
+              return (
+                <div className="p-4 space-y-4">
+                  {displayControls.length > 0 && (
+                    <div className="flex justify-end">
+                      <Button
+                        type="button"
+                        variant="quaternary"
+                        onClick={allSelected ? deselectAll : selectAll}
+                        className="text-xs h-7 min-h-7"
+                      >
+                        {allSelected ? __("Deselect All") : __("Select All")}
+                      </Button>
+                    </div>
+                  )}
+                  <div className="border border-border-low rounded-lg max-h-96 overflow-y-auto">
+                    {displayControls.length === 0 ? (
+                      <div className="p-4 text-center text-txt-tertiary">
+                        {__("No controls found in this framework")}
+                      </div>
+                    ) : (
+                      <div className="divide-y divide-border-low">
+                        {displayControls.map((ctrl) => {
+                          const isSelected = selectedControlIds.has(ctrl.id);
+                          const state = getControlState(ctrl.id);
+                          const exclusionJustification = getExclusionJustification(
+                            ctrl.id
+                          );
+
+                          return (
+                            <div key={ctrl.id} className="p-4 space-y-3">
+                              <div className="flex items-start gap-3">
+                                <Checkbox
+                                  checked={isSelected}
+                                  onChange={() => toggleControl(ctrl.id)}
+                                />
+                                <div className="flex-1 min-w-0">
+                                  <div className="font-medium">
+                                    {ctrl.sectionTitle}: {ctrl.name}
+                                  </div>
+                                </div>
+                              </div>
+
+                              {isSelected && (
+                                <div className="ml-7 space-y-2">
+                                  <Field label={__("State")}>
+                                    <Select
+                                      variant="editor"
+                                      value={state}
+                                      onValueChange={(value) =>
+                                        updateControlState(
+                                          ctrl.id,
+                                          value as
+                                            | "EXCLUDED"
+                                            | "IMPLEMENTED"
+                                            | "NOT_IMPLEMENTED"
+                                        )
+                                      }
+                                      className="w-full"
+                                    >
+                                      <Option value="IMPLEMENTED">
+                                        {__("Implemented")}
+                                      </Option>
+                                      <Option value="NOT_IMPLEMENTED">
+                                        {__("Not Implemented")}
+                                      </Option>
+                                      <Option value="EXCLUDED">
+                                        {__("Excluded")}
+                                      </Option>
+                                    </Select>
+                                  </Field>
+
+                                  {state === "EXCLUDED" || state === "NOT_IMPLEMENTED" && (
+                                    <Field label={__("Justification")}>
+                                      <Textarea
+                                        value={exclusionJustification}
+                                        onChange={(e) =>
+                                          updateJustification(
+                                            ctrl.id,
+                                            e.target.value
+                                          )
+                                        }
+                                        placeholder={__(
+                                          "Reason for exclusion"
+                                        )}
+                                        autogrow
+                                      />
+                                    </Field>
+                                  )}
+                                </div>
+                              )}
+                            </div>
+                          );
+                        })}
+                      </div>
+                    )}
+                  </div>
+                </div>
+              );
+            }}
+          />
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql.ts b/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql.ts
new file mode 100644
index 000000000..5ce820261
--- /dev/null
+++ b/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworkControlsQuery.graphql.ts
@@ -0,0 +1,197 @@
+/**
+ * @generated SignedSource<<760a4c9ef58d487ab996d36a6cf1aa21>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery$variables = {
+  frameworkId: string;
+};
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery$data = {
+  readonly framework: {
+    readonly controls?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+          readonly sectionTitle: string;
+        };
+      }>;
+    };
+    readonly id?: string;
+  };
+};
+export type StateOfApplicabilityControlsFieldFrameworkControlsQuery = {
+  response: StateOfApplicabilityControlsFieldFrameworkControlsQuery$data;
+  variables: StateOfApplicabilityControlsFieldFrameworkControlsQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "frameworkId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "frameworkId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "first",
+      "value": 500
+    },
+    {
+      "kind": "Literal",
+      "name": "orderBy",
+      "value": {
+        "direction": "ASC",
+        "field": "SECTION_TITLE"
+      }
+    }
+  ],
+  "concreteType": "ControlConnection",
+  "kind": "LinkedField",
+  "name": "controls",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "ControlEdge",
+      "kind": "LinkedField",
+      "name": "edges",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "Control",
+          "kind": "LinkedField",
+          "name": "node",
+          "plural": false,
+          "selections": [
+            (v2/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "sectionTitle",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "name",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": "controls(first:500,orderBy:{\"direction\":\"ASC\",\"field\":\"SECTION_TITLE\"})"
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "selections": [
+      {
+        "alias": "framework",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/)
+            ],
+            "type": "Framework",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "selections": [
+      {
+        "alias": "framework",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/)
+            ],
+            "type": "Framework",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "4e57853f9452f6167ef9dd2521f0b998",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsFieldFrameworkControlsQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsFieldFrameworkControlsQuery(\n  $frameworkId: ID!\n) {\n  framework: node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      controls(first: 500, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n        edges {\n          node {\n            id\n            sectionTitle\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "2817a6951ce5ad1efdee9951636916ff";
+
+export default node;
diff --git a/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql.ts b/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql.ts
new file mode 100644
index 000000000..6719dccc3
--- /dev/null
+++ b/apps/console/src/components/form/__generated__/StateOfApplicabilityControlsFieldFrameworksQuery.graphql.ts
@@ -0,0 +1,172 @@
+/**
+ * @generated SignedSource<<09147ad036a4ae9295cd5fc5242f6ee7>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityControlsFieldFrameworksQuery$variables = {
+  organizationId: string;
+};
+export type StateOfApplicabilityControlsFieldFrameworksQuery$data = {
+  readonly organization: {
+    readonly frameworks?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+        };
+      }>;
+    };
+  };
+};
+export type StateOfApplicabilityControlsFieldFrameworksQuery = {
+  response: StateOfApplicabilityControlsFieldFrameworksQuery$data;
+  variables: StateOfApplicabilityControlsFieldFrameworksQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 100
+        }
+      ],
+      "concreteType": "FrameworkConnection",
+      "kind": "LinkedField",
+      "name": "frameworks",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "FrameworkEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "Framework",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": "frameworks(first:100)"
+    }
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v3/*: any*/),
+          (v2/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "88fe75a1aeca2c9971693ed79bf82afe",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsFieldFrameworksQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsFieldFrameworksQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      frameworks(first: 100) {\n        edges {\n          node {\n            id\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "5a0adc0c46445f40980fdb8edb8122ce";
+
+export default node;
diff --git a/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsCardFragment.graphql.ts b/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsCardFragment.graphql.ts
index 1e7a1c6b3..37f5c787e 100644
--- a/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsCardFragment.graphql.ts
+++ b/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsCardFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<0b0392559fe2c7b5b92bec1b1131f9c6>>
+ * @generated SignedSource<<18ad235cee2891b222acb016b8986050>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type LinkedSnapshotsCardFragment$data = {
   readonly createdAt: any;
diff --git a/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsDialogFragment.graphql.ts b/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsDialogFragment.graphql.ts
index 24a7d4d37..f431dac6c 100644
--- a/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsDialogFragment.graphql.ts
+++ b/apps/console/src/components/snapshots/__generated__/LinkedSnapshotsDialogFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<21edb2424074940efad82c63929642c8>>
+ * @generated SignedSource<<4b2fe0335336a1c3888d8da35ffd8e58>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type LinkedSnapshotsDialogFragment$data = {
   readonly id: string;
diff --git a/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityCard.tsx b/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityCard.tsx
new file mode 100644
index 000000000..e4cf6f14d
--- /dev/null
+++ b/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityCard.tsx
@@ -0,0 +1,248 @@
+import { graphql } from "relay-runtime";
+import {
+  Card,
+  IconPlusLarge,
+  Button,
+  Tr,
+  Td,
+  Table,
+  Thead,
+  Tbody,
+  Th,
+  IconChevronDown,
+  IconTrashCan,
+  TrButton,
+  Badge,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import type { LinkedStatesOfApplicabilityCardFragment$key } from "./__generated__/LinkedStatesOfApplicabilityCardFragment.graphql";
+import { useFragment } from "react-relay";
+import { useMemo, useState, useEffect } from "react";
+import { sprintf } from "@probo/helpers";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import { LinkedStatesOfApplicabilityDialog } from "./LinkedStatesOfApplicabilityDialog";
+import clsx from "clsx";
+
+const linkedStateOfApplicabilityFragment = graphql`
+  fragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {
+    id
+    stateOfApplicabilityId
+    controlId
+    stateOfApplicability {
+      id
+      name
+    }
+    applicability
+    justification
+  }
+`;
+
+type AttachMutation<Params> = (p: {
+  variables: {
+    input: {
+      stateOfApplicabilityId: string;
+      applicability: boolean;
+      justification: string | null;
+    } & Params;
+    connections: string[];
+  };
+}) => void;
+
+type DetachMutation = (p: {
+  variables: {
+    input: {
+      stateOfApplicabilityId: string;
+      controlId: string;
+    };
+    connections: string[];
+  };
+}) => void;
+
+type Props<Params> = {
+  statesOfApplicability: readonly (LinkedStatesOfApplicabilityCardFragment$key & { id: string })[];
+  params: Params;
+  disabled?: boolean;
+  connectionId: string;
+  onAttach: AttachMutation<Params>;
+  onDetach: DetachMutation;
+  variant?: "card" | "table";
+  readOnly?: boolean;
+};
+
+export function LinkedStatesOfApplicabilityCard<Params>(props: Props<Params>) {
+  const { __ } = useTranslate();
+
+  const [limit, setLimit] = useState<number | null>(
+    props.variant === "card" ? 4 : null
+  );
+
+  const [linkedInfo, setLinkedInfo] = useState<{ stateOfApplicabilityId: string; controlId: string }[]>([]);
+
+  const statesOfApplicability = useMemo(() => {
+    return limit ? props.statesOfApplicability.slice(0, limit) : props.statesOfApplicability;
+  }, [props.statesOfApplicability, limit]);
+
+  const showMoreButton = limit !== null && props.statesOfApplicability.length > limit;
+  const variant = props.variant ?? "table";
+
+  const linkedData = linkedInfo;
+
+  const onAttach = (stateOfApplicabilityId: string, applicability: boolean, justification: string | null) => {
+    props.onAttach({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          applicability,
+          justification,
+          ...props.params,
+        },
+        connections: [props.connectionId],
+      },
+    });
+  };
+
+  const onDetach = (stateOfApplicabilityId: string, controlId: string) => {
+    props.onDetach({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          controlId,
+        },
+        connections: [props.connectionId],
+      },
+    });
+  };
+
+  const Wrapper = variant === "card" ? Card : "div";
+
+  return (
+    <Wrapper padded className="space-y-[10px]">
+      {props.statesOfApplicability.map((soa, idx) => (
+        <LinkedInfoExtractor
+          key={idx}
+          fragment={soa}
+          onExtracted={(info) => {
+            setLinkedInfo(prev => {
+              const exists = prev.some(p =>
+                p.stateOfApplicabilityId === info.stateOfApplicabilityId &&
+                p.controlId === info.controlId
+              );
+              return exists ? prev : [...prev, info];
+            });
+          }}
+        />
+      ))}
+      {variant === "card" && (
+        <div className="flex justify-between">
+          <div className="text-lg font-semibold">{__("States of Applicability")}</div>
+          {!props.readOnly && (
+            <LinkedStatesOfApplicabilityDialog
+              connectionId={props.connectionId}
+              disabled={props.disabled}
+              linkedStatesOfApplicability={linkedData}
+              onLink={onAttach}
+              onUnlink={onDetach}
+            >
+              <Button variant="tertiary" icon={IconPlusLarge}>
+                {__("Link state of applicability")}
+              </Button>
+            </LinkedStatesOfApplicabilityDialog>
+          )}
+        </div>
+      )}
+      <Table className={clsx(variant === "card" && "bg-invert")}>
+        <Thead>
+          <Tr>
+            <Th>{__("Name")}</Th>
+            <Th>{__("Applicability")}</Th>
+            <Th>{__("Justification")}</Th>
+            {!props.readOnly && <Th></Th>}
+          </Tr>
+        </Thead>
+        <Tbody>
+          {statesOfApplicability.length === 0 && (
+            <Tr>
+              <Td colSpan={props.readOnly ? 3 : 4} className="text-center text-txt-secondary">
+                {__("No states of applicability linked")}
+              </Td>
+            </Tr>
+          )}
+          {statesOfApplicability.map((soa) => (
+            <StateOfApplicabilityRow key={soa.id} stateOfApplicability={soa} onClick={onDetach} readOnly={props.readOnly} />
+          ))}
+          {variant === "table" && !props.readOnly && (
+            <LinkedStatesOfApplicabilityDialog
+              connectionId={props.connectionId}
+              disabled={props.disabled}
+              linkedStatesOfApplicability={linkedData}
+              onLink={onAttach}
+              onUnlink={onDetach}
+            >
+              <TrButton colspan={4} icon={IconPlusLarge}>
+                {__("Link state of applicability")}
+              </TrButton>
+            </LinkedStatesOfApplicabilityDialog>
+          )}
+        </Tbody>
+      </Table>
+      {showMoreButton && (
+        <Button
+          variant="tertiary"
+          icon={IconChevronDown}
+          onClick={() => setLimit(null)}
+        >
+          {sprintf(__("Show %d more"), props.statesOfApplicability.length - limit!)}
+        </Button>
+      )}
+    </Wrapper>
+  );
+}
+
+function LinkedInfoExtractor(props: {
+  fragment: LinkedStatesOfApplicabilityCardFragment$key;
+  onExtracted: (info: { stateOfApplicabilityId: string; controlId: string }) => void;
+}) {
+  const data = useFragment(linkedStateOfApplicabilityFragment, props.fragment);
+
+  useEffect(() => {
+    props.onExtracted({
+      stateOfApplicabilityId: data.stateOfApplicabilityId,
+      controlId: data.controlId,
+    });
+  }, [data.stateOfApplicabilityId, data.controlId, props.onExtracted]);
+
+  return null;
+}
+
+function StateOfApplicabilityRow(props: {
+  stateOfApplicability: LinkedStatesOfApplicabilityCardFragment$key & { id: string };
+  onClick: (stateOfApplicabilityId: string, controlId: string) => void;
+  readOnly?: boolean;
+}) {
+  const soa = useFragment(linkedStateOfApplicabilityFragment, props.stateOfApplicability);
+  const organizationId = useOrganizationId();
+  const { __ } = useTranslate();
+
+  return (
+    <Tr to={`/organizations/${organizationId}/states-of-applicability/${soa.stateOfApplicabilityId}`}>
+      <Td>{soa.stateOfApplicability.name}</Td>
+      <Td>
+        <Badge variant={soa.applicability ? "success" : "danger"}>
+          {soa.applicability ? __("Applicable") : __("Not Applicable")}
+        </Badge>
+      </Td>
+      <Td>{soa.justification || "-"}</Td>
+      {!props.readOnly && (
+        <Td noLink width={50} className="text-end">
+          <Button
+            variant="secondary"
+            onClick={() => props.onClick(soa.stateOfApplicabilityId, soa.controlId)}
+            icon={IconTrashCan}
+          >
+            {__("Unlink")}
+          </Button>
+        </Td>
+      )}
+    </Tr>
+  );
+}
diff --git a/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityDialog.tsx b/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityDialog.tsx
new file mode 100644
index 000000000..be15b9004
--- /dev/null
+++ b/apps/console/src/components/states-of-applicability/LinkedStatesOfApplicabilityDialog.tsx
@@ -0,0 +1,180 @@
+import { useTranslate } from "@probo/i18n";
+import { Dialog, DialogContent, DialogFooter, Button, Checkbox, Textarea, Badge } from "@probo/ui";
+import { Suspense, useState, useRef } from "react";
+import type { ReactNode } from "react";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "relay-runtime";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { LinkedStatesOfApplicabilityDialogQuery } from "./__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql";
+
+const query = graphql`
+  query LinkedStatesOfApplicabilityDialogQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        statesOfApplicability(first: 100) {
+          edges {
+            node {
+              id
+              name
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+type LinkedSOAInfo = {
+  stateOfApplicabilityId: string;
+  controlId: string;
+};
+
+type Props = {
+  children: ReactNode;
+  connectionId: string;
+  disabled?: boolean;
+  linkedStatesOfApplicability: readonly LinkedSOAInfo[];
+  onLink: (stateOfApplicabilityId: string, applicability: boolean, justification: string | null) => void;
+  onUnlink: (stateOfApplicabilityId: string, controlId: string) => void;
+};
+
+export function LinkedStatesOfApplicabilityDialog({ children, ...props }: Props) {
+  const dialogRef = useRef<{ open: () => void; close: () => void }>(null);
+
+  return (
+    <Dialog ref={dialogRef} trigger={children} title="Link State of Applicability">
+      <Suspense fallback={<div>Loading...</div>}>
+        <LinkedStatesOfApplicabilityDialogContent {...props} onClose={() => dialogRef.current?.close()} />
+      </Suspense>
+    </Dialog>
+  );
+}
+
+function LinkedStatesOfApplicabilityDialogContent(props: Omit<Props, "children"> & { onClose: () => void }) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const [selectedSOA, setSelectedSOA] = useState<{ id: string; name: string } | null>(null);
+  const [applicability, setApplicability] = useState(true);
+  const [justification, setJustification] = useState("");
+
+  const data = useLazyLoadQuery<LinkedStatesOfApplicabilityDialogQuery>(query, {
+    organizationId,
+  }, { fetchPolicy: "network-only" });
+
+  const linkedSOAIds = new Set(props.linkedStatesOfApplicability.map((soa) => soa.stateOfApplicabilityId));
+  const linkedSOAMap = new Map(props.linkedStatesOfApplicability.map((soa) => [soa.stateOfApplicabilityId, soa]));
+  const statesOfApplicability = data.organization?.statesOfApplicability?.edges.map((edge) => edge.node) ?? [];
+
+  const handleSelectSOA = (soa: { id: string; name: string }) => {
+    setSelectedSOA(soa);
+    setApplicability(true);
+    setJustification("");
+  };
+
+  const handleLink = () => {
+    if (selectedSOA) {
+      props.onLink(selectedSOA.id, applicability, justification.trim() || null);
+      props.onClose();
+    }
+  };
+
+  const handleUnlink = (stateOfApplicabilityId: string) => {
+    const linkedSOA = linkedSOAMap.get(stateOfApplicabilityId);
+    if (linkedSOA) {
+      props.onUnlink(linkedSOA.stateOfApplicabilityId, linkedSOA.controlId);
+    }
+  };
+
+  return (
+    <>
+      <DialogContent padded className="space-y-4">
+        {statesOfApplicability.length === 0 ? (
+          <div className="flex flex-col items-center justify-center py-12 text-center">
+            <div className="text-txt-secondary text-base mb-2">
+              {__("No states of applicability available")}
+            </div>
+            <div className="text-txt-tertiary text-sm">
+              {__("Create a state of applicability first to link it to this control")}
+            </div>
+          </div>
+        ) : !selectedSOA ? (
+          <div className="space-y-2">
+            <div className="text-sm font-medium mb-2">{__("Select a state of applicability:")}</div>
+            {statesOfApplicability.map((soa) => {
+              const isLinked = linkedSOAIds.has(soa.id);
+              return (
+                <div
+                  key={soa.id}
+                  className={`border border-border-low rounded-lg p-3 flex items-center justify-between ${!isLinked ? 'hover:bg-hover cursor-pointer' : ''}`}
+                  onClick={() => !isLinked && handleSelectSOA(soa)}
+                >
+                  <div className="font-medium">{soa.name}</div>
+                  {isLinked ? (
+                    <div className="flex items-center gap-2" onClick={(e) => e.stopPropagation()}>
+                      <Badge variant="success">{__("Linked")}</Badge>
+                      <Button
+                        variant="danger"
+                        onClick={() => handleUnlink(soa.id)}
+                        disabled={props.disabled}
+                      >
+                        {__("Unlink")}
+                      </Button>
+                    </div>
+                  ) : null}
+                </div>
+              );
+            })}
+          </div>
+        ) : (
+          <div className="space-y-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <div className="text-sm text-txt-secondary mb-1">{__("Selected:")}</div>
+                <div className="text-lg font-medium">{selectedSOA.name}</div>
+              </div>
+              <Button variant="tertiary" onClick={() => setSelectedSOA(null)}>
+                {__("Change")}
+              </Button>
+            </div>
+
+            <div className="border-t border-border-low pt-4 space-y-3">
+              <label className="flex items-center gap-2 cursor-pointer">
+                <Checkbox
+                  checked={applicability}
+                  onChange={(checked) => setApplicability(checked)}
+                />
+                <span className="font-medium">{__("Applicable")}</span>
+              </label>
+
+              <div>
+                <label className="text-sm font-medium mb-1 block">
+                  {__("Justification (optional)")}
+                </label>
+                <Textarea
+                  placeholder={__("Add a justification...")}
+                  value={justification}
+                  onChange={(e) => setJustification(e.target.value)}
+                  rows={3}
+                />
+              </div>
+            </div>
+          </div>
+        )}
+      </DialogContent>
+      <DialogFooter exitLabel={__("Close")}>
+        {selectedSOA ? (
+          <>
+            <Button variant="secondary" onClick={() => setSelectedSOA(null)}>
+              {__("Back")}
+            </Button>
+            <Button variant="primary" onClick={handleLink} disabled={props.disabled}>
+              {__("Link")}
+            </Button>
+          </>
+        ) : (
+          <></>
+        )}
+      </DialogFooter>
+    </>
+  );
+}
diff --git a/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityCardFragment.graphql.ts b/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityCardFragment.graphql.ts
new file mode 100644
index 000000000..fafe0d8cb
--- /dev/null
+++ b/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityCardFragment.graphql.ts
@@ -0,0 +1,100 @@
+/**
+ * @generated SignedSource<<fa19c3e1b91d31188625e48b8b6db7e9>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type LinkedStatesOfApplicabilityCardFragment$data = {
+  readonly applicability: boolean;
+  readonly controlId: string;
+  readonly id: string;
+  readonly justification: string | null | undefined;
+  readonly stateOfApplicability: {
+    readonly id: string;
+    readonly name: string;
+  };
+  readonly stateOfApplicabilityId: string;
+  readonly " $fragmentType": "LinkedStatesOfApplicabilityCardFragment";
+};
+export type LinkedStatesOfApplicabilityCardFragment$key = {
+  readonly " $data"?: LinkedStatesOfApplicabilityCardFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+};
+
+const node: ReaderFragment = (function(){
+var v0 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": null,
+  "name": "LinkedStatesOfApplicabilityCardFragment",
+  "selections": [
+    (v0/*: any*/),
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "stateOfApplicabilityId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "controlId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "StateOfApplicability",
+      "kind": "LinkedField",
+      "name": "stateOfApplicability",
+      "plural": false,
+      "selections": [
+        (v0/*: any*/),
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "applicability",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "justification",
+      "storageKey": null
+    }
+  ],
+  "type": "StateOfApplicabilityControl",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "b9a9922b27f277a769025f11b0829bdc";
+
+export default node;
diff --git a/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql.ts b/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql.ts
new file mode 100644
index 000000000..766977433
--- /dev/null
+++ b/apps/console/src/components/states-of-applicability/__generated__/LinkedStatesOfApplicabilityDialogQuery.graphql.ts
@@ -0,0 +1,172 @@
+/**
+ * @generated SignedSource<<a49fb511ab396ea46b199b2ae08edfff>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type LinkedStatesOfApplicabilityDialogQuery$variables = {
+  organizationId: string;
+};
+export type LinkedStatesOfApplicabilityDialogQuery$data = {
+  readonly organization: {
+    readonly statesOfApplicability?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly name: string;
+        };
+      }>;
+    };
+  };
+};
+export type LinkedStatesOfApplicabilityDialogQuery = {
+  response: LinkedStatesOfApplicabilityDialogQuery$data;
+  variables: LinkedStatesOfApplicabilityDialogQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 100
+        }
+      ],
+      "concreteType": "StateOfApplicabilityConnection",
+      "kind": "LinkedField",
+      "name": "statesOfApplicability",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "StateOfApplicabilityEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "StateOfApplicability",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": "statesOfApplicability(first:100)"
+    }
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v3/*: any*/),
+          (v2/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "b36c3216f309865885892fce0d52eac9",
+    "id": null,
+    "metadata": {},
+    "name": "LinkedStatesOfApplicabilityDialogQuery",
+    "operationKind": "query",
+    "text": "query LinkedStatesOfApplicabilityDialogQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      statesOfApplicability(first: 100) {\n        edges {\n          node {\n            id\n            name\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "a6ed2cd0171d834480319779e11fce99";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/FrameworkGraph.ts b/apps/console/src/hooks/graph/FrameworkGraph.ts
index 17fb0f52c..a2984f5a4 100644
--- a/apps/console/src/hooks/graph/FrameworkGraph.ts
+++ b/apps/console/src/hooks/graph/FrameworkGraph.ts
@@ -100,6 +100,16 @@ export const frameworkControlNodeQuery = graphql`
         status
         exclusionJustification
         ...FrameworkControlDialogFragment
+        stateOfApplicabilityControls(first: 100)
+          @connection(key: "FrameworkGraphControl_stateOfApplicabilityControls") {
+          __id
+          edges {
+            node {
+              id
+              ...LinkedStatesOfApplicabilityCardFragment
+            }
+          }
+        }
         measures(first: 100)
           @connection(key: "FrameworkGraphControl_measures") {
           __id
@@ -130,6 +140,16 @@ export const frameworkControlNodeQuery = graphql`
             }
           }
         }
+        obligations(first: 100)
+          @connection(key: "FrameworkGraphControl_obligations") {
+          __id
+          edges {
+            node {
+              id
+              ...LinkedObligationsCardFragment
+            }
+          }
+        }
         snapshots(first: 100)
           @connection(key: "FrameworkGraphControl_snapshots") {
           __id
diff --git a/apps/console/src/hooks/graph/ObligationGraph.ts b/apps/console/src/hooks/graph/ObligationGraph.ts
index 56a847c8b..f9201d99a 100644
--- a/apps/console/src/hooks/graph/ObligationGraph.ts
+++ b/apps/console/src/hooks/graph/ObligationGraph.ts
@@ -29,6 +29,7 @@ export const obligationNodeQuery = graphql`
         requirement
         actionsToBeImplemented
         regulator
+        type
         lastReviewDate
         dueDate
         status
@@ -61,6 +62,7 @@ export const createObligationMutation = graphql`
           requirement
           actionsToBeImplemented
           regulator
+          type
           lastReviewDate
           dueDate
           status
@@ -85,6 +87,7 @@ export const updateObligationMutation = graphql`
         requirement
         actionsToBeImplemented
         regulator
+        type
         lastReviewDate
         dueDate
         status
@@ -151,6 +154,7 @@ export const useCreateObligation = (connectionId: string) => {
     requirement?: string;
     actionsToBeImplemented?: string;
     regulator?: string;
+    type: string;
     ownerId: string;
     lastReviewDate?: string;
     dueDate?: string;
@@ -172,6 +176,7 @@ export const useCreateObligation = (connectionId: string) => {
           requirement: input.requirement,
           actionsToBeImplemented: input.actionsToBeImplemented,
           regulator: input.regulator,
+          type: input.type,
           ownerId: input.ownerId,
           lastReviewDate: input.lastReviewDate,
           dueDate: input.dueDate,
@@ -194,6 +199,7 @@ export const useUpdateObligation = () => {
     requirement?: string;
     actionsToBeImplemented?: string;
     regulator?: string;
+    type?: string;
     ownerId?: string;
     lastReviewDate?: string | null;
     dueDate?: string | null;
diff --git a/apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts b/apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts
new file mode 100644
index 000000000..ffcf30b49
--- /dev/null
+++ b/apps/console/src/hooks/graph/StateOfApplicabilityGraph.ts
@@ -0,0 +1,235 @@
+import { graphql } from "relay-runtime";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "./__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import type { StateOfApplicabilityGraphPaginatedFragment$key } from "./__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql";
+import {
+  useMutation,
+  usePaginationFragment,
+  usePreloadedQuery,
+  type PreloadedQuery,
+} from "react-relay";
+import { useConfirm, useToast } from "@probo/ui";
+import type { StateOfApplicabilityGraphDeleteMutation } from "./__generated__/StateOfApplicabilityGraphDeleteMutation.graphql";
+import {
+  promisifyMutation,
+  sprintf,
+  formatError,
+  type GraphQLError,
+} from "@probo/helpers";
+import { useTranslate } from "@probo/i18n";
+
+export const paginatedStateOfApplicabilityQuery = graphql`
+  query StateOfApplicabilityGraphPaginatedQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        id
+        ...StateOfApplicabilityGraphPaginatedFragment
+      }
+    }
+  }
+`;
+
+export const paginatedStateOfApplicabilityFragment = graphql`
+  fragment StateOfApplicabilityGraphPaginatedFragment on Organization
+  @refetchable(queryName: "StateOfApplicabilityListQuery")
+  @argumentDefinitions(
+    first: { type: "Int", defaultValue: 50 }
+    order: {
+      type: "StateOfApplicabilityOrder"
+      defaultValue: { direction: DESC, field: CREATED_AT }
+    }
+    after: { type: "CursorKey", defaultValue: null }
+    before: { type: "CursorKey", defaultValue: null }
+    last: { type: "Int", defaultValue: null }
+    filter: { type: "StateOfApplicabilityFilter", defaultValue: { snapshotId: null } }
+  ) {
+    statesOfApplicability(
+      first: $first
+      after: $after
+      last: $last
+      before: $before
+      orderBy: $order
+      filter: $filter
+    ) @connection(key: "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability") {
+      __id
+      edges {
+        node {
+          id
+          name
+          sourceId
+          snapshotId
+          createdAt
+          updatedAt
+          controlsInfo: controls(first: 0) {
+            totalCount
+          }
+        }
+      }
+    }
+  }
+`;
+
+export function useStateOfApplicabilityQuery(
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>,
+) {
+  const data = usePreloadedQuery(paginatedStateOfApplicabilityQuery, queryRef);
+  const pagination = usePaginationFragment(
+    paginatedStateOfApplicabilityFragment,
+    data.organization as StateOfApplicabilityGraphPaginatedFragment$key,
+  );
+  const statesOfApplicability = pagination.data.statesOfApplicability?.edges.map((edge) => edge.node);
+  return {
+    ...pagination,
+    statesOfApplicability,
+    connectionId: pagination.data.statesOfApplicability.__id,
+  };
+}
+
+export const deleteStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphDeleteMutation(
+    $input: DeleteStateOfApplicabilityInput!
+    $connections: [ID!]!
+  ) {
+    deleteStateOfApplicability(input: $input) {
+      deletedStateOfApplicabilityId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
+export const StateOfApplicabilityConnectionKey = "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability";
+
+export const useDeleteStateOfApplicability = (
+  stateOfApplicability: { id?: string; name?: string },
+  connectionId: string,
+  onSuccess?: () => void,
+) => {
+  const [mutate] = useMutation<StateOfApplicabilityGraphDeleteMutation>(deleteStateOfApplicabilityMutation);
+  const confirm = useConfirm();
+  const { toast } = useToast();
+  const { __ } = useTranslate();
+
+  return () => {
+    if (!stateOfApplicability.id || !stateOfApplicability.name) {
+      return alert(__("Failed to delete state of applicability: missing id or name"));
+    }
+    confirm(
+      () =>
+        promisifyMutation(mutate)({
+          variables: {
+            input: {
+              stateOfApplicabilityId: stateOfApplicability.id!,
+            },
+            connections: [connectionId],
+          },
+        })
+          .then(() => {
+            onSuccess?.();
+          })
+          .catch((error) => {
+            toast({
+              title: __("Error"),
+              description: formatError(
+                __("Failed to delete state of applicability"),
+                error as GraphQLError,
+              ),
+              variant: "error",
+            });
+          }),
+      {
+        message: sprintf(
+          __(
+            'This will permanently delete "%s". This action cannot be undone.',
+          ),
+          stateOfApplicability.name,
+        ),
+      },
+    );
+  };
+};
+
+export const createStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphCreateMutation(
+    $input: CreateStateOfApplicabilityInput!
+    $connections: [ID!]!
+  ) {
+    createStateOfApplicability(input: $input) {
+      stateOfApplicabilityEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          name
+          sourceId
+          snapshotId
+          createdAt
+          updatedAt
+        }
+      }
+    }
+  }
+`;
+
+export const updateStateOfApplicabilityMutation = graphql`
+  mutation StateOfApplicabilityGraphUpdateMutation(
+    $input: UpdateStateOfApplicabilityInput!
+  ) {
+    updateStateOfApplicability(input: $input) {
+      stateOfApplicability {
+        id
+        name
+        sourceId
+        snapshotId
+        createdAt
+        updatedAt
+        owner {
+          id
+          fullName
+        }
+      }
+    }
+  }
+`;
+
+export const stateOfApplicabilityNodeQuery = graphql`
+  query StateOfApplicabilityGraphNodeQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        name
+        sourceId
+        snapshotId
+        createdAt
+        updatedAt
+        organization {
+          id
+        }
+        owner {
+          id
+          fullName
+        }
+        ...StateOfApplicabilityControlsTabFragment
+      }
+    }
+  }
+`;
+
+export const stateOfApplicabilityForEditQuery = graphql`
+  query StateOfApplicabilityGraphForEditQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        name
+        controls(first: 1000, orderBy: { field: SECTION_TITLE, direction: ASC }) {
+          edges {
+            node {
+              id
+              sectionTitle
+              name
+              framework {
+                id
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
diff --git a/apps/console/src/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql.ts
index 341196b61..afd859ff2 100644
--- a/apps/console/src/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<54b072cf5a78b17f86e5fc810cac517a>>
+ * @generated SignedSource<<ec1b843d1afb3a82c747b8580b528fda>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -47,6 +47,15 @@ export type FrameworkGraphControlNodeQuery$data = {
       }>;
     };
     readonly name?: string;
+    readonly obligations?: {
+      readonly __id: string;
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly " $fragmentSpreads": FragmentRefs<"LinkedObligationsCardFragment">;
+        };
+      }>;
+    };
     readonly sectionTitle?: string;
     readonly snapshots?: {
       readonly __id: string;
@@ -57,6 +66,15 @@ export type FrameworkGraphControlNodeQuery$data = {
         };
       }>;
     };
+    readonly stateOfApplicabilityControls?: {
+      readonly __id: string;
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly id: string;
+          readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+        };
+      }>;
+    };
     readonly status?: ControlStatus;
     readonly " $fragmentSpreads": FragmentRefs<"FrameworkControlDialogFragment">;
   };
@@ -181,14 +199,18 @@ v12 = [
     "value": 100
   }
 ],
-v13 = {
+v13 = [
+  (v2/*: any*/),
+  (v3/*: any*/)
+],
+v14 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "state",
   "storageKey": null
 },
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -224,6 +246,49 @@ return {
                 "kind": "FragmentSpread",
                 "name": "FrameworkControlDialogFragment"
               },
+              {
+                "alias": "stateOfApplicabilityControls",
+                "args": null,
+                "concreteType": "StateOfApplicabilityControlConnection",
+                "kind": "LinkedField",
+                "name": "__FrameworkGraphControl_stateOfApplicabilityControls_connection",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityControlEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicabilityControl",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "args": null,
+                            "kind": "FragmentSpread",
+                            "name": "LinkedStatesOfApplicabilityCardFragment"
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": null
+              },
               {
                 "alias": "measures",
                 "args": null,
@@ -353,6 +418,49 @@ return {
                 ],
                 "storageKey": null
               },
+              {
+                "alias": "obligations",
+                "args": null,
+                "concreteType": "ObligationConnection",
+                "kind": "LinkedField",
+                "name": "__FrameworkGraphControl_obligations_connection",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "ObligationEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Obligation",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "args": null,
+                            "kind": "FragmentSpread",
+                            "name": "LinkedObligationsCardFragment"
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": null
+              },
               {
                 "alias": "snapshots",
                 "args": null,
@@ -431,6 +539,98 @@ return {
               (v5/*: any*/),
               (v6/*: any*/),
               (v7/*: any*/),
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "bestPractice",
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "concreteType": "StateOfApplicabilityControlConnection",
+                "kind": "LinkedField",
+                "name": "stateOfApplicabilityControls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityControlEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicabilityControl",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "stateOfApplicabilityId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "controlId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "concreteType": "StateOfApplicability",
+                            "kind": "LinkedField",
+                            "name": "stateOfApplicability",
+                            "plural": false,
+                            "selections": (v13/*: any*/),
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "applicability",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "justification",
+                            "storageKey": null
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": "stateOfApplicabilityControls(first:100)"
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "FrameworkGraphControl_stateOfApplicabilityControls",
+                "kind": "LinkedHandle",
+                "name": "stateOfApplicabilityControls"
+              },
               {
                 "alias": null,
                 "args": (v12/*: any*/),
@@ -457,7 +657,7 @@ return {
                         "selections": [
                           (v2/*: any*/),
                           (v3/*: any*/),
-                          (v13/*: any*/),
+                          (v14/*: any*/),
                           (v8/*: any*/)
                         ],
                         "storageKey": null
@@ -512,7 +712,7 @@ return {
                             "name": "title",
                             "storageKey": null
                           },
-                          (v14/*: any*/),
+                          (v15/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -609,8 +809,8 @@ return {
                         "selections": [
                           (v2/*: any*/),
                           (v3/*: any*/),
+                          (v15/*: any*/),
                           (v14/*: any*/),
-                          (v13/*: any*/),
                           {
                             "alias": null,
                             "args": null,
@@ -632,10 +832,7 @@ return {
                             "kind": "LinkedField",
                             "name": "framework",
                             "plural": false,
-                            "selections": [
-                              (v2/*: any*/),
-                              (v3/*: any*/)
-                            ],
+                            "selections": (v13/*: any*/),
                             "storageKey": null
                           },
                           (v8/*: any*/)
@@ -660,6 +857,94 @@ return {
                 "kind": "LinkedHandle",
                 "name": "audits"
               },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "concreteType": "ObligationConnection",
+                "kind": "LinkedField",
+                "name": "obligations",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "ObligationEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "Obligation",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "requirement",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "area",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "source",
+                            "storageKey": null
+                          },
+                          (v6/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "concreteType": "People",
+                            "kind": "LinkedField",
+                            "name": "owner",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "fullName",
+                                "storageKey": null
+                              },
+                              (v2/*: any*/)
+                            ],
+                            "storageKey": null
+                          },
+                          (v8/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      (v9/*: any*/)
+                    ],
+                    "storageKey": null
+                  },
+                  (v10/*: any*/),
+                  (v11/*: any*/)
+                ],
+                "storageKey": "obligations(first:100)"
+              },
+              {
+                "alias": null,
+                "args": (v12/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "FrameworkGraphControl_obligations",
+                "kind": "LinkedHandle",
+                "name": "obligations"
+              },
               {
                 "alias": null,
                 "args": (v12/*: any*/),
@@ -694,7 +979,7 @@ return {
                             "name": "type",
                             "storageKey": null
                           },
-                          (v14/*: any*/),
+                          (v15/*: any*/),
                           (v8/*: any*/)
                         ],
                         "storageKey": null
@@ -727,10 +1012,19 @@ return {
     ]
   },
   "params": {
-    "cacheID": "2ce9eb2cbe052019e86b2d0baecfb6f0",
+    "cacheID": "f7773b474bf5f22e9a7075c685839001",
     "id": null,
     "metadata": {
       "connection": [
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "node",
+            "stateOfApplicabilityControls"
+          ]
+        },
         {
           "count": null,
           "cursor": null,
@@ -758,6 +1052,15 @@ return {
             "audits"
           ]
         },
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "node",
+            "obligations"
+          ]
+        },
         {
           "count": null,
           "cursor": null,
@@ -771,11 +1074,11 @@ return {
     },
     "name": "FrameworkGraphControlNodeQuery",
     "operationKind": "query",
-    "text": "query FrameworkGraphControlNodeQuery(\n  $controlId: ID!\n) {\n  node(id: $controlId) {\n    __typename\n    ... on Control {\n      id\n      name\n      sectionTitle\n      description\n      status\n      exclusionJustification\n      ...FrameworkControlDialogFragment\n      measures(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedMeasuresCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedDocumentsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedAuditsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      snapshots(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedSnapshotsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n\nfragment LinkedAuditsCardFragment on Audit {\n  id\n  name\n  createdAt\n  state\n  validFrom\n  validUntil\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment LinkedMeasuresCardFragment on Measure {\n  id\n  name\n  state\n}\n\nfragment LinkedSnapshotsCardFragment on Snapshot {\n  id\n  name\n  description\n  type\n  createdAt\n}\n"
+    "text": "query FrameworkGraphControlNodeQuery(\n  $controlId: ID!\n) {\n  node(id: $controlId) {\n    __typename\n    ... on Control {\n      id\n      name\n      sectionTitle\n      description\n      status\n      exclusionJustification\n      ...FrameworkControlDialogFragment\n      stateOfApplicabilityControls(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedStatesOfApplicabilityCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      measures(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedMeasuresCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedDocumentsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedAuditsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      obligations(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedObligationsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n      snapshots(first: 100) {\n        edges {\n          node {\n            id\n            ...LinkedSnapshotsCardFragment\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n\nfragment LinkedAuditsCardFragment on Audit {\n  id\n  name\n  createdAt\n  state\n  validFrom\n  validUntil\n  framework {\n    id\n    name\n  }\n}\n\nfragment LinkedDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment LinkedMeasuresCardFragment on Measure {\n  id\n  name\n  state\n}\n\nfragment LinkedObligationsCardFragment on Obligation {\n  id\n  requirement\n  area\n  source\n  status\n  owner {\n    fullName\n    id\n  }\n}\n\nfragment LinkedSnapshotsCardFragment on Snapshot {\n  id\n  name\n  description\n  type\n  createdAt\n}\n\nfragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {\n  id\n  stateOfApplicabilityId\n  controlId\n  stateOfApplicability {\n    id\n    name\n  }\n  applicability\n  justification\n}\n"
   }
 };
 })();
 
-(node as any).hash = "afc4bbbce8d8b3cd57ac2bf77db58e55";
+(node as any).hash = "b28838e3c3c4cdd68906247d129799c8";
 
 export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/FrameworkGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/FrameworkGraphNodeQuery.graphql.ts
index d615bc172..f79c6b4a2 100644
--- a/apps/console/src/hooks/graph/__generated__/FrameworkGraphNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/FrameworkGraphNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6fcc115e1ab6df38ede8756968ae7a6a>>
+ * @generated SignedSource<<43528dc19e67fdeca407f5081e6252b9>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -210,6 +210,13 @@ return {
                             "kind": "ScalarField",
                             "name": "exclusionJustification",
                             "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "bestPractice",
+                            "storageKey": null
                           }
                         ],
                         "storageKey": null
@@ -242,12 +249,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "68c09567aff1176075300c645f5d117d",
+    "cacheID": "5af3d5c9f8d466c5d6a78d7bd5da70d1",
     "id": null,
     "metadata": {},
     "name": "FrameworkGraphNodeQuery",
     "operationKind": "query",
-    "text": "query FrameworkGraphNodeQuery(\n  $frameworkId: ID!\n) {\n  node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      name\n      ...FrameworkDetailPageFragment\n    }\n    id\n  }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n  id\n  name\n  description\n  lightLogoURL\n  darkLogoURL\n  organization {\n    name\n    id\n  }\n  controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        sectionTitle\n        name\n        status\n        exclusionJustification\n      }\n    }\n  }\n}\n"
+    "text": "query FrameworkGraphNodeQuery(\n  $frameworkId: ID!\n) {\n  node(id: $frameworkId) {\n    __typename\n    ... on Framework {\n      id\n      name\n      ...FrameworkDetailPageFragment\n    }\n    id\n  }\n}\n\nfragment FrameworkDetailPageFragment on Framework {\n  id\n  name\n  description\n  lightLogoURL\n  darkLogoURL\n  organization {\n    name\n    id\n  }\n  controls(first: 250, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n    edges {\n      node {\n        id\n        sectionTitle\n        name\n        status\n        exclusionJustification\n        bestPractice\n      }\n    }\n  }\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/hooks/graph/__generated__/ObligationGraphCreateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/ObligationGraphCreateMutation.graphql.ts
index 4eaf124a0..8bfc4960c 100644
--- a/apps/console/src/hooks/graph/__generated__/ObligationGraphCreateMutation.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/ObligationGraphCreateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<6c659dc34af3bc7107a55d45f49075b5>>
+ * @generated SignedSource<<46f875946badbe73d5c1ab10f442763d>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type CreateObligationInput = {
   actionsToBeImplemented?: string | null | undefined;
   area?: string | null | undefined;
@@ -21,6 +22,7 @@ export type CreateObligationInput = {
   requirement?: string | null | undefined;
   source?: string | null | undefined;
   status: ObligationStatus;
+  type: ObligationType;
 };
 export type ObligationGraphCreateMutation$variables = {
   connections: ReadonlyArray<string>;
@@ -44,6 +46,7 @@ export type ObligationGraphCreateMutation$data = {
         readonly requirement: string | null | undefined;
         readonly source: string | null | undefined;
         readonly status: ObligationStatus;
+        readonly type: ObligationType;
       };
     };
   };
@@ -130,6 +133,13 @@ v4 = {
           "name": "regulator",
           "storageKey": null
         },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "type",
+          "storageKey": null
+        },
         {
           "alias": null,
           "args": null,
@@ -249,16 +259,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "76eae037102523c7378b07856332c9ff",
+    "cacheID": "495da8600659a64f5d59ed86a56c8762",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphCreateMutation",
     "operationKind": "mutation",
-    "text": "mutation ObligationGraphCreateMutation(\n  $input: CreateObligationInput!\n) {\n  createObligation(input: $input) {\n    obligationEdge {\n      node {\n        id\n        area\n        source\n        requirement\n        actionsToBeImplemented\n        regulator\n        lastReviewDate\n        dueDate\n        status\n        owner {\n          id\n          fullName\n        }\n        createdAt\n      }\n    }\n  }\n}\n"
+    "text": "mutation ObligationGraphCreateMutation(\n  $input: CreateObligationInput!\n) {\n  createObligation(input: $input) {\n    obligationEdge {\n      node {\n        id\n        area\n        source\n        requirement\n        actionsToBeImplemented\n        regulator\n        type\n        lastReviewDate\n        dueDate\n        status\n        owner {\n          id\n          fullName\n        }\n        createdAt\n      }\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "f3d8ddbef3566e26b3fe65543d93d07d";
+(node as any).hash = "e28cc6399325e7288ce7a71d3400acdb";
 
 export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql.ts
index 170dcd265..c49fc44eb 100644
--- a/apps/console/src/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<d1b09bb9cf9c608b8b3ac1c2b55a109a>>
+ * @generated SignedSource<<3542cd7b93f38df062a93a1b9e325ff3>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type ObligationGraphNodeQuery$variables = {
   obligationId: string;
 };
@@ -35,6 +36,7 @@ export type ObligationGraphNodeQuery$data = {
     readonly source?: string | null | undefined;
     readonly sourceId?: string | null | undefined;
     readonly status?: ObligationStatus;
+    readonly type?: ObligationType;
     readonly updatedAt?: any;
   };
 };
@@ -118,24 +120,31 @@ v10 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "lastReviewDate",
+  "name": "type",
   "storageKey": null
 },
 v11 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "dueDate",
+  "name": "lastReviewDate",
   "storageKey": null
 },
 v12 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
-  "name": "status",
+  "name": "dueDate",
   "storageKey": null
 },
 v13 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "status",
+  "storageKey": null
+},
+v14 = {
   "alias": null,
   "args": null,
   "concreteType": "People",
@@ -154,7 +163,7 @@ v13 = {
   ],
   "storageKey": null
 },
-v14 = {
+v15 = {
   "alias": null,
   "args": null,
   "concreteType": "Organization",
@@ -173,14 +182,14 @@ v14 = {
   ],
   "storageKey": null
 },
-v15 = {
+v16 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
   "name": "createdAt",
   "storageKey": null
 },
-v16 = {
+v17 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -219,7 +228,8 @@ return {
               (v13/*: any*/),
               (v14/*: any*/),
               (v15/*: any*/),
-              (v16/*: any*/)
+              (v16/*: any*/),
+              (v17/*: any*/)
             ],
             "type": "Obligation",
             "abstractKey": null
@@ -269,7 +279,8 @@ return {
               (v13/*: any*/),
               (v14/*: any*/),
               (v15/*: any*/),
-              (v16/*: any*/)
+              (v16/*: any*/),
+              (v17/*: any*/)
             ],
             "type": "Obligation",
             "abstractKey": null
@@ -280,16 +291,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "6fd1c9d6e9f9a5baa60e4d270fc16db7",
+    "cacheID": "049eff8ed7a7476c04d09b64c061c3a6",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphNodeQuery",
     "operationKind": "query",
-    "text": "query ObligationGraphNodeQuery(\n  $obligationId: ID!\n) {\n  node(id: $obligationId) {\n    __typename\n    ... on Obligation {\n      id\n      snapshotId\n      sourceId\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
+    "text": "query ObligationGraphNodeQuery(\n  $obligationId: ID!\n) {\n  node(id: $obligationId) {\n    __typename\n    ... on Obligation {\n      id\n      snapshotId\n      sourceId\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      type\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      organization {\n        id\n        name\n      }\n      createdAt\n      updatedAt\n    }\n    id\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "ddefa1f2514f429a8ff174646bccf254";
+(node as any).hash = "c50090bdd31fc24e0fdb067677999f77";
 
 export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/ObligationGraphUpdateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/ObligationGraphUpdateMutation.graphql.ts
index 485ce8d8a..d63b4f210 100644
--- a/apps/console/src/hooks/graph/__generated__/ObligationGraphUpdateMutation.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/ObligationGraphUpdateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<2fb713ad39d2976a25e4fee57edec2f3>>
+ * @generated SignedSource<<879c7bec9540c7d9e46eecb2fd5243d7>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -10,6 +10,7 @@
 
 import { ConcreteRequest } from 'relay-runtime';
 export type ObligationStatus = "COMPLIANT" | "NON_COMPLIANT" | "PARTIALLY_COMPLIANT";
+export type ObligationType = "CONTRACTUAL" | "LEGAL";
 export type UpdateObligationInput = {
   actionsToBeImplemented?: string | null | undefined;
   area?: string | null | undefined;
@@ -21,6 +22,7 @@ export type UpdateObligationInput = {
   requirement?: string | null | undefined;
   source?: string | null | undefined;
   status?: ObligationStatus | null | undefined;
+  type?: ObligationType | null | undefined;
 };
 export type ObligationGraphUpdateMutation$variables = {
   input: UpdateObligationInput;
@@ -41,6 +43,7 @@ export type ObligationGraphUpdateMutation$data = {
       readonly requirement: string | null | undefined;
       readonly source: string | null | undefined;
       readonly status: ObligationStatus;
+      readonly type: ObligationType;
       readonly updatedAt: any;
     };
   };
@@ -124,6 +127,13 @@ v2 = [
             "name": "regulator",
             "storageKey": null
           },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "type",
+            "storageKey": null
+          },
           {
             "alias": null,
             "args": null,
@@ -196,16 +206,16 @@ return {
     "selections": (v2/*: any*/)
   },
   "params": {
-    "cacheID": "e42654b0cfd6ebeb8c78e8ec2f62c9c7",
+    "cacheID": "f9c2c73fd39c2d25eb6aa8d9e6670652",
     "id": null,
     "metadata": {},
     "name": "ObligationGraphUpdateMutation",
     "operationKind": "mutation",
-    "text": "mutation ObligationGraphUpdateMutation(\n  $input: UpdateObligationInput!\n) {\n  updateObligation(input: $input) {\n    obligation {\n      id\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      updatedAt\n    }\n  }\n}\n"
+    "text": "mutation ObligationGraphUpdateMutation(\n  $input: UpdateObligationInput!\n) {\n  updateObligation(input: $input) {\n    obligation {\n      id\n      area\n      source\n      requirement\n      actionsToBeImplemented\n      regulator\n      type\n      lastReviewDate\n      dueDate\n      status\n      owner {\n        id\n        fullName\n      }\n      updatedAt\n    }\n  }\n}\n"
   }
 };
 })();
 
-(node as any).hash = "68013ca15f0e4eaaa0b1ef877b4f528c";
+(node as any).hash = "07663daac0c8341a570a0bf3a41c8b77";
 
 export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/SnapshotGraphCreateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/SnapshotGraphCreateMutation.graphql.ts
index 246c1d0d9..f008b2e36 100644
--- a/apps/console/src/hooks/graph/__generated__/SnapshotGraphCreateMutation.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/SnapshotGraphCreateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<11dd6f7de6693a626306b674bb8cc4f0>>
+ * @generated SignedSource<<2307fb5807f0d42458650cfaf8ebdbba>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type CreateSnapshotInput = {
   description?: string | null | undefined;
   name: string;
diff --git a/apps/console/src/hooks/graph/__generated__/SnapshotGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/SnapshotGraphNodeQuery.graphql.ts
index a42f66982..eee7dac71 100644
--- a/apps/console/src/hooks/graph/__generated__/SnapshotGraphNodeQuery.graphql.ts
+++ b/apps/console/src/hooks/graph/__generated__/SnapshotGraphNodeQuery.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<d6dc9bf5a6c36f140bb864def22c0134>>
+ * @generated SignedSource<<0b5ef79fa213c96a316a4e0a94afade8>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type SnapshotGraphNodeQuery$variables = {
   snapshotId: string;
 };
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql.ts
new file mode 100644
index 000000000..f6bccdda2
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql.ts
@@ -0,0 +1,200 @@
+/**
+ * @generated SignedSource<<3a91be997803d4a28d0db40aebe53f25>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityInput = {
+  name: string;
+  organizationId: string;
+  ownerId: string;
+};
+export type StateOfApplicabilityGraphCreateMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphCreateMutation$data = {
+  readonly createStateOfApplicability: {
+    readonly stateOfApplicabilityEdge: {
+      readonly node: {
+        readonly createdAt: any;
+        readonly id: string;
+        readonly name: string;
+        readonly snapshotId: string | null | undefined;
+        readonly sourceId: string | null | undefined;
+        readonly updatedAt: any;
+      };
+    };
+  };
+};
+export type StateOfApplicabilityGraphCreateMutation = {
+  response: StateOfApplicabilityGraphCreateMutation$data;
+  variables: StateOfApplicabilityGraphCreateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "StateOfApplicabilityEdge",
+  "kind": "LinkedField",
+  "name": "stateOfApplicabilityEdge",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "StateOfApplicability",
+      "kind": "LinkedField",
+      "name": "node",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "sourceId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "snapshotId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "createdAt",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "updatedAt",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "stateOfApplicabilityEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "c1a3721f591bc17ed455a326eb9edead",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphCreateMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphCreateMutation(\n  $input: CreateStateOfApplicabilityInput!\n) {\n  createStateOfApplicability(input: $input) {\n    stateOfApplicabilityEdge {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "294d4fe89f8cbbbb4b8170a46dd3cd7a";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphDeleteMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphDeleteMutation.graphql.ts
new file mode 100644
index 000000000..6eea78f1c
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphDeleteMutation.graphql.ts
@@ -0,0 +1,132 @@
+/**
+ * @generated SignedSource<<deb6f38f36dc011d0fc4fc060303a57a>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityInput = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphDeleteMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphDeleteMutation$data = {
+  readonly deleteStateOfApplicability: {
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type StateOfApplicabilityGraphDeleteMutation = {
+  response: StateOfApplicabilityGraphDeleteMutation$data;
+  variables: StateOfApplicabilityGraphDeleteMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedStateOfApplicabilityId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "197a2ed2b48d43372e16deae6e9b98c2",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphDeleteMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphDeleteMutation(\n  $input: DeleteStateOfApplicabilityInput!\n) {\n  deleteStateOfApplicability(input: $input) {\n    deletedStateOfApplicabilityId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "92ec928d4ad0fe7ff4ae78ad9f1f329a";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphForEditQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphForEditQuery.graphql.ts
new file mode 100644
index 000000000..580effdc0
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphForEditQuery.graphql.ts
@@ -0,0 +1,218 @@
+/**
+ * @generated SignedSource<<9e7f481aa8c95332bc03c3974a6752f8>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type StateOfApplicabilityGraphForEditQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphForEditQuery$data = {
+  readonly node: {
+    readonly controls?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly framework: {
+            readonly id: string;
+            readonly name: string;
+          };
+          readonly id: string;
+          readonly name: string;
+          readonly sectionTitle: string;
+        };
+      }>;
+    };
+    readonly id?: string;
+    readonly name?: string;
+  };
+};
+export type StateOfApplicabilityGraphForEditQuery = {
+  response: StateOfApplicabilityGraphForEditQuery$data;
+  variables: StateOfApplicabilityGraphForEditQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "name",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": [
+    {
+      "kind": "Literal",
+      "name": "first",
+      "value": 1000
+    },
+    {
+      "kind": "Literal",
+      "name": "orderBy",
+      "value": {
+        "direction": "ASC",
+        "field": "SECTION_TITLE"
+      }
+    }
+  ],
+  "concreteType": "ControlConnection",
+  "kind": "LinkedField",
+  "name": "controls",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "ControlEdge",
+      "kind": "LinkedField",
+      "name": "edges",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "Control",
+          "kind": "LinkedField",
+          "name": "node",
+          "plural": false,
+          "selections": [
+            (v2/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "sectionTitle",
+              "storageKey": null
+            },
+            (v3/*: any*/),
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "Framework",
+              "kind": "LinkedField",
+              "name": "framework",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                (v3/*: any*/)
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": "controls(first:1000,orderBy:{\"direction\":\"ASC\",\"field\":\"SECTION_TITLE\"})"
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/),
+              (v4/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/),
+              (v4/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "b6b5490aa177e6e7e8339060eac14a9c",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphForEditQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphForEditQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      controls(first: 1000, orderBy: {field: SECTION_TITLE, direction: ASC}) {\n        edges {\n          node {\n            id\n            sectionTitle\n            name\n            framework {\n              id\n              name\n            }\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e89010d6f8d66b9df856280a59d5f0c8";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql.ts
new file mode 100644
index 000000000..ef62ef176
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql.ts
@@ -0,0 +1,343 @@
+/**
+ * @generated SignedSource<<d96c71d40860ec6fc2e2ac8a5ab992f8>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphNodeQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityGraphNodeQuery$data = {
+  readonly node: {
+    readonly createdAt?: any;
+    readonly id?: string;
+    readonly name?: string;
+    readonly organization?: {
+      readonly id: string;
+    } | null | undefined;
+    readonly owner?: {
+      readonly fullName: string;
+      readonly id: string;
+    };
+    readonly snapshotId?: string | null | undefined;
+    readonly sourceId?: string | null | undefined;
+    readonly updatedAt?: any;
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+  };
+};
+export type StateOfApplicabilityGraphNodeQuery = {
+  response: StateOfApplicabilityGraphNodeQuery$data;
+  variables: StateOfApplicabilityGraphNodeQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "name",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "sourceId",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "snapshotId",
+  "storageKey": null
+},
+v6 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "createdAt",
+  "storageKey": null
+},
+v7 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "updatedAt",
+  "storageKey": null
+},
+v8 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "Organization",
+  "kind": "LinkedField",
+  "name": "organization",
+  "plural": false,
+  "selections": [
+    (v2/*: any*/)
+  ],
+  "storageKey": null
+},
+v9 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "People",
+  "kind": "LinkedField",
+  "name": "owner",
+  "plural": false,
+  "selections": [
+    (v2/*: any*/),
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "fullName",
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/),
+              (v4/*: any*/),
+              (v5/*: any*/),
+              (v6/*: any*/),
+              (v7/*: any*/),
+              (v8/*: any*/),
+              (v9/*: any*/),
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "StateOfApplicabilityControlsTabFragment"
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/),
+              (v4/*: any*/),
+              (v5/*: any*/),
+              (v6/*: any*/),
+              (v7/*: any*/),
+              (v8/*: any*/),
+              (v9/*: any*/),
+              {
+                "alias": "controlsInfo",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "first",
+                    "value": 0
+                  }
+                ],
+                "concreteType": "ControlConnection",
+                "kind": "LinkedField",
+                "name": "controls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "totalCount",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": "controls(first:0)"
+              },
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "AvailableStateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "availableControls",
+                "plural": true,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "sectionTitle",
+                    "storageKey": null
+                  },
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkName",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "organizationId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "regulatory",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "contractual",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "riskAssessment",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "2c2c6535c53d2073bd41b39771d1afd9",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphNodeQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphNodeQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      organization {\n        id\n      }\n      owner {\n        id\n        fullName\n      }\n      ...StateOfApplicabilityControlsTabFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "88e882f3c0f529cc7224eb19a91191cf";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql.ts
new file mode 100644
index 000000000..05c1e3cf3
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql.ts
@@ -0,0 +1,301 @@
+/**
+ * @generated SignedSource<<28b9e5609f5d7c082c209bf839533d45>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphPaginatedFragment$data = {
+  readonly id: string;
+  readonly statesOfApplicability: {
+    readonly __id: string;
+    readonly edges: ReadonlyArray<{
+      readonly node: {
+        readonly controlsInfo: {
+          readonly totalCount: number;
+        };
+        readonly createdAt: any;
+        readonly id: string;
+        readonly name: string;
+        readonly snapshotId: string | null | undefined;
+        readonly sourceId: string | null | undefined;
+        readonly updatedAt: any;
+      };
+    }>;
+  };
+  readonly " $fragmentType": "StateOfApplicabilityGraphPaginatedFragment";
+};
+export type StateOfApplicabilityGraphPaginatedFragment$key = {
+  readonly " $data"?: StateOfApplicabilityGraphPaginatedFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+};
+
+import StateOfApplicabilityListQuery_graphql from './StateOfApplicabilityListQuery.graphql';
+
+const node: ReaderFragment = (function(){
+var v0 = [
+  "statesOfApplicability"
+],
+v1 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "argumentDefinitions": [
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "after"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "before"
+    },
+    {
+      "defaultValue": {
+        "snapshotId": null
+      },
+      "kind": "LocalArgument",
+      "name": "filter"
+    },
+    {
+      "defaultValue": 50,
+      "kind": "LocalArgument",
+      "name": "first"
+    },
+    {
+      "defaultValue": null,
+      "kind": "LocalArgument",
+      "name": "last"
+    },
+    {
+      "defaultValue": {
+        "direction": "DESC",
+        "field": "CREATED_AT"
+      },
+      "kind": "LocalArgument",
+      "name": "order"
+    }
+  ],
+  "kind": "Fragment",
+  "metadata": {
+    "connection": [
+      {
+        "count": null,
+        "cursor": null,
+        "direction": "bidirectional",
+        "path": (v0/*: any*/)
+      }
+    ],
+    "refetch": {
+      "connection": {
+        "forward": {
+          "count": "first",
+          "cursor": "after"
+        },
+        "backward": {
+          "count": "last",
+          "cursor": "before"
+        },
+        "path": (v0/*: any*/)
+      },
+      "fragmentPathInResult": [
+        "node"
+      ],
+      "operation": StateOfApplicabilityListQuery_graphql,
+      "identifierInfo": {
+        "identifierField": "id",
+        "identifierQueryVariableName": "id"
+      }
+    }
+  },
+  "name": "StateOfApplicabilityGraphPaginatedFragment",
+  "selections": [
+    {
+      "alias": "statesOfApplicability",
+      "args": [
+        {
+          "kind": "Variable",
+          "name": "filter",
+          "variableName": "filter"
+        },
+        {
+          "kind": "Variable",
+          "name": "orderBy",
+          "variableName": "order"
+        }
+      ],
+      "concreteType": "StateOfApplicabilityConnection",
+      "kind": "LinkedField",
+      "name": "__StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability_connection",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "StateOfApplicabilityEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "StateOfApplicability",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v1/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "name",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "sourceId",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "snapshotId",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "createdAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "updatedAt",
+                  "storageKey": null
+                },
+                {
+                  "alias": "controlsInfo",
+                  "args": [
+                    {
+                      "kind": "Literal",
+                      "name": "first",
+                      "value": 0
+                    }
+                  ],
+                  "concreteType": "ControlConnection",
+                  "kind": "LinkedField",
+                  "name": "controls",
+                  "plural": false,
+                  "selections": [
+                    {
+                      "alias": null,
+                      "args": null,
+                      "kind": "ScalarField",
+                      "name": "totalCount",
+                      "storageKey": null
+                    }
+                  ],
+                  "storageKey": "controls(first:0)"
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "__typename",
+                  "storageKey": null
+                }
+              ],
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "cursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "PageInfo",
+          "kind": "LinkedField",
+          "name": "pageInfo",
+          "plural": false,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "endCursor",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasNextPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "hasPreviousPage",
+              "storageKey": null
+            },
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "startCursor",
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        },
+        {
+          "kind": "ClientExtension",
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "kind": "ScalarField",
+              "name": "__id",
+              "storageKey": null
+            }
+          ]
+        }
+      ],
+      "storageKey": null
+    },
+    (v1/*: any*/)
+  ],
+  "type": "Organization",
+  "abstractKey": null
+};
+})();
+
+(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql.ts
new file mode 100644
index 000000000..1ec1a4a58
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql.ts
@@ -0,0 +1,318 @@
+/**
+ * @generated SignedSource<<1c22107bf5691e7764aa30352d99631e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityGraphPaginatedQuery$variables = {
+  organizationId: string;
+};
+export type StateOfApplicabilityGraphPaginatedQuery$data = {
+  readonly organization: {
+    readonly id?: string;
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+  };
+};
+export type StateOfApplicabilityGraphPaginatedQuery = {
+  response: StateOfApplicabilityGraphPaginatedQuery$data;
+  variables: StateOfApplicabilityGraphPaginatedQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v4 = [
+  {
+    "kind": "Literal",
+    "name": "filter",
+    "value": {
+      "snapshotId": null
+    }
+  },
+  {
+    "kind": "Literal",
+    "name": "first",
+    "value": 50
+  },
+  {
+    "kind": "Literal",
+    "name": "orderBy",
+    "value": {
+      "direction": "DESC",
+      "field": "CREATED_AT"
+    }
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              {
+                "args": null,
+                "kind": "FragmentSpread",
+                "name": "StateOfApplicabilityGraphPaginatedFragment"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v4/*: any*/),
+                "concreteType": "StateOfApplicabilityConnection",
+                "kind": "LinkedField",
+                "name": "statesOfApplicability",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicability",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v2/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "sourceId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "snapshotId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": "controlsInfo",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "first",
+                                "value": 0
+                              }
+                            ],
+                            "concreteType": "ControlConnection",
+                            "kind": "LinkedField",
+                            "name": "controls",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "totalCount",
+                                "storageKey": null
+                              }
+                            ],
+                            "storageKey": "controls(first:0)"
+                          },
+                          (v3/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": "statesOfApplicability(filter:{\"snapshotId\":null},first:50,orderBy:{\"direction\":\"DESC\",\"field\":\"CREATED_AT\"})"
+              },
+              {
+                "alias": null,
+                "args": (v4/*: any*/),
+                "filters": [
+                  "orderBy",
+                  "filter"
+                ],
+                "handle": "connection",
+                "key": "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability",
+                "kind": "LinkedHandle",
+                "name": "statesOfApplicability"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "c5f5cb61622ba5e4309521002c23a530",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphPaginatedQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityGraphPaginatedQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      ...StateOfApplicabilityGraphPaginatedFragment\n    }\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment on Organization {\n  statesOfApplicability(first: 50, orderBy: {direction: DESC, field: CREATED_AT}, filter: {snapshotId: null}) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e5eb3f251055f7dd34f7af30251226ca";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphUpdateMutation.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphUpdateMutation.graphql.ts
new file mode 100644
index 000000000..e21dbc00a
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityGraphUpdateMutation.graphql.ts
@@ -0,0 +1,171 @@
+/**
+ * @generated SignedSource<<fe37fa58e9c374383c4f59dac08aed39>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type UpdateStateOfApplicabilityInput = {
+  id: string;
+  name?: string | null | undefined;
+  ownerId?: string | null | undefined;
+};
+export type StateOfApplicabilityGraphUpdateMutation$variables = {
+  input: UpdateStateOfApplicabilityInput;
+};
+export type StateOfApplicabilityGraphUpdateMutation$data = {
+  readonly updateStateOfApplicability: {
+    readonly stateOfApplicability: {
+      readonly createdAt: any;
+      readonly id: string;
+      readonly name: string;
+      readonly owner: {
+        readonly fullName: string;
+        readonly id: string;
+      };
+      readonly snapshotId: string | null | undefined;
+      readonly sourceId: string | null | undefined;
+      readonly updatedAt: any;
+    };
+  };
+};
+export type StateOfApplicabilityGraphUpdateMutation = {
+  response: StateOfApplicabilityGraphUpdateMutation$data;
+  variables: StateOfApplicabilityGraphUpdateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v2 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UpdateStateOfApplicabilityPayload",
+    "kind": "LinkedField",
+    "name": "updateStateOfApplicability",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "StateOfApplicability",
+        "kind": "LinkedField",
+        "name": "stateOfApplicability",
+        "plural": false,
+        "selections": [
+          (v1/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "sourceId",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "snapshotId",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "updatedAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "People",
+            "kind": "LinkedField",
+            "name": "owner",
+            "plural": false,
+            "selections": [
+              (v1/*: any*/),
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "fullName",
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "selections": (v2/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "selections": (v2/*: any*/)
+  },
+  "params": {
+    "cacheID": "609bd562b84162f2807ee89b3c3273aa",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityGraphUpdateMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityGraphUpdateMutation(\n  $input: UpdateStateOfApplicabilityInput!\n) {\n  updateStateOfApplicability(input: $input) {\n    stateOfApplicability {\n      id\n      name\n      sourceId\n      snapshotId\n      createdAt\n      updatedAt\n      owner {\n        id\n        fullName\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e8810210629ef7fad113616c06f141ee";
+
+export default node;
diff --git a/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityListQuery.graphql.ts b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityListQuery.graphql.ts
new file mode 100644
index 000000000..6f77f4847
--- /dev/null
+++ b/apps/console/src/hooks/graph/__generated__/StateOfApplicabilityListQuery.graphql.ts
@@ -0,0 +1,399 @@
+/**
+ * @generated SignedSource<<e0d47d3fdb15b30f904396b7bcd1328f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type OrderDirection = "ASC" | "DESC";
+export type StateOfApplicabilityOrderField = "CREATED_AT" | "NAME";
+export type StateOfApplicabilityFilter = {
+  snapshotId?: string | null | undefined;
+};
+export type StateOfApplicabilityOrder = {
+  direction: OrderDirection;
+  field: StateOfApplicabilityOrderField;
+};
+export type StateOfApplicabilityListQuery$variables = {
+  after?: any | null | undefined;
+  before?: any | null | undefined;
+  filter?: StateOfApplicabilityFilter | null | undefined;
+  first?: number | null | undefined;
+  id: string;
+  last?: number | null | undefined;
+  order?: StateOfApplicabilityOrder | null | undefined;
+};
+export type StateOfApplicabilityListQuery$data = {
+  readonly node: {
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityGraphPaginatedFragment">;
+  };
+};
+export type StateOfApplicabilityListQuery = {
+  response: StateOfApplicabilityListQuery$data;
+  variables: StateOfApplicabilityListQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "after"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "before"
+},
+v2 = {
+  "defaultValue": {
+    "snapshotId": null
+  },
+  "kind": "LocalArgument",
+  "name": "filter"
+},
+v3 = {
+  "defaultValue": 50,
+  "kind": "LocalArgument",
+  "name": "first"
+},
+v4 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "id"
+},
+v5 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "last"
+},
+v6 = {
+  "defaultValue": {
+    "direction": "DESC",
+    "field": "CREATED_AT"
+  },
+  "kind": "LocalArgument",
+  "name": "order"
+},
+v7 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "id"
+  }
+],
+v8 = {
+  "kind": "Variable",
+  "name": "after",
+  "variableName": "after"
+},
+v9 = {
+  "kind": "Variable",
+  "name": "before",
+  "variableName": "before"
+},
+v10 = {
+  "kind": "Variable",
+  "name": "filter",
+  "variableName": "filter"
+},
+v11 = {
+  "kind": "Variable",
+  "name": "first",
+  "variableName": "first"
+},
+v12 = {
+  "kind": "Variable",
+  "name": "last",
+  "variableName": "last"
+},
+v13 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v14 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v15 = [
+  (v8/*: any*/),
+  (v9/*: any*/),
+  (v10/*: any*/),
+  (v11/*: any*/),
+  (v12/*: any*/),
+  {
+    "kind": "Variable",
+    "name": "orderBy",
+    "variableName": "order"
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v4/*: any*/),
+      (v5/*: any*/),
+      (v6/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityListQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v7/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "args": [
+              (v8/*: any*/),
+              (v9/*: any*/),
+              (v10/*: any*/),
+              (v11/*: any*/),
+              (v12/*: any*/),
+              {
+                "kind": "Variable",
+                "name": "order",
+                "variableName": "order"
+              }
+            ],
+            "kind": "FragmentSpread",
+            "name": "StateOfApplicabilityGraphPaginatedFragment"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/),
+      (v2/*: any*/),
+      (v3/*: any*/),
+      (v5/*: any*/),
+      (v6/*: any*/),
+      (v4/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "StateOfApplicabilityListQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v7/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v13/*: any*/),
+          (v14/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v15/*: any*/),
+                "concreteType": "StateOfApplicabilityConnection",
+                "kind": "LinkedField",
+                "name": "statesOfApplicability",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicabilityEdge",
+                    "kind": "LinkedField",
+                    "name": "edges",
+                    "plural": true,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "concreteType": "StateOfApplicability",
+                        "kind": "LinkedField",
+                        "name": "node",
+                        "plural": false,
+                        "selections": [
+                          (v14/*: any*/),
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "name",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "sourceId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "snapshotId",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "createdAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": null,
+                            "args": null,
+                            "kind": "ScalarField",
+                            "name": "updatedAt",
+                            "storageKey": null
+                          },
+                          {
+                            "alias": "controlsInfo",
+                            "args": [
+                              {
+                                "kind": "Literal",
+                                "name": "first",
+                                "value": 0
+                              }
+                            ],
+                            "concreteType": "ControlConnection",
+                            "kind": "LinkedField",
+                            "name": "controls",
+                            "plural": false,
+                            "selections": [
+                              {
+                                "alias": null,
+                                "args": null,
+                                "kind": "ScalarField",
+                                "name": "totalCount",
+                                "storageKey": null
+                              }
+                            ],
+                            "storageKey": "controls(first:0)"
+                          },
+                          (v13/*: any*/)
+                        ],
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "cursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "PageInfo",
+                    "kind": "LinkedField",
+                    "name": "pageInfo",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "endCursor",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasNextPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "hasPreviousPage",
+                        "storageKey": null
+                      },
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "startCursor",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "kind": "ClientExtension",
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "__id",
+                        "storageKey": null
+                      }
+                    ]
+                  }
+                ],
+                "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": (v15/*: any*/),
+                "filters": [
+                  "orderBy",
+                  "filter"
+                ],
+                "handle": "connection",
+                "key": "StateOfApplicabilityGraphPaginatedQuery_statesOfApplicability",
+                "kind": "LinkedHandle",
+                "name": "statesOfApplicability"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "d3227559321509a2a525848a0e26e20b",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityListQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityListQuery(\n  $after: CursorKey = null\n  $before: CursorKey = null\n  $filter: StateOfApplicabilityFilter = {snapshotId: null}\n  $first: Int = 50\n  $last: Int = null\n  $order: StateOfApplicabilityOrder = {direction: DESC, field: CREATED_AT}\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityGraphPaginatedFragment_4cFWzS\n    id\n  }\n}\n\nfragment StateOfApplicabilityGraphPaginatedFragment_4cFWzS on Organization {\n  statesOfApplicability(first: $first, after: $after, last: $last, before: $before, orderBy: $order, filter: $filter) {\n    edges {\n      node {\n        id\n        name\n        sourceId\n        snapshotId\n        createdAt\n        updatedAt\n        controlsInfo: controls(first: 0) {\n          totalCount\n        }\n        __typename\n      }\n      cursor\n    }\n    pageInfo {\n      endCursor\n      hasNextPage\n      hasPreviousPage\n      startCursor\n    }\n  }\n  id\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "895fc79e61b95bf83997e3d5bcc7f367";
+
+export default node;
diff --git a/apps/console/src/layouts/MainLayout.tsx b/apps/console/src/layouts/MainLayout.tsx
index ef03d61e1..aa9766d35 100644
--- a/apps/console/src/layouts/MainLayout.tsx
+++ b/apps/console/src/layouts/MainLayout.tsx
@@ -22,6 +22,7 @@ import {
   IconInboxEmpty,
   IconKey,
   IconListStack,
+  IconPageCheck,
   IconLock,
   IconMagnifyingGlass,
   IconMedal,
@@ -231,6 +232,13 @@ function MainLayoutContent({
               to={`${prefix}/rights-requests`}
             />
           )}
+          {isAuthorized("Organization", "listStatesOfApplicability") && (
+            <SidebarItem
+              label={__("States of Applicability")}
+              icon={IconPageCheck}
+              to={`${prefix}/states-of-applicability`}
+            />
+          )}
           {isAuthorized("Organization", "listSnapshots") && (
             <SidebarItem
               label={__("Snapshots")}
diff --git a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
index f59fe7cbd..90cf22346 100644
--- a/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
+++ b/apps/console/src/pages/organizations/frameworks/FrameworkControlPage.tsx
@@ -21,7 +21,9 @@ import { useNavigate, useOutletContext } from "react-router";
 import { useOrganizationId } from "/hooks/useOrganizationId";
 import { LinkedDocumentsCard } from "/components/documents/LinkedDocumentsCard";
 import { LinkedAuditsCard } from "/components/audits/LinkedAuditsCard";
+import { LinkedObligationsCard } from "/components/obligations/LinkedObligationsCard";
 import { LinkedSnapshotsCard } from "/components/snapshots/LinkedSnapshotsCard";
+import { LinkedStatesOfApplicabilityCard } from "/components/states-of-applicability/LinkedStatesOfApplicabilityCard";
 import { FrameworkControlDialog } from "./dialogs/FrameworkControlDialog";
 import { promisifyMutation } from "@probo/helpers";
 import type { FrameworkGraphControlNodeQuery } from "/hooks/graph/__generated__/FrameworkGraphControlNodeQuery.graphql";
@@ -30,6 +32,35 @@ import type { FrameworkDetailPageFragment$data } from "./__generated__/Framework
 import { use } from "react";
 import { PermissionsContext } from "/providers/PermissionsContext";
 
+const attachStateOfApplicabilityMutation = graphql`
+  mutation FrameworkControlPageAttachStateOfApplicabilityMutation(
+    $input: CreateStateOfApplicabilityControlMappingInput!
+    $connections: [ID!]!
+  ) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          ...LinkedStatesOfApplicabilityCardFragment
+        }
+      }
+    }
+  }
+`;
+
+const detachStateOfApplicabilityMutation = graphql`
+  mutation FrameworkControlPageDetachStateOfApplicabilityMutation(
+    $input: DeleteStateOfApplicabilityControlMappingInput!
+    $connections: [ID!]!
+  ) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
 const attachMeasureMutation = graphql`
   mutation FrameworkControlPageAttachMutation(
     $input: CreateControlMeasureMappingInput!
@@ -111,6 +142,33 @@ const detachAuditMutation = graphql`
   }
 `;
 
+const attachObligationMutation = graphql`
+  mutation FrameworkControlPageAttachObligationMutation(
+    $input: CreateControlObligationMappingInput!
+    $connections: [ID!]!
+  ) {
+    createControlObligationMapping(input: $input) {
+      obligationEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          ...LinkedObligationsCardFragment
+        }
+      }
+    }
+  }
+`;
+
+const detachObligationMutation = graphql`
+  mutation FrameworkControlPageDetachObligationMutation(
+    $input: DeleteControlObligationMappingInput!
+    $connections: [ID!]!
+  ) {
+    deleteControlObligationMapping(input: $input) {
+      deletedObligationId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
 const attachSnapshotMutation = graphql`
   mutation FrameworkControlPageAttachSnapshotMutation(
     $input: CreateControlSnapshotMappingInput!
@@ -168,16 +226,24 @@ export default function FrameworkControlPage({ queryRef }: Props) {
   const confirm = useConfirm();
   const navigate = useNavigate();
   const { isAuthorized } = use(PermissionsContext);
+  const [detachStateOfApplicability, isDetachingStateOfApplicability] = useMutation(detachStateOfApplicabilityMutation);
+  const [attachStateOfApplicability, isAttachingStateOfApplicability] = useMutation(attachStateOfApplicabilityMutation);
   const [detachMeasure, isDetachingMeasure] = useMutation(detachMeasureMutation);
   const [attachMeasure, isAttachingMeasure] = useMutation(attachMeasureMutation);
   const [detachDocument, isDetachingDocument] = useMutation(detachDocumentMutation);
   const [attachDocument, isAttachingDocument] = useMutation(attachDocumentMutation);
   const [detachAudit, isDetachingAudit] = useMutation(detachAuditMutation);
   const [attachAudit, isAttachingAudit] = useMutation(attachAuditMutation);
+  const [detachObligation, isDetachingObligation] = useMutation(detachObligationMutation);
+  const [attachObligation, isAttachingObligation] = useMutation(attachObligationMutation);
   const [detachSnapshot, isDetachingSnapshot] = useMutation(detachSnapshotMutation);
   const [attachSnapshot, isAttachingSnapshot] = useMutation(attachSnapshotMutation);
   const [deleteControl] = useMutation(deleteControlMutation);
 
+  const canLinkStateOfApplicability = isAuthorized("Control", "createStateOfApplicabilityControlMapping");
+  const canUnlinkStateOfApplicability = isAuthorized("Control", "deleteStateOfApplicabilityControlMapping");
+  const statesOfApplicabilityReadOnly = !canLinkStateOfApplicability && !canUnlinkStateOfApplicability;
+
   const canLinkMeasure = isAuthorized("Control", "createControlMeasureMapping");
   const canUnlinkMeasure = isAuthorized("Control", "deleteControlMeasureMapping");
   const measuresReadOnly = !canLinkMeasure && !canUnlinkMeasure;
@@ -190,6 +256,10 @@ export default function FrameworkControlPage({ queryRef }: Props) {
   const canUnlinkAudit = isAuthorized("Control", "deleteControlAuditMapping");
   const auditsReadOnly = !canLinkAudit && !canUnlinkAudit;
 
+  const canLinkObligation = isAuthorized("Control", "createControlObligationMapping");
+  const canUnlinkObligation = isAuthorized("Control", "deleteControlObligationMapping");
+  const obligationsReadOnly = !canLinkObligation && !canUnlinkObligation;
+
   const canLinkSnapshot = isAuthorized("Control", "createControlSnapshotMapping");
   const canUnlinkSnapshot = isAuthorized("Control", "deleteControlSnapshotMapping");
   const snapshotsReadOnly = !canLinkSnapshot && !canUnlinkSnapshot;
@@ -278,20 +348,20 @@ export default function FrameworkControlPage({ queryRef }: Props) {
         </div>
       </div>
 
-      {control.status === "EXCLUDED" && (
-        <div className="bg-danger border border-border-danger rounded-lg p-4">
-          <div className="flex items-center gap-2 mb-2">
-            <div className="font-medium text-txt-danger">
-              {__("This control is excluded")}
-            </div>
-          </div>
-          <div className="text-sm">
-            <strong>{__("Justification:")}</strong> {control.exclusionJustification || __("No justification provided")}
-          </div>
-        </div>
-      )}
       <div className={control.status === "EXCLUDED" ? "opacity-60" : ""}>
         <div className="text-base mb-4">{control.name}</div>
+        <div className="mb-4">
+          <LinkedStatesOfApplicabilityCard
+            variant="card"
+            statesOfApplicability={control.stateOfApplicabilityControls?.edges.map((edge) => edge.node) ?? []}
+            params={{ controlId: control.id }}
+            connectionId={control.stateOfApplicabilityControls?.__id ?? ""}
+            onAttach={withErrorHandling(attachStateOfApplicability, __("Failed to link state of applicability"))}
+            onDetach={withErrorHandling(detachStateOfApplicability, __("Failed to unlink state of applicability"))}
+            disabled={isAttachingStateOfApplicability || isDetachingStateOfApplicability}
+            readOnly={statesOfApplicabilityReadOnly}
+          />
+        </div>
         <div className="mb-4">
           <LinkedMeasuresCard
             variant="card"
@@ -328,6 +398,18 @@ export default function FrameworkControlPage({ queryRef }: Props) {
             readOnly={auditsReadOnly}
           />
         </div>
+        <div className="mb-4">
+          <LinkedObligationsCard
+            variant="card"
+            obligations={control.obligations?.edges.map((edge) => edge.node) ?? []}
+            params={{ controlId: control.id }}
+            connectionId={control.obligations?.__id ?? ""}
+            onAttach={withErrorHandling(attachObligation, __("Failed to link obligation"))}
+            onDetach={withErrorHandling(detachObligation, __("Failed to unlink obligation"))}
+            disabled={isAttachingObligation || isDetachingObligation}
+            readOnly={obligationsReadOnly}
+          />
+        </div>
         <div className="mb-4">
           <LinkedSnapshotsCard
             variant="card"
diff --git a/apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx b/apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx
index 3c3828c01..ed2306dfd 100644
--- a/apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx
+++ b/apps/console/src/pages/organizations/frameworks/FrameworkDetailPage.tsx
@@ -53,6 +53,7 @@ const frameworkDetailFragment = graphql`
           name
           status
           exclusionJustification
+          bestPractice
         }
       }
     }
diff --git a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachObligationMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachObligationMutation.graphql.ts
new file mode 100644
index 000000000..edca3c994
--- /dev/null
+++ b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachObligationMutation.graphql.ts
@@ -0,0 +1,235 @@
+/**
+ * @generated SignedSource<<b06f8ea18b076203f2e1ab8bae17d45f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type CreateControlObligationMappingInput = {
+  controlId: string;
+  obligationId: string;
+};
+export type FrameworkControlPageAttachObligationMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateControlObligationMappingInput;
+};
+export type FrameworkControlPageAttachObligationMutation$data = {
+  readonly createControlObligationMapping: {
+    readonly obligationEdge: {
+      readonly node: {
+        readonly id: string;
+        readonly " $fragmentSpreads": FragmentRefs<"LinkedObligationsCardFragment">;
+      };
+    };
+  };
+};
+export type FrameworkControlPageAttachObligationMutation = {
+  response: FrameworkControlPageAttachObligationMutation$data;
+  variables: FrameworkControlPageAttachObligationMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "createControlObligationMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "ObligationEdge",
+            "kind": "LinkedField",
+            "name": "obligationEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "Obligation",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "args": null,
+                    "kind": "FragmentSpread",
+                    "name": "LinkedObligationsCardFragment"
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "createControlObligationMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "ObligationEdge",
+            "kind": "LinkedField",
+            "name": "obligationEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "Obligation",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "requirement",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "area",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "source",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "status",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "People",
+                    "kind": "LinkedField",
+                    "name": "owner",
+                    "plural": false,
+                    "selections": [
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "fullName",
+                        "storageKey": null
+                      },
+                      (v3/*: any*/)
+                    ],
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "obligationEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "e5dce8dc0bc03faa0e4d42696c76b59d",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageAttachObligationMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageAttachObligationMutation(\n  $input: CreateControlObligationMappingInput!\n) {\n  createControlObligationMapping(input: $input) {\n    obligationEdge {\n      node {\n        id\n        ...LinkedObligationsCardFragment\n      }\n    }\n  }\n}\n\nfragment LinkedObligationsCardFragment on Obligation {\n  id\n  requirement\n  area\n  source\n  status\n  owner {\n    fullName\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "3c4bfe48fd9db37ce70cecd890d7248a";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachStateOfApplicabilityMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachStateOfApplicabilityMutation.graphql.ts
new file mode 100644
index 000000000..6d42c4798
--- /dev/null
+++ b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageAttachStateOfApplicabilityMutation.graphql.ts
@@ -0,0 +1,237 @@
+/**
+ * @generated SignedSource<<6798ad28a0faeedef40b1b0a89f7563e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly id: string;
+        readonly " $fragmentSpreads": FragmentRefs<"LinkedStatesOfApplicabilityCardFragment">;
+      };
+    };
+  };
+};
+export type FrameworkControlPageAttachStateOfApplicabilityMutation = {
+  response: FrameworkControlPageAttachStateOfApplicabilityMutation$data;
+  variables: FrameworkControlPageAttachStateOfApplicabilityMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "args": null,
+                    "kind": "FragmentSpread",
+                    "name": "LinkedStatesOfApplicabilityCardFragment"
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v3/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "concreteType": "StateOfApplicability",
+                    "kind": "LinkedField",
+                    "name": "stateOfApplicability",
+                    "plural": false,
+                    "selections": [
+                      (v3/*: any*/),
+                      {
+                        "alias": null,
+                        "args": null,
+                        "kind": "ScalarField",
+                        "name": "name",
+                        "storageKey": null
+                      }
+                    ],
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "stateOfApplicabilityControlEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "205bc4f133e268c943ef9df9881350f0",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageAttachStateOfApplicabilityMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageAttachStateOfApplicabilityMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        id\n        ...LinkedStatesOfApplicabilityCardFragment\n      }\n    }\n  }\n}\n\nfragment LinkedStatesOfApplicabilityCardFragment on StateOfApplicabilityControl {\n  id\n  stateOfApplicabilityId\n  controlId\n  stateOfApplicability {\n    id\n    name\n  }\n  applicability\n  justification\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "8da7bd1e22eb2eaf857a4e97cea47e90";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachObligationMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachObligationMutation.graphql.ts
new file mode 100644
index 000000000..c6a8fca24
--- /dev/null
+++ b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachObligationMutation.graphql.ts
@@ -0,0 +1,133 @@
+/**
+ * @generated SignedSource<<b1b8d1f4c0dc579cacc0434be9b36259>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteControlObligationMappingInput = {
+  controlId: string;
+  obligationId: string;
+};
+export type FrameworkControlPageDetachObligationMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteControlObligationMappingInput;
+};
+export type FrameworkControlPageDetachObligationMutation$data = {
+  readonly deleteControlObligationMapping: {
+    readonly deletedObligationId: string;
+  };
+};
+export type FrameworkControlPageDetachObligationMutation = {
+  response: FrameworkControlPageDetachObligationMutation$data;
+  variables: FrameworkControlPageDetachObligationMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedObligationId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteControlObligationMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteControlObligationMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteControlObligationMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedObligationId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "90f4a67d3a22217cc62841266c5a0450",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageDetachObligationMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageDetachObligationMutation(\n  $input: DeleteControlObligationMappingInput!\n) {\n  deleteControlObligationMapping(input: $input) {\n    deletedObligationId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "92da0169c3d421a658aa560b4e5ba1c8";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachStateOfApplicabilityMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachStateOfApplicabilityMutation.graphql.ts
new file mode 100644
index 000000000..0a647fe72
--- /dev/null
+++ b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkControlPageDetachStateOfApplicabilityMutation.graphql.ts
@@ -0,0 +1,153 @@
+/**
+ * @generated SignedSource<<b5ac3d2a6151aa858185089d6d979a34>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type FrameworkControlPageDetachStateOfApplicabilityMutation = {
+  response: FrameworkControlPageDetachStateOfApplicabilityMutation$data;
+  variables: FrameworkControlPageDetachStateOfApplicabilityMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedControlId",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedStateOfApplicabilityControlId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v4/*: any*/),
+          (v5/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "deleteStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          (v4/*: any*/),
+          (v5/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedStateOfApplicabilityControlId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "f0ec8162516546b2cdd221c0c9832908",
+    "id": null,
+    "metadata": {},
+    "name": "FrameworkControlPageDetachStateOfApplicabilityMutation",
+    "operationKind": "mutation",
+    "text": "mutation FrameworkControlPageDetachStateOfApplicabilityMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "f1a4efbd039ed9f457905903df50a160";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkDetailPageFragment.graphql.ts b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkDetailPageFragment.graphql.ts
index de73066cc..2a4c2b603 100644
--- a/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkDetailPageFragment.graphql.ts
+++ b/apps/console/src/pages/organizations/frameworks/__generated__/FrameworkDetailPageFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<1da75e11f49e841800329ded9f67a1d4>>
+ * @generated SignedSource<<1c21fa202a0315a19517c79eb93932f3>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -16,6 +16,7 @@ export type FrameworkDetailPageFragment$data = {
     readonly __id: string;
     readonly edges: ReadonlyArray<{
       readonly node: {
+        readonly bestPractice: boolean;
         readonly exclusionJustification: string | null | undefined;
         readonly id: string;
         readonly name: string;
@@ -155,6 +156,13 @@ return {
                   "kind": "ScalarField",
                   "name": "exclusionJustification",
                   "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "bestPractice",
+                  "storageKey": null
                 }
               ],
               "storageKey": null
@@ -183,6 +191,6 @@ return {
 };
 })();
 
-(node as any).hash = "34a82531b8812ee16e75eb035bc739e8";
+(node as any).hash = "e7be231a4f5cbad12945d2ca627cc442";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
index 651663a6b..e3ee92eb0 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/FrameworkControlDialog.tsx
@@ -6,8 +6,8 @@ import {
   DialogFooter,
   Input,
   Textarea,
-  Option,
   useDialogRef,
+  Checkbox,
 } from "@probo/ui";
 import type { ReactNode } from "react";
 import { useTranslate } from "@probo/i18n";
@@ -17,7 +17,6 @@ import type { FrameworkControlDialogFragment$key } from "./__generated__/Framewo
 import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { z } from "zod";
 import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
-import { ControlledSelect } from "/components/form/ControlledField";
 import { useEffect, useMemo } from "react";
 
 type Props = {
@@ -35,6 +34,7 @@ const controlFragment = graphql`
     sectionTitle
     status
     exclusionJustification
+    bestPractice
   }
 `;
 
@@ -67,16 +67,7 @@ const schema = z.object({
   name: z.string(),
   description: z.string().optional().nullable(),
   sectionTitle: z.string(),
-  status: z.enum(["INCLUDED", "EXCLUDED"]),
-  exclusionJustification: z.string().optional(),
-}).refine((data) => {
-  if (data.status === "EXCLUDED") {
-    return data.exclusionJustification && data.exclusionJustification.trim().length > 0;
-  }
-  return true;
-}, {
-  message: "Exclusion justification is required when status is excluded",
-  path: ["exclusionJustification"],
+  bestPractice: z.boolean(),
 });
 
 export function FrameworkControlDialog(props: Props) {
@@ -92,11 +83,10 @@ export function FrameworkControlDialog(props: Props) {
     name: frameworkControl?.name ?? "",
     description: frameworkControl?.description ?? "",
     sectionTitle: frameworkControl?.sectionTitle ?? "",
-    status: frameworkControl?.status ?? "INCLUDED",
-    exclusionJustification: frameworkControl?.exclusionJustification ?? "",
+    bestPractice: frameworkControl?.bestPractice ?? true,
   }), [frameworkControl]);
 
-  const { control, handleSubmit, register, reset, watch } = useFormWithSchema(schema, {
+  const { handleSubmit, register, reset, watch, setValue } = useFormWithSchema(schema, {
     defaultValues,
   });
 
@@ -104,8 +94,7 @@ export function FrameworkControlDialog(props: Props) {
     reset(defaultValues);
   }, [defaultValues, reset]);
 
-  const statusValue = watch("status");
-  const showExclusionJustification = statusValue === "EXCLUDED";
+  const bestPracticeValue = watch("bestPractice");
 
   const onSubmit = handleSubmit(async (data) => {
     if (frameworkControl) {
@@ -117,8 +106,7 @@ export function FrameworkControlDialog(props: Props) {
             name: data.name,
             description: data.description || null,
             sectionTitle: data.sectionTitle,
-            status: data.status,
-            exclusionJustification: data.status === "EXCLUDED" ? data.exclusionJustification : null,
+            bestPractice: data.bestPractice,
           },
         },
       });
@@ -131,8 +119,7 @@ export function FrameworkControlDialog(props: Props) {
             name: data.name,
             description: data.description || null,
             sectionTitle: data.sectionTitle,
-            status: data.status,
-            exclusionJustification: data.status === "EXCLUDED" ? data.exclusionJustification : null,
+            bestPractice: data.bestPractice ?? true,
           },
           connections: [props.connectionId!],
         },
@@ -178,23 +165,13 @@ export function FrameworkControlDialog(props: Props) {
             placeholder={__("Add description")}
             {...register("description")}
           />
-          <ControlledSelect
-            control={control}
-            name="status"
-            placeholder={__("Select status")}
-          >
-            <Option value="INCLUDED">{__("Included")}</Option>
-            <Option value="EXCLUDED">{__("Excluded")}</Option>
-          </ControlledSelect>
-          {showExclusionJustification && (
-            <Textarea
-              required
-              id="exclusionJustification"
-              variant="bordered"
-              placeholder={__("Reason for exclusion")}
-              {...register("exclusionJustification")}
+          <label className="flex items-center gap-2 cursor-pointer">
+            <Checkbox
+              checked={bestPracticeValue}
+              onChange={(checked) => setValue("bestPractice", checked)}
             />
-          )}
+            <span className="text-sm">{__("Best Practice")}</span>
+          </label>
         </DialogContent>
         <DialogFooter>
           <Button type="submit" disabled={isMutating}>
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogCreateMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogCreateMutation.graphql.ts
index 86092a92f..9845a1459 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogCreateMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogCreateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<7985268ac23df51ae6187b72c4f33d83>>
+ * @generated SignedSource<<35c2c66dca0c895c7abca2b0f4917a68>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ConcreteRequest } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 export type CreateControlInput = {
+  bestPractice: boolean;
   description?: string | null | undefined;
   exclusionJustification?: string | null | undefined;
   frameworkId: string;
@@ -181,6 +182,13 @@ return {
                     "kind": "ScalarField",
                     "name": "exclusionJustification",
                     "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
                   }
                 ],
                 "storageKey": null
@@ -210,12 +218,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "3df2d5a0a51c774ccf711423e947093d",
+    "cacheID": "81df1f9c65937d3e387edffc6e9a28ac",
     "id": null,
     "metadata": {},
     "name": "FrameworkControlDialogCreateMutation",
     "operationKind": "mutation",
-    "text": "mutation FrameworkControlDialogCreateMutation(\n  $input: CreateControlInput!\n) {\n  createControl(input: $input) {\n    controlEdge {\n      node {\n        ...FrameworkControlDialogFragment\n        id\n      }\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n"
+    "text": "mutation FrameworkControlDialogCreateMutation(\n  $input: CreateControlInput!\n) {\n  createControl(input: $input) {\n    controlEdge {\n      node {\n        ...FrameworkControlDialogFragment\n        id\n      }\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogFragment.graphql.ts b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogFragment.graphql.ts
index 8da6cf691..3d5f36c10 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogFragment.graphql.ts
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<67703eb04d68c2798f5549ed6d948339>>
+ * @generated SignedSource<<3a62e5f931a990d83caca02ab629b0c0>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ReaderFragment } from 'relay-runtime';
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 import { FragmentRefs } from "relay-runtime";
 export type FrameworkControlDialogFragment$data = {
+  readonly bestPractice: boolean;
   readonly description: string | null | undefined;
   readonly exclusionJustification: string | null | undefined;
   readonly id: string;
@@ -72,12 +73,19 @@ const node: ReaderFragment = {
       "kind": "ScalarField",
       "name": "exclusionJustification",
       "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "bestPractice",
+      "storageKey": null
     }
   ],
   "type": "Control",
   "abstractKey": null
 };
 
-(node as any).hash = "856a8302abf15737b6a4d4316b77f8cc";
+(node as any).hash = "481f75ce8c525c1fa12517ef173ad868";
 
 export default node;
diff --git a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogUpdateMutation.graphql.ts b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogUpdateMutation.graphql.ts
index 38cb81585..d8d19fde7 100644
--- a/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogUpdateMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/frameworks/dialogs/__generated__/FrameworkControlDialogUpdateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<7d04994d5cabbbfc12f82754e8da0d83>>
+ * @generated SignedSource<<7ee3c72e16fa86d6c006c004e4f93c95>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -12,6 +12,7 @@ import { ConcreteRequest } from 'relay-runtime';
 import { FragmentRefs } from "relay-runtime";
 export type ControlStatus = "EXCLUDED" | "INCLUDED";
 export type UpdateControlInput = {
+  bestPractice?: boolean | null | undefined;
   description?: string | null | undefined;
   exclusionJustification?: string | null | undefined;
   id: string;
@@ -150,6 +151,13 @@ return {
                 "kind": "ScalarField",
                 "name": "exclusionJustification",
                 "storageKey": null
+              },
+              {
+                "alias": null,
+                "args": null,
+                "kind": "ScalarField",
+                "name": "bestPractice",
+                "storageKey": null
               }
             ],
             "storageKey": null
@@ -160,12 +168,12 @@ return {
     ]
   },
   "params": {
-    "cacheID": "cee79ce9185400bad478453c44930dd6",
+    "cacheID": "374c69b33dd6e94dec75829fe0777f58",
     "id": null,
     "metadata": {},
     "name": "FrameworkControlDialogUpdateMutation",
     "operationKind": "mutation",
-    "text": "mutation FrameworkControlDialogUpdateMutation(\n  $input: UpdateControlInput!\n) {\n  updateControl(input: $input) {\n    control {\n      ...FrameworkControlDialogFragment\n      id\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n}\n"
+    "text": "mutation FrameworkControlDialogUpdateMutation(\n  $input: UpdateControlInput!\n) {\n  updateControl(input: $input) {\n    control {\n      ...FrameworkControlDialogFragment\n      id\n    }\n  }\n}\n\nfragment FrameworkControlDialogFragment on Control {\n  id\n  name\n  description\n  sectionTitle\n  status\n  exclusionJustification\n  bestPractice\n}\n"
   }
 };
 })();
diff --git a/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx b/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
index 8704b8164..3735b7f02 100644
--- a/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
+++ b/apps/console/src/pages/organizations/obligations/ObligationDetailsPage.tsx
@@ -32,7 +32,7 @@ import { useFormWithSchema } from "/hooks/useFormWithSchema";
 import { Controller } from "react-hook-form";
 import { formatError, type GraphQLError } from "@probo/helpers";
 import z from "zod";
-import { getObligationStatusVariant, getObligationStatusLabel, formatDatetime, getObligationStatusOptions, validateSnapshotConsistency } from "@probo/helpers";
+import { getObligationStatusVariant, getObligationStatusLabel, formatDatetime, getObligationStatusOptions, getObligationTypeOptions, validateSnapshotConsistency } from "@probo/helpers";
 import { SnapshotBanner } from "/components/SnapshotBanner";
 import type { ObligationGraphNodeQuery } from "/hooks/graph/__generated__/ObligationGraphNodeQuery.graphql";
 import { use } from "react";
@@ -44,6 +44,7 @@ const updateObligationSchema = z.object({
   requirement: z.string().optional(),
   actionsToBeImplemented: z.string().optional(),
   regulator: z.string().optional(),
+  type: z.enum(["LEGAL", "CONTRACTUAL"]),
   lastReviewDate: z.string().optional(),
   dueDate: z.string().optional(),
   status: z.enum(["NON_COMPLIANT", "PARTIALLY_COMPLIANT", "COMPLIANT"]),
@@ -68,6 +69,7 @@ export default function ObligationDetailsPage(props: Props) {
 
   const updateObligation = useUpdateObligation();
   const statusOptions = getObligationStatusOptions(__);
+  const typeOptions = getObligationTypeOptions(__);
 
   const connectionId = ConnectionHandler.getConnectionID(
     organizationId,
@@ -88,6 +90,7 @@ export default function ObligationDetailsPage(props: Props) {
         requirement: obligation?.requirement || "",
         actionsToBeImplemented: obligation?.actionsToBeImplemented || "",
         regulator: obligation?.regulator || "",
+        type: obligation?.type ?? "LEGAL",
         lastReviewDate: obligation?.lastReviewDate
           ? new Date(obligation.lastReviewDate).toISOString().split("T")[0]
           : "",
@@ -109,6 +112,7 @@ export default function ObligationDetailsPage(props: Props) {
         requirement: formData.requirement || undefined,
         actionsToBeImplemented: formData.actionsToBeImplemented || undefined,
         regulator: formData.regulator || undefined,
+        type: formData.type,
         lastReviewDate: formatDatetime(formData.lastReviewDate) ?? null,
         dueDate: formatDatetime(formData.dueDate) ?? null,
         status: formData.status,
@@ -247,6 +251,29 @@ export default function ObligationDetailsPage(props: Props) {
                 disabled={isSnapshotMode}
               />
             </Field>
+
+            <Field label={__("Type")} error={formState.errors.type?.message}>
+              <Controller
+                control={control}
+                name="type"
+                render={({ field }) => (
+                  <Select
+                    variant="editor"
+                    placeholder={__("Select type")}
+                    onValueChange={field.onChange}
+                    value={field.value}
+                    className="w-full"
+                    disabled={isSnapshotMode}
+                  >
+                    {typeOptions.map((option) => (
+                      <Option key={option.value} value={option.value}>
+                        {option.label}
+                      </Option>
+                    ))}
+                  </Select>
+                )}
+              />
+            </Field>
           </div>
 
           <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
diff --git a/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx b/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
index 225e72a4d..4e871e96d 100644
--- a/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
+++ b/apps/console/src/pages/organizations/obligations/dialogs/CreateObligationDialog.tsx
@@ -21,7 +21,7 @@ import { useCreateObligation } from "../../../../hooks/graph/ObligationGraph";
 import { PeopleSelectField } from "/components/form/PeopleSelectField";
 import { Controller } from "react-hook-form";
 import { formatError, type GraphQLError } from "@probo/helpers";
-import { formatDatetime, getObligationStatusOptions } from "@probo/helpers";
+import { formatDatetime, getObligationStatusOptions, getObligationTypeOptions } from "@probo/helpers";
 
 const schema = z.object({
   area: z.string().optional(),
@@ -29,6 +29,7 @@ const schema = z.object({
   requirement: z.string().optional(),
   actionsToBeImplemented: z.string().optional(),
   regulator: z.string().optional(),
+  type: z.enum(["LEGAL", "CONTRACTUAL"]),
   ownerId: z.string().min(1, "Owner is required"),
   lastReviewDate: z.string().optional(),
   dueDate: z.string().optional(),
@@ -54,6 +55,7 @@ export function CreateObligationDialog({
 
   const createObligation = useCreateObligation(connection || "");
   const statusOptions = getObligationStatusOptions(__);
+  const typeOptions = getObligationTypeOptions(__);
 
   const { register, handleSubmit, formState, reset, control } = useFormWithSchema(schema, {
     defaultValues: {
@@ -62,6 +64,7 @@ export function CreateObligationDialog({
       requirement: "",
       actionsToBeImplemented: "",
       regulator: "",
+      type: "LEGAL" as const,
       ownerId: "",
       lastReviewDate: "",
       dueDate: "",
@@ -78,6 +81,7 @@ export function CreateObligationDialog({
         requirement: formData.requirement || undefined,
         actionsToBeImplemented: formData.actionsToBeImplemented || undefined,
         regulator: formData.regulator || undefined,
+        type: formData.type,
         ownerId: formData.ownerId,
         lastReviewDate: formatDatetime(formData.lastReviewDate),
         dueDate: formatDatetime(formData.dueDate),
@@ -169,6 +173,31 @@ export function CreateObligationDialog({
               placeholder={__("Enter regulator")}
               error={formState.errors.regulator?.message}
             />
+
+            <Field label={__("Type")}>
+              <Controller
+                control={control}
+                name="type"
+                render={({ field }) => (
+                  <Select
+                    variant="editor"
+                    placeholder={__("Select type")}
+                    onValueChange={field.onChange}
+                    value={field.value}
+                    className="w-full"
+                  >
+                    {typeOptions.map((option) => (
+                      <Option key={option.value} value={option.value}>
+                        {option.label}
+                      </Option>
+                    ))}
+                  </Select>
+                )}
+              />
+              {formState.errors.type && (
+                <p className="text-sm text-red-500 mt-1">{formState.errors.type.message}</p>
+              )}
+            </Field>
           </div>
 
           <div className="grid grid-cols-2 gap-4">
diff --git a/apps/console/src/pages/organizations/snapshots/__generated__/SnapshotsPageFragment.graphql.ts b/apps/console/src/pages/organizations/snapshots/__generated__/SnapshotsPageFragment.graphql.ts
index a60a7eac3..17a398634 100644
--- a/apps/console/src/pages/organizations/snapshots/__generated__/SnapshotsPageFragment.graphql.ts
+++ b/apps/console/src/pages/organizations/snapshots/__generated__/SnapshotsPageFragment.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<79d48ab0fd5b269022244b0777eac279>>
+ * @generated SignedSource<<e9e261236245bcf1724038c76fe9918c>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ReaderFragment } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 import { FragmentRefs } from "relay-runtime";
 export type SnapshotsPageFragment$data = {
   readonly snapshots: {
diff --git a/apps/console/src/pages/organizations/snapshots/dialog/__generated__/SnapshotFormDialogCreateMutation.graphql.ts b/apps/console/src/pages/organizations/snapshots/dialog/__generated__/SnapshotFormDialogCreateMutation.graphql.ts
index 41363f5f4..d399ab081 100644
--- a/apps/console/src/pages/organizations/snapshots/dialog/__generated__/SnapshotFormDialogCreateMutation.graphql.ts
+++ b/apps/console/src/pages/organizations/snapshots/dialog/__generated__/SnapshotFormDialogCreateMutation.graphql.ts
@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<4a28eec1f25c5d290bc070a534042521>>
+ * @generated SignedSource<<d0a4f2beac754ba3a7865f227b9d6aae>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -9,7 +9,7 @@
 // @ts-nocheck
 
 import { ConcreteRequest } from 'relay-runtime';
-export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "VENDORS";
+export type SnapshotsType = "ASSETS" | "CONTINUAL_IMPROVEMENTS" | "DATA" | "NONCONFORMITIES" | "OBLIGATIONS" | "PROCESSING_ACTIVITIES" | "RISKS" | "STATES_OF_APPLICABILITY" | "VENDORS";
 export type CreateSnapshotInput = {
   description?: string | null | undefined;
   name: string;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx b/apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx
new file mode 100644
index 000000000..d3661fa33
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage.tsx
@@ -0,0 +1,364 @@
+import { useNavigate, useParams } from "react-router";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import {
+  ActionDropdown,
+  Breadcrumb,
+  DropdownItem,
+  IconTrashCan,
+  IconArrowDown,
+  PageHeader,
+  Card,
+  Button,
+  IconPencil,
+  IconCheckmark1,
+  IconCrossLargeX,
+  Input,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import {
+  ConnectionHandler,
+  graphql,
+  type PreloadedQuery,
+  usePreloadedQuery,
+} from "react-relay";
+import type {
+  StateOfApplicabilityGraphNodeQuery,
+} from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+import type { StateOfApplicabilityDetailPageExportMutation } from "./__generated__/StateOfApplicabilityDetailPageExportMutation.graphql";
+import {
+  StateOfApplicabilityConnectionKey,
+  stateOfApplicabilityNodeQuery,
+  useDeleteStateOfApplicability,
+  updateStateOfApplicabilityMutation,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import { use, useState, Suspense } from "react";
+import { PermissionsContext } from "/providers/PermissionsContext";
+import { usePageTitle } from "@probo/hooks";
+import { formatDate, validateSnapshotConsistency } from "@probo/helpers";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { z } from "zod";
+import StateOfApplicabilityControlsTab from "./tabs/StateOfApplicabilityControlsTab";
+import { SnapshotBanner } from "/components/SnapshotBanner";
+import { PeopleSelectField } from "/components/form/PeopleSelectField";
+
+const exportStateOfApplicabilityPDFMutation = graphql`
+  mutation StateOfApplicabilityDetailPageExportMutation($input: ExportStateOfApplicabilityPDFInput!) {
+    exportStateOfApplicabilityPDF(input: $input) {
+      data
+    }
+  }
+`;
+
+type Props = {
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphNodeQuery>;
+};
+
+export default function StateOfApplicabilityDetailPage(props: Props) {
+  const { stateOfApplicabilityId, snapshotId } = useParams<{ stateOfApplicabilityId: string; snapshotId?: string }>();
+  const organizationId = useOrganizationId();
+  const data = usePreloadedQuery(stateOfApplicabilityNodeQuery, props.queryRef);
+  const stateOfApplicability = data.node;
+  const { __ } = useTranslate();
+  const navigate = useNavigate();
+  const { isAuthorized } = use(PermissionsContext);
+  const isSnapshotMode = Boolean(snapshotId);
+
+  if (!stateOfApplicabilityId || !stateOfApplicability) {
+    throw new Error(
+      "Cannot load state of applicability detail page without stateOfApplicabilityId parameter",
+    );
+  }
+
+  validateSnapshotConsistency(stateOfApplicability, snapshotId);
+
+  const connectionId = ConnectionHandler.getConnectionID(
+    organizationId,
+    StateOfApplicabilityConnectionKey,
+  );
+
+  const deleteStateOfApplicability = useDeleteStateOfApplicability(
+    stateOfApplicability,
+    connectionId,
+    () => navigate(`/organizations/${organizationId}/states-of-applicability`),
+  );
+
+  usePageTitle(stateOfApplicability.name || __("State of Applicability"));
+
+  const [isEditingName, setIsEditingName] = useState(false);
+  const [isEditingOwner, setIsEditingOwner] = useState(false);
+  const [updateStateOfApplicability, isUpdating] = useMutationWithToasts(
+    updateStateOfApplicabilityMutation,
+    {
+      successMessage: __("State of Applicability updated successfully."),
+      errorMessage: __("Failed to update State of Applicability"),
+    }
+  );
+
+  const canUpdate = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+  const canDelete = !isSnapshotMode && isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
+
+  const [exportStateOfApplicabilityPDF, isExporting] = useMutationWithToasts<StateOfApplicabilityDetailPageExportMutation>(
+    exportStateOfApplicabilityPDFMutation,
+    {
+      successMessage: __("State of Applicability exported successfully."),
+      errorMessage: __("Failed to export State of Applicability"),
+    }
+  );
+
+  const handleExport = () => {
+    if (!stateOfApplicability.id) return;
+
+    exportStateOfApplicabilityPDF({
+      variables: {
+        input: {
+          stateOfApplicabilityId: stateOfApplicability.id,
+        },
+      },
+      onCompleted: (data) => {
+        if (data.exportStateOfApplicabilityPDF?.data) {
+          const link = window.document.createElement("a");
+          link.href = data.exportStateOfApplicabilityPDF.data;
+          link.download = `${stateOfApplicability.name || "state-of-applicability"}.pdf`;
+          window.document.body.appendChild(link);
+          link.click();
+          window.document.body.removeChild(link);
+        }
+      },
+    });
+  };
+
+  const nameSchema = z.object({
+    name: z.string().min(1, __("Name is required")),
+  });
+
+  const ownerSchema = z.object({
+    ownerId: z.string().min(1, __("Owner is required")),
+  });
+
+  const { register: registerName, handleSubmit: handleSubmitName, reset: resetName } = useFormWithSchema(
+    nameSchema,
+    {
+      defaultValues: {
+        name: stateOfApplicability.name || "",
+      },
+    }
+  );
+
+  const { control: controlOwner, handleSubmit: handleSubmitOwner, reset: resetOwner } = useFormWithSchema(
+    ownerSchema,
+    {
+      defaultValues: {
+        ownerId: stateOfApplicability.owner?.id || "",
+      },
+    }
+  );
+
+  const handleUpdateName = handleSubmitName((data) => {
+    if (!stateOfApplicability.id) return;
+
+    updateStateOfApplicability({
+      variables: {
+        input: {
+          id: stateOfApplicability.id,
+          name: data.name,
+        },
+      },
+      onSuccess: () => {
+        setIsEditingName(false);
+        resetName({ name: data.name });
+      },
+    });
+  });
+
+  const handleUpdateOwner = handleSubmitOwner((data) => {
+    if (!stateOfApplicability.id) return;
+
+    updateStateOfApplicability({
+      variables: {
+        input: {
+          id: stateOfApplicability.id,
+          ownerId: data.ownerId,
+        },
+      },
+      onSuccess: () => {
+        setIsEditingOwner(false);
+        resetOwner({ ownerId: data.ownerId });
+      },
+    });
+  });
+
+  const handleCancelNameEdit = () => {
+    setIsEditingName(false);
+    resetName({
+      name: stateOfApplicability.name || "",
+    });
+  };
+
+  const handleCancelOwnerEdit = () => {
+    setIsEditingOwner(false);
+    resetOwner({
+      ownerId: stateOfApplicability.owner?.id || "",
+    });
+  };
+
+  const listUrl = snapshotId
+    ? `/organizations/${organizationId}/snapshots/${snapshotId}/states-of-applicability`
+    : `/organizations/${organizationId}/states-of-applicability`;
+
+  return (
+    <div className="space-y-6">
+      {snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
+      <Breadcrumb
+        items={[
+          {
+            label: __("States of Applicability"),
+            to: listUrl,
+          },
+          {
+            label: stateOfApplicability.name || __("State of Applicability detail"),
+          },
+        ]}
+      />
+
+      <PageHeader
+        title={
+          isEditingName && canUpdate ? (
+            <div className="flex items-center gap-2">
+              <Input
+                {...registerName("name")}
+                variant="title"
+                className="flex-1"
+                autoFocus
+                onKeyDown={(e) => {
+                  if (e.key === "Escape") {
+                    handleCancelNameEdit();
+                  }
+                  if (e.key === "Enter" && e.ctrlKey) {
+                    handleUpdateName();
+                  }
+                }}
+              />
+              <Button
+                variant="quaternary"
+                icon={IconCheckmark1}
+                onClick={handleUpdateName}
+                disabled={isUpdating}
+              />
+              <Button
+                variant="quaternary"
+                icon={IconCrossLargeX}
+                onClick={handleCancelNameEdit}
+              />
+            </div>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span>{stateOfApplicability.name || ""}</span>
+              {canUpdate && (
+                <Button
+                  variant="quaternary"
+                  icon={IconPencil}
+                  onClick={() => setIsEditingName(true)}
+                />
+              )}
+            </div>
+          )
+        }
+      >
+        <Button
+          variant="secondary"
+          icon={IconArrowDown}
+          onClick={handleExport}
+          disabled={isExporting}
+        >
+          {__("Export")}
+        </Button>
+        {canDelete && (
+          <ActionDropdown variant="secondary">
+            <DropdownItem variant="danger" icon={IconTrashCan} onClick={deleteStateOfApplicability}>
+              {__("Delete")}
+            </DropdownItem>
+          </ActionDropdown>
+        )}
+      </PageHeader>
+
+      <div className="space-y-6">
+        <div className="space-y-4">
+          <h2 className="text-base font-medium">{__("Details")}</h2>
+          <Card className="space-y-4" padded>
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Owner")}
+                </div>
+                {isEditingOwner && canUpdate ? (
+                  <div className="flex items-center gap-2">
+                    <Suspense fallback={<div>{__("Loading...")}</div>}>
+                      <PeopleSelectField
+                        organizationId={organizationId}
+                        control={controlOwner}
+                        name="ownerId"
+                      />
+                    </Suspense>
+                    <Button
+                      variant="quaternary"
+                      icon={IconCheckmark1}
+                      onClick={handleUpdateOwner}
+                      disabled={isUpdating}
+                    />
+                    <Button
+                      variant="quaternary"
+                      icon={IconCrossLargeX}
+                      onClick={handleCancelOwnerEdit}
+                    />
+                  </div>
+                ) : (
+                  <div className="flex items-center gap-2">
+                    <div className="text-sm text-txt-primary">
+                      {stateOfApplicability.owner?.fullName || "-"}
+                    </div>
+                    {canUpdate && (
+                      <Button
+                        variant="quaternary"
+                        icon={IconPencil}
+                        onClick={() => setIsEditingOwner(true)}
+                      />
+                    )}
+                  </div>
+                )}
+              </div>
+            </div>
+            <div className="grid grid-cols-2 gap-4">
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Created at")}
+                </div>
+                <div className="text-sm text-txt-primary">
+                  {formatDate(stateOfApplicability.createdAt)}
+                </div>
+              </div>
+              <div>
+                <div className="text-xs text-txt-tertiary font-semibold mb-1">
+                  {__("Updated at")}
+                </div>
+                <div className="text-sm text-txt-primary">
+                  {formatDate(stateOfApplicability.updatedAt)}
+                </div>
+              </div>
+            </div>
+          </Card>
+        </div>
+
+        {stateOfApplicability.id && (
+          <div className="space-y-4">
+            <h2 className="text-base font-medium">{__("Controls")}</h2>
+            <StateOfApplicabilityControlsTab
+              stateOfApplicability={stateOfApplicability as typeof stateOfApplicability & { id: string }}
+              isSnapshotMode={isSnapshotMode}
+            />
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/apps/console/src/pages/organizations/states-of-applicability/StatesOfApplicabilityPage.tsx b/apps/console/src/pages/organizations/states-of-applicability/StatesOfApplicabilityPage.tsx
new file mode 100644
index 000000000..00261dc04
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/StatesOfApplicabilityPage.tsx
@@ -0,0 +1,192 @@
+import {
+  Button,
+  IconPlusLarge,
+  PageHeader,
+  Card,
+  Thead,
+  Tbody,
+  Tr,
+  Th,
+  Td,
+  ActionDropdown,
+  DropdownItem,
+  IconTrashCan,
+  Table,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import { type PreloadedQuery } from "react-relay";
+import {
+  useStateOfApplicabilityQuery,
+  useDeleteStateOfApplicability,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphPaginatedFragment$data } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedFragment.graphql";
+import type { NodeOf } from "/types";
+import { usePageTitle } from "@probo/hooks";
+import { CreateStateOfApplicabilityDialog } from "./dialogs/CreateStateOfApplicabilityDialog";
+import { PermissionsContext } from "/providers/PermissionsContext";
+import { use, useEffect } from "react";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import { formatDate } from "@probo/helpers";
+import { useParams } from "react-router";
+import { SnapshotBanner } from "/components/SnapshotBanner";
+
+type StateOfApplicability = NodeOf<
+  StateOfApplicabilityGraphPaginatedFragment$data["statesOfApplicability"]
+>;
+
+export default function StatesOfApplicabilityPage({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<StateOfApplicabilityGraphPaginatedQuery>;
+}) {
+  const { __ } = useTranslate();
+  const { isAuthorized } = use(PermissionsContext);
+  const { snapshotId } = useParams<{ snapshotId?: string }>();
+  const isSnapshotMode = Boolean(snapshotId);
+  const {
+    statesOfApplicability,
+    connectionId,
+    hasNext,
+    loadNext,
+    isLoadingNext,
+    refetch,
+  } = useStateOfApplicabilityQuery(queryRef);
+
+  usePageTitle(__("States of Applicability"));
+
+  // Refetch with snapshot filter when in snapshot mode
+  useEffect(() => {
+    if (snapshotId) {
+      refetch({ filter: { snapshotId } }, { fetchPolicy: 'store-or-network' });
+    }
+  }, [snapshotId, refetch]);
+
+  const hasAnyAction = !isSnapshotMode &&
+    isAuthorized("StateOfApplicability", "deleteStateOfApplicability");
+
+  return (
+    <div className="space-y-6">
+      {snapshotId && <SnapshotBanner snapshotId={snapshotId} />}
+      <PageHeader
+        title={__("States of Applicability")}
+        description={__(
+          "Manage states of applicability for your organization's frameworks.",
+        )}
+      >
+        {!isSnapshotMode && isAuthorized("Organization", "createStateOfApplicability") && (
+          <CreateStateOfApplicabilityDialog connectionId={connectionId}>
+            <Button icon={IconPlusLarge}>
+              {__("Add state of applicability")}
+            </Button>
+          </CreateStateOfApplicabilityDialog>
+        )}
+      </PageHeader>
+
+      {statesOfApplicability && statesOfApplicability.length > 0 ? (
+        <Card>
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>{__("Name")}</Th>
+                <Th>{__("Created at")}</Th>
+                <Th>{__("Controls")}</Th>
+                {hasAnyAction && <Th>{__("Actions")}</Th>}
+              </Tr>
+            </Thead>
+            <Tbody>
+              {statesOfApplicability.map((soa) => (
+                <StateOfApplicabilityRow
+                  key={soa.id}
+                  stateOfApplicability={soa}
+                  connectionId={connectionId}
+                  hasAnyAction={hasAnyAction}
+                />
+              ))}
+            </Tbody>
+          </Table>
+
+          {hasNext && (
+            <div className="p-4 border-t">
+              <Button
+                variant="secondary"
+                onClick={() => loadNext(50)}
+                disabled={isLoadingNext}
+              >
+                {isLoadingNext ? __("Loading...") : __("Load more")}
+              </Button>
+            </div>
+          )}
+        </Card>
+      ) : (
+        <Card padded>
+          <div className="text-center py-12">
+            <h3 className="text-lg font-semibold mb-2">
+              {__("No states of applicability yet")}
+            </h3>
+            <p className="text-txt-tertiary mb-4">
+              {__("Create your first state of applicability to get started.")}
+            </p>
+          </div>
+        </Card>
+      )}
+    </div>
+  );
+}
+
+function StateOfApplicabilityRow({
+  stateOfApplicability,
+  connectionId,
+  hasAnyAction,
+}: {
+  stateOfApplicability: StateOfApplicability;
+  connectionId: string;
+  hasAnyAction: boolean;
+}) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const { snapshotId } = useParams<{ snapshotId?: string }>();
+  const deleteStateOfApplicability = useDeleteStateOfApplicability(
+    stateOfApplicability,
+    connectionId,
+  );
+  const { isAuthorized } = use(PermissionsContext);
+
+  const detailUrl = snapshotId
+    ? `/organizations/${organizationId}/snapshots/${snapshotId}/states-of-applicability/${stateOfApplicability.id}`
+    : `/organizations/${organizationId}/states-of-applicability/${stateOfApplicability.id}`;
+
+  return (
+    <Tr to={detailUrl}>
+      <Td>{stateOfApplicability.name}</Td>
+      <Td>
+        <time dateTime={stateOfApplicability.createdAt}>
+          {formatDate(stateOfApplicability.createdAt)}
+        </time>
+      </Td>
+      <Td>{stateOfApplicability.controlsInfo?.totalCount ?? 0}</Td>
+      {hasAnyAction && (
+        <Td noLink width={50} className="text-end">
+          <ActionDropdown>
+            {isAuthorized(
+              "StateOfApplicability",
+              "deleteStateOfApplicability",
+            ) && (
+              <DropdownItem
+                icon={IconTrashCan}
+                variant="danger"
+                onSelect={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  deleteStateOfApplicability();
+                }}
+              >
+                {__("Delete")}
+              </DropdownItem>
+            )}
+          </ActionDropdown>
+        </Td>
+      )}
+    </Tr>
+  );
+}
diff --git a/apps/console/src/pages/organizations/states-of-applicability/__generated__/StateOfApplicabilityDetailPageExportMutation.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/__generated__/StateOfApplicabilityDetailPageExportMutation.graphql.ts
new file mode 100644
index 000000000..8baf70251
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/__generated__/StateOfApplicabilityDetailPageExportMutation.graphql.ts
@@ -0,0 +1,92 @@
+/**
+ * @generated SignedSource<<9dc238538172b956fb81954024522ee1>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type ExportStateOfApplicabilityPDFInput = {
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityDetailPageExportMutation$variables = {
+  input: ExportStateOfApplicabilityPDFInput;
+};
+export type StateOfApplicabilityDetailPageExportMutation$data = {
+  readonly exportStateOfApplicabilityPDF: {
+    readonly data: string;
+  };
+};
+export type StateOfApplicabilityDetailPageExportMutation = {
+  response: StateOfApplicabilityDetailPageExportMutation$data;
+  variables: StateOfApplicabilityDetailPageExportMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "ExportStateOfApplicabilityPDFPayload",
+    "kind": "LinkedField",
+    "name": "exportStateOfApplicabilityPDF",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "data",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "dbc24d23ab71abb76f95b114f86f200d",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityDetailPageExportMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityDetailPageExportMutation(\n  $input: ExportStateOfApplicabilityPDFInput!\n) {\n  exportStateOfApplicabilityPDF(input: $input) {\n    data\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "36be308a451ada118c2bcc9c3b0c0a2b";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/CreateStateOfApplicabilityDialog.tsx b/apps/console/src/pages/organizations/states-of-applicability/dialogs/CreateStateOfApplicabilityDialog.tsx
new file mode 100644
index 000000000..d898c99e3
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/CreateStateOfApplicabilityDialog.tsx
@@ -0,0 +1,110 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Field,
+  useDialogRef,
+} from "@probo/ui";
+import type { ReactNode } from "react";
+import { useNavigate } from "react-router";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import z from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { createStateOfApplicabilityMutation } from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphCreateMutation } from "/hooks/graph/__generated__/StateOfApplicabilityGraphCreateMutation.graphql";
+import { PeopleSelectField } from "/components/form/PeopleSelectField";
+import { Suspense } from "react";
+
+type Props = {
+  children: ReactNode;
+  connectionId: string;
+};
+
+const schema = z.object({
+  name: z.string().min(1),
+  ownerId: z.string().min(1),
+});
+
+export function CreateStateOfApplicabilityDialog({
+  children,
+  connectionId,
+}: Props) {
+  const { __ } = useTranslate();
+  const organizationId = useOrganizationId();
+  const navigate = useNavigate();
+  const { control, register, handleSubmit, reset } = useFormWithSchema(schema, {
+    defaultValues: {
+      name: "",
+      ownerId: "",
+    },
+  });
+  const ref = useDialogRef();
+
+  const [mutate, isMutating] = useMutationWithToasts<StateOfApplicabilityGraphCreateMutation>(
+    createStateOfApplicabilityMutation,
+    {
+      successMessage: __("State of applicability created successfully."),
+      errorMessage: __("Failed to create state of applicability"),
+    },
+  );
+
+  const onSubmit = handleSubmit((data) => {
+    mutate({
+      variables: {
+        input: {
+          name: data.name,
+          organizationId,
+          ownerId: data.ownerId,
+        },
+        connections: [connectionId],
+      },
+      onCompleted: (response) => {
+        reset();
+        ref.current?.close();
+        const stateOfApplicabilityId = response.createStateOfApplicability.stateOfApplicabilityEdge.node.id;
+        navigate(`/organizations/${organizationId}/states-of-applicability/${stateOfApplicabilityId}`);
+      },
+    });
+  });
+
+  return (
+    <Dialog
+      ref={ref}
+      trigger={children}
+      title={
+        <Breadcrumb
+          items={[__("States of Applicability"), __("New State of Applicability")]}
+        />
+      }
+    >
+      <form onSubmit={onSubmit}>
+        <DialogContent padded className="space-y-4">
+          <Field
+            label={__("Name")}
+            {...register("name")}
+            type="text"
+            required
+          />
+          <Field label={__("Owner")}>
+            <Suspense fallback={<div>{__("Loading...")}</div>}>
+              <PeopleSelectField
+                organizationId={organizationId}
+                control={control}
+                name="ownerId"
+              />
+            </Suspense>
+          </Field>
+        </DialogContent>
+        <DialogFooter>
+          <Button disabled={isMutating} type="submit">
+            {__("Create")}
+          </Button>
+        </DialogFooter>
+      </form>
+    </Dialog>
+  );
+}
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/EditControlDialog.tsx b/apps/console/src/pages/organizations/states-of-applicability/dialogs/EditControlDialog.tsx
new file mode 100644
index 000000000..f77adbeed
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/EditControlDialog.tsx
@@ -0,0 +1,176 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Field,
+  Select,
+  Option,
+  Textarea,
+  useDialogRef,
+  Badge,
+} from "@probo/ui";
+import { forwardRef, useImperativeHandle, useState } from "react";
+import { graphql } from "react-relay";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { z } from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+
+const linkControlMutation = graphql`
+  mutation EditControlDialogLinkMutation($input: CreateStateOfApplicabilityControlMappingInput!) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge {
+        node {
+          stateOfApplicabilityId
+          controlId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+export type EditControlDialogRef = {
+  open: (control: {
+    stateOfApplicabilityId: string;
+    controlId: string;
+    sectionTitle: string;
+    name: string;
+    frameworkName: string;
+    applicability: boolean;
+    justification: string | null;
+  }) => void;
+};
+
+const schema = z.object({
+  applicability: z.boolean(),
+  justification: z.string().optional(),
+});
+
+export const EditControlDialog = forwardRef<EditControlDialogRef, { onSuccess?: () => void }>(
+  ({ onSuccess }, ref) => {
+    const { __ } = useTranslate();
+    const dialogRef = useDialogRef();
+    const [control, setControl] = useState<{
+      stateOfApplicabilityId: string;
+      controlId: string;
+      sectionTitle: string;
+      name: string;
+      frameworkName: string;
+      applicability: boolean;
+      justification: string | null;
+    } | null>(null);
+
+    const [linkMutate, isLinking] = useMutationWithToasts(linkControlMutation, {
+      successMessage: __("Control updated successfully."),
+      errorMessage: __("Failed to update control"),
+    });
+
+    const { register, handleSubmit, setValue, watch } = useFormWithSchema(schema, {
+      defaultValues: {
+        applicability: true,
+        justification: "",
+      },
+    });
+    const applicability = watch("applicability");
+
+    useImperativeHandle(ref, () => ({
+      open: (ctrl) => {
+        setControl(ctrl);
+        setValue("applicability", ctrl.applicability);
+        setValue("justification", ctrl.justification || "");
+        dialogRef.current?.open();
+      },
+    }));
+
+    const onSubmit = handleSubmit((data) => {
+      if (!control) return;
+
+      linkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId: control.stateOfApplicabilityId,
+            controlId: control.controlId,
+            applicability: data.applicability,
+            justification: !data.applicability ? data.justification || null : null,
+          },
+        },
+        onSuccess: () => {
+          dialogRef.current?.close();
+          setControl(null);
+          onSuccess?.();
+        },
+        updater: (store) => {
+          const stateOfApplicability = store.get(control.stateOfApplicabilityId);
+          if (stateOfApplicability) {
+            stateOfApplicability.invalidateRecord();
+          }
+        },
+      });
+    });
+
+    return (
+      <Dialog
+        ref={dialogRef}
+        className="max-w-lg"
+        title={
+          <Breadcrumb
+            items={[__("States of Applicability"), __("Edit Control")]}
+          />
+        }
+      >
+        {control ? (
+          <form onSubmit={onSubmit}>
+            <DialogContent padded className="space-y-4">
+              <div className="space-y-2">
+                <div className="text-sm font-medium text-txt-secondary">
+                  {control.frameworkName}
+                </div>
+                <div className="flex items-center gap-2">
+                  <Badge size="md">{control.sectionTitle}</Badge>
+                  <span className="text-base font-medium text-txt-primary">{control.name}</span>
+                </div>
+              </div>
+
+              <Field label={__("Applicability")}>
+                <Select
+                  variant="editor"
+                  value={applicability ? "yes" : "no"}
+                  onValueChange={(value) => setValue("applicability", value === "yes")}
+                >
+                  <Option value="yes">{__("Yes")}</Option>
+                  <Option value="no">{__("No")}</Option>
+                </Select>
+              </Field>
+
+              {!applicability && (
+                <Field label={__("Justification")}>
+                  <Textarea
+                    {...register("justification")}
+                    placeholder={__("Reason for non-applicability")}
+                    autogrow
+                  />
+                </Field>
+              )}
+            </DialogContent>
+            <DialogFooter>
+              <Button
+                type="button"
+                variant="secondary"
+                onClick={() => dialogRef.current?.close()}
+              >
+                {__("Cancel")}
+              </Button>
+              <Button type="submit" disabled={isLinking}>
+                {__("Save")}
+              </Button>
+            </DialogFooter>
+          </form>
+        ) : null}
+      </Dialog>
+    );
+  }
+);
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/LinkControlDialog.tsx b/apps/console/src/pages/organizations/states-of-applicability/dialogs/LinkControlDialog.tsx
new file mode 100644
index 000000000..f9496d565
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/LinkControlDialog.tsx
@@ -0,0 +1,385 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Breadcrumb,
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Select,
+  Option,
+  Textarea,
+  useDialogRef,
+  Spinner,
+  Badge,
+  Input,
+  IconMagnifyingGlass,
+  IconChevronDown,
+  IconChevronUp,
+  IconCheckmark1,
+} from "@probo/ui";
+import { forwardRef, useImperativeHandle, useState, Suspense, useMemo } from "react";
+import { useLazyLoadQuery } from "react-relay";
+import { graphql } from "react-relay";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+
+const linkControlQuery = graphql`
+  query LinkControlDialogQuery($stateOfApplicabilityId: ID!) {
+    node(id: $stateOfApplicabilityId) {
+      ... on StateOfApplicability {
+        id
+        availableControls {
+          controlId
+          sectionTitle
+          name
+          frameworkId
+          frameworkName
+          organizationId
+          stateOfApplicabilityId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+const linkControlMutation = graphql`
+  mutation LinkControlDialogLinkMutation($input: CreateStateOfApplicabilityControlMappingInput!) {
+    createStateOfApplicabilityControlMapping(input: $input) {
+      stateOfApplicabilityControlEdge {
+        node {
+          stateOfApplicabilityId
+          controlId
+          applicability
+          justification
+        }
+      }
+    }
+  }
+`;
+
+const unlinkControlMutation = graphql`
+  mutation LinkControlDialogUnlinkMutation($input: DeleteStateOfApplicabilityControlMappingInput!) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId
+    }
+  }
+`;
+
+export type LinkControlDialogRef = {
+  open: (stateOfApplicabilityId: string, onUpdate?: () => void) => void;
+};
+
+type Control = {
+  controlId: string;
+  sectionTitle: string;
+  name: string;
+  frameworkId: string;
+  frameworkName: string;
+  organizationId: string;
+  stateOfApplicabilityId: string | null;
+  applicability: boolean | null;
+  justification: string | null;
+};
+
+function ControlRow({
+  control,
+  stateOfApplicabilityId,
+  isLinked,
+  onUpdate,
+}: {
+  control: Control;
+  stateOfApplicabilityId: string;
+  isLinked: boolean;
+  onUpdate?: () => void;
+}) {
+  const { __ } = useTranslate();
+  const [selectedState, setSelectedState] = useState<string>(() => {
+    if (!isLinked) return "not-linked";
+    return control.applicability ? "applicable" : "not-applicable";
+  });
+  const [justification, setJustification] = useState(
+    control.justification || ""
+  );
+  const [showJustification, setShowJustification] = useState(false);
+
+  const [linkMutate, isLinking] = useMutationWithToasts(linkControlMutation, {
+    successMessage: __("Control updated successfully."),
+    errorMessage: __("Failed to update control"),
+  });
+
+  const [unlinkMutate, isUnlinking] = useMutationWithToasts(unlinkControlMutation, {
+    successMessage: __("Control removed successfully."),
+    errorMessage: __("Failed to remove control"),
+  });
+
+  const handleStateChange = (newState: string) => {
+    setSelectedState(newState);
+
+    if (newState === "not-linked") {
+      unlinkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId,
+            controlId: control.controlId,
+          },
+        },
+        onSuccess: () => {
+          setShowJustification(false);
+          onUpdate?.();
+        },
+      });
+    } else if (newState === "applicable") {
+      setShowJustification(false);
+      linkMutate({
+        variables: {
+          input: {
+            stateOfApplicabilityId,
+            controlId: control.controlId,
+            applicability: true,
+            justification: null,
+          },
+        },
+        onSuccess: () => {
+          onUpdate?.();
+        },
+      });
+    } else if (newState === "not-applicable") {
+      setShowJustification(true);
+      setJustification(control.justification || "");
+    }
+  };
+
+  const handleSaveJustification = () => {
+    linkMutate({
+      variables: {
+        input: {
+          stateOfApplicabilityId,
+          controlId: control.controlId,
+          applicability: false,
+          justification: justification || null,
+        },
+      },
+      onSuccess: () => {
+        setShowJustification(false);
+        onUpdate?.();
+      },
+    });
+  };
+
+  return (
+    <div className="p-4 border-b border-border-low">
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex-1 min-w-0">
+          <div className="flex items-center gap-2">
+            <Badge size="md">{control.sectionTitle}</Badge>
+            <span className="text-sm font-medium text-txt-primary">{control.name}</span>
+          </div>
+          {isLinked && control.applicability !== null && !showJustification && control.justification && (
+            <div className="mt-2 text-sm text-txt-secondary">
+              {control.justification}
+            </div>
+          )}
+        </div>
+        <div className="flex items-start gap-2">
+          <Select
+            variant="editor"
+            value={selectedState}
+            onValueChange={handleStateChange}
+            disabled={isLinking || isUnlinking}
+            className="w-48"
+          >
+            <Option value="not-linked">
+              {__("Not Linked")}
+            </Option>
+            <Option value="applicable">
+              {__("Applicable")}
+            </Option>
+            <Option value="not-applicable">
+              {__("Not Applicable")}
+            </Option>
+          </Select>
+        </div>
+      </div>
+      {showJustification && (
+        <div className="mt-3 flex items-start gap-2">
+          <Textarea
+            value={justification}
+            onChange={(e) => setJustification(e.target.value)}
+            placeholder={__("Reason for non-applicability")}
+            className="flex-1"
+            autogrow
+          />
+          <Button
+            variant="primary"
+            icon={IconCheckmark1}
+            onClick={handleSaveJustification}
+            disabled={isLinking}
+            aria-label={__("Save")}
+          />
+        </div>
+      )}
+    </div>
+  );
+}
+
+function LinkControlDialogContent({
+  stateOfApplicabilityId,
+  onUpdate,
+}: {
+  stateOfApplicabilityId: string;
+  onUpdate?: () => void;
+}) {
+  const { __ } = useTranslate();
+  const [search, setSearch] = useState("");
+  const [collapsedFrameworks, setCollapsedFrameworks] = useState<Set<string>>(new Set());
+  const data = useLazyLoadQuery(
+    linkControlQuery,
+    { stateOfApplicabilityId },
+    { fetchPolicy: "store-or-network" }
+  ) as {
+    node: {
+      availableControls?: Control[];
+    } | null;
+  };
+
+  const filteredControls = useMemo(() => {
+    const controls = data.node?.availableControls || [];
+    if (!search) return controls;
+    const lowerSearch = search.toLowerCase();
+    return controls.filter(
+      (c) =>
+        c.name.toLowerCase().includes(lowerSearch) ||
+        c.sectionTitle.toLowerCase().includes(lowerSearch) ||
+        c.frameworkName.toLowerCase().includes(lowerSearch)
+    );
+  }, [data.node?.availableControls, search]);
+
+  const groupedControls = useMemo(() => {
+    const groups: Record<string, Record<string, Control[]>> = {};
+    filteredControls.forEach((control) => {
+      if (!groups[control.frameworkName]) {
+        groups[control.frameworkName] = {};
+      }
+      if (!groups[control.frameworkName][control.sectionTitle]) {
+        groups[control.frameworkName][control.sectionTitle] = [];
+      }
+      groups[control.frameworkName][control.sectionTitle].push(control);
+    });
+    return groups;
+  }, [filteredControls]);
+
+  const toggleFramework = (frameworkName: string) => {
+    setCollapsedFrameworks((prev) => {
+      const newSet = new Set(prev);
+      if (newSet.has(frameworkName)) {
+        newSet.delete(frameworkName);
+      } else {
+        newSet.add(frameworkName);
+      }
+      return newSet;
+    });
+  };
+
+  return (
+    <>
+      <DialogContent className="p-0">
+        <div className="sticky top-0 bg-level-2 p-4 border-b border-border-low z-10">
+          <Input
+            icon={IconMagnifyingGlass}
+            placeholder={__("Search controls...")}
+            onValueChange={setSearch}
+          />
+        </div>
+        <div className="max-h-[60vh] overflow-y-auto">
+          {filteredControls.length === 0 ? (
+            <div className="p-8 text-center text-txt-secondary">
+              {__("No controls found")}
+            </div>
+          ) : (
+            Object.entries(groupedControls).map(([frameworkName, sections]) => {
+              const isCollapsed = collapsedFrameworks.has(frameworkName);
+              return (
+                <div key={frameworkName}>
+                  <div className="sticky top-0 bg-level-1 px-4 py-2 border-b border-border-low z-10 flex items-center justify-between">
+                    <h3 className="text-sm font-semibold text-txt-primary">{frameworkName}</h3>
+                    <Button
+                      variant="tertiary"
+                      icon={isCollapsed ? IconChevronDown : IconChevronUp}
+                      onClick={() => toggleFramework(frameworkName)}
+                      aria-label={isCollapsed ? __("Expand") : __("Collapse")}
+                    />
+                  </div>
+                  {!isCollapsed && Object.entries(sections).map(([sectionTitle, sectionControls]) => (
+                    <div key={`${frameworkName}-${sectionTitle}`}>
+                      {sectionControls.map((control) => (
+                        <ControlRow
+                          key={control.controlId}
+                          control={control}
+                          stateOfApplicabilityId={stateOfApplicabilityId}
+                          isLinked={control.stateOfApplicabilityId !== null}
+                          onUpdate={onUpdate}
+                        />
+                      ))}
+                    </div>
+                  ))}
+                </div>
+              );
+            })
+          )}
+        </div>
+      </DialogContent>
+      <DialogFooter exitLabel={__("Close")}></DialogFooter>
+    </>
+  );
+}
+
+export const LinkControlDialog = forwardRef<LinkControlDialogRef>((_props, ref) => {
+  const { __ } = useTranslate();
+  const dialogRef = useDialogRef();
+  const [stateOfApplicabilityId, setStateOfApplicabilityId] = useState<string | null>(null);
+  const [onUpdateCallback, setOnUpdateCallback] = useState<(() => void) | undefined>(undefined);
+
+  useImperativeHandle(ref, () => ({
+    open: (soaId: string, callback?: () => void) => {
+      setStateOfApplicabilityId(soaId);
+      setOnUpdateCallback(() => callback);
+      dialogRef.current?.open();
+    },
+  }), [dialogRef]);
+
+  const handleClose = () => {
+    setStateOfApplicabilityId(null);
+    setOnUpdateCallback(undefined);
+  };
+
+  return (
+    <Dialog
+      ref={dialogRef}
+      className="max-w-3xl"
+      title={
+        <Breadcrumb
+          items={[__("States of Applicability"), __("Add Controls")]}
+        />
+      }
+      onClose={handleClose}
+    >
+      {stateOfApplicabilityId ? (
+        <Suspense
+          fallback={
+            <DialogContent padded className="flex items-center justify-center py-8">
+              <Spinner />
+            </DialogContent>
+          }
+        >
+          <LinkControlDialogContent
+            stateOfApplicabilityId={stateOfApplicabilityId}
+            onUpdate={onUpdateCallback}
+          />
+        </Suspense>
+      ) : null}
+    </Dialog>
+  );
+});
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/EditControlDialogLinkMutation.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/EditControlDialogLinkMutation.graphql.ts
new file mode 100644
index 000000000..4cab21a6a
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/EditControlDialogLinkMutation.graphql.ts
@@ -0,0 +1,194 @@
+/**
+ * @generated SignedSource<<100330ea65f9914591271a9a1f78fd2e>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type EditControlDialogLinkMutation$variables = {
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type EditControlDialogLinkMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly applicability: boolean;
+        readonly controlId: string;
+        readonly justification: string | null | undefined;
+        readonly stateOfApplicabilityId: string;
+      };
+    };
+  };
+};
+export type EditControlDialogLinkMutation = {
+  response: EditControlDialogLinkMutation$data;
+  variables: EditControlDialogLinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "stateOfApplicabilityId",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "controlId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "applicability",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "justification",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "EditControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/)
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "EditControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "id",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "e15d97ea6b798532fb82fc577cbccd64",
+    "id": null,
+    "metadata": {},
+    "name": "EditControlDialogLinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation EditControlDialogLinkMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        stateOfApplicabilityId\n        controlId\n        applicability\n        justification\n        id\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e7a83ce3daa0051a0b2bb03b0429f2c4";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogLinkMutation.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogLinkMutation.graphql.ts
new file mode 100644
index 000000000..f812abd12
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogLinkMutation.graphql.ts
@@ -0,0 +1,194 @@
+/**
+ * @generated SignedSource<<ab6168a4560a52cdd137c9090c37dacc>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateStateOfApplicabilityControlMappingInput = {
+  applicability: boolean;
+  controlId: string;
+  justification?: string | null | undefined;
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogLinkMutation$variables = {
+  input: CreateStateOfApplicabilityControlMappingInput;
+};
+export type LinkControlDialogLinkMutation$data = {
+  readonly createStateOfApplicabilityControlMapping: {
+    readonly stateOfApplicabilityControlEdge: {
+      readonly node: {
+        readonly applicability: boolean;
+        readonly controlId: string;
+        readonly justification: string | null | undefined;
+        readonly stateOfApplicabilityId: string;
+      };
+    };
+  };
+};
+export type LinkControlDialogLinkMutation = {
+  response: LinkControlDialogLinkMutation$data;
+  variables: LinkControlDialogLinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "stateOfApplicabilityId",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "controlId",
+  "storageKey": null
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "applicability",
+  "storageKey": null
+},
+v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "justification",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/)
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogLinkMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": "CreateStateOfApplicabilityControlMappingPayload",
+        "kind": "LinkedField",
+        "name": "createStateOfApplicabilityControlMapping",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "concreteType": "StateOfApplicabilityControlEdge",
+            "kind": "LinkedField",
+            "name": "stateOfApplicabilityControlEdge",
+            "plural": false,
+            "selections": [
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "StateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "node",
+                "plural": false,
+                "selections": [
+                  (v2/*: any*/),
+                  (v3/*: any*/),
+                  (v4/*: any*/),
+                  (v5/*: any*/),
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "id",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "59e215d4f18e0429cbf813aae4db8c94",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogLinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation LinkControlDialogLinkMutation(\n  $input: CreateStateOfApplicabilityControlMappingInput!\n) {\n  createStateOfApplicabilityControlMapping(input: $input) {\n    stateOfApplicabilityControlEdge {\n      node {\n        stateOfApplicabilityId\n        controlId\n        applicability\n        justification\n        id\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "47757e096c6beeba6be6290a2154f841";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogQuery.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogQuery.graphql.ts
new file mode 100644
index 000000000..993856949
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogQuery.graphql.ts
@@ -0,0 +1,211 @@
+/**
+ * @generated SignedSource<<feca91fd2418eba0f5714a2c76346d08>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type LinkControlDialogQuery$variables = {
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogQuery$data = {
+  readonly node: {
+    readonly availableControls?: ReadonlyArray<{
+      readonly applicability: boolean | null | undefined;
+      readonly controlId: string;
+      readonly frameworkId: string;
+      readonly frameworkName: string;
+      readonly justification: string | null | undefined;
+      readonly name: string;
+      readonly organizationId: string;
+      readonly sectionTitle: string;
+      readonly stateOfApplicabilityId: string | null | undefined;
+    }>;
+    readonly id?: string;
+  };
+};
+export type LinkControlDialogQuery = {
+  response: LinkControlDialogQuery$data;
+  variables: LinkControlDialogQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "stateOfApplicabilityId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "stateOfApplicabilityId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "AvailableStateOfApplicabilityControl",
+  "kind": "LinkedField",
+  "name": "availableControls",
+  "plural": true,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "controlId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "sectionTitle",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "frameworkId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "frameworkName",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "organizationId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "stateOfApplicabilityId",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "applicability",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "justification",
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              (v3/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v3/*: any*/)
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "a0d70e15a1236fe0e8626e685ea16a15",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogQuery",
+    "operationKind": "query",
+    "text": "query LinkControlDialogQuery(\n  $stateOfApplicabilityId: ID!\n) {\n  node(id: $stateOfApplicabilityId) {\n    __typename\n    ... on StateOfApplicability {\n      id\n      availableControls {\n        controlId\n        sectionTitle\n        name\n        frameworkId\n        frameworkName\n        organizationId\n        stateOfApplicabilityId\n        applicability\n        justification\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "26daf3c064517bdbbf025da7ce5fc30f";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogUnlinkMutation.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogUnlinkMutation.graphql.ts
new file mode 100644
index 000000000..5beb60c97
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/dialogs/__generated__/LinkControlDialogUnlinkMutation.graphql.ts
@@ -0,0 +1,109 @@
+/**
+ * @generated SignedSource<<3bb4d04e228ac7dbda8ebfb8b7c2567f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type LinkControlDialogUnlinkMutation$variables = {
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type LinkControlDialogUnlinkMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type LinkControlDialogUnlinkMutation = {
+  response: LinkControlDialogUnlinkMutation$data;
+  variables: LinkControlDialogUnlinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+    "kind": "LinkedField",
+    "name": "deleteStateOfApplicabilityControlMapping",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedControlId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityControlId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "LinkControlDialogUnlinkMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "LinkControlDialogUnlinkMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "766d15d5071197ed2907d876caf37995",
+    "id": null,
+    "metadata": {},
+    "name": "LinkControlDialogUnlinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation LinkControlDialogUnlinkMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "a184d521b495bf3ff76796530e9eb0e1";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx
new file mode 100644
index 000000000..27f3a0d71
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityControlsTab.tsx
@@ -0,0 +1,267 @@
+import { graphql, useRefetchableFragment } from "react-relay";
+import { Badge, Table, Tbody, Td, Th, Thead, Tr, Button, IconPlusLarge, IconPencil, IconTrashCan, ActionDropdown, DropdownItem } from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { useOrganizationId } from "/hooks/useOrganizationId";
+import type { StateOfApplicabilityControlsTabFragment$key } from "./__generated__/StateOfApplicabilityControlsTabFragment.graphql";
+import { Suspense, useMemo, useRef } from "react";
+import { LinkControlDialog, type LinkControlDialogRef } from "../dialogs/LinkControlDialog";
+import { EditControlDialog, type EditControlDialogRef } from "../dialogs/EditControlDialog";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { use } from "react";
+import { PermissionsContext } from "/providers/PermissionsContext";
+
+export const controlsFragment = graphql`
+  fragment StateOfApplicabilityControlsTabFragment on StateOfApplicability
+  @refetchable(queryName: "StateOfApplicabilityControlsTabRefetchQuery") {
+    id
+    controlsInfo: controls(first: 0) {
+      totalCount
+    }
+    availableControls {
+      controlId
+      sectionTitle
+      name
+      frameworkId
+      frameworkName
+      organizationId
+      stateOfApplicabilityId
+      applicability
+      justification
+      bestPractice
+      regulatory
+      contractual
+      riskAssessment
+    }
+  }
+`;
+
+const unlinkControlMutation = graphql`
+  mutation StateOfApplicabilityControlsTabUnlinkMutation($input: DeleteStateOfApplicabilityControlMappingInput!) {
+    deleteStateOfApplicabilityControlMapping(input: $input) {
+      deletedStateOfApplicabilityId
+      deletedControlId
+      deletedStateOfApplicabilityControlId
+    }
+  }
+`;
+
+export default function StateOfApplicabilityControlsTab({
+  stateOfApplicability,
+  isSnapshotMode = false,
+}: {
+  stateOfApplicability: StateOfApplicabilityControlsTabFragment$key & { id: string };
+  isSnapshotMode?: boolean;
+}) {
+  const { __ } = useTranslate();
+  const [data, refetch] = useRefetchableFragment(controlsFragment, stateOfApplicability);
+  const organizationId = useOrganizationId();
+  const manageDialogRef = useRef<LinkControlDialogRef>(null);
+  const editDialogRef = useRef<EditControlDialogRef>(null);
+  const { isAuthorized } = use(PermissionsContext);
+
+  const linkedControls = useMemo(
+    () => (data.availableControls || []).filter((c) => c.stateOfApplicabilityId !== null),
+    [data.availableControls]
+  );
+
+  const [unlinkControl, isUnlinking] = useMutationWithToasts(
+    unlinkControlMutation,
+    {
+      successMessage: __("Control removed successfully."),
+      errorMessage: __("Failed to remove control"),
+    },
+  );
+
+  const canLink = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+  const canUnlink = !isSnapshotMode && isAuthorized("StateOfApplicability", "updateStateOfApplicability");
+
+  const handleOpenManageDialog = () => {
+    manageDialogRef.current?.open(data.id, () => {
+      refetch({}, { fetchPolicy: "store-and-network" });
+    });
+  };
+
+  const handleOpenEditDialog = (control: {
+    controlId: string;
+    sectionTitle: string;
+    name: string;
+    frameworkName: string;
+    applicability: boolean;
+    justification: string | null;
+  }) => {
+    editDialogRef.current?.open({
+      stateOfApplicabilityId: data.id,
+      controlId: control.controlId,
+      sectionTitle: control.sectionTitle,
+      name: control.name,
+      frameworkName: control.frameworkName,
+      applicability: control.applicability,
+      justification: control.justification,
+    });
+  };
+
+  const handleUnlink = (controlId: string) => {
+    unlinkControl({
+      variables: {
+        input: {
+          stateOfApplicabilityId: data.id,
+          controlId,
+        },
+      },
+      onSuccess: () => {
+        refetch({}, { fetchPolicy: "network-only" });
+      },
+    });
+  };
+
+  return (
+    <>
+      <div className="space-y-4">
+        {canLink && (
+          <div className="flex justify-end">
+            <Button
+              icon={IconPlusLarge}
+              onClick={handleOpenManageDialog}
+            >
+              {__("Add Controls")}
+            </Button>
+          </div>
+        )}
+
+        <Table>
+          <Thead>
+            <Tr>
+              <Th className="w-32">{__("Framework")}</Th>
+              <Th>{__("Control")}</Th>
+              <Th className="w-28 text-center">{__("Applicability")}</Th>
+              <Th className="min-w-48">{__("Justification")}</Th>
+              <Th className="w-24 text-center">{__("Regulatory")}</Th>
+              <Th className="w-24 text-center">{__("Contractual")}</Th>
+              <Th className="w-32 text-center">{__("Best Practice")}</Th>
+              <Th className="w-36 text-center">{__("Risk Assessment")}</Th>
+              {(canLink || canUnlink) && <Th className="w-12"></Th>}
+            </Tr>
+          </Thead>
+          <Tbody>
+            {linkedControls.length === 0 && (
+              <Tr>
+                <Td colSpan={canLink || canUnlink ? 9 : 8} className="text-center text-txt-secondary py-12">
+                  {__("No controls linked")}
+                </Td>
+              </Tr>
+            )}
+            {linkedControls.map((control) => (
+              <Tr
+                key={control.controlId}
+                to={`/organizations/${organizationId}/frameworks/${control.frameworkId}/controls/${control.controlId}`}
+              >
+                <Td className="font-medium text-txt-secondary">{control.frameworkName}</Td>
+                <Td>
+                  <div className="space-y-1">
+                    <div className="text-xs font-medium text-txt-tertiary">{control.sectionTitle}</div>
+                    <div className="text-sm">{control.name}</div>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    {control.applicability !== null ? (
+                      <Badge variant={control.applicability ? "success" : "danger"} size="sm">
+                        {control.applicability ? __("Yes") : __("No")}
+                      </Badge>
+                    ) : (
+                      <span className="text-txt-tertiary">-</span>
+                    )}
+                  </div>
+                </Td>
+                <Td>
+                  <div className="text-sm text-txt-secondary line-clamp-2">
+                    {control.justification || <span className="text-txt-tertiary italic">-</span>}
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.regulatory ? "success" : "danger"} size="sm">
+                      {control.regulatory ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.contractual ? "success" : "danger"} size="sm">
+                      {control.contractual ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.bestPractice ? "success" : "danger"} size="sm">
+                      {control.bestPractice ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                <Td>
+                  <div className="flex justify-center">
+                    <Badge variant={control.riskAssessment ? "success" : "danger"} size="sm">
+                      {control.riskAssessment ? __("Yes") : __("No")}
+                    </Badge>
+                  </div>
+                </Td>
+                {(canLink || canUnlink) && (
+                  <Td noLink className="text-end">
+                    <ActionDropdown>
+                      {canLink && (
+                        <DropdownItem
+                          icon={IconPencil}
+                          onClick={(e) => {
+                            e.preventDefault();
+                            e.stopPropagation();
+                            if (typeof control.applicability === 'boolean') {
+                              handleOpenEditDialog({
+                                controlId: control.controlId,
+                                sectionTitle: control.sectionTitle,
+                                name: control.name,
+                                frameworkName: control.frameworkName,
+                                applicability: control.applicability,
+                                justification: control.justification ?? null,
+                              });
+                            }
+                          }}
+                        >
+                          {__("Edit")}
+                        </DropdownItem>
+                      )}
+                      {canUnlink && (
+                        <DropdownItem
+                          icon={IconTrashCan}
+                          variant="danger"
+                          onClick={(e) => {
+                            e.preventDefault();
+                            e.stopPropagation();
+                            handleUnlink(control.controlId);
+                          }}
+                          disabled={isUnlinking}
+                        >
+                          {__("Remove")}
+                        </DropdownItem>
+                      )}
+                    </ActionDropdown>
+                  </Td>
+                )}
+              </Tr>
+            ))}
+          </Tbody>
+        </Table>
+      </div>
+
+      <Suspense fallback={null}>
+        <LinkControlDialog ref={manageDialogRef} />
+        <EditControlDialog
+          ref={editDialogRef}
+          onSuccess={() => {
+            refetch({}, { fetchPolicy: "network-only" });
+          }}
+        />
+      </Suspense>
+    </>
+  );
+}
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityOverviewTab.tsx b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityOverviewTab.tsx
new file mode 100644
index 000000000..dc3a846f7
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/StateOfApplicabilityOverviewTab.tsx
@@ -0,0 +1,51 @@
+import { useOutletContext } from "react-router";
+import { Card, Field } from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { formatDate } from "@probo/helpers";
+import type { StateOfApplicabilityGraphNodeQuery$data } from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+
+type StateOfApplicabilityNode = NonNullable<StateOfApplicabilityGraphNodeQuery$data["node"]>;
+
+export default function StateOfApplicabilityOverviewTab() {
+  const { stateOfApplicability } = useOutletContext<{
+    stateOfApplicability: StateOfApplicabilityNode;
+  }>();
+  const { __ } = useTranslate();
+
+  return (
+    <div className="space-y-4">
+      <h2 className="text-base font-medium">{__("State of Applicability details")}</h2>
+      <Card className="space-y-4" padded>
+        <Field
+          label={__("Name")}
+          value={stateOfApplicability.name}
+          disabled
+        />
+        {stateOfApplicability.sourceId && (
+          <Field
+            label={__("Source")}
+            value={stateOfApplicability.sourceId}
+            disabled
+          />
+        )}
+        {stateOfApplicability.snapshotId && (
+          <Field
+            label={__("Snapshot")}
+            value={stateOfApplicability.snapshotId}
+            disabled
+          />
+        )}
+        <Field
+          label={__("Created at")}
+          value={formatDate(stateOfApplicability.createdAt)}
+          disabled
+        />
+        <Field
+          label={__("Updated at")}
+          value={formatDate(stateOfApplicability.updatedAt)}
+          disabled
+        />
+      </Card>
+    </div>
+  );
+}
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabFragment.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabFragment.graphql.ts
new file mode 100644
index 000000000..996787bec
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabFragment.graphql.ts
@@ -0,0 +1,200 @@
+/**
+ * @generated SignedSource<<306449631752d4277aa96b77601e2d8f>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ReaderFragment } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityControlsTabFragment$data = {
+  readonly availableControls: ReadonlyArray<{
+    readonly applicability: boolean | null | undefined;
+    readonly bestPractice: boolean;
+    readonly contractual: boolean;
+    readonly controlId: string;
+    readonly frameworkId: string;
+    readonly frameworkName: string;
+    readonly justification: string | null | undefined;
+    readonly name: string;
+    readonly organizationId: string;
+    readonly regulatory: boolean;
+    readonly riskAssessment: boolean;
+    readonly sectionTitle: string;
+    readonly stateOfApplicabilityId: string | null | undefined;
+  }>;
+  readonly controlsInfo: {
+    readonly totalCount: number;
+  };
+  readonly id: string;
+  readonly " $fragmentType": "StateOfApplicabilityControlsTabFragment";
+};
+export type StateOfApplicabilityControlsTabFragment$key = {
+  readonly " $data"?: StateOfApplicabilityControlsTabFragment$data;
+  readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+};
+
+import StateOfApplicabilityControlsTabRefetchQuery_graphql from './StateOfApplicabilityControlsTabRefetchQuery.graphql';
+
+const node: ReaderFragment = {
+  "argumentDefinitions": [],
+  "kind": "Fragment",
+  "metadata": {
+    "refetch": {
+      "connection": null,
+      "fragmentPathInResult": [
+        "node"
+      ],
+      "operation": StateOfApplicabilityControlsTabRefetchQuery_graphql,
+      "identifierInfo": {
+        "identifierField": "id",
+        "identifierQueryVariableName": "id"
+      }
+    }
+  },
+  "name": "StateOfApplicabilityControlsTabFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "id",
+      "storageKey": null
+    },
+    {
+      "alias": "controlsInfo",
+      "args": [
+        {
+          "kind": "Literal",
+          "name": "first",
+          "value": 0
+        }
+      ],
+      "concreteType": "ControlConnection",
+      "kind": "LinkedField",
+      "name": "controls",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "totalCount",
+          "storageKey": null
+        }
+      ],
+      "storageKey": "controls(first:0)"
+    },
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "AvailableStateOfApplicabilityControl",
+      "kind": "LinkedField",
+      "name": "availableControls",
+      "plural": true,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "controlId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "sectionTitle",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "frameworkId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "frameworkName",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "organizationId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "stateOfApplicabilityId",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "applicability",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "justification",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "bestPractice",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "regulatory",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "contractual",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "riskAssessment",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "type": "StateOfApplicability",
+  "abstractKey": null
+};
+
+(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabRefetchQuery.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabRefetchQuery.graphql.ts
new file mode 100644
index 000000000..0711162aa
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabRefetchQuery.graphql.ts
@@ -0,0 +1,247 @@
+/**
+ * @generated SignedSource<<06d34888ed5b3e0d66f2159e1a916196>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+import { FragmentRefs } from "relay-runtime";
+export type StateOfApplicabilityControlsTabRefetchQuery$variables = {
+  id: string;
+};
+export type StateOfApplicabilityControlsTabRefetchQuery$data = {
+  readonly node: {
+    readonly " $fragmentSpreads": FragmentRefs<"StateOfApplicabilityControlsTabFragment">;
+  };
+};
+export type StateOfApplicabilityControlsTabRefetchQuery = {
+  response: StateOfApplicabilityControlsTabRefetchQuery$data;
+  variables: StateOfApplicabilityControlsTabRefetchQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "id"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "id"
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "args": null,
+            "kind": "FragmentSpread",
+            "name": "StateOfApplicabilityControlsTabFragment"
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": "controlsInfo",
+                "args": [
+                  {
+                    "kind": "Literal",
+                    "name": "first",
+                    "value": 0
+                  }
+                ],
+                "concreteType": "ControlConnection",
+                "kind": "LinkedField",
+                "name": "controls",
+                "plural": false,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "totalCount",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": "controls(first:0)"
+              },
+              {
+                "alias": null,
+                "args": null,
+                "concreteType": "AvailableStateOfApplicabilityControl",
+                "kind": "LinkedField",
+                "name": "availableControls",
+                "plural": true,
+                "selections": [
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "controlId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "sectionTitle",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "name",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "frameworkName",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "organizationId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "stateOfApplicabilityId",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "applicability",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "justification",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "bestPractice",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "regulatory",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "contractual",
+                    "storageKey": null
+                  },
+                  {
+                    "alias": null,
+                    "args": null,
+                    "kind": "ScalarField",
+                    "name": "riskAssessment",
+                    "storageKey": null
+                  }
+                ],
+                "storageKey": null
+              }
+            ],
+            "type": "StateOfApplicability",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "50874b763d9f2cfc01d097ec9b68ec82",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsTabRefetchQuery",
+    "operationKind": "query",
+    "text": "query StateOfApplicabilityControlsTabRefetchQuery(\n  $id: ID!\n) {\n  node(id: $id) {\n    __typename\n    ...StateOfApplicabilityControlsTabFragment\n    id\n  }\n}\n\nfragment StateOfApplicabilityControlsTabFragment on StateOfApplicability {\n  id\n  controlsInfo: controls(first: 0) {\n    totalCount\n  }\n  availableControls {\n    controlId\n    sectionTitle\n    name\n    frameworkId\n    frameworkName\n    organizationId\n    stateOfApplicabilityId\n    applicability\n    justification\n    bestPractice\n    regulatory\n    contractual\n    riskAssessment\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e72695289b29d1a4b60e3f7c18ba1165";
+
+export default node;
diff --git a/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabUnlinkMutation.graphql.ts b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabUnlinkMutation.graphql.ts
new file mode 100644
index 000000000..df896d5d7
--- /dev/null
+++ b/apps/console/src/pages/organizations/states-of-applicability/tabs/__generated__/StateOfApplicabilityControlsTabUnlinkMutation.graphql.ts
@@ -0,0 +1,109 @@
+/**
+ * @generated SignedSource<<a9742800c22e683eb17d46d52b7d6aa5>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteStateOfApplicabilityControlMappingInput = {
+  controlId: string;
+  stateOfApplicabilityId: string;
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation$variables = {
+  input: DeleteStateOfApplicabilityControlMappingInput;
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation$data = {
+  readonly deleteStateOfApplicabilityControlMapping: {
+    readonly deletedControlId: string;
+    readonly deletedStateOfApplicabilityControlId: string;
+    readonly deletedStateOfApplicabilityId: string;
+  };
+};
+export type StateOfApplicabilityControlsTabUnlinkMutation = {
+  response: StateOfApplicabilityControlsTabUnlinkMutation$data;
+  variables: StateOfApplicabilityControlsTabUnlinkMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "DeleteStateOfApplicabilityControlMappingPayload",
+    "kind": "LinkedField",
+    "name": "deleteStateOfApplicabilityControlMapping",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedControlId",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "deletedStateOfApplicabilityControlId",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "6bf3ac32bd032b215e3e4f48100353d7",
+    "id": null,
+    "metadata": {},
+    "name": "StateOfApplicabilityControlsTabUnlinkMutation",
+    "operationKind": "mutation",
+    "text": "mutation StateOfApplicabilityControlsTabUnlinkMutation(\n  $input: DeleteStateOfApplicabilityControlMappingInput!\n) {\n  deleteStateOfApplicabilityControlMapping(input: $input) {\n    deletedStateOfApplicabilityId\n    deletedControlId\n    deletedStateOfApplicabilityControlId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "b8c3e0ca44bde75468fcfab09151854d";
+
+export default node;
diff --git a/apps/console/src/routes.tsx b/apps/console/src/routes.tsx
index 80474b791..f292c7185 100644
--- a/apps/console/src/routes.tsx
+++ b/apps/console/src/routes.tsx
@@ -35,6 +35,7 @@ import { snapshotsRoutes } from "./routes/snapshotsRoutes.ts";
 import { continualImprovementRoutes } from "./routes/continualImprovementRoutes.ts";
 import { rightsRequestRoutes } from "./routes/rightsRequestRoutes.ts";
 import { processingActivityRoutes } from "./routes/processingActivityRoutes.ts";
+import { statesOfApplicabilityRoutes } from "./routes/statesOfApplicabilityRoutes.ts";
 import { lazy } from "@probo/react-lazy";
 import { loaderFromQueryLoader, routeFromAppRoute, withQueryRef, type AppRoute } from "@probo/routes";
 import { employeeDocumentsQuery } from "./pages/organizations/employee/EmployeeDocumentsPage";
@@ -227,8 +228,9 @@ const routes = [
       ...continualImprovementRoutes,
       ...rightsRequestRoutes,
       ...processingActivityRoutes,
-      ...snapshotsRoutes,
+      ...statesOfApplicabilityRoutes,
       ...trustCenterRoutes,
+      ...snapshotsRoutes,
       {
         path: "*",
         Component: PageError,
diff --git a/apps/console/src/routes/statesOfApplicabilityRoutes.ts b/apps/console/src/routes/statesOfApplicabilityRoutes.ts
new file mode 100644
index 000000000..92ed5186e
--- /dev/null
+++ b/apps/console/src/routes/statesOfApplicabilityRoutes.ts
@@ -0,0 +1,70 @@
+import { lazy } from "@probo/react-lazy";
+import { loadQuery } from "react-relay";
+import { relayEnvironment } from "/providers/RelayProviders";
+import { PageSkeleton } from "/components/skeletons/PageSkeleton.tsx";
+import {
+  paginatedStateOfApplicabilityQuery,
+  stateOfApplicabilityNodeQuery,
+} from "/hooks/graph/StateOfApplicabilityGraph";
+import type { StateOfApplicabilityGraphPaginatedQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphPaginatedQuery.graphql";
+import type { StateOfApplicabilityGraphNodeQuery } from "/hooks/graph/__generated__/StateOfApplicabilityGraphNodeQuery.graphql";
+import { loaderFromQueryLoader, withQueryRef, type AppRoute } from "@probo/routes";
+
+export const statesOfApplicabilityRoutes = [
+  {
+    path: "states-of-applicability",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ organizationId }) =>
+      loadQuery<StateOfApplicabilityGraphPaginatedQuery>(
+        relayEnvironment,
+        paginatedStateOfApplicabilityQuery,
+        { organizationId: organizationId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StatesOfApplicabilityPage")),
+    ),
+  },
+  {
+    path: "snapshots/:snapshotId/states-of-applicability",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ organizationId }) =>
+      loadQuery<StateOfApplicabilityGraphPaginatedQuery>(
+        relayEnvironment,
+        paginatedStateOfApplicabilityQuery,
+        { organizationId: organizationId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StatesOfApplicabilityPage")),
+    ),
+  },
+  {
+    path: "states-of-applicability/:stateOfApplicabilityId",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ stateOfApplicabilityId }) =>
+      loadQuery<StateOfApplicabilityGraphNodeQuery>(
+        relayEnvironment,
+        stateOfApplicabilityNodeQuery,
+        { stateOfApplicabilityId: stateOfApplicabilityId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage")),
+    ),
+  },
+  {
+    path: "snapshots/:snapshotId/states-of-applicability/:stateOfApplicabilityId",
+    Fallback: PageSkeleton,
+    loader: loaderFromQueryLoader(({ stateOfApplicabilityId }) =>
+      loadQuery<StateOfApplicabilityGraphNodeQuery>(
+        relayEnvironment,
+        stateOfApplicabilityNodeQuery,
+        { stateOfApplicabilityId: stateOfApplicabilityId! },
+      ),
+    ),
+    Component: withQueryRef(
+      lazy(() => import("/pages/organizations/states-of-applicability/StateOfApplicabilityDetailPage")),
+    ),
+  },
+] satisfies AppRoute[];
diff --git a/e2e/console/control_test.go b/e2e/console/control_test.go
index c6546eca8..f06018c0b 100644
--- a/e2e/console/control_test.go
+++ b/e2e/console/control_test.go
@@ -66,6 +66,7 @@ func TestControl_Create(t *testing.T) {
 				"name":         "Information Security Policies",
 				"description":  "Policies for information security",
 				"status":       "INCLUDED",
+				"bestPractice": true,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -112,6 +113,7 @@ func TestControl_Create(t *testing.T) {
 				"description":            "Cryptography controls",
 				"status":                 "EXCLUDED",
 				"exclusionJustification": "Not applicable - no cryptographic data processing",
+				"bestPractice":           false,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -356,6 +358,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -368,6 +371,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -376,10 +380,11 @@ func TestControl_RequiredFields(t *testing.T) {
 			name: "Missing sectionTitle should fail",
 			variables: map[string]any{
 				"input": map[string]any{
-					"frameworkId": frameworkID,
-					"name":        "Test Control",
-					"description": "Test",
-					"status":      "INCLUDED",
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"status":       "INCLUDED",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -392,6 +397,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"description":  "Test",
 					"sectionTitle": "Section 1",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -404,6 +410,20 @@ func TestControl_RequiredFields(t *testing.T) {
 					"name":         "Test Control",
 					"sectionTitle": "Section 1",
 					"status":       "INCLUDED",
+					"bestPractice": true,
+				},
+			},
+			wantError: true,
+		},
+		{
+			name: "Missing bestPractice should fail",
+			variables: map[string]any{
+				"input": map[string]any{
+					"frameworkId":  frameworkID,
+					"name":         "Test Control",
+					"description":  "Test",
+					"sectionTitle": "Section 1",
+					"status":       "INCLUDED",
 				},
 			},
 			wantError: true,
@@ -417,6 +437,7 @@ func TestControl_RequiredFields(t *testing.T) {
 					"description":  "Test",
 					"sectionTitle": "Section 1",
 					"status":       "INVALID_STATUS",
+					"bestPractice": true,
 				},
 			},
 			wantError: true,
@@ -504,6 +525,7 @@ func TestControl_OmittableDescription(t *testing.T) {
 			"description":  "Initial description",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -668,6 +690,7 @@ func TestControl_SubResolvers(t *testing.T) {
 			"description":  "Test description",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &controlResult)
 	require.NoError(t, err)
@@ -881,6 +904,7 @@ func TestControl_ExclusionJustification(t *testing.T) {
 				"sectionTitle":           "Section 1",
 				"status":                 "EXCLUDED",
 				"exclusionJustification": "Not applicable to our business",
+				"bestPractice":           false,
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -919,6 +943,7 @@ func TestControl_ExclusionJustification(t *testing.T) {
 				"description":  "Test",
 				"sectionTitle": "Section 2",
 				"status":       "INCLUDED",
+				"bestPractice": true,
 			},
 		}, &createResult)
 		require.NoError(t, err)
diff --git a/e2e/console/mapping_test.go b/e2e/console/mapping_test.go
index 8bafb28f3..60446625a 100644
--- a/e2e/console/mapping_test.go
+++ b/e2e/console/mapping_test.go
@@ -83,6 +83,7 @@ func TestControlMeasureMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control for mapping",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -362,6 +363,7 @@ func TestControlDocumentMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -503,6 +505,7 @@ func TestControlAuditMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -640,6 +643,7 @@ func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"status":       "INCLUDED",
+			"bestPractice": true,
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -897,6 +901,7 @@ func TestRiskObligationMapping_CreateDelete(t *testing.T) {
 			"requirement":    "Obligation for Risk Mapping",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createObligationResult)
 	require.NoError(t, err)
diff --git a/e2e/console/obligation_test.go b/e2e/console/obligation_test.go
index 7c092b0e7..54f6efe5f 100644
--- a/e2e/console/obligation_test.go
+++ b/e2e/console/obligation_test.go
@@ -69,6 +69,7 @@ func TestObligation_Create(t *testing.T) {
 			"regulator":      "ICO",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &result)
 	require.NoError(t, err)
@@ -115,6 +116,7 @@ func TestObligation_Update(t *testing.T) {
 			"area":           "Original Area",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -191,6 +193,7 @@ func TestObligation_Delete(t *testing.T) {
 			"area":           "Obligation to Delete",
 			"ownerId":        peopleID,
 			"status":         "NON_COMPLIANT",
+			"type":           "LEGAL",
 		},
 	}, &createResult)
 	require.NoError(t, err)
@@ -256,6 +259,7 @@ func TestObligation_List(t *testing.T) {
 				"area":           area,
 				"ownerId":        peopleID,
 				"status":         "NON_COMPLIANT",
+				"type":           "LEGAL",
 			},
 		}, &result)
 		require.NoError(t, err)
@@ -342,6 +346,7 @@ func TestObligation_StatusValues(t *testing.T) {
 					"area":           "Status Test " + status,
 					"ownerId":        peopleID,
 					"status":         status,
+					"type":           "LEGAL",
 				},
 			}, &result)
 			require.NoError(t, err)
diff --git a/e2e/console/rbac_test.go b/e2e/console/rbac_test.go
index da4e55b64..7c50e21d3 100644
--- a/e2e/console/rbac_test.go
+++ b/e2e/console/rbac_test.go
@@ -413,7 +413,7 @@ func TestRBAC(t *testing.T) {
 			client: owner,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Owner"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: true,
 		},
@@ -423,7 +423,7 @@ func TestRBAC(t *testing.T) {
 			client: admin,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Admin"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: true,
 		},
@@ -433,7 +433,7 @@ func TestRBAC(t *testing.T) {
 			client: viewer,
 			query:  createControlMutation,
 			variables: func() map[string]any {
-				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "status": "INCLUDED"}}
+				return map[string]any{"input": map[string]any{"frameworkId": frameworkID, "name": factory.SafeName("Control"), "description": "Test", "sectionTitle": factory.SafeName("Section Viewer"), "status": "INCLUDED", "bestPractice": true}}
 			},
 			shouldAllow: false,
 		},
diff --git a/e2e/internal/factory/factory.go b/e2e/internal/factory/factory.go
index 2c995cc48..04bab605f 100644
--- a/e2e/internal/factory/factory.go
+++ b/e2e/internal/factory/factory.go
@@ -218,6 +218,7 @@ func CreateControl(c *testutil.Client, frameworkID string, attrs ...Attrs) strin
 		"description":  a.getString("description", "Test control description"),
 		"sectionTitle": a.getString("sectionTitle", fmt.Sprintf("Section %s", gofakeit.LetterN(3))),
 		"status":       a.getString("status", "INCLUDED"),
+		"bestPractice": a.getBool("bestPractice", true),
 	}
 
 	var result struct {
@@ -389,9 +390,9 @@ func CreatePeople(c *testutil.Client, attrs ...Attrs) string {
 	`
 
 	input := map[string]any{
-		"organizationId":          c.GetOrganizationID().String(),
+		"organizationId":           c.GetOrganizationID().String(),
 		"fullName":                 a.getString("fullName", SafeName("Person")),
-		"primaryEmailAddress":     a.getString("primaryEmailAddress", SafeEmail()),
+		"primaryEmailAddress":      a.getString("primaryEmailAddress", SafeEmail()),
 		"additionalEmailAddresses": a.getSlice("additionalEmailAddresses", []string{}),
 		"kind":                     a.getString("kind", "EMPLOYEE"),
 	}
@@ -498,6 +499,11 @@ func (b *ControlBuilder) WithStatus(status string) *ControlBuilder {
 	return b
 }
 
+func (b *ControlBuilder) WithBestPractice(bestPractice bool) *ControlBuilder {
+	b.attrs["bestPractice"] = bestPractice
+	return b
+}
+
 func (b *ControlBuilder) Create() string {
 	return CreateControl(b.client, b.frameworkID, b.attrs)
 }
diff --git a/packages/helpers/src/index.ts b/packages/helpers/src/index.ts
index 31ee96bbf..5ecf19f2b 100644
--- a/packages/helpers/src/index.ts
+++ b/packages/helpers/src/index.ts
@@ -52,6 +52,10 @@ export {
     getObligationStatusLabel,
     getObligationStatusOptions,
 } from "./obligationStatus";
+export {
+    getObligationTypeLabel,
+    getObligationTypeOptions,
+} from "./obligationType";
 export {
     getTrustCenterVisibilityVariant,
     getTrustCenterVisibilityLabel,
diff --git a/packages/helpers/src/obligationType.ts b/packages/helpers/src/obligationType.ts
new file mode 100644
index 000000000..4f3eb1070
--- /dev/null
+++ b/packages/helpers/src/obligationType.ts
@@ -0,0 +1,29 @@
+type Translator = (s: string) => string;
+
+export type ObligationType = "LEGAL" | "CONTRACTUAL";
+
+export const obligationTypes = [
+  "LEGAL",
+  "CONTRACTUAL",
+] as const;
+
+export const getObligationTypeLabel = (type: ObligationType) => {
+  switch (type) {
+    case "LEGAL":
+      return "Legal";
+    case "CONTRACTUAL":
+      return "Contractual";
+    default:
+      return type;
+  }
+};
+
+export function getObligationTypeOptions(__: Translator) {
+  return obligationTypes.map((type) => ({
+    value: type,
+    label: __({
+      "LEGAL": "Legal",
+      "CONTRACTUAL": "Contractual",
+    }[type]),
+  }));
+}
diff --git a/packages/helpers/src/snapshots.ts b/packages/helpers/src/snapshots.ts
index 66530f276..b4a74e8e0 100644
--- a/packages/helpers/src/snapshots.ts
+++ b/packages/helpers/src/snapshots.ts
@@ -9,6 +9,7 @@ export const snapshotTypes = [
   "OBLIGATIONS",
   "CONTINUAL_IMPROVEMENTS",
   "PROCESSING_ACTIVITIES",
+  "STATES_OF_APPLICABILITY",
 ] as const;
 
 export function getSnapshotTypeLabel(__: Translator, type: string | null | undefined) {
@@ -33,6 +34,8 @@ export function getSnapshotTypeLabel(__: Translator, type: string | null | undef
       return __("Continual Improvements");
     case "PROCESSING_ACTIVITIES":
       return __("Processing Activities");
+    case "STATES_OF_APPLICABILITY":
+      return __("States of Applicability");
     default:
       return __("Unknown");
   }
@@ -56,6 +59,8 @@ export function getSnapshotTypeUrlPath(type?: string): string {
       return "/continual-improvements";
     case "PROCESSING_ACTIVITIES":
       return "/processing-activities";
+    case "STATES_OF_APPLICABILITY":
+      return "/states-of-applicability";
     default:
       return "";
   }
diff --git a/pkg/authz/permissions.go b/pkg/authz/permissions.go
index 4c490437a..5246277fa 100644
--- a/pkg/authz/permissions.go
+++ b/pkg/authz/permissions.go
@@ -103,6 +103,7 @@ const (
 	ActionListMeetings                Action = "listMeetings"
 	ActionListMembers                 Action = "listMembers"
 	ActionListNonconformities         Action = "listNonconformities"
+	ActionListStatesOfApplicability   Action = "listStatesOfApplicability"
 	ActionListObligations             Action = "listObligations"
 	ActionListPeople                  Action = "listPeople"
 	ActionListProcessingActivities    Action = "listProcessingActivities"
@@ -120,43 +121,46 @@ const (
 	ActionListSignableDocuments       Action = "listSignableDocuments"
 	ActionListSignableDocumentVersion Action = "listSignableDocumentVersion"
 
-	ActionCreateAsset                          Action = "createAsset"
-	ActionCreateAudit                          Action = "createAudit"
-	ActionCreateContinualImprovement           Action = "createContinualImprovement"
-	ActionCreateRightsRequest                  Action = "createRightsRequest"
-	ActionCreateControl                        Action = "createControl"
-	ActionCreateControlAuditMapping            Action = "createControlAuditMapping"
-	ActionCreateControlDocumentMapping         Action = "createControlDocumentMapping"
-	ActionCreateControlMeasureMapping          Action = "createControlMeasureMapping"
-	ActionCreateControlSnapshotMapping         Action = "createControlSnapshotMapping"
-	ActionCreateCustomDomain                   Action = "createCustomDomain"
-	ActionCreateDatum                          Action = "createDatum"
-	ActionCreateDocument                       Action = "createDocument"
-	ActionCreateDraftDocumentVersion           Action = "createDraftDocumentVersion"
-	ActionCreateFramework                      Action = "createFramework"
-	ActionCreateMeasure                        Action = "createMeasure"
-	ActionCreateMeeting                        Action = "createMeeting"
-	ActionCreateNonconformity                  Action = "createNonconformity"
-	ActionCreateObligation                     Action = "createObligation"
-	ActionCreatePeople                         Action = "createPeople"
-	ActionCreateProcessingActivity             Action = "createProcessingActivity"
-	ActionCreateDataProtectionImpactAssessment Action = "createDataProtectionImpactAssessment"
-	ActionCreateTransferImpactAssessment       Action = "createTransferImpactAssessment"
-	ActionCreateRisk                           Action = "createRisk"
-	ActionCreateRiskDocumentMapping            Action = "createRiskDocumentMapping"
-	ActionCreateRiskMeasureMapping             Action = "createRiskMeasureMapping"
-	ActionCreateRiskObligationMapping          Action = "createRiskObligationMapping"
-	ActionCreateSAMLConfiguration              Action = "createSAMLConfiguration"
-	ActionCreateSnapshot                       Action = "createSnapshot"
-	ActionCreateTask                           Action = "createTask"
-	ActionCreateTrustCenter                    Action = "createTrustCenter"
-	ActionCreateTrustCenterAccess              Action = "createTrustCenterAccess"
-	ActionCreateTrustCenterFile                Action = "createTrustCenterFile"
-	ActionCreateTrustCenterReference           Action = "createTrustCenterReference"
-	ActionCreateVendor                         Action = "createVendor"
-	ActionCreateVendorContact                  Action = "createVendorContact"
-	ActionCreateVendorRiskAssessment           Action = "createVendorRiskAssessment"
-	ActionCreateVendorService                  Action = "createVendorService"
+	ActionCreateAsset                              Action = "createAsset"
+	ActionCreateAudit                              Action = "createAudit"
+	ActionCreateContinualImprovement               Action = "createContinualImprovement"
+	ActionCreateRightsRequest                      Action = "createRightsRequest"
+	ActionCreateControl                            Action = "createControl"
+	ActionCreateControlAuditMapping                Action = "createControlAuditMapping"
+	ActionCreateControlObligationMapping           Action = "createControlObligationMapping"
+	ActionCreateControlDocumentMapping             Action = "createControlDocumentMapping"
+	ActionCreateControlMeasureMapping              Action = "createControlMeasureMapping"
+	ActionCreateControlSnapshotMapping             Action = "createControlSnapshotMapping"
+	ActionCreateStateOfApplicabilityControlMapping Action = "createStateOfApplicabilityControlMapping"
+	ActionCreateCustomDomain                       Action = "createCustomDomain"
+	ActionCreateDatum                              Action = "createDatum"
+	ActionCreateDocument                           Action = "createDocument"
+	ActionCreateDraftDocumentVersion               Action = "createDraftDocumentVersion"
+	ActionCreateFramework                          Action = "createFramework"
+	ActionCreateMeasure                            Action = "createMeasure"
+	ActionCreateMeeting                            Action = "createMeeting"
+	ActionCreateNonconformity                      Action = "createNonconformity"
+	ActionCreateObligation                         Action = "createObligation"
+	ActionCreatePeople                             Action = "createPeople"
+	ActionCreateProcessingActivity                 Action = "createProcessingActivity"
+	ActionCreateStateOfApplicability               Action = "createStateOfApplicability"
+	ActionCreateDataProtectionImpactAssessment     Action = "createDataProtectionImpactAssessment"
+	ActionCreateTransferImpactAssessment           Action = "createTransferImpactAssessment"
+	ActionCreateRisk                               Action = "createRisk"
+	ActionCreateRiskDocumentMapping                Action = "createRiskDocumentMapping"
+	ActionCreateRiskMeasureMapping                 Action = "createRiskMeasureMapping"
+	ActionCreateRiskObligationMapping              Action = "createRiskObligationMapping"
+	ActionCreateSAMLConfiguration                  Action = "createSAMLConfiguration"
+	ActionCreateSnapshot                           Action = "createSnapshot"
+	ActionCreateTask                               Action = "createTask"
+	ActionCreateTrustCenter                        Action = "createTrustCenter"
+	ActionCreateTrustCenterAccess                  Action = "createTrustCenterAccess"
+	ActionCreateTrustCenterFile                    Action = "createTrustCenterFile"
+	ActionCreateTrustCenterReference               Action = "createTrustCenterReference"
+	ActionCreateVendor                             Action = "createVendor"
+	ActionCreateVendorContact                      Action = "createVendorContact"
+	ActionCreateVendorRiskAssessment               Action = "createVendorRiskAssessment"
+	ActionCreateVendorService                      Action = "createVendorService"
 
 	ActionUpdateAsset                            Action = "updateAsset"
 	ActionUpdateAudit                            Action = "updateAudit"
@@ -175,6 +179,7 @@ const (
 	ActionUpdateOrganization                     Action = "updateOrganization"
 	ActionUpdatePeople                           Action = "updatePeople"
 	ActionUpdateProcessingActivity               Action = "updateProcessingActivity"
+	ActionUpdateStateOfApplicability             Action = "updateStateOfApplicability"
 	ActionUpdateDataProtectionImpactAssessment   Action = "updateDataProtectionImpactAssessment"
 	ActionUpdateTransferImpactAssessment         Action = "updateTransferImpactAssessment"
 	ActionUpdateRisk                             Action = "updateRisk"
@@ -190,50 +195,53 @@ const (
 	ActionUpdateVendorDataPrivacyAgreement       Action = "updateVendorDataPrivacyAgreement"
 	ActionUpdateVendorService                    Action = "updateVendorService"
 
-	ActionDeleteAsset                            Action = "deleteAsset"
-	ActionDeleteAudit                            Action = "deleteAudit"
-	ActionDeleteAuditReport                      Action = "deleteAuditReport"
-	ActionDeleteContinualImprovement             Action = "deleteContinualImprovement"
-	ActionDeleteRightsRequest                    Action = "deleteRightsRequest"
-	ActionDeleteControl                          Action = "deleteControl"
-	ActionDeleteControlAuditMapping              Action = "deleteControlAuditMapping"
-	ActionDeleteControlDocumentMapping           Action = "deleteControlDocumentMapping"
-	ActionDeleteControlMeasureMapping            Action = "deleteControlMeasureMapping"
-	ActionDeleteControlSnapshotMapping           Action = "deleteControlSnapshotMapping"
-	ActionDeleteCustomDomain                     Action = "deleteCustomDomain"
-	ActionDeleteDatum                            Action = "deleteDatum"
-	ActionDeleteDocument                         Action = "deleteDocument"
-	ActionDeleteDraftDocumentVersion             Action = "deleteDraftDocumentVersion"
-	ActionDeleteEvidence                         Action = "deleteEvidence"
-	ActionDeleteFramework                        Action = "deleteFramework"
-	ActionDeleteInvitation                       Action = "deleteInvitation"
-	ActionDeleteMeasure                          Action = "deleteMeasure"
-	ActionDeleteMeeting                          Action = "deleteMeeting"
-	ActionDeleteNonconformity                    Action = "deleteNonconformity"
-	ActionDeleteObligation                       Action = "deleteObligation"
-	ActionDeleteOrganization                     Action = "deleteOrganization"
-	ActionDeleteOrganizationHorizontalLogo       Action = "deleteOrganizationHorizontalLogo"
-	ActionDeletePeople                           Action = "deletePeople"
-	ActionDeleteProcessingActivity               Action = "deleteProcessingActivity"
-	ActionDeleteDataProtectionImpactAssessment   Action = "deleteDataProtectionImpactAssessment"
-	ActionDeleteTransferImpactAssessment         Action = "deleteTransferImpactAssessment"
-	ActionDeleteRisk                             Action = "deleteRisk"
-	ActionDeleteRiskDocumentMapping              Action = "deleteRiskDocumentMapping"
-	ActionDeleteRiskMeasureMapping               Action = "deleteRiskMeasureMapping"
-	ActionDeleteRiskObligationMapping            Action = "deleteRiskObligationMapping"
-	ActionDeleteSAMLConfiguration                Action = "deleteSAMLConfiguration"
-	ActionDeleteSnapshot                         Action = "deleteSnapshot"
-	ActionDeleteTask                             Action = "deleteTask"
-	ActionDeleteTrustCenterAccess                Action = "deleteTrustCenterAccess"
-	ActionDeleteTrustCenterFile                  Action = "deleteTrustCenterFile"
-	ActionDeleteTrustCenterNDA                   Action = "deleteTrustCenterNDA"
-	ActionDeleteTrustCenterReference             Action = "deleteTrustCenterReference"
-	ActionDeleteVendor                           Action = "deleteVendor"
-	ActionDeleteVendorBusinessAssociateAgreement Action = "deleteVendorBusinessAssociateAgreement"
-	ActionDeleteVendorComplianceReport           Action = "deleteVendorComplianceReport"
-	ActionDeleteVendorContact                    Action = "deleteVendorContact"
-	ActionDeleteVendorDataPrivacyAgreement       Action = "deleteVendorDataPrivacyAgreement"
-	ActionDeleteVendorService                    Action = "deleteVendorService"
+	ActionDeleteAsset                              Action = "deleteAsset"
+	ActionDeleteAudit                              Action = "deleteAudit"
+	ActionDeleteAuditReport                        Action = "deleteAuditReport"
+	ActionDeleteContinualImprovement               Action = "deleteContinualImprovement"
+	ActionDeleteRightsRequest                      Action = "deleteRightsRequest"
+	ActionDeleteControl                            Action = "deleteControl"
+	ActionDeleteControlAuditMapping                Action = "deleteControlAuditMapping"
+	ActionDeleteControlObligationMapping           Action = "deleteControlObligationMapping"
+	ActionDeleteControlDocumentMapping             Action = "deleteControlDocumentMapping"
+	ActionDeleteControlMeasureMapping              Action = "deleteControlMeasureMapping"
+	ActionDeleteControlSnapshotMapping             Action = "deleteControlSnapshotMapping"
+	ActionDeleteStateOfApplicabilityControlMapping Action = "deleteStateOfApplicabilityControlMapping"
+	ActionDeleteCustomDomain                       Action = "deleteCustomDomain"
+	ActionDeleteDatum                              Action = "deleteDatum"
+	ActionDeleteDocument                           Action = "deleteDocument"
+	ActionDeleteDraftDocumentVersion               Action = "deleteDraftDocumentVersion"
+	ActionDeleteEvidence                           Action = "deleteEvidence"
+	ActionDeleteFramework                          Action = "deleteFramework"
+	ActionDeleteInvitation                         Action = "deleteInvitation"
+	ActionDeleteMeasure                            Action = "deleteMeasure"
+	ActionDeleteMeeting                            Action = "deleteMeeting"
+	ActionDeleteNonconformity                      Action = "deleteNonconformity"
+	ActionDeleteObligation                         Action = "deleteObligation"
+	ActionDeleteOrganization                       Action = "deleteOrganization"
+	ActionDeleteOrganizationHorizontalLogo         Action = "deleteOrganizationHorizontalLogo"
+	ActionDeletePeople                             Action = "deletePeople"
+	ActionDeleteProcessingActivity                 Action = "deleteProcessingActivity"
+	ActionDeleteStateOfApplicability               Action = "deleteStateOfApplicability"
+	ActionDeleteDataProtectionImpactAssessment     Action = "deleteDataProtectionImpactAssessment"
+	ActionDeleteTransferImpactAssessment           Action = "deleteTransferImpactAssessment"
+	ActionDeleteRisk                               Action = "deleteRisk"
+	ActionDeleteRiskDocumentMapping                Action = "deleteRiskDocumentMapping"
+	ActionDeleteRiskMeasureMapping                 Action = "deleteRiskMeasureMapping"
+	ActionDeleteRiskObligationMapping              Action = "deleteRiskObligationMapping"
+	ActionDeleteSAMLConfiguration                  Action = "deleteSAMLConfiguration"
+	ActionDeleteSnapshot                           Action = "deleteSnapshot"
+	ActionDeleteTask                               Action = "deleteTask"
+	ActionDeleteTrustCenterAccess                  Action = "deleteTrustCenterAccess"
+	ActionDeleteTrustCenterFile                    Action = "deleteTrustCenterFile"
+	ActionDeleteTrustCenterNDA                     Action = "deleteTrustCenterNDA"
+	ActionDeleteTrustCenterReference               Action = "deleteTrustCenterReference"
+	ActionDeleteVendor                             Action = "deleteVendor"
+	ActionDeleteVendorBusinessAssociateAgreement   Action = "deleteVendorBusinessAssociateAgreement"
+	ActionDeleteVendorComplianceReport             Action = "deleteVendorComplianceReport"
+	ActionDeleteVendorContact                      Action = "deleteVendorContact"
+	ActionDeleteVendorDataPrivacyAgreement         Action = "deleteVendorDataPrivacyAgreement"
+	ActionDeleteVendorService                      Action = "deleteVendorService"
 
 	ActionAcceptInvitation                         Action = "acceptInvitation"
 	ActionAssessVendor                             Action = "assessVendor"
@@ -315,16 +323,17 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionConfirmEmail:                             NonEmployeeRoles,
 		ActionAcceptInvitation:                         NonEmployeeRoles,
 
-		ActionListTrustCenterFiles:   CoreRoles,
-		ActionGetTrustCenter:         CoreRoles,
-		ActionMemberships:            CoreRoles,
-		ActionListMembers:            CoreRoles,
-		ActionListInvitations:        CoreRoles,
-		ActionListSlackConnections:   CoreRoles,
-		ActionGetCustomDomain:        CoreRoles,
-		ActionListSAMLConfigurations: CoreRoles,
-		ActionListMeetings:           CoreRoles,
-		ActionListTasks:              CoreRoles,
+		ActionListTrustCenterFiles:      CoreRoles,
+		ActionGetTrustCenter:            CoreRoles,
+		ActionMemberships:               CoreRoles,
+		ActionListMembers:               CoreRoles,
+		ActionListInvitations:           CoreRoles,
+		ActionListSlackConnections:      CoreRoles,
+		ActionGetCustomDomain:           CoreRoles,
+		ActionListSAMLConfigurations:    CoreRoles,
+		ActionListMeetings:              CoreRoles,
+		ActionListStatesOfApplicability: NonEmployeeRoles,
+		ActionListTasks:                 CoreRoles,
 
 		ActionUpdateOrganization:               EditRoles,
 		ActionDeleteOrganizationHorizontalLogo: EditRoles,
@@ -339,6 +348,7 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionCreateMeasure:                    EditRoles,
 		ActionImportMeasure:                    EditRoles,
 		ActionCreateMeeting:                    EditRoles,
+		ActionCreateStateOfApplicability:       EditRoles,
 		ActionCreateTask:                       EditRoles,
 		ActionCreateRisk:                       EditRoles,
 		ActionCreateDocument:                   EditRoles,
@@ -498,23 +508,32 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionExportFramework:                       EditRoles,
 	},
 	coredata.ControlEntityType: {
-		ActionGet:           NonEmployeeRoles,
-		ActionGetFramework:  NonEmployeeRoles,
-		ActionListMeasures:  NonEmployeeRoles,
-		ActionListDocuments: NonEmployeeRoles,
-		ActionListAudits:    NonEmployeeRoles,
-		ActionListSnapshots: NonEmployeeRoles,
-
-		ActionUpdateControl:                EditRoles,
-		ActionDeleteControl:                EditRoles,
-		ActionCreateControlMeasureMapping:  EditRoles,
-		ActionCreateControlDocumentMapping: EditRoles,
-		ActionDeleteControlMeasureMapping:  EditRoles,
-		ActionDeleteControlDocumentMapping: EditRoles,
-		ActionCreateControlAuditMapping:    EditRoles,
-		ActionDeleteControlAuditMapping:    EditRoles,
-		ActionCreateControlSnapshotMapping: EditRoles,
-		ActionDeleteControlSnapshotMapping: EditRoles,
+		ActionGet:                       NonEmployeeRoles,
+		ActionGetFramework:              NonEmployeeRoles,
+		ActionListMeasures:              NonEmployeeRoles,
+		ActionListDocuments:             NonEmployeeRoles,
+		ActionListAudits:                NonEmployeeRoles,
+		ActionListObligations:           NonEmployeeRoles,
+		ActionListSnapshots:             NonEmployeeRoles,
+		ActionListStatesOfApplicability: NonEmployeeRoles,
+
+		ActionUpdateControl:                            EditRoles,
+		ActionDeleteControl:                            EditRoles,
+		ActionCreateControlMeasureMapping:              EditRoles,
+		ActionCreateControlDocumentMapping:             EditRoles,
+		ActionDeleteControlMeasureMapping:              EditRoles,
+		ActionDeleteControlDocumentMapping:             EditRoles,
+		ActionCreateControlAuditMapping:                EditRoles,
+		ActionDeleteControlAuditMapping:                EditRoles,
+		ActionCreateControlObligationMapping:           EditRoles,
+		ActionDeleteControlObligationMapping:           EditRoles,
+		ActionCreateControlSnapshotMapping:             EditRoles,
+		ActionCreateStateOfApplicabilityControlMapping: EditRoles,
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
+		ActionDeleteControlSnapshotMapping:             EditRoles,
+	},
+	coredata.StateOfApplicabilityControlEntityType: {
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
 	},
 	coredata.MeasureEntityType: {
 		ActionListTasks: CoreRoles,
@@ -689,6 +708,7 @@ var Permissions = map[uint16]map[Action][]Role{
 	coredata.RightsRequestEntityType: {
 		ActionGet:             NonEmployeeRoles,
 		ActionGetOrganization: NonEmployeeRoles,
+		ActionListControls:    NonEmployeeRoles,
 
 		ActionUpdateRightsRequest: EditRoles,
 		ActionDeleteRightsRequest: EditRoles,
@@ -763,6 +783,16 @@ var Permissions = map[uint16]map[Action][]Role{
 		ActionUpdateMeeting: EditRoles,
 		ActionDeleteMeeting: EditRoles,
 	},
+	coredata.StateOfApplicabilityEntityType: {
+		ActionGet:             NonEmployeeRoles,
+		ActionGetOrganization: NonEmployeeRoles,
+		ActionListControls:    NonEmployeeRoles,
+		ActionTotalCount:      NonEmployeeRoles,
+
+		ActionUpdateStateOfApplicability:               EditRoles,
+		ActionDeleteStateOfApplicability:               EditRoles,
+		ActionDeleteStateOfApplicabilityControlMapping: EditRoles,
+	},
 }
 
 func GetPermissionsForAction(entityType uint16, action Action) []Role {
diff --git a/pkg/coredata/control.go b/pkg/coredata/control.go
index 7e965285d..1bf442f0d 100644
--- a/pkg/coredata/control.go
+++ b/pkg/coredata/control.go
@@ -38,6 +38,7 @@ type (
 		Description            *string       `db:"description"`
 		Status                 ControlStatus `db:"status"`
 		ExclusionJustification *string       `db:"exclusion_justification"`
+		BestPractice           bool          `db:"best_practice"`
 		CreatedAt              time.Time     `db:"created_at"`
 		UpdatedAt              time.Time     `db:"updated_at"`
 	}
@@ -134,6 +135,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -153,6 +155,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -245,6 +248,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -264,6 +268,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -362,6 +367,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -387,6 +393,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -467,6 +474,7 @@ SELECT
     description,
     status,
 	exclusion_justification,
+	best_practice,
     created_at,
     updated_at
 FROM
@@ -562,6 +570,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -581,6 +590,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -628,6 +638,7 @@ SELECT
     description,
     status,
     exclusion_justification,
+    best_practice,
     created_at,
     updated_at
 FROM
@@ -677,6 +688,7 @@ SELECT
     description,
     status,
     exclusion_justification,
+    best_practice,
     created_at,
     updated_at
 FROM
@@ -726,6 +738,7 @@ INSERT INTO
         description,
         status,
         exclusion_justification,
+        best_practice,
         created_at,
         updated_at
     )
@@ -739,6 +752,7 @@ VALUES (
     @description,
 	@status,
 	@exclusion_justification,
+	@best_practice,
     @created_at,
     @updated_at
 );
@@ -754,6 +768,7 @@ VALUES (
 		"description":             c.Description,
 		"status":                  c.Status,
 		"exclusion_justification": c.ExclusionJustification,
+		"best_practice":           c.BestPractice,
 		"created_at":              c.CreatedAt,
 		"updated_at":              c.UpdatedAt,
 	}
@@ -808,6 +823,7 @@ UPDATE controls SET
     section_title = @section_title,
 	status = @status,
 	exclusion_justification = @exclusion_justification,
+	best_practice = @best_practice,
     updated_at = @updated_at
 WHERE %s
     AND id = @control_id
@@ -821,6 +837,7 @@ WHERE %s
 		"section_title":           c.SectionTitle,
 		"status":                  c.Status,
 		"exclusion_justification": c.ExclusionJustification,
+		"best_practice":           c.BestPractice,
 		"updated_at":              c.UpdatedAt,
 	}
 
@@ -905,6 +922,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -924,6 +942,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -1017,6 +1036,7 @@ WITH ctrl AS (
 		c.description,
 		c.status,
 		c.exclusion_justification,
+		c.best_practice,
 		c.created_at,
 		c.updated_at,
 		c.search_vector
@@ -1036,6 +1056,7 @@ SELECT
 	description,
 	status,
 	exclusion_justification,
+	best_practice,
 	created_at,
 	updated_at
 FROM
@@ -1065,3 +1086,117 @@ WHERE %s
 
 	return nil
 }
+
+func (c *Controls) CountByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	filter *ControlFilter,
+) (int, error) {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.tenant_id,
+		c.search_vector
+	FROM
+		controls c
+	INNER JOIN
+		states_of_applicability_controls soac ON c.id = soac.control_id
+	WHERE
+		soac.state_of_applicability_id = @state_of_applicability_id
+)
+SELECT
+	COUNT(id)
+FROM
+	ctrl
+WHERE %s
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (c *Controls) LoadByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	cursor *page.Cursor[ControlOrderField],
+	filter *ControlFilter,
+) error {
+	q := `
+WITH ctrl AS (
+	SELECT
+		c.id,
+		c.section_title,
+		c.framework_id,
+		c.organization_id,
+		c.tenant_id,
+		c.name,
+		c.description,
+		c.status,
+		c.exclusion_justification,
+		c.best_practice,
+		c.created_at,
+		c.updated_at,
+		c.search_vector
+	FROM
+		controls c
+	INNER JOIN
+		states_of_applicability_controls soac ON c.id = soac.control_id
+	WHERE
+		soac.state_of_applicability_id = @state_of_applicability_id
+)
+SELECT
+	id,
+	section_title,
+	framework_id,
+	organization_id,
+	name,
+	description,
+	status,
+	exclusion_justification,
+	best_practice,
+	created_at,
+	updated_at
+FROM
+	ctrl
+WHERE %s
+	AND %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
+	if err != nil {
+		return fmt.Errorf("cannot collect controls: %w", err)
+	}
+
+	*c = controls
+
+	return nil
+}
diff --git a/pkg/coredata/control_mesure.go b/pkg/coredata/control_mesure.go
index 5e7681713..8a19f4438 100644
--- a/pkg/coredata/control_mesure.go
+++ b/pkg/coredata/control_mesure.go
@@ -136,3 +136,56 @@ WHERE
 	*cms = controlMeasures
 	return nil
 }
+
+type ControlWithRisk struct {
+	ControlID gid.GID `db:"control_id"`
+}
+
+type ControlsWithRisk []*ControlWithRisk
+
+func (cwrs *ControlsWithRisk) LoadByControlIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlIDs []gid.GID,
+) error {
+	q := `
+WITH control_risks AS (
+	SELECT DISTINCT
+		cm.control_id,
+		rm.risk_id,
+		r.tenant_id
+	FROM
+		controls_measures cm
+	INNER JOIN
+		risks_measures rm ON cm.measure_id = rm.measure_id
+	INNER JOIN
+		risks r ON rm.risk_id = r.id
+	WHERE
+		cm.control_id = ANY(@control_ids)
+)
+SELECT DISTINCT
+	control_id
+FROM
+	control_risks
+WHERE
+	%s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_ids": controlIDs}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control risks: %w", err)
+	}
+
+	controlsWithRisk, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlWithRisk])
+	if err != nil {
+		return fmt.Errorf("cannot collect control risks: %w", err)
+	}
+
+	*cwrs = controlsWithRisk
+	return nil
+}
diff --git a/pkg/coredata/control_obligation.go b/pkg/coredata/control_obligation.go
new file mode 100644
index 000000000..76e2c4ac3
--- /dev/null
+++ b/pkg/coredata/control_obligation.go
@@ -0,0 +1,221 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	ControlObligation struct {
+		ControlID    gid.GID   `db:"control_id"`
+		ObligationID gid.GID   `db:"obligation_id"`
+		CreatedAt    time.Time `db:"created_at"`
+	}
+
+	ControlObligations []*ControlObligation
+)
+
+func (co ControlObligation) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    controls_obligations (
+        control_id,
+        obligation_id,
+        tenant_id,
+        created_at
+    )
+VALUES (
+    @control_id,
+    @obligation_id,
+    @tenant_id,
+    @created_at
+)
+ON CONFLICT (control_id, obligation_id) DO NOTHING;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id":    co.ControlID,
+		"obligation_id": co.ObligationID,
+		"tenant_id":     scope.GetTenantID(),
+		"created_at":    co.CreatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (co ControlObligation) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	obligationID gid.GID,
+) error {
+	q := `
+DELETE
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND control_id = @control_id
+    AND obligation_id = @obligation_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"control_id":    controlID,
+		"obligation_id": obligationID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (cos *ControlObligations) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    obligation_id,
+    created_at
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND control_id = @control_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_obligations: %w", err)
+	}
+
+	controlObligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_obligations: %w", err)
+	}
+
+	*cos = controlObligations
+	return nil
+}
+
+func (cos *ControlObligations) LoadByObligationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	obligationID gid.GID,
+) error {
+	q := `
+SELECT
+    control_id,
+    obligation_id,
+    created_at
+FROM
+    controls_obligations
+WHERE
+    %s
+    AND obligation_id = @obligation_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"obligation_id": obligationID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control_obligations: %w", err)
+	}
+
+	controlObligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect control_obligations: %w", err)
+	}
+
+	*cos = controlObligations
+	return nil
+}
+
+type ControlObligationType struct {
+	ControlID gid.GID        `db:"control_id"`
+	Type      ObligationType `db:"type"`
+}
+
+type ControlObligationTypes []*ControlObligationType
+
+func (cots *ControlObligationTypes) LoadTypesByControlIDs(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlIDs []gid.GID,
+) error {
+	q := `
+WITH control_obls AS (
+	SELECT
+		co.control_id,
+		o.type,
+		o.tenant_id
+	FROM
+		controls_obligations co
+	INNER JOIN
+		obligations o ON co.obligation_id = o.id
+	WHERE
+		co.control_id = ANY(@control_ids)
+)
+SELECT DISTINCT
+	control_id,
+	type
+FROM
+	control_obls
+WHERE
+	%s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_ids": controlIDs}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query control obligations: %w", err)
+	}
+
+	controlObligationTypes, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ControlObligationType])
+	if err != nil {
+		return fmt.Errorf("cannot collect control obligations: %w", err)
+	}
+
+	*cots = controlObligationTypes
+	return nil
+}
diff --git a/pkg/coredata/entity_type_reg.go b/pkg/coredata/entity_type_reg.go
index 84a0c06cf..1f93bab6d 100644
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -70,6 +70,8 @@ const (
 	DataProtectionImpactAssessmentEntityType   uint16 = 46
 	TransferImpactAssessmentEntityType         uint16 = 47
 	RightsRequestEntityType                    uint16 = 48
+	StateOfApplicabilityEntityType             uint16 = 49
+	StateOfApplicabilityControlEntityType      uint16 = 50
 )
 
 type EntityInfo struct {
@@ -274,6 +276,14 @@ var entityRegistry = map[uint16]EntityInfo{
 		Model: "RightsRequest",
 		Table: "rights_requests",
 	},
+	StateOfApplicabilityEntityType: {
+		Model: "StateOfApplicability",
+		Table: "states_of_applicability",
+	},
+	StateOfApplicabilityControlEntityType: {
+		Model: "StateOfApplicabilityControl",
+		Table: "states_of_applicability_controls",
+	},
 }
 
 func EntityTable(entityType uint16) (string, bool) {
diff --git a/pkg/coredata/migrations/20260102T134633Z.sql b/pkg/coredata/migrations/20260102T134633Z.sql
new file mode 100644
index 000000000..c25f275d1
--- /dev/null
+++ b/pkg/coredata/migrations/20260102T134633Z.sql
@@ -0,0 +1,161 @@
+CREATE TABLE states_of_applicability (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL,
+    name TEXT NOT NULL,
+    source_id TEXT,
+    snapshot_id TEXT,
+    owner_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT states_of_applicability_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT states_of_applicability_snapshot_id_fkey
+        FOREIGN KEY (snapshot_id)
+        REFERENCES snapshots(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    CONSTRAINT states_of_applicability_owner_id_fkey
+        FOREIGN KEY (owner_id)
+        REFERENCES peoples(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX states_of_applicability_source_id_snapshot_id_uniq
+    ON states_of_applicability (source_id, snapshot_id)
+    WHERE snapshot_id IS NULL;
+
+CREATE UNIQUE INDEX states_of_applicability_name_organization_id_uniq
+    ON states_of_applicability (name, organization_id)
+    WHERE snapshot_id IS NULL;
+
+CREATE TABLE states_of_applicability_controls (
+    id TEXT PRIMARY KEY,
+    state_of_applicability_id TEXT NOT NULL REFERENCES states_of_applicability(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    control_id TEXT NOT NULL REFERENCES controls(id) ON DELETE RESTRICT ON UPDATE CASCADE,
+    organization_id TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    snapshot_id TEXT,
+    applicability BOOLEAN NOT NULL,
+    justification TEXT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    CONSTRAINT states_of_applicability_controls_organization_id_fkey
+        FOREIGN KEY (organization_id)
+        REFERENCES organizations(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+    CONSTRAINT states_of_applicability_controls_snapshot_id_fkey
+        FOREIGN KEY (snapshot_id)
+        REFERENCES snapshots(id)
+        ON UPDATE CASCADE
+        ON DELETE CASCADE,
+
+    UNIQUE (state_of_applicability_id, control_id)
+);
+
+ALTER TABLE controls ADD COLUMN best_practice BOOLEAN NOT NULL DEFAULT TRUE;
+ALTER TABLE controls ALTER COLUMN best_practice DROP DEFAULT;
+
+ALTER TYPE snapshots_type ADD VALUE 'STATES_OF_APPLICABILITY';
+
+CREATE TYPE obligation_type AS ENUM (
+    'LEGAL',
+    'CONTRACTUAL'
+);
+
+ALTER TABLE obligations ADD COLUMN type obligation_type NOT NULL DEFAULT 'LEGAL';
+ALTER TABLE obligations ALTER COLUMN type DROP DEFAULT;
+
+CREATE TABLE controls_obligations (
+    control_id TEXT NOT NULL REFERENCES controls(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    obligation_id TEXT NOT NULL REFERENCES obligations(id) ON DELETE CASCADE ON UPDATE CASCADE,
+    tenant_id TEXT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    PRIMARY KEY (control_id, obligation_id)
+);
+
+INSERT INTO states_of_applicability (
+    id,
+    tenant_id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+)
+SELECT
+    generate_gid(decode_base64_unpadded(f.tenant_id), 49) as id,
+    f.tenant_id,
+    f.organization_id,
+    f.name,
+    NULL as source_id,
+    NULL as snapshot_id,
+    (SELECT id FROM peoples WHERE tenant_id = f.tenant_id LIMIT 1) as owner_id,
+    NOW() as created_at,
+    NOW() as updated_at
+FROM frameworks f
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM states_of_applicability soa
+    WHERE soa.name = f.name
+    AND soa.snapshot_id IS NULL
+)
+AND EXISTS (
+    SELECT 1 FROM peoples WHERE tenant_id = f.tenant_id
+)
+AND EXISTS (
+    SELECT 1
+    FROM controls c
+    WHERE c.framework_id = f.id
+    AND (
+        c.status = 'EXCLUDED'
+        OR (c.exclusion_justification IS NOT NULL AND c.exclusion_justification != '')
+    )
+);
+
+INSERT INTO states_of_applicability_controls (
+    id,
+    state_of_applicability_id,
+    control_id,
+    organization_id,
+    tenant_id,
+    snapshot_id,
+    applicability,
+    justification,
+    created_at,
+    updated_at
+)
+SELECT
+    generate_gid(decode_base64_unpadded(c.tenant_id), 50) as id,
+    soa.id as state_of_applicability_id,
+    c.id as control_id,
+    c.organization_id,
+    c.tenant_id,
+    NULL as snapshot_id,
+    CASE
+        WHEN c.status = 'EXCLUDED' THEN FALSE
+        ELSE TRUE
+    END as applicability,
+    c.exclusion_justification,
+    NOW() as created_at,
+    NOW() as updated_at
+FROM frameworks f
+JOIN states_of_applicability soa ON soa.name = f.name AND soa.snapshot_id IS NULL
+JOIN controls c ON c.framework_id = f.id
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM states_of_applicability_controls soac
+    WHERE soac.state_of_applicability_id = soa.id
+    AND soac.control_id = c.id
+);
diff --git a/pkg/coredata/obligation.go b/pkg/coredata/obligation.go
index 863c4681b..2084d93f1 100644
--- a/pkg/coredata/obligation.go
+++ b/pkg/coredata/obligation.go
@@ -20,10 +20,10 @@ import (
 	"maps"
 	"time"
 
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
 	"github.com/jackc/pgx/v5"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
 )
 
 type (
@@ -39,6 +39,7 @@ type (
 		LastReviewDate         *time.Time       `db:"last_review_date"`
 		DueDate                *time.Time       `db:"due_date"`
 		Status                 ObligationStatus `db:"status"`
+		Type                   ObligationType   `db:"type"`
 		SnapshotID             *gid.GID         `db:"snapshot_id"`
 		SourceID               *gid.GID         `db:"source_id"`
 		CreatedAt              time.Time        `db:"created_at"`
@@ -84,6 +85,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	created_at,
 	updated_at
 FROM
@@ -216,6 +218,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -273,6 +276,7 @@ WITH obls AS (
 		o.last_review_date,
 		o.due_date,
 		o.status,
+		o.type,
 		o.snapshot_id,
 		o.source_id,
 		o.created_at,
@@ -298,6 +302,7 @@ SELECT
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -331,6 +336,131 @@ WHERE %s
 	return nil
 }
 
+func (os *Obligations) CountByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	filter *ObligationFilter,
+) (int, error) {
+	q := `
+WITH obls AS (
+	SELECT
+		o.id,
+		o.tenant_id,
+		o.snapshot_id
+	FROM
+		obligations o
+	INNER JOIN
+		controls_obligations co ON o.id = co.obligation_id
+	WHERE
+		co.control_id = @control_id
+)
+SELECT
+	COUNT(id)
+FROM
+	obls
+WHERE %s
+	AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	err := row.Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count obligations: %w", err)
+	}
+
+	return count, nil
+}
+
+func (os *Obligations) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[ObligationOrderField],
+	filter *ObligationFilter,
+) error {
+	q := `
+WITH obls AS (
+	SELECT
+		o.id,
+		o.organization_id,
+		o.area,
+		o.source,
+		o.requirement,
+		o.actions_to_be_implemented,
+		o.regulator,
+		o.owner_id,
+		o.last_review_date,
+		o.due_date,
+		o.status,
+		o.type,
+		o.snapshot_id,
+		o.source_id,
+		o.created_at,
+		o.updated_at,
+		o.tenant_id
+	FROM
+		obligations o
+	INNER JOIN
+		controls_obligations co ON o.id = co.obligation_id
+	WHERE
+		co.control_id = @control_id
+)
+SELECT
+	id,
+	organization_id,
+	area,
+	source,
+	requirement,
+	actions_to_be_implemented,
+	regulator,
+	owner_id,
+	last_review_date,
+	due_date,
+	status,
+	type,
+	snapshot_id,
+	source_id,
+	created_at,
+	updated_at
+FROM
+	obls
+WHERE %s
+	AND %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query obligations: %w", err)
+	}
+
+	obligations, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Obligation])
+	if err != nil {
+		return fmt.Errorf("cannot collect obligations: %w", err)
+	}
+
+	*os = obligations
+
+	return nil
+}
+
 func (o *Obligation) Insert(
 	ctx context.Context,
 	conn pg.Conn,
@@ -350,6 +480,7 @@ INSERT INTO obligations (
 	last_review_date,
 	due_date,
 	status,
+	type,
 	snapshot_id,
 	source_id,
 	created_at,
@@ -367,6 +498,7 @@ INSERT INTO obligations (
 	@last_review_date,
 	@due_date,
 	@status,
+	@type,
 	@snapshot_id,
 	@source_id,
 	@created_at,
@@ -387,6 +519,7 @@ INSERT INTO obligations (
 		"last_review_date":          o.LastReviewDate,
 		"due_date":                  o.DueDate,
 		"status":                    o.Status,
+		"type":                      o.Type,
 		"snapshot_id":               o.SnapshotID,
 		"source_id":                 o.SourceID,
 		"created_at":                o.CreatedAt,
@@ -417,6 +550,7 @@ UPDATE obligations SET
 	last_review_date = @last_review_date,
 	due_date = @due_date,
 	status = @status,
+	type = @type,
 	updated_at = @updated_at
 WHERE
 	%s
@@ -437,6 +571,7 @@ WHERE
 		"last_review_date":          o.LastReviewDate,
 		"due_date":                  o.DueDate,
 		"status":                    o.Status,
+		"type":                      o.Type,
 		"updated_at":                o.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
@@ -492,6 +627,7 @@ INSERT INTO obligations (
 	last_review_date,
 	due_date,
 	status,
+	type,
 	created_at,
 	updated_at
 )
@@ -510,6 +646,7 @@ SELECT
 	o.last_review_date,
 	o.due_date,
 	o.status,
+	o.type,
 	o.created_at,
 	o.updated_at
 FROM obligations o
diff --git a/pkg/coredata/obligation_type.go b/pkg/coredata/obligation_type.go
new file mode 100644
index 000000000..2d5f2628a
--- /dev/null
+++ b/pkg/coredata/obligation_type.go
@@ -0,0 +1,64 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type ObligationType string
+
+const (
+	ObligationTypeLegal       ObligationType = "LEGAL"
+	ObligationTypeContractual ObligationType = "CONTRACTUAL"
+)
+
+func ObligationTypes() []ObligationType {
+	return []ObligationType{
+		ObligationTypeLegal,
+		ObligationTypeContractual,
+	}
+}
+
+func (ot ObligationType) String() string {
+	return string(ot)
+}
+
+func (ot *ObligationType) Scan(value any) error {
+	var s string
+	switch v := value.(type) {
+	case string:
+		s = v
+	case []byte:
+		s = string(v)
+	default:
+		return fmt.Errorf("unsupported type for ObligationType: %T", value)
+	}
+
+	switch s {
+	case "LEGAL":
+		*ot = ObligationTypeLegal
+	case "CONTRACTUAL":
+		*ot = ObligationTypeContractual
+	default:
+		return fmt.Errorf("invalid ObligationType value: %q", s)
+	}
+	return nil
+}
+
+func (ot ObligationType) Value() (driver.Value, error) {
+	return ot.String(), nil
+}
diff --git a/pkg/coredata/snapshots_type.go b/pkg/coredata/snapshots_type.go
index 1a091325c..65d578cb6 100644
--- a/pkg/coredata/snapshots_type.go
+++ b/pkg/coredata/snapshots_type.go
@@ -32,6 +32,7 @@ const (
 	SnapshotsTypeObligations           SnapshotsType = "OBLIGATIONS"
 	SnapshotsTypeContinualImprovements SnapshotsType = "CONTINUAL_IMPROVEMENTS"
 	SnapshotsTypeProcessingActivities  SnapshotsType = "PROCESSING_ACTIVITIES"
+	SnapshotsTypeStatesOfApplicability SnapshotsType = "STATES_OF_APPLICABILITY"
 )
 
 func SnapshotsTypes() []SnapshotsType {
@@ -41,6 +42,10 @@ func SnapshotsTypes() []SnapshotsType {
 		SnapshotsTypeAssets,
 		SnapshotsTypeData,
 		SnapshotsTypeNonconformities,
+		SnapshotsTypeObligations,
+		SnapshotsTypeContinualImprovements,
+		SnapshotsTypeProcessingActivities,
+		SnapshotsTypeStatesOfApplicability,
 	}
 }
 
@@ -76,6 +81,8 @@ func (st *SnapshotsType) Scan(value any) error {
 		*st = SnapshotsTypeContinualImprovements
 	case SnapshotsTypeProcessingActivities.String():
 		*st = SnapshotsTypeProcessingActivities
+	case SnapshotsTypeStatesOfApplicability.String():
+		*st = SnapshotsTypeStatesOfApplicability
 	default:
 		return fmt.Errorf("invalid SnapshotsType value: %q", s)
 	}
diff --git a/pkg/coredata/snapshottable.go b/pkg/coredata/snapshottable.go
index 119dbba42..05d4a759c 100644
--- a/pkg/coredata/snapshottable.go
+++ b/pkg/coredata/snapshottable.go
@@ -18,8 +18,8 @@ import (
 	"context"
 	"fmt"
 
-	"go.probo.inc/probo/pkg/gid"
 	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
 )
 
 type Snapshottable interface {
@@ -44,6 +44,8 @@ func GetSnapshottable(snapshotType SnapshotsType) (Snapshottable, error) {
 		return ProcessingActivities{}, nil
 	case SnapshotsTypeVendors:
 		return Vendors{}, nil
+	case SnapshotsTypeStatesOfApplicability:
+		return StatesOfApplicability{}, nil
 	default:
 		return nil, fmt.Errorf("unsupported snapshot type: %s", snapshotType)
 	}
diff --git a/pkg/coredata/state_of_applicability.go b/pkg/coredata/state_of_applicability.go
new file mode 100644
index 000000000..ad0bc7b0e
--- /dev/null
+++ b/pkg/coredata/state_of_applicability.go
@@ -0,0 +1,466 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicability struct {
+		ID             gid.GID   `db:"id"`
+		OrganizationID gid.GID   `db:"organization_id"`
+		Name           string    `db:"name"`
+		SourceID       *gid.GID  `db:"source_id"`
+		SnapshotID     *gid.GID  `db:"snapshot_id"`
+		OwnerID        gid.GID   `db:"owner_id"`
+		CreatedAt      time.Time `db:"created_at"`
+		UpdatedAt      time.Time `db:"updated_at"`
+	}
+
+	StatesOfApplicability []*StateOfApplicability
+
+	ErrStateOfApplicabilityNotFound struct {
+		Identifier string
+	}
+
+	ErrStateOfApplicabilityAlreadyExists struct {
+		message string
+	}
+)
+
+func (e ErrStateOfApplicabilityNotFound) Error() string {
+	return fmt.Sprintf("state of applicability not found: %s", e.Identifier)
+}
+
+func (e ErrStateOfApplicabilityAlreadyExists) Error() string {
+	return e.message
+}
+
+func (s StateOfApplicability) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey {
+	switch orderBy {
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	case StateOfApplicabilityOrderFieldName:
+		return page.NewCursorKey(s.ID, s.Name)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (s *StateOfApplicability) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND id = @state_of_applicability_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"state_of_applicability_id": stateOfApplicabilityID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability: %w", err)
+	}
+
+	stateOfApplicability, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicability])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrStateOfApplicabilityNotFound{Identifier: stateOfApplicabilityID.String()}
+		}
+
+		return fmt.Errorf("cannot collect state_of_applicability: %w", err)
+	}
+
+	*s = stateOfApplicability
+	return nil
+}
+
+func (s *StatesOfApplicability) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	cursor *page.Cursor[StateOfApplicabilityOrderField],
+	filter *StateOfApplicabilityFilter,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+    source_id,
+    snapshot_id,
+    owner_id,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability: %w", err)
+	}
+
+	statesOfApplicability, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicability])
+	if err != nil {
+		return fmt.Errorf("cannot collect states_of_applicability: %w", err)
+	}
+
+	*s = statesOfApplicability
+	return nil
+}
+
+func (s *StatesOfApplicability) CountByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	filter *StateOfApplicabilityFilter,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(*)
+FROM
+    states_of_applicability
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"organization_id": organizationID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, filter.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot count states_of_applicability: %w", err)
+	}
+
+	return count, nil
+}
+
+func (s *StateOfApplicability) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability (
+        tenant_id,
+        id,
+        organization_id,
+        name,
+        source_id,
+        snapshot_id,
+        owner_id,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @tenant_id,
+    @state_of_applicability_id,
+    @organization_id,
+    @name,
+    @source_id,
+    @snapshot_id,
+    @owner_id,
+    @created_at,
+    @updated_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":                 scope.GetTenantID(),
+		"state_of_applicability_id": s.ID,
+		"organization_id":           s.OrganizationID,
+		"name":                      s.Name,
+		"source_id":                 s.SourceID,
+		"snapshot_id":               s.SnapshotID,
+		"owner_id":                  s.OwnerID,
+		"created_at":                s.CreatedAt,
+		"updated_at":                s.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityAlreadyExists{
+					message: fmt.Sprintf("state of applicability with name %q already exists", s.Name),
+				}
+			}
+		}
+		return fmt.Errorf("cannot insert state_of_applicability: %w", err)
+	}
+
+	return nil
+}
+
+func (s *StateOfApplicability) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE states_of_applicability
+SET
+    name = @name,
+    owner_id = @owner_id,
+    updated_at = @updated_at
+WHERE %s
+    AND id = @state_of_applicability_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": s.ID,
+		"name":                      s.Name,
+		"owner_id":                  s.OwnerID,
+		"updated_at":                s.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityAlreadyExists{
+					message: fmt.Sprintf("state of applicability with name %q already exists", s.Name),
+				}
+			}
+		}
+		return fmt.Errorf("cannot update state_of_applicability: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return &ErrStateOfApplicabilityNotFound{Identifier: s.ID.String()}
+	}
+
+	return nil
+}
+
+func (s *StateOfApplicability) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM states_of_applicability
+WHERE %s
+    AND id = @state_of_applicability_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": s.ID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete state_of_applicability: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return &ErrStateOfApplicabilityNotFound{Identifier: s.ID.String()}
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) Snapshot(ctx context.Context, conn pg.Conn, scope Scoper, organizationID, snapshotID gid.GID) error {
+	if err := soas.insertStateOfApplicabilitySnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability snapshots: %w", err)
+	}
+
+	if err := soas.insertStateOfApplicabilityControlSnapshots(ctx, conn, scope, organizationID, snapshotID); err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability_control snapshots: %w", err)
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) insertStateOfApplicabilitySnapshots(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	snapshotID gid.GID,
+) error {
+	query := `
+INSERT INTO states_of_applicability (
+	id,
+	tenant_id,
+	organization_id,
+	name,
+	source_id,
+	snapshot_id,
+	owner_id,
+	created_at,
+	updated_at
+)
+SELECT
+	generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_entity_type),
+	@tenant_id,
+	soa.organization_id,
+	soa.name,
+	soa.id,
+	@snapshot_id,
+	soa.owner_id,
+	soa.created_at,
+	soa.updated_at
+FROM states_of_applicability soa
+WHERE %s
+	AND soa.organization_id = @organization_id
+	AND soa.snapshot_id IS NULL
+	`
+
+	query = fmt.Sprintf(query, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":                          scope.GetTenantID(),
+		"snapshot_id":                        snapshotID,
+		"organization_id":                    organizationID,
+		"state_of_applicability_entity_type": StateOfApplicabilityEntityType,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, query, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability snapshots: %w", err)
+	}
+
+	return nil
+}
+
+func (soas StatesOfApplicability) insertStateOfApplicabilityControlSnapshots(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	organizationID gid.GID,
+	snapshotID gid.GID,
+) error {
+	query := `
+WITH source_soa AS (
+	SELECT id, organization_id
+	FROM states_of_applicability
+	WHERE %s
+		AND organization_id = @organization_id
+		AND snapshot_id IS NULL
+),
+snapshot_soa AS (
+	SELECT id, source_id
+	FROM states_of_applicability
+	WHERE snapshot_id = @snapshot_id
+)
+INSERT INTO states_of_applicability_controls (
+	id,
+	state_of_applicability_id,
+	control_id,
+	organization_id,
+	tenant_id,
+	snapshot_id,
+	applicability,
+	justification,
+	created_at,
+	updated_at
+)
+SELECT
+	generate_gid(decode_base64_unpadded(@tenant_id), @state_of_applicability_control_entity_type),
+	snapshot_soa.id,
+	soac.control_id,
+	soac.organization_id,
+	@tenant_id,
+	@snapshot_id,
+	soac.applicability,
+	soac.justification,
+	soac.created_at,
+	soac.updated_at
+FROM states_of_applicability_controls soac
+INNER JOIN source_soa
+	ON soac.state_of_applicability_id = source_soa.id
+INNER JOIN snapshot_soa
+	ON snapshot_soa.source_id = source_soa.id
+WHERE soac.snapshot_id IS NULL
+	`
+
+	query = fmt.Sprintf(query, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":       scope.GetTenantID(),
+		"snapshot_id":     snapshotID,
+		"organization_id": organizationID,
+		"state_of_applicability_control_entity_type": StateOfApplicabilityControlEntityType,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, query, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert state_of_applicability_control snapshots: %w", err)
+	}
+
+	return nil
+}
diff --git a/pkg/coredata/state_of_applicability_control.go b/pkg/coredata/state_of_applicability_control.go
new file mode 100644
index 000000000..df7ad8b22
--- /dev/null
+++ b/pkg/coredata/state_of_applicability_control.go
@@ -0,0 +1,607 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityControl struct {
+		ID                     gid.GID   `db:"id"`
+		StateOfApplicabilityID gid.GID   `db:"state_of_applicability_id"`
+		ControlID              gid.GID   `db:"control_id"`
+		OrganizationID         gid.GID   `db:"organization_id"`
+		SnapshotID             *gid.GID  `db:"snapshot_id"`
+		Applicability          bool      `db:"applicability"`
+		Justification          *string   `db:"justification"`
+		CreatedAt              time.Time `db:"created_at"`
+		UpdatedAt              time.Time `db:"updated_at"`
+	}
+
+	StateOfApplicabilityControls []*StateOfApplicabilityControl
+
+	AvailableStateOfApplicabilityControl struct {
+		ControlID              gid.GID  `db:"control_id"`
+		SectionTitle           string   `db:"section_title"`
+		Name                   string   `db:"name"`
+		FrameworkID            gid.GID  `db:"framework_id"`
+		FrameworkName          string   `db:"framework_name"`
+		OrganizationID         gid.GID  `db:"organization_id"`
+		StateOfApplicabilityID *gid.GID `db:"state_of_applicability_id"`
+		Applicability          *bool    `db:"applicability"`
+		Justification          *string  `db:"justification"`
+		BestPractice           bool     `db:"best_practice"`
+		Regulatory             bool     `db:"regulatory"`
+		Contractual            bool     `db:"contractual"`
+		RiskAssessment         bool     `db:"risk_assessment"`
+	}
+
+	AvailableStateOfApplicabilityControls []*AvailableStateOfApplicabilityControl
+
+	ErrStateOfApplicabilityControlNotFound struct {
+		StateOfApplicabilityID gid.GID
+		ControlID              gid.GID
+	}
+
+	ErrStateOfApplicabilityControlAlreadyExists struct {
+		StateOfApplicabilityID gid.GID
+		ControlID              gid.GID
+	}
+)
+
+func (e ErrStateOfApplicabilityControlNotFound) Error() string {
+	return fmt.Sprintf("state of applicability control not found: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID)
+}
+
+func (e ErrStateOfApplicabilityControlAlreadyExists) Error() string {
+	return fmt.Sprintf("state of applicability control already exists: state_of_applicability_id=%s, control_id=%s", e.StateOfApplicabilityID, e.ControlID)
+}
+
+func (s StateOfApplicabilityControl) CursorKey(orderBy StateOfApplicabilityOrderField) page.CursorKey {
+	switch orderBy {
+	case StateOfApplicabilityOrderFieldName:
+		return page.NewCursorKey(s.ID, s.StateOfApplicabilityID)
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return page.NewCursorKey(s.ID, s.CreatedAt)
+	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (sac *StateOfApplicabilityControl) LoadByStateOfApplicabilityIDAndControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+) error {
+	q := `
+WITH current_soa AS (
+	SELECT id
+	FROM states_of_applicability
+	WHERE %s
+		AND id = @state_of_applicability_id
+		AND snapshot_id IS NULL
+)
+SELECT
+	soac.id,
+	soac.state_of_applicability_id,
+	soac.control_id,
+	soac.organization_id,
+	soac.snapshot_id,
+	soac.applicability,
+	soac.justification,
+	soac.created_at,
+	soac.updated_at
+FROM
+	states_of_applicability_controls soac
+INNER JOIN
+	current_soa ON soac.state_of_applicability_id = current_soa.id
+WHERE
+	soac.control_id = @control_id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+		"control_id":                controlID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+	}
+
+	control, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return &ErrStateOfApplicabilityControlNotFound{
+				StateOfApplicabilityID: stateOfApplicabilityID,
+				ControlID:              controlID,
+			}
+		}
+		return fmt.Errorf("cannot collect state of applicability control: %w", err)
+	}
+
+	*sac = control
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability_controls (
+        id,
+        state_of_applicability_id,
+        control_id,
+        organization_id,
+        tenant_id,
+        snapshot_id,
+        applicability,
+        justification,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @id,
+    @state_of_applicability_id,
+    @control_id,
+    @organization_id,
+    @tenant_id,
+    @snapshot_id,
+    @applicability,
+    @justification,
+    @created_at,
+    @updated_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                        sac.ID,
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"organization_id":           sac.OrganizationID,
+		"tenant_id":                 scope.GetTenantID(),
+		"snapshot_id":               sac.SnapshotID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"created_at":                sac.CreatedAt,
+		"updated_at":                sac.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			if pgErr.Code == "23505" {
+				return &ErrStateOfApplicabilityControlAlreadyExists{
+					StateOfApplicabilityID: sac.StateOfApplicabilityID,
+					ControlID:              sac.ControlID,
+				}
+			}
+		}
+
+		return fmt.Errorf("cannot insert state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE states_of_applicability_controls
+SET
+    applicability = @applicability,
+    justification = @justification,
+    updated_at = @updated_at
+WHERE %s
+    AND state_of_applicability_id = @state_of_applicability_id
+    AND control_id = @control_id
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"updated_at":                sac.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Upsert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    states_of_applicability_controls (
+        id,
+        state_of_applicability_id,
+        control_id,
+        organization_id,
+        tenant_id,
+        snapshot_id,
+        applicability,
+        justification,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @id,
+    @state_of_applicability_id,
+    @control_id,
+    @organization_id,
+    @tenant_id,
+    @snapshot_id,
+    @applicability,
+    @justification,
+    @created_at,
+    @updated_at
+)
+ON CONFLICT (state_of_applicability_id, control_id) DO UPDATE SET
+    applicability = EXCLUDED.applicability,
+    justification = EXCLUDED.justification,
+    updated_at = EXCLUDED.updated_at
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":                        sac.ID,
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+		"organization_id":           sac.OrganizationID,
+		"tenant_id":                 scope.GetTenantID(),
+		"snapshot_id":               sac.SnapshotID,
+		"applicability":             sac.Applicability,
+		"justification":             sac.Justification,
+		"created_at":                sac.CreatedAt,
+		"updated_at":                sac.UpdatedAt,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot upsert state_of_applicability_control: %w", err)
+	}
+
+	return nil
+}
+
+func (sac *StateOfApplicabilityControl) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+WITH current_soa AS (
+	SELECT id
+	FROM states_of_applicability
+	WHERE %s
+		AND id = @state_of_applicability_id
+		AND snapshot_id IS NULL
+)
+DELETE FROM states_of_applicability_controls
+WHERE state_of_applicability_id IN (SELECT id FROM current_soa)
+	AND control_id = @control_id;
+`
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": sac.StateOfApplicabilityID,
+		"control_id":                sac.ControlID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (sacs *StateOfApplicabilityControls) LoadByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    state_of_applicability_id,
+    control_id,
+    organization_id,
+    snapshot_id,
+    applicability,
+    justification,
+    created_at,
+    updated_at
+FROM
+    states_of_applicability_controls
+WHERE
+    %s
+    AND state_of_applicability_id = @state_of_applicability_id
+ORDER BY created_at ASC
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query states_of_applicability_controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect states_of_applicability_controls: %w", err)
+	}
+
+	*sacs = controls
+	return nil
+}
+
+func (sacs *StateOfApplicabilityControls) LoadByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+	cursor *page.Cursor[StateOfApplicabilityOrderField],
+) error {
+	q := `
+WITH soac_ctrl AS (
+	SELECT
+		soac.id,
+		soac.state_of_applicability_id,
+		soac.control_id,
+		soac.organization_id,
+		soac.snapshot_id,
+		soac.applicability,
+		soac.justification,
+		soac.created_at,
+		soac.updated_at,
+		soac.tenant_id
+	FROM
+		states_of_applicability_controls soac
+	INNER JOIN
+		states_of_applicability soa ON soac.state_of_applicability_id = soa.id
+	WHERE
+		soac.control_id = @control_id
+		AND soa.snapshot_id IS NULL
+)
+SELECT
+	id,
+	state_of_applicability_id,
+	control_id,
+	organization_id,
+	snapshot_id,
+	applicability,
+	justification,
+	created_at,
+	updated_at
+FROM
+	soac_ctrl
+WHERE %s
+	AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query state_of_applicability_controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[StateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect state_of_applicability_controls: %w", err)
+	}
+
+	*sacs = controls
+	return nil
+}
+
+func (sacs *StateOfApplicabilityControls) CountByControlID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	controlID gid.GID,
+) (int, error) {
+	q := `
+WITH soac_ctrl AS (
+	SELECT
+		soac.id,
+		soac.organization_id,
+		soac.tenant_id
+	FROM
+		states_of_applicability_controls soac
+	WHERE
+		soac.control_id = @control_id
+)
+SELECT
+	COUNT(id)
+FROM
+	soac_ctrl
+WHERE
+	%s;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"control_id": controlID}
+	maps.Copy(args, scope.SQLArguments())
+
+	row := conn.QueryRow(ctx, q, args)
+
+	var count int
+	if err := row.Scan(&count); err != nil {
+		return 0, fmt.Errorf("cannot scan count: %w", err)
+	}
+
+	return count, nil
+}
+
+func (acfs *AvailableStateOfApplicabilityControls) LoadAvailableByStateOfApplicabilityID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	stateOfApplicabilityID gid.GID,
+) error {
+	q := `
+WITH soa_info AS (
+    SELECT
+        soa.organization_id,
+        soa.tenant_id AS soa_tenant_id
+    FROM states_of_applicability soa
+    WHERE soa.tenant_id = @tenant_id
+        AND soa.id = @state_of_applicability_id
+),
+filtered_controls AS (
+    SELECT
+        c.id AS control_id,
+        c.section_title,
+        c.name,
+        c.framework_id,
+        c.organization_id,
+        c.tenant_id,
+        c.best_practice
+    FROM controls c
+    WHERE %s
+),
+all_controls AS (
+    SELECT
+        fc.control_id,
+        fc.section_title,
+        fc.name,
+        fc.framework_id,
+        fc.organization_id,
+        fc.tenant_id,
+        f.name AS framework_name,
+        fc.best_practice
+    FROM filtered_controls fc
+    INNER JOIN frameworks f ON fc.framework_id = f.id
+    CROSS JOIN soa_info si
+    WHERE fc.organization_id = si.organization_id
+),
+existing_links AS (
+    SELECT
+        soac.control_id,
+        soac.state_of_applicability_id,
+        soac.applicability,
+        soac.justification
+    FROM states_of_applicability_controls soac
+    CROSS JOIN soa_info si
+    WHERE soac.tenant_id = si.soa_tenant_id
+        AND soac.state_of_applicability_id = @state_of_applicability_id
+),
+regulatory_controls AS (
+    SELECT DISTINCT co.control_id
+    FROM controls_obligations co
+    INNER JOIN obligations o ON o.id = co.obligation_id
+    CROSS JOIN soa_info si
+    WHERE co.tenant_id = si.soa_tenant_id
+        AND o.tenant_id = si.soa_tenant_id
+        AND o.type = 'LEGAL'
+),
+contractual_controls AS (
+    SELECT DISTINCT co.control_id
+    FROM controls_obligations co
+    INNER JOIN obligations o ON o.id = co.obligation_id
+    CROSS JOIN soa_info si
+    WHERE co.tenant_id = si.soa_tenant_id
+        AND o.tenant_id = si.soa_tenant_id
+        AND o.type = 'CONTRACTUAL'
+),
+risk_controls AS (
+    SELECT DISTINCT cm.control_id
+    FROM controls_measures cm
+    INNER JOIN risks_measures rm ON rm.measure_id = cm.measure_id
+    CROSS JOIN soa_info si
+    WHERE cm.tenant_id = si.soa_tenant_id
+        AND rm.tenant_id = si.soa_tenant_id
+)
+SELECT
+    ac.control_id,
+    ac.section_title,
+    ac.name,
+    ac.framework_id,
+    ac.organization_id,
+    ac.framework_name,
+    el.state_of_applicability_id,
+    el.applicability,
+    el.justification,
+    ac.best_practice,
+    CASE WHEN reg.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS regulatory,
+    CASE WHEN cont.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS contractual,
+    CASE WHEN risk.control_id IS NOT NULL THEN TRUE ELSE FALSE END AS risk_assessment
+FROM all_controls ac
+LEFT JOIN existing_links el ON ac.control_id = el.control_id
+LEFT JOIN regulatory_controls reg ON reg.control_id = ac.control_id
+LEFT JOIN contractual_controls cont ON cont.control_id = ac.control_id
+LEFT JOIN risk_controls risk ON risk.control_id = ac.control_id
+ORDER BY ac.framework_name, ac.section_title, ac.name
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"state_of_applicability_id": stateOfApplicabilityID,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query available controls: %w", err)
+	}
+
+	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[AvailableStateOfApplicabilityControl])
+	if err != nil {
+		return fmt.Errorf("cannot collect available controls: %w", err)
+	}
+
+	*acfs = controls
+	return nil
+}
diff --git a/pkg/coredata/state_of_applicability_filter.go b/pkg/coredata/state_of_applicability_filter.go
new file mode 100644
index 000000000..4e1581d50
--- /dev/null
+++ b/pkg/coredata/state_of_applicability_filter.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"go.probo.inc/probo/pkg/gid"
+	"github.com/jackc/pgx/v5"
+)
+
+type (
+	StateOfApplicabilityFilter struct {
+		snapshotID **gid.GID
+	}
+)
+
+func NewStateOfApplicabilityFilter(snapshotID **gid.GID) *StateOfApplicabilityFilter {
+	return &StateOfApplicabilityFilter{
+		snapshotID: snapshotID,
+	}
+}
+
+func (f *StateOfApplicabilityFilter) SQLArguments() pgx.StrictNamedArgs {
+	args := pgx.StrictNamedArgs{}
+
+	if f.snapshotID == nil {
+		args["has_snapshot_filter"] = false
+		args["filter_snapshot_id"] = nil
+	} else if *f.snapshotID == nil {
+		args["has_snapshot_filter"] = true
+		args["filter_snapshot_id"] = nil
+	} else {
+		args["has_snapshot_filter"] = true
+		args["filter_snapshot_id"] = **f.snapshotID
+	}
+
+	return args
+}
+
+func (f *StateOfApplicabilityFilter) SQLFragment() string {
+	return `
+CASE
+	WHEN @has_snapshot_filter::boolean = false THEN TRUE
+	WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NOT NULL THEN
+		snapshot_id = @filter_snapshot_id::text
+	WHEN @has_snapshot_filter::boolean = true AND @filter_snapshot_id::text IS NULL THEN
+		snapshot_id IS NULL
+	ELSE TRUE
+END`
+}
diff --git a/pkg/coredata/state_of_applicability_order_field.go b/pkg/coredata/state_of_applicability_order_field.go
new file mode 100644
index 000000000..5fdea2718
--- /dev/null
+++ b/pkg/coredata/state_of_applicability_order_field.go
@@ -0,0 +1,62 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"fmt"
+)
+
+type (
+	StateOfApplicabilityOrderField string
+)
+
+const (
+	StateOfApplicabilityOrderFieldName      StateOfApplicabilityOrderField = "NAME"
+	StateOfApplicabilityOrderFieldCreatedAt StateOfApplicabilityOrderField = "CREATED_AT"
+)
+
+func (s StateOfApplicabilityOrderField) Column() string {
+	switch s {
+	case StateOfApplicabilityOrderFieldName:
+		return "name"
+	case StateOfApplicabilityOrderFieldCreatedAt:
+		return "created_at"
+	}
+	panic(fmt.Sprintf("unsupported order by: %s", s))
+}
+
+func (s StateOfApplicabilityOrderField) String() string {
+	return string(s)
+}
+
+func (s StateOfApplicabilityOrderField) IsValid() bool {
+	switch s {
+	case StateOfApplicabilityOrderFieldName, StateOfApplicabilityOrderFieldCreatedAt:
+		return true
+	}
+	return false
+}
+
+func (s StateOfApplicabilityOrderField) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
+}
+
+func (s *StateOfApplicabilityOrderField) UnmarshalText(text []byte) error {
+	*s = StateOfApplicabilityOrderField(text)
+	if !s.IsValid() {
+		return fmt.Errorf("%s is not a valid StateOfApplicabilityOrderField", string(text))
+	}
+	return nil
+}
diff --git a/pkg/docgen/generator.go b/pkg/docgen/generator.go
index dbb4543b4..22eb18d38 100644
--- a/pkg/docgen/generator.go
+++ b/pkg/docgen/generator.go
@@ -47,13 +47,34 @@ var (
 	//go:embed transfer_impact_assessments_template.html
 	transferImpactAssessmentsTemplateContent string
 
+	//go:embed soa_template.html
+	soaTemplateContent string
+
 	templateFuncs = template.FuncMap{
 		"now":                  func() time.Time { return time.Now() },
 		"eq":                   func(a, b any) bool { return a == b },
+		"add":                  func(a, b int) int { return a + b },
 		"string":               func(v fmt.Stringer) string { return v.String() },
 		"lower":                func(s string) string { return strings.ToLower(s) },
-		"add":                  func(a, b int) int { return a + b },
 		"classificationString": func(c Classification) string { return string(c) },
+		"boolToYesNo": func(b *bool) string {
+			if b == nil {
+				return ""
+			}
+			if *b {
+				return "yes"
+			}
+			return "no"
+		},
+		"boolToYesNoDash": func(b *bool) string {
+			if b == nil {
+				return "-"
+			}
+			if *b {
+				return "Yes"
+			}
+			return "No"
+		},
 		"formatContent": func(content string) template.HTML {
 			md := goldmark.New(
 				goldmark.WithExtensions(extension.Table),
@@ -176,6 +197,8 @@ var (
 	dataProtectionImpactAssessmentsTemplate = template.Must(template.New("dataProtectionImpactAssessments").Funcs(templateFuncs).Parse(dataProtectionImpactAssessmentsTemplateContent))
 
 	transferImpactAssessmentsTemplate = template.Must(template.New("transferImpactAssessments").Funcs(templateFuncs).Parse(transferImpactAssessmentsTemplateContent))
+
+	stateOfApplicabilityTemplate = template.Must(template.New("state-of-applicability").Funcs(templateFuncs).Parse(soaTemplateContent))
 )
 
 type (
@@ -264,6 +287,35 @@ type (
 		LocalLawRisk           *string
 		SupplementaryMeasures  *string
 	}
+
+	StateOfApplicabilityData struct {
+		Title                       string
+		OrganizationName            string
+		CreatedAt                   time.Time
+		TotalControls               int
+		FrameworkGroups             []FrameworkControlGroup
+		CompanyHorizontalLogoBase64 string
+		Version                     int
+		PublishedAt                 time.Time
+		Approver                    string
+	}
+
+	FrameworkControlGroup struct {
+		FrameworkName string
+		Controls      []ControlData
+	}
+
+	ControlData struct {
+		FrameworkName  string
+		SectionTitle   string
+		Name           string
+		Applicability  *bool
+		Justification  *string
+		BestPractice   bool
+		Regulatory     *bool
+		Contractual    *bool
+		RiskAssessment *bool
+	}
 )
 
 const (
@@ -308,3 +360,12 @@ func RenderTransferImpactAssessmentsTableHTML(data TransferImpactAssessmentTable
 
 	return buf.Bytes(), nil
 }
+
+func RenderStateOfApplicabilityHTML(data StateOfApplicabilityData) ([]byte, error) {
+	var buf bytes.Buffer
+	if err := stateOfApplicabilityTemplate.Execute(&buf, data); err != nil {
+		return nil, fmt.Errorf("cannot execute SOA template: %w", err)
+	}
+
+	return buf.Bytes(), nil
+}
diff --git a/pkg/docgen/generator_test.go b/pkg/docgen/generator_test.go
index 592f4a5f7..b90264481 100644
--- a/pkg/docgen/generator_test.go
+++ b/pkg/docgen/generator_test.go
@@ -20,9 +20,9 @@ import (
 	"testing"
 	"time"
 
-	"go.probo.inc/probo/pkg/coredata"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
 )
 
 func TestRenderHTML(t *testing.T) {
@@ -198,6 +198,8 @@ func TestTemplateFunctions(t *testing.T) {
 		eqFunc := templateFuncs["eq"].(func(any, any) bool)
 		assert.True(t, eqFunc("test", "test"))
 		assert.False(t, eqFunc("test", "other"))
+		assert.True(t, eqFunc(0, 0))
+		assert.False(t, eqFunc(0, 1))
 	})
 
 	t.Run("lower function", func(t *testing.T) {
diff --git a/pkg/docgen/soa_template.html b/pkg/docgen/soa_template.html
new file mode 100644
index 000000000..c17e32ae2
--- /dev/null
+++ b/pkg/docgen/soa_template.html
@@ -0,0 +1,480 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>State of Applicability</title>
+    <style>
+        @page {
+            size: A4 landscape;
+            margin: 2.5cm;
+            @bottom-right {
+                content: "Page " counter(page) " of " counter(pages);
+                font-family: Arial, sans-serif;
+                font-size: 9pt;
+                color: #666;
+            }
+        }
+
+        body {
+            font-family: Arial, sans-serif;
+            font-size: 7.5pt;
+            line-height: 1.4;
+            color: #333;
+            margin: 0;
+            padding: 0;
+            background: white;
+        }
+
+        /* Cover page */
+        .cover-page {
+            page-break-after: always;
+        }
+
+        .company-header {
+            margin-bottom: 30px;
+            page-break-after: avoid;
+        }
+
+        .company-logo {
+            max-height: 50px;
+            max-width: 250px;
+            object-fit: contain;
+            display: block;
+        }
+
+        .export-title {
+            font-size: 22pt;
+            font-weight: normal;
+            color: #1a1a1a;
+            margin: 0 0 25px 0;
+            text-align: left;
+        }
+
+        .export-subtitle {
+            font-size: 18pt;
+            font-weight: normal;
+            color: #1a1a1a;
+            margin: 0 0 25px 0;
+            text-align: left;
+        }
+
+        .document-meta {
+            margin: 0 0 30px 0;
+            font-size: 9pt;
+        }
+
+        .meta-table {
+            width: 100%;
+            border-collapse: collapse;
+            border: 1px solid #333;
+        }
+
+        .meta-table td {
+            padding: 6px 8px;
+            border: 1px solid #333;
+            vertical-align: middle;
+        }
+
+        .meta-table td:first-child {
+            font-weight: 600;
+            width: 25%;
+            background: #f8f8f8;
+            color: #333;
+        }
+
+        .classification {
+            font-weight: bold;
+            text-transform: uppercase;
+        }
+
+        .purpose-section {
+            margin: 30px 0;
+            page-break-after: avoid;
+        }
+
+        .purpose-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .purpose-text {
+            font-size: 10pt;
+            color: #333;
+            line-height: 1.5;
+            text-align: justify;
+        }
+
+        /* Controls page */
+        .controls-page {
+            page-break-before: always;
+        }
+
+        .controls-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .controls-table {
+            width: 100%;
+            border-collapse: collapse;
+            font-size: 8pt;
+            margin-top: 10px;
+        }
+
+        .controls-table th,
+        .controls-table td {
+            padding: 5px 6px;
+            text-align: left;
+            border: 1px solid #ddd;
+            vertical-align: top;
+        }
+
+        .controls-table th {
+            background: #f5f5f5;
+            font-weight: bold;
+            color: #333;
+        }
+
+        .controls-table tr {
+            page-break-inside: avoid;
+        }
+
+        .section-tag {
+            display: inline-block;
+            background: #e0e0e0;
+            color: #333;
+            padding: 2px 5px;
+            border-radius: 3px;
+            font-size: 7pt;
+            font-weight: 500;
+            margin-right: 5px;
+        }
+
+        .state-tag {
+            display: inline-block;
+            padding: 2px 5px;
+            border-radius: 4px;
+            font-size: 8pt;
+            font-weight: 500;
+        }
+
+        .state-tag-success {
+            background: #eefadc;
+            color: #5d770d;
+        }
+
+        .state-tag-warning {
+            background: #fff4d5;
+            color: #ad5700;
+        }
+
+        .state-tag-danger {
+            background: #ffefef;
+            color: #cd2b31;
+        }
+
+        /* Annex page */
+        .annex-page {
+            page-break-before: always;
+        }
+
+        .annex-title {
+            font-size: 15pt;
+            font-weight: bold;
+            color: #000;
+            margin: 0 0 15px 0;
+            page-break-after: avoid;
+        }
+
+        .annex-section {
+            margin-bottom: 20px;
+        }
+
+        .annex-section-title {
+            font-size: 13pt;
+            font-weight: bold;
+            color: #000;
+            margin: 15px 0 10px 0;
+        }
+
+        .annex-subsection-title {
+            font-size: 10pt;
+            font-weight: bold;
+            color: #333;
+            margin: 12px 0 8px 0;
+        }
+
+        .annex-enum-list {
+            margin: 10px 0;
+            padding-left: 20px;
+        }
+
+        .annex-enum-item {
+            margin-bottom: 8px;
+            font-size: 10pt;
+            line-height: 1.5;
+        }
+
+        .annex-enum-name {
+            font-weight: 600;
+            color: #333;
+        }
+
+        .annex-enum-description {
+            color: #000;
+            margin-left: 5px;
+        }
+
+        /* Prevent bad page breaks */
+        h1, h2, h3, h4, h5, h6 {
+            page-break-after: avoid;
+            page-break-inside: avoid;
+        }
+
+        @media print {
+            body {
+                background: white;
+            }
+        }
+    </style>
+</head>
+<body>
+    <div class="cover-page">
+        <div class="company-header">
+            {{- if .CompanyHorizontalLogoBase64}}
+            {{imgTag .CompanyHorizontalLogoBase64 "Company Logo" "company-logo"}}
+            {{- end}}
+        </div>
+
+        <h1 class="export-title">State of Applicability</h1>
+        <h2 class="export-subtitle">{{.Title}}</h2>
+
+        <div class="document-meta">
+            <table class="meta-table">
+                <tr>
+                    <td>Classification</td>
+                    <td>
+                        <span class="classification">CONFIDENTIAL</span>
+                    </td>
+                </tr>
+                <tr>
+                    <td>Approver</td>
+                    <td>{{.Approver}}</td>
+                </tr>
+                <tr>
+                    <td>Version</td>
+                    <td>{{.Version}}</td>
+                </tr>
+                <tr>
+                    <td>Published</td>
+                    <td>{{.PublishedAt.Format "January 2, 2006"}}</td>
+                </tr>
+            </table>
+        </div>
+
+        <div class="purpose-section">
+            <div class="purpose-title">1. Purpose</div>
+            <div class="purpose-text">
+                This document provides a comprehensive overview of the state of applicability for controls within the organization.
+                It serves as a record of which controls are applicable or not applicable to the organization, along with their
+                relationships to regulatory requirements, contractual obligations, risk assessments, and best practices.
+            </div>
+        </div>
+    </div>
+
+    {{- if .FrameworkGroups}}
+    <div class="controls-page">
+        <h1 class="controls-title">2. Controls</h1>
+        <table class="controls-table">
+            <thead>
+                <tr>
+                    <th rowspan="2" style="width: 12%;">Framework</th>
+                    <th rowspan="2" style="width: 24%;">Control</th>
+                    <th rowspan="2" style="width: 9%;">Applicability</th>
+                    <th rowspan="2" style="width: 17%;">Justification</th>
+                    <th colspan="4" style="width: 38%; text-align: center;">Justification for inclusion</th>
+                </tr>
+                <tr>
+                    <th style="width: 8%;">Regulatory</th>
+                    <th style="width: 8%;">Contractual</th>
+                    <th style="width: 10%;">Best Practice</th>
+                    <th style="width: 12%;">Risk Assessment</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{- range $group := .FrameworkGroups}}
+                    {{- range $group.Controls}}
+                    <tr>
+                        <td>{{$group.FrameworkName}}</td>
+                        <td><span class="section-tag">{{.SectionTitle}}</span>{{.Name}}</td>
+                        <td>
+                            {{- $state := boolToYesNo .Applicability}}
+                            {{- if eq $state "yes"}}
+                            <span class="state-tag state-tag-success">Yes</span>
+                            {{- else if eq $state "no"}}
+                            <span class="state-tag state-tag-danger">No</span>
+                            {{- else}}
+                            <span class="state-tag">-</span>
+                            {{- end}}
+                        </td>
+                        <td>
+                            {{- if .Justification}}
+                            {{.Justification}}
+                            {{- else}}
+                            -
+                            {{- end}}
+                        </td>
+                        <td>{{boolToYesNoDash .Regulatory}}</td>
+                        <td>{{boolToYesNoDash .Contractual}}</td>
+                        <td>
+                            {{- if .Applicability}}
+                                {{- if and .Applicability .BestPractice}}
+                                Yes
+                                {{- else if .Applicability}}
+                                No
+                                {{- else}}
+                                -
+                                {{- end}}
+                            {{- else}}
+                            -
+                            {{- end}}
+                        </td>
+                        <td>{{boolToYesNoDash .RiskAssessment}}</td>
+                    </tr>
+                    {{- end}}
+                {{- end}}
+            </tbody>
+        </table>
+    </div>
+    {{- end}}
+
+    <div class="annex-page">
+        <h1 class="annex-title">3. Annexes</h1>
+
+        <div class="annex-section">
+            <div class="annex-section-title">3.1 Column Definitions</div>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Framework</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">The name of the compliance framework or standard to which the control belongs (e.g., ISO 27001, SOC 2, GDPR).</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Control</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">The specific control identifier and name within the framework, including its section reference.</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Applicability</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">Yes:</span>
+                    <span class="annex-enum-description">The control is applicable to the organization.</span>
+                </li>
+                <li class="annex-enum-item">
+                    <span class="annex-enum-name">No:</span>
+                    <span class="annex-enum-description">The control is not applicable to the organization (with justification provided).</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Justification</div>
+            <ul class="annex-enum-list">
+                <li class="annex-enum-item">
+                    <span class="annex-enum-description">Provides the rationale when a control is not applicable. This field is empty for applicable controls.</span>
+                </li>
+            </ul>
+        </div>
+
+        <div class="annex-section">
+            <div class="annex-subsection-title">Justification for inclusion</div>
+            <div class="annex-enum-description" style="margin-bottom: 12px;">
+                For applicable controls, this section provides additional context on why the control is included, based on regulatory requirements, contractual obligations, best practices, or risk assessments.
+            </div>
+
+            <div style="margin-left: 20px;">
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Regulatory</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is linked to one or more legal or regulatory obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not associated with any legal or regulatory obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Contractual</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is linked to one or more contractual obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not associated with any contractual obligations.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Best Practice</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is designated as a best practice recommendation.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not designated as a best practice.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+
+                <div class="annex-subsection-title" style="font-size: 9pt; margin-top: 10px;">Risk Assessment</div>
+                <ul class="annex-enum-list">
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">Yes:</span>
+                        <span class="annex-enum-description">The control is associated with one or more identified risks through risk mitigation measures.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">No:</span>
+                        <span class="annex-enum-description">The control is not currently associated with any identified risks.</span>
+                    </li>
+                    <li class="annex-enum-item">
+                        <span class="annex-enum-name">-:</span>
+                        <span class="annex-enum-description">Not applicable (control is not applicable).</span>
+                    </li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</body>
+</html>
diff --git a/pkg/probo/control_service.go b/pkg/probo/control_service.go
index 82599d7ac..897d74e7b 100644
--- a/pkg/probo/control_service.go
+++ b/pkg/probo/control_service.go
@@ -39,6 +39,7 @@ type (
 		SectionTitle           string
 		Status                 *coredata.ControlStatus
 		ExclusionJustification *string
+		BestPractice           bool
 	}
 
 	UpdateControlRequest struct {
@@ -48,6 +49,7 @@ type (
 		SectionTitle           *string
 		Status                 *coredata.ControlStatus
 		ExclusionJustification *string
+		BestPractice           *bool
 	}
 )
 
@@ -587,6 +589,81 @@ func (s ControlService) DeleteAuditMapping(
 	return control, audit, nil
 }
 
+func (s ControlService) CreateObligationMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	obligationID gid.GID,
+) (*coredata.Control, *coredata.Obligation, error) {
+	control := &coredata.Control{}
+	obligation := &coredata.Obligation{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := obligation.LoadByID(ctx, conn, s.svc.scope, obligationID); err != nil {
+				return fmt.Errorf("cannot load obligation: %w", err)
+			}
+
+			controlObligation := &coredata.ControlObligation{
+				ControlID:    controlID,
+				ObligationID: obligationID,
+				CreatedAt:    time.Now(),
+			}
+
+			if err := controlObligation.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot create control obligation mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return control, obligation, nil
+}
+
+func (s ControlService) DeleteObligationMapping(
+	ctx context.Context,
+	controlID gid.GID,
+	obligationID gid.GID,
+) (*coredata.Control, *coredata.Obligation, error) {
+	control := &coredata.Control{}
+	obligation := &coredata.Obligation{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			if err := obligation.LoadByID(ctx, conn, s.svc.scope, obligationID); err != nil {
+				return fmt.Errorf("cannot load obligation: %w", err)
+			}
+
+			controlObligation := &coredata.ControlObligation{}
+			if err := controlObligation.Delete(ctx, conn, s.svc.scope, control.ID, obligation.ID); err != nil {
+				return fmt.Errorf("cannot delete control obligation mapping: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot delete control obligation mapping: %w", err)
+	}
+
+	return control, obligation, nil
+}
+
 func (s ControlService) ListForAuditID(
 	ctx context.Context,
 	auditID gid.GID,
@@ -723,6 +800,63 @@ func (s ControlService) ListForSnapshotID(
 	return page.NewPage([]*coredata.Control(controls), cursor), nil
 }
 
+func (s ControlService) CountForStateOfApplicabilityID(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	filter *coredata.ControlFilter,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			controls := &coredata.Controls{}
+			count, err = controls.CountByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count controls: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, fmt.Errorf("cannot count controls: %w", err)
+	}
+
+	return count, nil
+}
+
+func (s ControlService) ListForStateOfApplicabilityID(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	cursor *page.Cursor[coredata.ControlOrderField],
+	filter *coredata.ControlFilter,
+) (*page.Page[*coredata.Control, coredata.ControlOrderField], error) {
+	var controls coredata.Controls
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state of applicability: %w", err)
+			}
+			if err := controls.LoadByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID, cursor, filter); err != nil {
+				return fmt.Errorf("cannot load controls: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage([]*coredata.Control(controls), cursor), nil
+}
+
 func (s ControlService) Create(
 	ctx context.Context,
 	req CreateControlRequest,
@@ -742,6 +876,7 @@ func (s ControlService) Create(
 		SectionTitle:           req.SectionTitle,
 		Status:                 *req.Status,
 		ExclusionJustification: req.ExclusionJustification,
+		BestPractice:           req.BestPractice,
 		CreatedAt:              now,
 		UpdatedAt:              now,
 	}
@@ -822,6 +957,10 @@ func (s ControlService) Update(
 			control.ExclusionJustification = req.ExclusionJustification
 		}
 
+		if req.BestPractice != nil {
+			control.BestPractice = *req.BestPractice
+		}
+
 		control.UpdatedAt = time.Now()
 
 		return control.Update(ctx, conn, s.svc.scope)
diff --git a/pkg/probo/data_protection_impact_assessment_service.go b/pkg/probo/data_protection_impact_assessment_service.go
index e57810ca2..824410d82 100644
--- a/pkg/probo/data_protection_impact_assessment_service.go
+++ b/pkg/probo/data_protection_impact_assessment_service.go
@@ -329,9 +329,7 @@ func (s *DataProtectionImpactAssessmentService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {
diff --git a/pkg/probo/document_service.go b/pkg/probo/document_service.go
index 0aada966c..5cb1e760d 100644
--- a/pkg/probo/document_service.go
+++ b/pkg/probo/document_service.go
@@ -1640,9 +1640,7 @@ func exportDocumentPDF(
 	horizontalLogoBase64 := ""
 	if organization.HorizontalLogoFileID != nil {
 		fileRecord := &coredata.File{}
-		fileErr := svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-			return fileRecord.LoadByID(ctx, conn, scope, *organization.HorizontalLogoFileID)
-		})
+		fileErr := fileRecord.LoadByID(ctx, conn, scope, *organization.HorizontalLogoFileID)
 		if fileErr == nil {
 			base64Data, mimeType, logoErr := svc.fileManager.GetFileBase64(ctx, fileRecord)
 			if logoErr == nil {
diff --git a/pkg/probo/framework_service.go b/pkg/probo/framework_service.go
index feb7d7fe7..37e2b2206 100644
--- a/pkg/probo/framework_service.go
+++ b/pkg/probo/framework_service.go
@@ -72,9 +72,10 @@ type (
 				Dark  string `json:"dark"`
 			} `json:"logo,omitempty"`
 			Controls []struct {
-				ID          string `json:"id"`
-				Name        string `json:"name"`
-				Description string `json:"description"`
+				ID           string `json:"id"`
+				Name         string `json:"name"`
+				Description  string `json:"description"`
+				BestPractice *bool  `json:"best_practice,omitempty"`
 			} `json:"controls"`
 		}
 	}
@@ -572,6 +573,10 @@ func (s FrameworkService) Import(
 
 			now := time.Now()
 			description := control.Description
+			bestPractice := true
+			if control.BestPractice != nil {
+				bestPractice = *control.BestPractice
+			}
 			control := &coredata.Control{
 				ID:             controlID,
 				FrameworkID:    frameworkID,
@@ -580,6 +585,7 @@ func (s FrameworkService) Import(
 				Name:           control.Name,
 				Description:    &description,
 				Status:         coredata.ControlStatusIncluded,
+				BestPractice:   bestPractice,
 				CreatedAt:      now,
 				UpdatedAt:      now,
 			}
diff --git a/pkg/probo/obligation_service.go b/pkg/probo/obligation_service.go
index 9c27f3527..d17566a4e 100644
--- a/pkg/probo/obligation_service.go
+++ b/pkg/probo/obligation_service.go
@@ -41,7 +41,8 @@ type (
 		OwnerID                gid.GID
 		LastReviewDate         *time.Time
 		DueDate                *time.Time
-		Status                 *coredata.ObligationStatus
+		Status                 coredata.ObligationStatus
+		Type                   coredata.ObligationType
 	}
 
 	UpdateObligationRequest struct {
@@ -55,6 +56,7 @@ type (
 		LastReviewDate         **time.Time
 		DueDate                **time.Time
 		Status                 *coredata.ObligationStatus
+		Type                   *coredata.ObligationType
 	}
 )
 
@@ -69,6 +71,7 @@ func (cor *CreateObligationRequest) Validate() error {
 	v.Check(cor.Regulator, "regulator", validator.SafeText(TitleMaxLength))
 	v.Check(cor.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.PeopleEntityType))
 	v.Check(cor.Status, "status", validator.OneOfSlice(coredata.ObligationStatuses()))
+	v.Check(cor.Type, "type", validator.OneOfSlice(coredata.ObligationTypes()))
 
 	return v.Error()
 }
@@ -84,6 +87,7 @@ func (uor *UpdateObligationRequest) Validate() error {
 	v.Check(uor.Regulator, "regulator", validator.SafeText(NameMaxLength))
 	v.Check(uor.OwnerID, "owner_id", validator.GID(coredata.PeopleEntityType))
 	v.Check(uor.Status, "status", validator.OneOfSlice(coredata.ObligationStatuses()))
+	v.Check(uor.Type, "type", validator.OneOfSlice(coredata.ObligationTypes()))
 
 	return v.Error()
 }
@@ -133,7 +137,8 @@ func (s *ObligationService) Create(
 		OwnerID:                req.OwnerID,
 		LastReviewDate:         req.LastReviewDate,
 		DueDate:                req.DueDate,
-		Status:                 *req.Status,
+		Status:                 req.Status,
+		Type:                   req.Type,
 		CreatedAt:              now,
 		UpdatedAt:              now,
 	}
@@ -223,6 +228,10 @@ func (s *ObligationService) Update(
 				obligation.Status = *req.Status
 			}
 
+			if req.Type != nil {
+				obligation.Type = *req.Type
+			}
+
 			obligation.UpdatedAt = time.Now()
 
 			if err := obligation.Update(ctx, conn, s.svc.scope); err != nil {
@@ -290,6 +299,38 @@ func (s ObligationService) CountForOrganizationID(
 	return count, nil
 }
 
+func (s ObligationService) ListForControlID(
+	ctx context.Context,
+	controlID gid.GID,
+	cursor *page.Cursor[coredata.ObligationOrderField],
+	filter *coredata.ObligationFilter,
+) (*page.Page[*coredata.Obligation, coredata.ObligationOrderField], error) {
+	var obligations coredata.Obligations
+	control := &coredata.Control{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := control.LoadByID(ctx, conn, s.svc.scope, controlID); err != nil {
+				return fmt.Errorf("cannot load control: %w", err)
+			}
+
+			err := obligations.LoadByControlID(ctx, conn, s.svc.scope, control.ID, cursor, filter)
+			if err != nil {
+				return fmt.Errorf("cannot load obligations: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(obligations, cursor), nil
+}
+
 func (s ObligationService) ListForOrganizationID(
 	ctx context.Context,
 	organizationID gid.GID,
diff --git a/pkg/probo/processing_activity_service.go b/pkg/probo/processing_activity_service.go
index 584ac1914..9324b1b37 100644
--- a/pkg/probo/processing_activity_service.go
+++ b/pkg/probo/processing_activity_service.go
@@ -415,9 +415,7 @@ func (s *ProcessingActivityService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {
diff --git a/pkg/probo/service.go b/pkg/probo/service.go
index 4fa8327db..550b19ff2 100644
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -117,6 +117,7 @@ type (
 		ProcessingActivities              *ProcessingActivityService
 		DataProtectionImpactAssessments   *DataProtectionImpactAssessmentService
 		TransferImpactAssessments         *TransferImpactAssessmentService
+		StatesOfApplicability            *StateOfApplicabilityService
 		Files                             *FileService
 		CustomDomains                     *CustomDomainService
 		SlackMessages                     *slack.SlackMessageService
@@ -264,6 +265,10 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 		svc:               tenantService,
 		html2pdfConverter: s.html2pdfConverter,
 	}
+	tenantService.StatesOfApplicability = &StateOfApplicabilityService{
+		svc:               tenantService,
+		html2pdfConverter: s.html2pdfConverter,
+	}
 	tenantService.Files = &FileService{svc: tenantService}
 	tenantService.CustomDomains = &CustomDomainService{
 		svc:           tenantService,
diff --git a/pkg/probo/state_of_applicability_service.go b/pkg/probo/state_of_applicability_service.go
new file mode 100644
index 000000000..11f5e7904
--- /dev/null
+++ b/pkg/probo/state_of_applicability_service.go
@@ -0,0 +1,589 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/docgen"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/html2pdf"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type StateOfApplicabilityService struct {
+	svc               *TenantService
+	html2pdfConverter *html2pdf.Converter
+}
+
+type (
+	CreateStateOfApplicabilityRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		OwnerID        gid.GID
+	}
+
+	UpdateStateOfApplicabilityRequest struct {
+		StateOfApplicabilityID gid.GID
+		Name                   *string
+		OwnerID                *gid.GID
+	}
+)
+
+func (csr *CreateStateOfApplicabilityRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(csr.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
+	v.Check(csr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(csr.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.PeopleEntityType))
+
+	return v.Error()
+}
+
+func (usr *UpdateStateOfApplicabilityRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(usr.StateOfApplicabilityID, "state_of_applicability_id", validator.Required(), validator.GID(coredata.StateOfApplicabilityEntityType))
+	v.Check(usr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(usr.OwnerID, "owner_id", validator.GID(coredata.PeopleEntityType))
+
+	return v.Error()
+}
+
+func (s StateOfApplicabilityService) ListForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor[coredata.StateOfApplicabilityOrderField],
+	filter *coredata.StateOfApplicabilityFilter,
+) (*page.Page[*coredata.StateOfApplicability, coredata.StateOfApplicabilityOrderField], error) {
+	var statesOfApplicability coredata.StatesOfApplicability
+	organization := &coredata.Organization{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			err := statesOfApplicability.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organization.ID,
+				cursor,
+				filter,
+			)
+			if err != nil {
+				return fmt.Errorf("cannot load states_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(statesOfApplicability, cursor), nil
+}
+
+func (s StateOfApplicabilityService) CountForOrganizationID(
+	ctx context.Context,
+	organizationID gid.GID,
+	filter *coredata.StateOfApplicabilityFilter,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) (err error) {
+			statesOfApplicability := &coredata.StatesOfApplicability{}
+			count, err = statesOfApplicability.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID, filter)
+			if err != nil {
+				return fmt.Errorf("cannot count states_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s StateOfApplicabilityService) Get(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) (*coredata.StateOfApplicability, error) {
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Create(
+	ctx context.Context,
+	req CreateStateOfApplicabilityRequest,
+) (*coredata.StateOfApplicability, error) {
+	if err := req.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	now := time.Now()
+	organization := &coredata.Organization{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID)
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("cannot load organization: %w", err)
+	}
+
+	stateOfApplicabilityID := gid.New(organization.ID.TenantID(), coredata.StateOfApplicabilityEntityType)
+	stateOfApplicability := &coredata.StateOfApplicability{
+		ID:             stateOfApplicabilityID,
+		OrganizationID: organization.ID,
+		Name:           req.Name,
+		OwnerID:        req.OwnerID,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Update(
+	ctx context.Context,
+	req UpdateStateOfApplicabilityRequest,
+) (*coredata.StateOfApplicability, error) {
+	if err := req.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	stateOfApplicability := &coredata.StateOfApplicability{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, req.StateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state_of_applicability: %w", err)
+			}
+
+			if req.Name != nil {
+				stateOfApplicability.Name = *req.Name
+			}
+			if req.OwnerID != nil {
+				stateOfApplicability.OwnerID = *req.OwnerID
+			}
+
+			stateOfApplicability.UpdatedAt = time.Now()
+
+			if err := stateOfApplicability.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return stateOfApplicability, nil
+}
+
+func (s StateOfApplicabilityService) Delete(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) error {
+	stateOfApplicability := &coredata.StateOfApplicability{ID: stateOfApplicabilityID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state_of_applicability: %w", err)
+			}
+
+			if err := stateOfApplicability.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete state_of_applicability: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s StateOfApplicabilityService) ListAvailableControls(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) ([]*coredata.AvailableStateOfApplicabilityControl, error) {
+	var availableControls coredata.AvailableStateOfApplicabilityControls
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load available controls: %w", err)
+			}
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return availableControls, nil
+}
+
+func (s StateOfApplicabilityService) LinkControl(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+	applicability bool,
+	justification *string,
+) (*coredata.StateOfApplicabilityControl, error) {
+	stateOfApplicability := &coredata.StateOfApplicability{}
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID)
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot load state of applicability: %w", err)
+	}
+
+	now := time.Now()
+	control := &coredata.StateOfApplicabilityControl{
+		ID:                     gid.New(s.svc.scope.GetTenantID(), coredata.StateOfApplicabilityControlEntityType),
+		StateOfApplicabilityID: stateOfApplicabilityID,
+		ControlID:              controlID,
+		OrganizationID:         stateOfApplicability.OrganizationID,
+		Applicability:          applicability,
+		Justification:          justification,
+		CreatedAt:              now,
+		UpdatedAt:              now,
+	}
+
+	err = s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
+		return control.Upsert(ctx, conn, s.svc.scope)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return control, nil
+}
+
+func (s StateOfApplicabilityService) DeleteControlLink(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+	controlID gid.GID,
+) (gid.GID, error) {
+	control := &coredata.StateOfApplicabilityControl{}
+
+	err := s.svc.pg.WithTx(ctx, func(conn pg.Conn) error {
+		if err := control.LoadByStateOfApplicabilityIDAndControlID(ctx, conn, s.svc.scope, stateOfApplicabilityID, controlID); err != nil {
+			return err
+		}
+		return control.Delete(ctx, conn, s.svc.scope)
+	})
+	if err != nil {
+		return gid.GID{}, err
+	}
+
+	return control.ID, nil
+}
+
+func (s StateOfApplicabilityService) ListControlLinks(
+	ctx context.Context,
+	controlID gid.GID,
+	cursor *page.Cursor[coredata.StateOfApplicabilityOrderField],
+) (*page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField], error) {
+	var controls coredata.StateOfApplicabilityControls
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		return controls.LoadByControlID(ctx, conn, s.svc.scope, controlID, cursor)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(controls, cursor), nil
+}
+
+func (s StateOfApplicabilityService) ExportPDF(
+	ctx context.Context,
+	stateOfApplicabilityID gid.GID,
+) ([]byte, error) {
+	var documentData docgen.StateOfApplicabilityData
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			stateOfApplicability := &coredata.StateOfApplicability{}
+			if err := stateOfApplicability.LoadByID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load state of applicability: %w", err)
+			}
+
+			organization := &coredata.Organization{}
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization: %w", err)
+			}
+
+			owner := &coredata.People{}
+			if err := owner.LoadByID(ctx, conn, s.svc.scope, stateOfApplicability.OwnerID); err != nil {
+				return fmt.Errorf("cannot load owner: %w", err)
+			}
+
+			var availableControls coredata.AvailableStateOfApplicabilityControls
+			if err := availableControls.LoadAvailableByStateOfApplicabilityID(ctx, conn, s.svc.scope, stateOfApplicabilityID); err != nil {
+				return fmt.Errorf("cannot load available controls: %w", err)
+			}
+
+			linkedControls := make([]*coredata.AvailableStateOfApplicabilityControl, 0)
+			for _, ctrl := range availableControls {
+				if ctrl.StateOfApplicabilityID != nil {
+					linkedControls = append(linkedControls, ctrl)
+				}
+			}
+
+			obligationsByControl := make(map[gid.GID][]coredata.ObligationType)
+			if len(linkedControls) > 0 {
+				controlIDs := make([]gid.GID, len(linkedControls))
+				for i, ctrl := range linkedControls {
+					controlIDs[i] = ctrl.ControlID
+				}
+
+				var controlObligationTypes coredata.ControlObligationTypes
+				if err := controlObligationTypes.LoadTypesByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
+					return fmt.Errorf("cannot load control obligations: %w", err)
+				}
+
+				for _, cot := range controlObligationTypes {
+					obligationsByControl[cot.ControlID] = append(obligationsByControl[cot.ControlID], cot.Type)
+				}
+			}
+
+			controlsWithRisks := make(map[gid.GID]bool)
+			if len(linkedControls) > 0 {
+				controlIDs := make([]gid.GID, len(linkedControls))
+				for i, ctrl := range linkedControls {
+					controlIDs[i] = ctrl.ControlID
+				}
+
+				var controlsWithRisk coredata.ControlsWithRisk
+				if err := controlsWithRisk.LoadByControlIDs(ctx, conn, s.svc.scope, controlIDs); err != nil {
+					return fmt.Errorf("cannot load controls with risks: %w", err)
+				}
+
+				for _, cwr := range controlsWithRisk {
+					controlsWithRisks[cwr.ControlID] = true
+				}
+			}
+
+			frameworkControlsMap := make(map[string][]docgen.ControlData)
+			frameworkOrder := []string{}
+
+			for _, ctrl := range linkedControls {
+				if _, exists := frameworkControlsMap[ctrl.FrameworkName]; !exists {
+					frameworkOrder = append(frameworkOrder, ctrl.FrameworkName)
+					frameworkControlsMap[ctrl.FrameworkName] = []docgen.ControlData{}
+				}
+
+				var regulatory *bool
+				var contractual *bool
+				var riskAssessment *bool
+
+				if ctrl.Applicability != nil && *ctrl.Applicability {
+					falseVal := false
+					trueVal := true
+
+					regulatory = &falseVal
+					contractual = &falseVal
+					riskAssessment = &falseVal
+
+					obligations := obligationsByControl[ctrl.ControlID]
+					for _, obligationType := range obligations {
+						if obligationType == coredata.ObligationTypeLegal {
+							regulatory = &trueVal
+						}
+						if obligationType == coredata.ObligationTypeContractual {
+							contractual = &trueVal
+						}
+					}
+
+					if controlsWithRisks[ctrl.ControlID] {
+						riskAssessment = &trueVal
+					}
+				}
+
+				frameworkControlsMap[ctrl.FrameworkName] = append(
+					frameworkControlsMap[ctrl.FrameworkName],
+					docgen.ControlData{
+						FrameworkName:  ctrl.FrameworkName,
+						SectionTitle:   ctrl.SectionTitle,
+						Name:           ctrl.Name,
+						Applicability:  ctrl.Applicability,
+						Justification:  ctrl.Justification,
+						BestPractice:   ctrl.BestPractice,
+						Regulatory:     regulatory,
+						Contractual:    contractual,
+						RiskAssessment: riskAssessment,
+					},
+				)
+			}
+
+			frameworkGroups := make([]docgen.FrameworkControlGroup, len(frameworkOrder))
+			for i, frameworkName := range frameworkOrder {
+				frameworkGroups[i] = docgen.FrameworkControlGroup{
+					FrameworkName: frameworkName,
+					Controls:      frameworkControlsMap[frameworkName],
+				}
+			}
+
+			var snapshots coredata.Snapshots
+			snapshotType := coredata.SnapshotsTypeStatesOfApplicability
+
+			var version int
+			var publishedAt time.Time
+
+			if stateOfApplicability.SnapshotID != nil {
+				snapshot := &coredata.Snapshot{}
+				if err := snapshot.LoadByID(ctx, conn, s.svc.scope, *stateOfApplicability.SnapshotID); err != nil {
+					return fmt.Errorf("cannot load snapshot: %w", err)
+				}
+				publishedAt = snapshot.CreatedAt
+				snapshotFilter := coredata.NewSnapshotFilter(&snapshotType).WithBeforeDate(&snapshot.CreatedAt)
+				snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID, snapshotFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
+				}
+				version = snapshotCount
+			} else {
+				publishedAt = time.Now()
+				snapshotFilter := coredata.NewSnapshotFilter(&snapshotType)
+				snapshotCount, err := snapshots.CountByOrganizationID(ctx, conn, s.svc.scope, stateOfApplicability.OrganizationID, snapshotFilter)
+				if err != nil {
+					return fmt.Errorf("cannot count states of applicability snapshots: %w", err)
+				}
+				version = snapshotCount + 1
+			}
+
+			horizontalLogoBase64 := ""
+			if organization.HorizontalLogoFileID != nil {
+				fileRecord := &coredata.File{}
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
+				if fileErr == nil {
+					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
+					if logoErr == nil {
+						horizontalLogoBase64 = fmt.Sprintf("data:%s;base64,%s", mimeType, base64Data)
+					}
+				}
+			}
+
+			documentData = docgen.StateOfApplicabilityData{
+				Title:                       stateOfApplicability.Name,
+				OrganizationName:            organization.Name,
+				CreatedAt:                   stateOfApplicability.CreatedAt,
+				TotalControls:               len(linkedControls),
+				FrameworkGroups:             frameworkGroups,
+				CompanyHorizontalLogoBase64: horizontalLogoBase64,
+				Version:                     version,
+				PublishedAt:                 publishedAt,
+				Approver:                    owner.FullName,
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	htmlData, err := docgen.RenderStateOfApplicabilityHTML(documentData)
+	if err != nil {
+		return nil, fmt.Errorf("cannot render HTML: %w", err)
+	}
+
+	cfg := html2pdf.RenderConfig{
+		PageFormat:      html2pdf.PageFormatA4,
+		Orientation:     html2pdf.OrientationPortrait,
+		MarginTop:       html2pdf.NewMarginInches(1.0),
+		MarginBottom:    html2pdf.NewMarginInches(1.0),
+		MarginLeft:      html2pdf.NewMarginInches(1.0),
+		MarginRight:     html2pdf.NewMarginInches(1.0),
+		PrintBackground: true,
+		Scale:           1.0,
+	}
+
+	pdfReader, err := s.html2pdfConverter.GeneratePDF(ctx, htmlData, cfg)
+	if err != nil {
+		return nil, fmt.Errorf("cannot generate PDF: %w", err)
+	}
+
+	pdfData, err := io.ReadAll(pdfReader)
+	if err != nil {
+		return nil, fmt.Errorf("cannot read PDF data: %w", err)
+	}
+
+	return pdfData, nil
+}
diff --git a/pkg/probo/transfer_impact_assessment_service.go b/pkg/probo/transfer_impact_assessment_service.go
index ed3563700..3c6a0f02b 100644
--- a/pkg/probo/transfer_impact_assessment_service.go
+++ b/pkg/probo/transfer_impact_assessment_service.go
@@ -329,9 +329,7 @@ func (s *TransferImpactAssessmentService) ExportPDF(
 			horizontalLogoBase64 := ""
 			if organization.HorizontalLogoFileID != nil {
 				fileRecord := &coredata.File{}
-				fileErr := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
-					return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
-				})
+				fileErr := fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
 				if fileErr == nil {
 					base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
 					if logoErr == nil {
diff --git a/pkg/server/api/console/v1/schema.graphql b/pkg/server/api/console/v1/schema.graphql
index 4f12e87a2..edcc62c2b 100644
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -224,6 +224,14 @@ enum ObligationStatus
     @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant")
 }
 
+enum ObligationType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ObligationType") {
+  LEGAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeLegal")
+  CONTRACTUAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual")
+}
+
 enum ContinualImprovementStatus
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.ContinualImprovementStatus"
@@ -1235,6 +1243,10 @@ enum SnapshotsType
     @goEnum(
       value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeProcessingActivities"
     )
+  STATES_OF_APPLICABILITY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeStatesOfApplicability"
+    )
 }
 
 enum SnapshotOrderField
@@ -1567,6 +1579,10 @@ input DatumFilter {
   snapshotId: ID
 }
 
+input StateOfApplicabilityFilter {
+  snapshotId: ID
+}
+
 input NonconformityFilter {
   snapshotId: ID
 }
@@ -1715,6 +1731,15 @@ type Organization implements Node {
     orderBy: MeetingOrder
   ): MeetingConnection! @goField(forceResolver: true)
 
+  statesOfApplicability(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+    filter: StateOfApplicabilityFilter = { snapshotId: null }
+  ): StateOfApplicabilityConnection! @goField(forceResolver: true)
+
   measures(
     first: Int
     after: CursorKey
@@ -2072,6 +2097,7 @@ type Control implements Node
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 
   framework: Framework! @goField(forceResolver: true)
 
@@ -2101,6 +2127,15 @@ type Control implements Node
     orderBy: AuditOrder
   ): AuditConnection! @goField(forceResolver: true)
 
+  obligations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ObligationOrder
+    filter: ObligationFilter
+  ): ObligationConnection! @goField(forceResolver: true)
+
   snapshots(
     first: Int
     after: CursorKey
@@ -2109,6 +2144,14 @@ type Control implements Node
     orderBy: SnapshotOrder
   ): SnapshotConnection! @goField(forceResolver: true)
 
+  stateOfApplicabilityControls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+  ): StateOfApplicabilityControlConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2266,6 +2309,26 @@ type Meeting implements Node {
   updatedAt: Datetime!
 }
 
+type StateOfApplicability implements Node {
+  id: ID!
+  name: String!
+  sourceId: ID
+  snapshotId: ID
+  organization: Organization @goField(forceResolver: true)
+  owner: People! @goField(forceResolver: true)
+  controls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ControlOrder
+    filter: ControlFilter
+  ): ControlConnection! @goField(forceResolver: true)
+  availableControls: [AvailableStateOfApplicabilityControl!]! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Risk implements Node {
   id: ID!
   snapshotId: ID
@@ -2381,6 +2444,7 @@ type Obligation implements Node {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2835,6 +2899,20 @@ type MeetingEdge {
   node: Meeting!
 }
 
+type StateOfApplicabilityConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [StateOfApplicabilityEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityEdge {
+  cursor: CursorKey!
+  node: StateOfApplicability!
+}
+
 type RiskConnection
   @goModel(
     model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskConnection"
@@ -3191,12 +3269,24 @@ type Mutation {
   deleteControlDocumentMapping(
     input: DeleteControlDocumentMappingInput!
   ): DeleteControlDocumentMappingPayload!
+  createStateOfApplicabilityControlMapping(
+    input: CreateStateOfApplicabilityControlMappingInput!
+  ): CreateStateOfApplicabilityControlMappingPayload!
+  deleteStateOfApplicabilityControlMapping(
+    input: DeleteStateOfApplicabilityControlMappingInput!
+  ): DeleteStateOfApplicabilityControlMappingPayload!
   createControlAuditMapping(
     input: CreateControlAuditMappingInput!
   ): CreateControlAuditMappingPayload!
   deleteControlAuditMapping(
     input: DeleteControlAuditMappingInput!
   ): DeleteControlAuditMappingPayload!
+  createControlObligationMapping(
+    input: CreateControlObligationMappingInput!
+  ): CreateControlObligationMappingPayload!
+  deleteControlObligationMapping(
+    input: DeleteControlObligationMappingInput!
+  ): DeleteControlObligationMappingPayload!
   createControlSnapshotMapping(
     input: CreateControlSnapshotMappingInput!
   ): CreateControlSnapshotMappingPayload!
@@ -3269,6 +3359,19 @@ type Mutation {
   createMeeting(input: CreateMeetingInput!): CreateMeetingPayload!
   updateMeeting(input: UpdateMeetingInput!): UpdateMeetingPayload!
   deleteMeeting(input: DeleteMeetingInput!): DeleteMeetingPayload!
+  # StateOfApplicability mutations
+  createStateOfApplicability(
+    input: CreateStateOfApplicabilityInput!
+  ): CreateStateOfApplicabilityPayload!
+  updateStateOfApplicability(
+    input: UpdateStateOfApplicabilityInput!
+  ): UpdateStateOfApplicabilityPayload!
+  deleteStateOfApplicability(
+    input: DeleteStateOfApplicabilityInput!
+  ): DeleteStateOfApplicabilityPayload!
+  exportStateOfApplicabilityPDF(
+    input: ExportStateOfApplicabilityPDFInput!
+  ): ExportStateOfApplicabilityPDFPayload!
   publishDocumentVersion(
     input: PublishDocumentVersionInput!
   ): PublishDocumentVersionPayload!
@@ -3762,6 +3865,18 @@ input DeleteControlDocumentMappingInput {
   documentId: ID!
 }
 
+input CreateStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+input DeleteStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+}
+
 input CreateControlAuditMappingInput {
   controlId: ID!
   auditId: ID!
@@ -3772,6 +3887,16 @@ input DeleteControlAuditMappingInput {
   auditId: ID!
 }
 
+input CreateControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
+input DeleteControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
 input CreateControlSnapshotMappingInput {
   controlId: ID!
   snapshotId: ID!
@@ -3989,6 +4114,95 @@ input DeleteMeetingInput {
   meetingId: ID!
 }
 
+input CreateStateOfApplicabilityInput {
+  organizationId: ID!
+  name: String!
+  ownerId: ID!
+}
+
+input UpdateStateOfApplicabilityInput {
+  id: ID!
+  name: String
+  ownerId: ID
+}
+
+input StateOfApplicabilityControlInput {
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+type AvailableStateOfApplicabilityControl {
+  controlId: ID!
+  sectionTitle: String!
+  name: String!
+  frameworkId: ID!
+  frameworkName: String!
+  organizationId: ID!
+  stateOfApplicabilityId: ID
+  applicability: Boolean
+  justification: String
+  bestPractice: Boolean!
+  regulatory: Boolean!
+  contractual: Boolean!
+  riskAssessment: Boolean!
+}
+
+input DeleteStateOfApplicabilityInput {
+  stateOfApplicabilityId: ID!
+}
+
+
+type StateOfApplicabilityControl {
+  id: ID!
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
+  applicability: Boolean!
+  justification: String
+}
+
+type StateOfApplicabilityControlConnection @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlConnection") {
+  totalCount: Int!
+  edges: [StateOfApplicabilityControlEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityControlEdge @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlEdge") {
+  cursor: CursorKey!
+  node: StateOfApplicabilityControl!
+}
+
+input ExportStateOfApplicabilityPDFInput {
+  stateOfApplicabilityId: ID!
+}
+
+type ExportStateOfApplicabilityPDFPayload {
+  data: String!
+}
+
+input StateOfApplicabilityOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: StateOfApplicabilityOrderField!
+}
+
+enum StateOfApplicabilityOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderField"
+  ) {
+  NAME
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldName"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldCreatedAt"
+    )
+}
+
 input ConfirmEmailInput {
   token: String!
 }
@@ -4027,6 +4241,7 @@ input CreateControlInput {
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 }
 
 input UpdateControlInput {
@@ -4036,6 +4251,7 @@ input UpdateControlInput {
   description: String @goField(omittable: true)
   status: ControlStatus
   exclusionJustification: String
+  bestPractice: Boolean
 }
 
 input DeleteControlInput {
@@ -4119,6 +4335,7 @@ input CreateObligationInput {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
 }
 
 input UpdateObligationInput {
@@ -4132,6 +4349,7 @@ input UpdateObligationInput {
   lastReviewDate: Datetime @goField(omittable: true)
   dueDate: Datetime @goField(omittable: true)
   status: ObligationStatus
+  type: ObligationType
 }
 
 input DeleteObligationInput {
@@ -4501,6 +4719,16 @@ type DeleteControlDocumentMappingPayload {
   deletedDocumentId: ID!
 }
 
+type CreateStateOfApplicabilityControlMappingPayload {
+  stateOfApplicabilityControlEdge: StateOfApplicabilityControlEdge!
+}
+
+type DeleteStateOfApplicabilityControlMappingPayload {
+  deletedStateOfApplicabilityId: ID!
+  deletedControlId: ID!
+  deletedStateOfApplicabilityControlId: ID!
+}
+
 type CreateControlAuditMappingPayload {
   controlEdge: ControlEdge!
   auditEdge: AuditEdge!
@@ -4511,6 +4739,16 @@ type DeleteControlAuditMappingPayload {
   deletedAuditId: ID!
 }
 
+type CreateControlObligationMappingPayload {
+  controlEdge: ControlEdge!
+  obligationEdge: ObligationEdge!
+}
+
+type DeleteControlObligationMappingPayload {
+  deletedControlId: ID!
+  deletedObligationId: ID!
+}
+
 type CreateControlSnapshotMappingPayload {
   controlEdge: ControlEdge!
   snapshotEdge: SnapshotEdge!
@@ -4656,6 +4894,18 @@ type DeleteMeetingPayload {
   deletedMeetingId: ID!
 }
 
+type CreateStateOfApplicabilityPayload {
+  stateOfApplicabilityEdge: StateOfApplicabilityEdge!
+}
+
+type UpdateStateOfApplicabilityPayload {
+  stateOfApplicability: StateOfApplicability!
+}
+
+type DeleteStateOfApplicabilityPayload {
+  deletedStateOfApplicabilityId: ID!
+}
+
 type ConfirmEmailPayload {
   success: Boolean!
 }
diff --git a/pkg/server/api/console/v1/schema/schema.go b/pkg/server/api/console/v1/schema/schema.go
index b4435ab08..8305ce356 100644
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -95,6 +95,9 @@ type ResolverRoot interface {
 	SignableDocument() SignableDocumentResolver
 	Snapshot() SnapshotResolver
 	SnapshotConnection() SnapshotConnectionResolver
+	StateOfApplicability() StateOfApplicabilityResolver
+	StateOfApplicabilityConnection() StateOfApplicabilityConnectionResolver
+	StateOfApplicabilityControl() StateOfApplicabilityControlResolver
 	Task() TaskResolver
 	TaskConnection() TaskConnectionResolver
 	TransferImpactAssessment() TransferImpactAssessmentResolver
@@ -183,6 +186,22 @@ type ComplexityRoot struct {
 		Node   func(childComplexity int) int
 	}
 
+	AvailableStateOfApplicabilityControl struct {
+		Applicability          func(childComplexity int) int
+		BestPractice           func(childComplexity int) int
+		Contractual            func(childComplexity int) int
+		ControlID              func(childComplexity int) int
+		FrameworkID            func(childComplexity int) int
+		FrameworkName          func(childComplexity int) int
+		Justification          func(childComplexity int) int
+		Name                   func(childComplexity int) int
+		OrganizationID         func(childComplexity int) int
+		Regulatory             func(childComplexity int) int
+		RiskAssessment         func(childComplexity int) int
+		SectionTitle           func(childComplexity int) int
+		StateOfApplicabilityID func(childComplexity int) int
+	}
+
 	BulkDeleteDocumentsPayload struct {
 		DeletedDocumentIds func(childComplexity int) int
 	}
@@ -236,19 +255,22 @@ type ComplexityRoot struct {
 	}
 
 	Control struct {
-		Audits                 func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) int
-		CreatedAt              func(childComplexity int) int
-		Description            func(childComplexity int) int
-		Documents              func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) int
-		ExclusionJustification func(childComplexity int) int
-		Framework              func(childComplexity int) int
-		ID                     func(childComplexity int) int
-		Measures               func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) int
-		Name                   func(childComplexity int) int
-		SectionTitle           func(childComplexity int) int
-		Snapshots              func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) int
-		Status                 func(childComplexity int) int
-		UpdatedAt              func(childComplexity int) int
+		Audits                       func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) int
+		BestPractice                 func(childComplexity int) int
+		CreatedAt                    func(childComplexity int) int
+		Description                  func(childComplexity int) int
+		Documents                    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) int
+		ExclusionJustification       func(childComplexity int) int
+		Framework                    func(childComplexity int) int
+		ID                           func(childComplexity int) int
+		Measures                     func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) int
+		Name                         func(childComplexity int) int
+		Obligations                  func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy, filter *types.ObligationFilter) int
+		SectionTitle                 func(childComplexity int) int
+		Snapshots                    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) int
+		StateOfApplicabilityControls func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) int
+		Status                       func(childComplexity int) int
+		UpdatedAt                    func(childComplexity int) int
 	}
 
 	ControlConnection struct {
@@ -289,6 +311,11 @@ type ComplexityRoot struct {
 		MeasureEdge func(childComplexity int) int
 	}
 
+	CreateControlObligationMappingPayload struct {
+		ControlEdge    func(childComplexity int) int
+		ObligationEdge func(childComplexity int) int
+	}
+
 	CreateControlPayload struct {
 		ControlEdge func(childComplexity int) int
 	}
@@ -386,6 +413,14 @@ type ComplexityRoot struct {
 		SnapshotEdge func(childComplexity int) int
 	}
 
+	CreateStateOfApplicabilityControlMappingPayload struct {
+		StateOfApplicabilityControlEdge func(childComplexity int) int
+	}
+
+	CreateStateOfApplicabilityPayload struct {
+		StateOfApplicabilityEdge func(childComplexity int) int
+	}
+
 	CreateTaskPayload struct {
 		TaskEdge func(childComplexity int) int
 	}
@@ -519,6 +554,11 @@ type ComplexityRoot struct {
 		DeletedMeasureID func(childComplexity int) int
 	}
 
+	DeleteControlObligationMappingPayload struct {
+		DeletedControlID    func(childComplexity int) int
+		DeletedObligationID func(childComplexity int) int
+	}
+
 	DeleteControlPayload struct {
 		DeletedControlID func(childComplexity int) int
 	}
@@ -623,6 +663,16 @@ type ComplexityRoot struct {
 		DeletedSnapshotID func(childComplexity int) int
 	}
 
+	DeleteStateOfApplicabilityControlMappingPayload struct {
+		DeletedControlID                     func(childComplexity int) int
+		DeletedStateOfApplicabilityControlID func(childComplexity int) int
+		DeletedStateOfApplicabilityID        func(childComplexity int) int
+	}
+
+	DeleteStateOfApplicabilityPayload struct {
+		DeletedStateOfApplicabilityID func(childComplexity int) int
+	}
+
 	DeleteTaskPayload struct {
 		DeletedTaskID func(childComplexity int) int
 	}
@@ -799,6 +849,10 @@ type ComplexityRoot struct {
 		Data func(childComplexity int) int
 	}
 
+	ExportStateOfApplicabilityPDFPayload struct {
+		Data func(childComplexity int) int
+	}
+
 	ExportTransferImpactAssessmentsPDFPayload struct {
 		Data func(childComplexity int) int
 	}
@@ -978,6 +1032,7 @@ type ComplexityRoot struct {
 		CreateControlAuditMapping                func(childComplexity int, input types.CreateControlAuditMappingInput) int
 		CreateControlDocumentMapping             func(childComplexity int, input types.CreateControlDocumentMappingInput) int
 		CreateControlMeasureMapping              func(childComplexity int, input types.CreateControlMeasureMappingInput) int
+		CreateControlObligationMapping           func(childComplexity int, input types.CreateControlObligationMappingInput) int
 		CreateControlSnapshotMapping             func(childComplexity int, input types.CreateControlSnapshotMappingInput) int
 		CreateCustomDomain                       func(childComplexity int, input types.CreateCustomDomainInput) int
 		CreateDataProtectionImpactAssessment     func(childComplexity int, input types.CreateDataProtectionImpactAssessmentInput) int
@@ -999,6 +1054,8 @@ type ComplexityRoot struct {
 		CreateRiskObligationMapping              func(childComplexity int, input types.CreateRiskObligationMappingInput) int
 		CreateSAMLConfiguration                  func(childComplexity int, input types.CreateSAMLConfigurationInput) int
 		CreateSnapshot                           func(childComplexity int, input types.CreateSnapshotInput) int
+		CreateStateOfApplicability               func(childComplexity int, input types.CreateStateOfApplicabilityInput) int
+		CreateStateOfApplicabilityControlMapping func(childComplexity int, input types.CreateStateOfApplicabilityControlMappingInput) int
 		CreateTask                               func(childComplexity int, input types.CreateTaskInput) int
 		CreateTransferImpactAssessment           func(childComplexity int, input types.CreateTransferImpactAssessmentInput) int
 		CreateTrustCenterAccess                  func(childComplexity int, input types.CreateTrustCenterAccessInput) int
@@ -1016,6 +1073,7 @@ type ComplexityRoot struct {
 		DeleteControlAuditMapping                func(childComplexity int, input types.DeleteControlAuditMappingInput) int
 		DeleteControlDocumentMapping             func(childComplexity int, input types.DeleteControlDocumentMappingInput) int
 		DeleteControlMeasureMapping              func(childComplexity int, input types.DeleteControlMeasureMappingInput) int
+		DeleteControlObligationMapping           func(childComplexity int, input types.DeleteControlObligationMappingInput) int
 		DeleteControlSnapshotMapping             func(childComplexity int, input types.DeleteControlSnapshotMappingInput) int
 		DeleteCustomDomain                       func(childComplexity int, input types.DeleteCustomDomainInput) int
 		DeleteDataProtectionImpactAssessment     func(childComplexity int, input types.DeleteDataProtectionImpactAssessmentInput) int
@@ -1040,6 +1098,8 @@ type ComplexityRoot struct {
 		DeleteRiskObligationMapping              func(childComplexity int, input types.DeleteRiskObligationMappingInput) int
 		DeleteSAMLConfiguration                  func(childComplexity int, input types.DeleteSAMLConfigurationInput) int
 		DeleteSnapshot                           func(childComplexity int, input types.DeleteSnapshotInput) int
+		DeleteStateOfApplicability               func(childComplexity int, input types.DeleteStateOfApplicabilityInput) int
+		DeleteStateOfApplicabilityControlMapping func(childComplexity int, input types.DeleteStateOfApplicabilityControlMappingInput) int
 		DeleteTask                               func(childComplexity int, input types.DeleteTaskInput) int
 		DeleteTransferImpactAssessment           func(childComplexity int, input types.DeleteTransferImpactAssessmentInput) int
 		DeleteTrustCenterAccess                  func(childComplexity int, input types.DeleteTrustCenterAccessInput) int
@@ -1059,6 +1119,7 @@ type ComplexityRoot struct {
 		ExportFramework                          func(childComplexity int, input types.ExportFrameworkInput) int
 		ExportProcessingActivitiesPDF            func(childComplexity int, input types.ExportProcessingActivitiesPDFInput) int
 		ExportSignableVersionDocumentPDF         func(childComplexity int, input types.ExportSignableDocumentVersionPDFInput) int
+		ExportStateOfApplicabilityPDF            func(childComplexity int, input types.ExportStateOfApplicabilityPDFInput) int
 		ExportTransferImpactAssessmentsPDF       func(childComplexity int, input types.ExportTransferImpactAssessmentsPDFInput) int
 		GenerateDocumentChangelog                func(childComplexity int, input types.GenerateDocumentChangelogInput) int
 		GenerateFrameworkStateOfApplicability    func(childComplexity int, input types.GenerateFrameworkStateOfApplicabilityInput) int
@@ -1093,6 +1154,7 @@ type ComplexityRoot struct {
 		UpdateRightsRequest                      func(childComplexity int, input types.UpdateRightsRequestInput) int
 		UpdateRisk                               func(childComplexity int, input types.UpdateRiskInput) int
 		UpdateSAMLConfiguration                  func(childComplexity int, input types.UpdateSAMLConfigurationInput) int
+		UpdateStateOfApplicability               func(childComplexity int, input types.UpdateStateOfApplicabilityInput) int
 		UpdateTask                               func(childComplexity int, input types.UpdateTaskInput) int
 		UpdateTransferImpactAssessment           func(childComplexity int, input types.UpdateTransferImpactAssessmentInput) int
 		UpdateTrustCenter                        func(childComplexity int, input types.UpdateTrustCenterInput) int
@@ -1157,6 +1219,7 @@ type ComplexityRoot struct {
 		Source                 func(childComplexity int) int
 		SourceID               func(childComplexity int) int
 		Status                 func(childComplexity int) int
+		Type                   func(childComplexity int) int
 		UpdatedAt              func(childComplexity int) int
 	}
 
@@ -1203,6 +1266,7 @@ type ComplexityRoot struct {
 		SamlConfigurations              func(childComplexity int) int
 		SlackConnections                func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
 		Snapshots                       func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) int
+		StatesOfApplicability           func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy, filter *types.StateOfApplicabilityFilter) int
 		Tasks                           func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) int
 		TransferImpactAssessments       func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TransferImpactAssessmentOrderBy, filter *types.TransferImpactAssessmentFilter) int
 		TrustCenter                     func(childComplexity int) int
@@ -1494,6 +1558,50 @@ type ComplexityRoot struct {
 		Node   func(childComplexity int) int
 	}
 
+	StateOfApplicability struct {
+		AvailableControls func(childComplexity int) int
+		Controls          func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) int
+		CreatedAt         func(childComplexity int) int
+		ID                func(childComplexity int) int
+		Name              func(childComplexity int) int
+		Organization      func(childComplexity int) int
+		Owner             func(childComplexity int) int
+		SnapshotID        func(childComplexity int) int
+		SourceID          func(childComplexity int) int
+		UpdatedAt         func(childComplexity int) int
+	}
+
+	StateOfApplicabilityConnection struct {
+		Edges      func(childComplexity int) int
+		PageInfo   func(childComplexity int) int
+		TotalCount func(childComplexity int) int
+	}
+
+	StateOfApplicabilityControl struct {
+		Applicability          func(childComplexity int) int
+		ControlID              func(childComplexity int) int
+		ID                     func(childComplexity int) int
+		Justification          func(childComplexity int) int
+		StateOfApplicability   func(childComplexity int) int
+		StateOfApplicabilityID func(childComplexity int) int
+	}
+
+	StateOfApplicabilityControlConnection struct {
+		Edges      func(childComplexity int) int
+		PageInfo   func(childComplexity int) int
+		TotalCount func(childComplexity int) int
+	}
+
+	StateOfApplicabilityControlEdge struct {
+		Cursor func(childComplexity int) int
+		Node   func(childComplexity int) int
+	}
+
+	StateOfApplicabilityEdge struct {
+		Cursor func(childComplexity int) int
+		Node   func(childComplexity int) int
+	}
+
 	Task struct {
 		AssignedTo   func(childComplexity int) int
 		CreatedAt    func(childComplexity int) int
@@ -1737,6 +1845,10 @@ type ComplexityRoot struct {
 		SamlConfiguration func(childComplexity int) int
 	}
 
+	UpdateStateOfApplicabilityPayload struct {
+		StateOfApplicability func(childComplexity int) int
+	}
+
 	UpdateTaskPayload struct {
 		Task func(childComplexity int) int
 	}
@@ -2024,7 +2136,9 @@ type ControlResolver interface {
 	Measures(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error)
 	Documents(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error)
 	Audits(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error)
+	Obligations(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy, filter *types.ObligationFilter) (*types.ObligationConnection, error)
 	Snapshots(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) (*types.SnapshotConnection, error)
+	StateOfApplicabilityControls(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) (*types.StateOfApplicabilityControlConnection, error)
 }
 type ControlConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.ControlConnection) (int, error)
@@ -2168,8 +2282,12 @@ type MutationResolver interface {
 	CreateControlDocumentMapping(ctx context.Context, input types.CreateControlDocumentMappingInput) (*types.CreateControlDocumentMappingPayload, error)
 	DeleteControlMeasureMapping(ctx context.Context, input types.DeleteControlMeasureMappingInput) (*types.DeleteControlMeasureMappingPayload, error)
 	DeleteControlDocumentMapping(ctx context.Context, input types.DeleteControlDocumentMappingInput) (*types.DeleteControlDocumentMappingPayload, error)
+	CreateStateOfApplicabilityControlMapping(ctx context.Context, input types.CreateStateOfApplicabilityControlMappingInput) (*types.CreateStateOfApplicabilityControlMappingPayload, error)
+	DeleteStateOfApplicabilityControlMapping(ctx context.Context, input types.DeleteStateOfApplicabilityControlMappingInput) (*types.DeleteStateOfApplicabilityControlMappingPayload, error)
 	CreateControlAuditMapping(ctx context.Context, input types.CreateControlAuditMappingInput) (*types.CreateControlAuditMappingPayload, error)
 	DeleteControlAuditMapping(ctx context.Context, input types.DeleteControlAuditMappingInput) (*types.DeleteControlAuditMappingPayload, error)
+	CreateControlObligationMapping(ctx context.Context, input types.CreateControlObligationMappingInput) (*types.CreateControlObligationMappingPayload, error)
+	DeleteControlObligationMapping(ctx context.Context, input types.DeleteControlObligationMappingInput) (*types.DeleteControlObligationMappingPayload, error)
 	CreateControlSnapshotMapping(ctx context.Context, input types.CreateControlSnapshotMappingInput) (*types.CreateControlSnapshotMappingPayload, error)
 	DeleteControlSnapshotMapping(ctx context.Context, input types.DeleteControlSnapshotMappingInput) (*types.DeleteControlSnapshotMappingPayload, error)
 	CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error)
@@ -2200,6 +2318,10 @@ type MutationResolver interface {
 	CreateMeeting(ctx context.Context, input types.CreateMeetingInput) (*types.CreateMeetingPayload, error)
 	UpdateMeeting(ctx context.Context, input types.UpdateMeetingInput) (*types.UpdateMeetingPayload, error)
 	DeleteMeeting(ctx context.Context, input types.DeleteMeetingInput) (*types.DeleteMeetingPayload, error)
+	CreateStateOfApplicability(ctx context.Context, input types.CreateStateOfApplicabilityInput) (*types.CreateStateOfApplicabilityPayload, error)
+	UpdateStateOfApplicability(ctx context.Context, input types.UpdateStateOfApplicabilityInput) (*types.UpdateStateOfApplicabilityPayload, error)
+	DeleteStateOfApplicability(ctx context.Context, input types.DeleteStateOfApplicabilityInput) (*types.DeleteStateOfApplicabilityPayload, error)
+	ExportStateOfApplicabilityPDF(ctx context.Context, input types.ExportStateOfApplicabilityPDFInput) (*types.ExportStateOfApplicabilityPDFPayload, error)
 	PublishDocumentVersion(ctx context.Context, input types.PublishDocumentVersionInput) (*types.PublishDocumentVersionPayload, error)
 	BulkPublishDocumentVersions(ctx context.Context, input types.BulkPublishDocumentVersionsInput) (*types.BulkPublishDocumentVersionsPayload, error)
 	BulkDeleteDocuments(ctx context.Context, input types.BulkDeleteDocumentsInput) (*types.BulkDeleteDocumentsPayload, error)
@@ -2296,6 +2418,7 @@ type OrganizationResolver interface {
 	Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.PeopleOrderBy, filter *types.PeopleFilter) (*types.PeopleConnection, error)
 	Documents(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error)
 	Meetings(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeetingOrderBy) (*types.MeetingConnection, error)
+	StatesOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy, filter *types.StateOfApplicabilityFilter) (*types.StateOfApplicabilityConnection, error)
 	Measures(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error)
 	Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy, filter *types.RiskFilter) (*types.RiskConnection, error)
 	Tasks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error)
@@ -2374,6 +2497,18 @@ type SnapshotResolver interface {
 type SnapshotConnectionResolver interface {
 	TotalCount(ctx context.Context, obj *types.SnapshotConnection) (int, error)
 }
+type StateOfApplicabilityResolver interface {
+	Organization(ctx context.Context, obj *types.StateOfApplicability) (*types.Organization, error)
+	Owner(ctx context.Context, obj *types.StateOfApplicability) (*types.People, error)
+	Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error)
+	AvailableControls(ctx context.Context, obj *types.StateOfApplicability) ([]*types.AvailableStateOfApplicabilityControl, error)
+}
+type StateOfApplicabilityConnectionResolver interface {
+	TotalCount(ctx context.Context, obj *types.StateOfApplicabilityConnection) (int, error)
+}
+type StateOfApplicabilityControlResolver interface {
+	StateOfApplicability(ctx context.Context, obj *types.StateOfApplicabilityControl) (*types.StateOfApplicability, error)
+}
 type TaskResolver interface {
 	AssignedTo(ctx context.Context, obj *types.Task) (*types.People, error)
 	Organization(ctx context.Context, obj *types.Task) (*types.Organization, error)
@@ -2724,6 +2859,85 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.AuditEdge.Node(childComplexity), true
 
+	case "AvailableStateOfApplicabilityControl.applicability":
+		if e.complexity.AvailableStateOfApplicabilityControl.Applicability == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.Applicability(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.bestPractice":
+		if e.complexity.AvailableStateOfApplicabilityControl.BestPractice == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.BestPractice(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.contractual":
+		if e.complexity.AvailableStateOfApplicabilityControl.Contractual == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.Contractual(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.controlId":
+		if e.complexity.AvailableStateOfApplicabilityControl.ControlID == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.ControlID(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.frameworkId":
+		if e.complexity.AvailableStateOfApplicabilityControl.FrameworkID == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.FrameworkID(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.frameworkName":
+		if e.complexity.AvailableStateOfApplicabilityControl.FrameworkName == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.FrameworkName(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.justification":
+		if e.complexity.AvailableStateOfApplicabilityControl.Justification == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.Justification(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.name":
+		if e.complexity.AvailableStateOfApplicabilityControl.Name == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.Name(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.organizationId":
+		if e.complexity.AvailableStateOfApplicabilityControl.OrganizationID == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.OrganizationID(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.regulatory":
+		if e.complexity.AvailableStateOfApplicabilityControl.Regulatory == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.Regulatory(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.riskAssessment":
+		if e.complexity.AvailableStateOfApplicabilityControl.RiskAssessment == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.RiskAssessment(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.sectionTitle":
+		if e.complexity.AvailableStateOfApplicabilityControl.SectionTitle == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.SectionTitle(childComplexity), true
+	case "AvailableStateOfApplicabilityControl.stateOfApplicabilityId":
+		if e.complexity.AvailableStateOfApplicabilityControl.StateOfApplicabilityID == nil {
+			break
+		}
+
+		return e.complexity.AvailableStateOfApplicabilityControl.StateOfApplicabilityID(childComplexity), true
+
 	case "BulkDeleteDocumentsPayload.deletedDocumentIds":
 		if e.complexity.BulkDeleteDocumentsPayload.DeletedDocumentIds == nil {
 			break
@@ -2894,6 +3108,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Control.Audits(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.AuditOrderBy)), true
+	case "Control.bestPractice":
+		if e.complexity.Control.BestPractice == nil {
+			break
+		}
+
+		return e.complexity.Control.BestPractice(childComplexity), true
 	case "Control.createdAt":
 		if e.complexity.Control.CreatedAt == nil {
 			break
@@ -2952,6 +3172,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Control.Name(childComplexity), true
+	case "Control.obligations":
+		if e.complexity.Control.Obligations == nil {
+			break
+		}
+
+		args, err := ec.field_Control_obligations_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Control.Obligations(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.ObligationOrderBy), args["filter"].(*types.ObligationFilter)), true
 	case "Control.sectionTitle":
 		if e.complexity.Control.SectionTitle == nil {
 			break
@@ -2969,6 +3200,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Control.Snapshots(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.SnapshotOrderBy)), true
+	case "Control.stateOfApplicabilityControls":
+		if e.complexity.Control.StateOfApplicabilityControls == nil {
+			break
+		}
+
+		args, err := ec.field_Control_stateOfApplicabilityControls_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Control.StateOfApplicabilityControls(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.StateOfApplicabilityOrderBy)), true
 	case "Control.status":
 		if e.complexity.Control.Status == nil {
 			break
@@ -3074,6 +3316,19 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.CreateControlMeasureMappingPayload.MeasureEdge(childComplexity), true
 
+	case "CreateControlObligationMappingPayload.controlEdge":
+		if e.complexity.CreateControlObligationMappingPayload.ControlEdge == nil {
+			break
+		}
+
+		return e.complexity.CreateControlObligationMappingPayload.ControlEdge(childComplexity), true
+	case "CreateControlObligationMappingPayload.obligationEdge":
+		if e.complexity.CreateControlObligationMappingPayload.ObligationEdge == nil {
+			break
+		}
+
+		return e.complexity.CreateControlObligationMappingPayload.ObligationEdge(childComplexity), true
+
 	case "CreateControlPayload.controlEdge":
 		if e.complexity.CreateControlPayload.ControlEdge == nil {
 			break
@@ -3265,6 +3520,20 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.CreateSnapshotPayload.SnapshotEdge(childComplexity), true
 
+	case "CreateStateOfApplicabilityControlMappingPayload.stateOfApplicabilityControlEdge":
+		if e.complexity.CreateStateOfApplicabilityControlMappingPayload.StateOfApplicabilityControlEdge == nil {
+			break
+		}
+
+		return e.complexity.CreateStateOfApplicabilityControlMappingPayload.StateOfApplicabilityControlEdge(childComplexity), true
+
+	case "CreateStateOfApplicabilityPayload.stateOfApplicabilityEdge":
+		if e.complexity.CreateStateOfApplicabilityPayload.StateOfApplicabilityEdge == nil {
+			break
+		}
+
+		return e.complexity.CreateStateOfApplicabilityPayload.StateOfApplicabilityEdge(childComplexity), true
+
 	case "CreateTaskPayload.taskEdge":
 		if e.complexity.CreateTaskPayload.TaskEdge == nil {
 			break
@@ -3660,6 +3929,19 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.DeleteControlMeasureMappingPayload.DeletedMeasureID(childComplexity), true
 
+	case "DeleteControlObligationMappingPayload.deletedControlId":
+		if e.complexity.DeleteControlObligationMappingPayload.DeletedControlID == nil {
+			break
+		}
+
+		return e.complexity.DeleteControlObligationMappingPayload.DeletedControlID(childComplexity), true
+	case "DeleteControlObligationMappingPayload.deletedObligationId":
+		if e.complexity.DeleteControlObligationMappingPayload.DeletedObligationID == nil {
+			break
+		}
+
+		return e.complexity.DeleteControlObligationMappingPayload.DeletedObligationID(childComplexity), true
+
 	case "DeleteControlPayload.deletedControlId":
 		if e.complexity.DeleteControlPayload.DeletedControlID == nil {
 			break
@@ -3859,6 +4141,32 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.DeleteSnapshotPayload.DeletedSnapshotID(childComplexity), true
 
+	case "DeleteStateOfApplicabilityControlMappingPayload.deletedControlId":
+		if e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedControlID == nil {
+			break
+		}
+
+		return e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedControlID(childComplexity), true
+	case "DeleteStateOfApplicabilityControlMappingPayload.deletedStateOfApplicabilityControlId":
+		if e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedStateOfApplicabilityControlID == nil {
+			break
+		}
+
+		return e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedStateOfApplicabilityControlID(childComplexity), true
+	case "DeleteStateOfApplicabilityControlMappingPayload.deletedStateOfApplicabilityId":
+		if e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedStateOfApplicabilityID == nil {
+			break
+		}
+
+		return e.complexity.DeleteStateOfApplicabilityControlMappingPayload.DeletedStateOfApplicabilityID(childComplexity), true
+
+	case "DeleteStateOfApplicabilityPayload.deletedStateOfApplicabilityId":
+		if e.complexity.DeleteStateOfApplicabilityPayload.DeletedStateOfApplicabilityID == nil {
+			break
+		}
+
+		return e.complexity.DeleteStateOfApplicabilityPayload.DeletedStateOfApplicabilityID(childComplexity), true
+
 	case "DeleteTaskPayload.deletedTaskId":
 		if e.complexity.DeleteTaskPayload.DeletedTaskID == nil {
 			break
@@ -4403,6 +4711,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.ExportSignableDocumentVersionPDFPayload.Data(childComplexity), true
 
+	case "ExportStateOfApplicabilityPDFPayload.data":
+		if e.complexity.ExportStateOfApplicabilityPDFPayload.Data == nil {
+			break
+		}
+
+		return e.complexity.ExportStateOfApplicabilityPDFPayload.Data(childComplexity), true
+
 	case "ExportTransferImpactAssessmentsPDFPayload.data":
 		if e.complexity.ExportTransferImpactAssessmentsPDFPayload.Data == nil {
 			break
@@ -5146,6 +5461,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.CreateControlMeasureMapping(childComplexity, args["input"].(types.CreateControlMeasureMappingInput)), true
+	case "Mutation.createControlObligationMapping":
+		if e.complexity.Mutation.CreateControlObligationMapping == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_createControlObligationMapping_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.CreateControlObligationMapping(childComplexity, args["input"].(types.CreateControlObligationMappingInput)), true
 	case "Mutation.createControlSnapshotMapping":
 		if e.complexity.Mutation.CreateControlSnapshotMapping == nil {
 			break
@@ -5377,6 +5703,28 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.CreateSnapshot(childComplexity, args["input"].(types.CreateSnapshotInput)), true
+	case "Mutation.createStateOfApplicability":
+		if e.complexity.Mutation.CreateStateOfApplicability == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_createStateOfApplicability_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.CreateStateOfApplicability(childComplexity, args["input"].(types.CreateStateOfApplicabilityInput)), true
+	case "Mutation.createStateOfApplicabilityControlMapping":
+		if e.complexity.Mutation.CreateStateOfApplicabilityControlMapping == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_createStateOfApplicabilityControlMapping_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.CreateStateOfApplicabilityControlMapping(childComplexity, args["input"].(types.CreateStateOfApplicabilityControlMappingInput)), true
 	case "Mutation.createTask":
 		if e.complexity.Mutation.CreateTask == nil {
 			break
@@ -5564,6 +5912,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.DeleteControlMeasureMapping(childComplexity, args["input"].(types.DeleteControlMeasureMappingInput)), true
+	case "Mutation.deleteControlObligationMapping":
+		if e.complexity.Mutation.DeleteControlObligationMapping == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_deleteControlObligationMapping_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.DeleteControlObligationMapping(childComplexity, args["input"].(types.DeleteControlObligationMappingInput)), true
 	case "Mutation.deleteControlSnapshotMapping":
 		if e.complexity.Mutation.DeleteControlSnapshotMapping == nil {
 			break
@@ -5828,6 +6187,28 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.DeleteSnapshot(childComplexity, args["input"].(types.DeleteSnapshotInput)), true
+	case "Mutation.deleteStateOfApplicability":
+		if e.complexity.Mutation.DeleteStateOfApplicability == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_deleteStateOfApplicability_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.DeleteStateOfApplicability(childComplexity, args["input"].(types.DeleteStateOfApplicabilityInput)), true
+	case "Mutation.deleteStateOfApplicabilityControlMapping":
+		if e.complexity.Mutation.DeleteStateOfApplicabilityControlMapping == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_deleteStateOfApplicabilityControlMapping_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.DeleteStateOfApplicabilityControlMapping(childComplexity, args["input"].(types.DeleteStateOfApplicabilityControlMappingInput)), true
 	case "Mutation.deleteTask":
 		if e.complexity.Mutation.DeleteTask == nil {
 			break
@@ -6037,6 +6418,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.ExportSignableVersionDocumentPDF(childComplexity, args["input"].(types.ExportSignableDocumentVersionPDFInput)), true
+	case "Mutation.exportStateOfApplicabilityPDF":
+		if e.complexity.Mutation.ExportStateOfApplicabilityPDF == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_exportStateOfApplicabilityPDF_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.ExportStateOfApplicabilityPDF(childComplexity, args["input"].(types.ExportStateOfApplicabilityPDFInput)), true
 	case "Mutation.exportTransferImpactAssessmentsPDF":
 		if e.complexity.Mutation.ExportTransferImpactAssessmentsPDF == nil {
 			break
@@ -6411,6 +6803,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Mutation.UpdateSAMLConfiguration(childComplexity, args["input"].(types.UpdateSAMLConfigurationInput)), true
+	case "Mutation.updateStateOfApplicability":
+		if e.complexity.Mutation.UpdateStateOfApplicability == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_updateStateOfApplicability_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.UpdateStateOfApplicability(childComplexity, args["input"].(types.UpdateStateOfApplicabilityInput)), true
 	case "Mutation.updateTask":
 		if e.complexity.Mutation.UpdateTask == nil {
 			break
@@ -6817,6 +7220,12 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Obligation.Status(childComplexity), true
+	case "Obligation.type":
+		if e.complexity.Obligation.Type == nil {
+			break
+		}
+
+		return e.complexity.Obligation.Type(childComplexity), true
 	case "Obligation.updatedAt":
 		if e.complexity.Obligation.UpdatedAt == nil {
 			break
@@ -7142,6 +7551,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}
 
 		return e.complexity.Organization.Snapshots(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.SnapshotOrderBy)), true
+	case "Organization.statesOfApplicability":
+		if e.complexity.Organization.StatesOfApplicability == nil {
+			break
+		}
+
+		args, err := ec.field_Organization_statesOfApplicability_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Organization.StatesOfApplicability(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.StateOfApplicabilityOrderBy), args["filter"].(*types.StateOfApplicabilityFilter)), true
 	case "Organization.tasks":
 		if e.complexity.Organization.Tasks == nil {
 			break
@@ -8342,6 +8762,173 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.SnapshotEdge.Node(childComplexity), true
 
+	case "StateOfApplicability.availableControls":
+		if e.complexity.StateOfApplicability.AvailableControls == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.AvailableControls(childComplexity), true
+	case "StateOfApplicability.controls":
+		if e.complexity.StateOfApplicability.Controls == nil {
+			break
+		}
+
+		args, err := ec.field_StateOfApplicability_controls_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.StateOfApplicability.Controls(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey), args["orderBy"].(*types.ControlOrderBy), args["filter"].(*types.ControlFilter)), true
+	case "StateOfApplicability.createdAt":
+		if e.complexity.StateOfApplicability.CreatedAt == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.CreatedAt(childComplexity), true
+	case "StateOfApplicability.id":
+		if e.complexity.StateOfApplicability.ID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.ID(childComplexity), true
+	case "StateOfApplicability.name":
+		if e.complexity.StateOfApplicability.Name == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.Name(childComplexity), true
+	case "StateOfApplicability.organization":
+		if e.complexity.StateOfApplicability.Organization == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.Organization(childComplexity), true
+	case "StateOfApplicability.owner":
+		if e.complexity.StateOfApplicability.Owner == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.Owner(childComplexity), true
+	case "StateOfApplicability.snapshotId":
+		if e.complexity.StateOfApplicability.SnapshotID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.SnapshotID(childComplexity), true
+	case "StateOfApplicability.sourceId":
+		if e.complexity.StateOfApplicability.SourceID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.SourceID(childComplexity), true
+	case "StateOfApplicability.updatedAt":
+		if e.complexity.StateOfApplicability.UpdatedAt == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicability.UpdatedAt(childComplexity), true
+
+	case "StateOfApplicabilityConnection.edges":
+		if e.complexity.StateOfApplicabilityConnection.Edges == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityConnection.Edges(childComplexity), true
+	case "StateOfApplicabilityConnection.pageInfo":
+		if e.complexity.StateOfApplicabilityConnection.PageInfo == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityConnection.PageInfo(childComplexity), true
+	case "StateOfApplicabilityConnection.totalCount":
+		if e.complexity.StateOfApplicabilityConnection.TotalCount == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityConnection.TotalCount(childComplexity), true
+
+	case "StateOfApplicabilityControl.applicability":
+		if e.complexity.StateOfApplicabilityControl.Applicability == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.Applicability(childComplexity), true
+	case "StateOfApplicabilityControl.controlId":
+		if e.complexity.StateOfApplicabilityControl.ControlID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.ControlID(childComplexity), true
+	case "StateOfApplicabilityControl.id":
+		if e.complexity.StateOfApplicabilityControl.ID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.ID(childComplexity), true
+	case "StateOfApplicabilityControl.justification":
+		if e.complexity.StateOfApplicabilityControl.Justification == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.Justification(childComplexity), true
+	case "StateOfApplicabilityControl.stateOfApplicability":
+		if e.complexity.StateOfApplicabilityControl.StateOfApplicability == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.StateOfApplicability(childComplexity), true
+	case "StateOfApplicabilityControl.stateOfApplicabilityId":
+		if e.complexity.StateOfApplicabilityControl.StateOfApplicabilityID == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControl.StateOfApplicabilityID(childComplexity), true
+
+	case "StateOfApplicabilityControlConnection.edges":
+		if e.complexity.StateOfApplicabilityControlConnection.Edges == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControlConnection.Edges(childComplexity), true
+	case "StateOfApplicabilityControlConnection.pageInfo":
+		if e.complexity.StateOfApplicabilityControlConnection.PageInfo == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControlConnection.PageInfo(childComplexity), true
+	case "StateOfApplicabilityControlConnection.totalCount":
+		if e.complexity.StateOfApplicabilityControlConnection.TotalCount == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControlConnection.TotalCount(childComplexity), true
+
+	case "StateOfApplicabilityControlEdge.cursor":
+		if e.complexity.StateOfApplicabilityControlEdge.Cursor == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControlEdge.Cursor(childComplexity), true
+	case "StateOfApplicabilityControlEdge.node":
+		if e.complexity.StateOfApplicabilityControlEdge.Node == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityControlEdge.Node(childComplexity), true
+
+	case "StateOfApplicabilityEdge.cursor":
+		if e.complexity.StateOfApplicabilityEdge.Cursor == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityEdge.Cursor(childComplexity), true
+	case "StateOfApplicabilityEdge.node":
+		if e.complexity.StateOfApplicabilityEdge.Node == nil {
+			break
+		}
+
+		return e.complexity.StateOfApplicabilityEdge.Node(childComplexity), true
+
 	case "Task.assignedTo":
 		if e.complexity.Task.AssignedTo == nil {
 			break
@@ -9106,6 +9693,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 
 		return e.complexity.UpdateSAMLConfigurationPayload.SamlConfiguration(childComplexity), true
 
+	case "UpdateStateOfApplicabilityPayload.stateOfApplicability":
+		if e.complexity.UpdateStateOfApplicabilityPayload.StateOfApplicability == nil {
+			break
+		}
+
+		return e.complexity.UpdateStateOfApplicabilityPayload.StateOfApplicability(childComplexity), true
+
 	case "UpdateTaskPayload.task":
 		if e.complexity.UpdateTaskPayload.Task == nil {
 			break
@@ -10014,6 +10608,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputCreateControlDocumentMappingInput,
 		ec.unmarshalInputCreateControlInput,
 		ec.unmarshalInputCreateControlMeasureMappingInput,
+		ec.unmarshalInputCreateControlObligationMappingInput,
 		ec.unmarshalInputCreateControlSnapshotMappingInput,
 		ec.unmarshalInputCreateCustomDomainInput,
 		ec.unmarshalInputCreateDataProtectionImpactAssessmentInput,
@@ -10036,6 +10631,8 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputCreateRiskObligationMappingInput,
 		ec.unmarshalInputCreateSAMLConfigurationInput,
 		ec.unmarshalInputCreateSnapshotInput,
+		ec.unmarshalInputCreateStateOfApplicabilityControlMappingInput,
+		ec.unmarshalInputCreateStateOfApplicabilityInput,
 		ec.unmarshalInputCreateTaskInput,
 		ec.unmarshalInputCreateTransferImpactAssessmentInput,
 		ec.unmarshalInputCreateTrustCenterAccessInput,
@@ -10057,6 +10654,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputDeleteControlDocumentMappingInput,
 		ec.unmarshalInputDeleteControlInput,
 		ec.unmarshalInputDeleteControlMeasureMappingInput,
+		ec.unmarshalInputDeleteControlObligationMappingInput,
 		ec.unmarshalInputDeleteControlSnapshotMappingInput,
 		ec.unmarshalInputDeleteCustomDomainInput,
 		ec.unmarshalInputDeleteDataProtectionImpactAssessmentInput,
@@ -10081,6 +10679,8 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputDeleteRiskObligationMappingInput,
 		ec.unmarshalInputDeleteSAMLConfigurationInput,
 		ec.unmarshalInputDeleteSnapshotInput,
+		ec.unmarshalInputDeleteStateOfApplicabilityControlMappingInput,
+		ec.unmarshalInputDeleteStateOfApplicabilityInput,
 		ec.unmarshalInputDeleteTaskInput,
 		ec.unmarshalInputDeleteTransferImpactAssessmentInput,
 		ec.unmarshalInputDeleteTrustCenterAccessInput,
@@ -10107,6 +10707,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputExportFrameworkInput,
 		ec.unmarshalInputExportProcessingActivitiesPDFInput,
 		ec.unmarshalInputExportSignableDocumentVersionPDFInput,
+		ec.unmarshalInputExportStateOfApplicabilityPDFInput,
 		ec.unmarshalInputExportTransferImpactAssessmentsPDFInput,
 		ec.unmarshalInputFrameworkOrder,
 		ec.unmarshalInputFulfillEvidenceInput,
@@ -10142,6 +10743,9 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputSendSigningNotificationsInput,
 		ec.unmarshalInputSignDocumentInput,
 		ec.unmarshalInputSnapshotOrder,
+		ec.unmarshalInputStateOfApplicabilityControlInput,
+		ec.unmarshalInputStateOfApplicabilityFilter,
+		ec.unmarshalInputStateOfApplicabilityOrder,
 		ec.unmarshalInputTaskOrder,
 		ec.unmarshalInputTransferImpactAssessmentFilter,
 		ec.unmarshalInputTransferImpactAssessmentOrder,
@@ -10171,6 +10775,7 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputUpdateRightsRequestInput,
 		ec.unmarshalInputUpdateRiskInput,
 		ec.unmarshalInputUpdateSAMLConfigurationInput,
+		ec.unmarshalInputUpdateStateOfApplicabilityInput,
 		ec.unmarshalInputUpdateTaskInput,
 		ec.unmarshalInputUpdateTransferImpactAssessmentInput,
 		ec.unmarshalInputUpdateTrustCenterAccessInput,
@@ -10519,6 +11124,14 @@ enum ObligationStatus
     @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationStatusCompliant")
 }
 
+enum ObligationType
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ObligationType") {
+  LEGAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeLegal")
+  CONTRACTUAL
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ObligationTypeContractual")
+}
+
 enum ContinualImprovementStatus
   @goModel(
     model: "go.probo.inc/probo/pkg/coredata.ContinualImprovementStatus"
@@ -11530,6 +12143,10 @@ enum SnapshotsType
     @goEnum(
       value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeProcessingActivities"
     )
+  STATES_OF_APPLICABILITY
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeStatesOfApplicability"
+    )
 }
 
 enum SnapshotOrderField
@@ -11862,6 +12479,10 @@ input DatumFilter {
   snapshotId: ID
 }
 
+input StateOfApplicabilityFilter {
+  snapshotId: ID
+}
+
 input NonconformityFilter {
   snapshotId: ID
 }
@@ -12010,6 +12631,15 @@ type Organization implements Node {
     orderBy: MeetingOrder
   ): MeetingConnection! @goField(forceResolver: true)
 
+  statesOfApplicability(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+    filter: StateOfApplicabilityFilter = { snapshotId: null }
+  ): StateOfApplicabilityConnection! @goField(forceResolver: true)
+
   measures(
     first: Int
     after: CursorKey
@@ -12367,6 +12997,7 @@ type Control implements Node
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 
   framework: Framework! @goField(forceResolver: true)
 
@@ -12396,6 +13027,15 @@ type Control implements Node
     orderBy: AuditOrder
   ): AuditConnection! @goField(forceResolver: true)
 
+  obligations(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ObligationOrder
+    filter: ObligationFilter
+  ): ObligationConnection! @goField(forceResolver: true)
+
   snapshots(
     first: Int
     after: CursorKey
@@ -12404,6 +13044,14 @@ type Control implements Node
     orderBy: SnapshotOrder
   ): SnapshotConnection! @goField(forceResolver: true)
 
+  stateOfApplicabilityControls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: StateOfApplicabilityOrder
+  ): StateOfApplicabilityControlConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -12561,6 +13209,26 @@ type Meeting implements Node {
   updatedAt: Datetime!
 }
 
+type StateOfApplicability implements Node {
+  id: ID!
+  name: String!
+  sourceId: ID
+  snapshotId: ID
+  organization: Organization @goField(forceResolver: true)
+  owner: People! @goField(forceResolver: true)
+  controls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: ControlOrder
+    filter: ControlFilter
+  ): ControlConnection! @goField(forceResolver: true)
+  availableControls: [AvailableStateOfApplicabilityControl!]! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
 type Risk implements Node {
   id: ID!
   snapshotId: ID
@@ -12676,6 +13344,7 @@ type Obligation implements Node {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -13130,6 +13799,20 @@ type MeetingEdge {
   node: Meeting!
 }
 
+type StateOfApplicabilityConnection
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityConnection"
+  ) {
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [StateOfApplicabilityEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityEdge {
+  cursor: CursorKey!
+  node: StateOfApplicability!
+}
+
 type RiskConnection
   @goModel(
     model: "go.probo.inc/probo/pkg/server/api/console/v1/types.RiskConnection"
@@ -13486,12 +14169,24 @@ type Mutation {
   deleteControlDocumentMapping(
     input: DeleteControlDocumentMappingInput!
   ): DeleteControlDocumentMappingPayload!
+  createStateOfApplicabilityControlMapping(
+    input: CreateStateOfApplicabilityControlMappingInput!
+  ): CreateStateOfApplicabilityControlMappingPayload!
+  deleteStateOfApplicabilityControlMapping(
+    input: DeleteStateOfApplicabilityControlMappingInput!
+  ): DeleteStateOfApplicabilityControlMappingPayload!
   createControlAuditMapping(
     input: CreateControlAuditMappingInput!
   ): CreateControlAuditMappingPayload!
   deleteControlAuditMapping(
     input: DeleteControlAuditMappingInput!
   ): DeleteControlAuditMappingPayload!
+  createControlObligationMapping(
+    input: CreateControlObligationMappingInput!
+  ): CreateControlObligationMappingPayload!
+  deleteControlObligationMapping(
+    input: DeleteControlObligationMappingInput!
+  ): DeleteControlObligationMappingPayload!
   createControlSnapshotMapping(
     input: CreateControlSnapshotMappingInput!
   ): CreateControlSnapshotMappingPayload!
@@ -13564,6 +14259,19 @@ type Mutation {
   createMeeting(input: CreateMeetingInput!): CreateMeetingPayload!
   updateMeeting(input: UpdateMeetingInput!): UpdateMeetingPayload!
   deleteMeeting(input: DeleteMeetingInput!): DeleteMeetingPayload!
+  # StateOfApplicability mutations
+  createStateOfApplicability(
+    input: CreateStateOfApplicabilityInput!
+  ): CreateStateOfApplicabilityPayload!
+  updateStateOfApplicability(
+    input: UpdateStateOfApplicabilityInput!
+  ): UpdateStateOfApplicabilityPayload!
+  deleteStateOfApplicability(
+    input: DeleteStateOfApplicabilityInput!
+  ): DeleteStateOfApplicabilityPayload!
+  exportStateOfApplicabilityPDF(
+    input: ExportStateOfApplicabilityPDFInput!
+  ): ExportStateOfApplicabilityPDFPayload!
   publishDocumentVersion(
     input: PublishDocumentVersionInput!
   ): PublishDocumentVersionPayload!
@@ -14057,6 +14765,18 @@ input DeleteControlDocumentMappingInput {
   documentId: ID!
 }
 
+input CreateStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+input DeleteStateOfApplicabilityControlMappingInput {
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+}
+
 input CreateControlAuditMappingInput {
   controlId: ID!
   auditId: ID!
@@ -14067,6 +14787,16 @@ input DeleteControlAuditMappingInput {
   auditId: ID!
 }
 
+input CreateControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
+input DeleteControlObligationMappingInput {
+  controlId: ID!
+  obligationId: ID!
+}
+
 input CreateControlSnapshotMappingInput {
   controlId: ID!
   snapshotId: ID!
@@ -14284,6 +15014,95 @@ input DeleteMeetingInput {
   meetingId: ID!
 }
 
+input CreateStateOfApplicabilityInput {
+  organizationId: ID!
+  name: String!
+  ownerId: ID!
+}
+
+input UpdateStateOfApplicabilityInput {
+  id: ID!
+  name: String
+  ownerId: ID
+}
+
+input StateOfApplicabilityControlInput {
+  controlId: ID!
+  applicability: Boolean!
+  justification: String
+}
+
+type AvailableStateOfApplicabilityControl {
+  controlId: ID!
+  sectionTitle: String!
+  name: String!
+  frameworkId: ID!
+  frameworkName: String!
+  organizationId: ID!
+  stateOfApplicabilityId: ID
+  applicability: Boolean
+  justification: String
+  bestPractice: Boolean!
+  regulatory: Boolean!
+  contractual: Boolean!
+  riskAssessment: Boolean!
+}
+
+input DeleteStateOfApplicabilityInput {
+  stateOfApplicabilityId: ID!
+}
+
+
+type StateOfApplicabilityControl {
+  id: ID!
+  stateOfApplicabilityId: ID!
+  controlId: ID!
+  stateOfApplicability: StateOfApplicability! @goField(forceResolver: true)
+  applicability: Boolean!
+  justification: String
+}
+
+type StateOfApplicabilityControlConnection @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlConnection") {
+  totalCount: Int!
+  edges: [StateOfApplicabilityControlEdge!]!
+  pageInfo: PageInfo!
+}
+
+type StateOfApplicabilityControlEdge @goModel(model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityControlEdge") {
+  cursor: CursorKey!
+  node: StateOfApplicabilityControl!
+}
+
+input ExportStateOfApplicabilityPDFInput {
+  stateOfApplicabilityId: ID!
+}
+
+type ExportStateOfApplicabilityPDFPayload {
+  data: String!
+}
+
+input StateOfApplicabilityOrder
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/api/console/v1/types.StateOfApplicabilityOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: StateOfApplicabilityOrderField!
+}
+
+enum StateOfApplicabilityOrderField
+  @goModel(
+    model: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderField"
+  ) {
+  NAME
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldName"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/coredata.StateOfApplicabilityOrderFieldCreatedAt"
+    )
+}
+
 input ConfirmEmailInput {
   token: String!
 }
@@ -14322,6 +15141,7 @@ input CreateControlInput {
   description: String
   status: ControlStatus!
   exclusionJustification: String
+  bestPractice: Boolean!
 }
 
 input UpdateControlInput {
@@ -14331,6 +15151,7 @@ input UpdateControlInput {
   description: String @goField(omittable: true)
   status: ControlStatus
   exclusionJustification: String
+  bestPractice: Boolean
 }
 
 input DeleteControlInput {
@@ -14414,6 +15235,7 @@ input CreateObligationInput {
   lastReviewDate: Datetime
   dueDate: Datetime
   status: ObligationStatus!
+  type: ObligationType!
 }
 
 input UpdateObligationInput {
@@ -14427,6 +15249,7 @@ input UpdateObligationInput {
   lastReviewDate: Datetime @goField(omittable: true)
   dueDate: Datetime @goField(omittable: true)
   status: ObligationStatus
+  type: ObligationType
 }
 
 input DeleteObligationInput {
@@ -14796,6 +15619,16 @@ type DeleteControlDocumentMappingPayload {
   deletedDocumentId: ID!
 }
 
+type CreateStateOfApplicabilityControlMappingPayload {
+  stateOfApplicabilityControlEdge: StateOfApplicabilityControlEdge!
+}
+
+type DeleteStateOfApplicabilityControlMappingPayload {
+  deletedStateOfApplicabilityId: ID!
+  deletedControlId: ID!
+  deletedStateOfApplicabilityControlId: ID!
+}
+
 type CreateControlAuditMappingPayload {
   controlEdge: ControlEdge!
   auditEdge: AuditEdge!
@@ -14806,6 +15639,16 @@ type DeleteControlAuditMappingPayload {
   deletedAuditId: ID!
 }
 
+type CreateControlObligationMappingPayload {
+  controlEdge: ControlEdge!
+  obligationEdge: ObligationEdge!
+}
+
+type DeleteControlObligationMappingPayload {
+  deletedControlId: ID!
+  deletedObligationId: ID!
+}
+
 type CreateControlSnapshotMappingPayload {
   controlEdge: ControlEdge!
   snapshotEdge: SnapshotEdge!
@@ -14951,6 +15794,18 @@ type DeleteMeetingPayload {
   deletedMeetingId: ID!
 }
 
+type CreateStateOfApplicabilityPayload {
+  stateOfApplicabilityEdge: StateOfApplicabilityEdge!
+}
+
+type UpdateStateOfApplicabilityPayload {
+  stateOfApplicability: StateOfApplicability!
+}
+
+type DeleteStateOfApplicabilityPayload {
+  deletedStateOfApplicabilityId: ID!
+}
+
 type ConfirmEmailPayload {
   success: Boolean!
 }
@@ -15895,6 +16750,42 @@ func (ec *executionContext) field_Control_measures_args(ctx context.Context, raw
 	return args, nil
 }
 
+func (ec *executionContext) field_Control_obligations_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOObligationOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐObligationOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	arg5, err := graphql.ProcessArgField(ctx, rawArgs, "filter", ec.unmarshalOObligationFilter2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐObligationFilter)
+	if err != nil {
+		return nil, err
+	}
+	args["filter"] = arg5
+	return args, nil
+}
+
 func (ec *executionContext) field_Control_snapshots_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -15926,6 +16817,37 @@ func (ec *executionContext) field_Control_snapshots_args(ctx context.Context, ra
 	return args, nil
 }
 
+func (ec *executionContext) field_Control_stateOfApplicabilityControls_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOStateOfApplicabilityOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
 func (ec *executionContext) field_Datum_vendors_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -16389,6 +17311,17 @@ func (ec *executionContext) field_Mutation_createControlMeasureMapping_args(ctx
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_createControlObligationMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNCreateControlObligationMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlObligationMappingInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_createControlSnapshotMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -16631,6 +17564,28 @@ func (ec *executionContext) field_Mutation_createSnapshot_args(ctx context.Conte
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_createStateOfApplicabilityControlMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNCreateStateOfApplicabilityControlMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityControlMappingInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
+func (ec *executionContext) field_Mutation_createStateOfApplicability_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNCreateStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_createTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -16807,6 +17762,17 @@ func (ec *executionContext) field_Mutation_deleteControlMeasureMapping_args(ctx
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_deleteControlObligationMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNDeleteControlObligationMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlObligationMappingInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_deleteControlSnapshotMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -17082,6 +18048,28 @@ func (ec *executionContext) field_Mutation_deleteSnapshot_args(ctx context.Conte
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_deleteStateOfApplicabilityControlMapping_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNDeleteStateOfApplicabilityControlMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityControlMappingInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
+func (ec *executionContext) field_Mutation_deleteStateOfApplicability_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNDeleteStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_deleteTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -17291,6 +18279,17 @@ func (ec *executionContext) field_Mutation_exportSignableVersionDocumentPDF_args
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_exportStateOfApplicabilityPDF_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNExportStateOfApplicabilityPDFInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportStateOfApplicabilityPDFInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_exportTransferImpactAssessmentsPDF_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -17665,6 +18664,17 @@ func (ec *executionContext) field_Mutation_updateSAMLConfiguration_args(ctx cont
 	return args, nil
 }
 
+func (ec *executionContext) field_Mutation_updateStateOfApplicability_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "input", ec.unmarshalNUpdateStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateStateOfApplicabilityInput)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+
 func (ec *executionContext) field_Mutation_updateTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -18543,6 +19553,42 @@ func (ec *executionContext) field_Organization_snapshots_args(ctx context.Contex
 	return args, nil
 }
 
+func (ec *executionContext) field_Organization_statesOfApplicability_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOStateOfApplicabilityOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	arg5, err := graphql.ProcessArgField(ctx, rawArgs, "filter", ec.unmarshalOStateOfApplicabilityFilter2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityFilter)
+	if err != nil {
+		return nil, err
+	}
+	args["filter"] = arg5
+	return args, nil
+}
+
 func (ec *executionContext) field_Organization_tasks_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -18946,224 +19992,260 @@ func (ec *executionContext) field_Snapshot_controls_args(ctx context.Context, ra
 	return args, nil
 }
 
-func (ec *executionContext) field_Task_evidences_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOEvidenceOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐEvidenceOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_TrustCenterAccess_availableDocumentAccesses_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterDocumentAccessOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_TrustCenter_accesses_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterAccessOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_TrustCenter_references_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterReferenceOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_Vendor_complianceReports_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorComplianceReportOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorComplianceReportOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_Vendor_contacts_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorContactOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorContactOrderBy)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_Vendor_riskAssessments_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
-	var err error
-	args := map[string]any{}
-	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["first"] = arg0
-	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["after"] = arg1
-	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
-	if err != nil {
-		return nil, err
-	}
-	args["last"] = arg2
-	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
-	if err != nil {
-		return nil, err
-	}
-	args["before"] = arg3
-	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorRiskAssessmentOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorRiskAssessmentOrder)
-	if err != nil {
-		return nil, err
-	}
-	args["orderBy"] = arg4
-	return args, nil
-}
-
-func (ec *executionContext) field_Vendor_services_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+func (ec *executionContext) field_StateOfApplicability_controls_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOControlOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐControlOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	arg5, err := graphql.ProcessArgField(ctx, rawArgs, "filter", ec.unmarshalOControlFilter2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐControlFilter)
+	if err != nil {
+		return nil, err
+	}
+	args["filter"] = arg5
+	return args, nil
+}
+
+func (ec *executionContext) field_Task_evidences_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOEvidenceOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐEvidenceOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_TrustCenterAccess_availableDocumentAccesses_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterDocumentAccessOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_TrustCenter_accesses_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterAccessOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_TrustCenter_references_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOTrustCenterReferenceOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_Vendor_complianceReports_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorComplianceReportOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorComplianceReportOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_Vendor_contacts_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorContactOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorContactOrderBy)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_Vendor_riskAssessments_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	arg4, err := graphql.ProcessArgField(ctx, rawArgs, "orderBy", ec.unmarshalOVendorRiskAssessmentOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐVendorRiskAssessmentOrder)
+	if err != nil {
+		return nil, err
+	}
+	args["orderBy"] = arg4
+	return args, nil
+}
+
+func (ec *executionContext) field_Vendor_services_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
 	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
@@ -19800,6 +20882,8 @@ func (ec *executionContext) fieldContext_Asset_organization(_ context.Context, f
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -20208,6 +21292,8 @@ func (ec *executionContext) fieldContext_Audit_organization(_ context.Context, f
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -20794,6 +21880,383 @@ func (ec *executionContext) fieldContext_AuditEdge_node(_ context.Context, field
 	return fc, nil
 }
 
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_controlId(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_controlId,
+		func(ctx context.Context) (any, error) {
+			return obj.ControlID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_controlId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_sectionTitle(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_sectionTitle,
+		func(ctx context.Context) (any, error) {
+			return obj.SectionTitle, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_sectionTitle(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_name(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_name,
+		func(ctx context.Context) (any, error) {
+			return obj.Name, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_name(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_frameworkId(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_frameworkId,
+		func(ctx context.Context) (any, error) {
+			return obj.FrameworkID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_frameworkId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_frameworkName(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_frameworkName,
+		func(ctx context.Context) (any, error) {
+			return obj.FrameworkName, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_frameworkName(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_organizationId(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_organizationId,
+		func(ctx context.Context) (any, error) {
+			return obj.OrganizationID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_organizationId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_stateOfApplicabilityId(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_stateOfApplicabilityId,
+		func(ctx context.Context) (any, error) {
+			return obj.StateOfApplicabilityID, nil
+		},
+		nil,
+		ec.marshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_stateOfApplicabilityId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_applicability(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_applicability,
+		func(ctx context.Context) (any, error) {
+			return obj.Applicability, nil
+		},
+		nil,
+		ec.marshalOBoolean2ᚖbool,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_applicability(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_justification(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_justification,
+		func(ctx context.Context) (any, error) {
+			return obj.Justification, nil
+		},
+		nil,
+		ec.marshalOString2ᚖstring,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_justification(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_bestPractice(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_bestPractice,
+		func(ctx context.Context) (any, error) {
+			return obj.BestPractice, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_bestPractice(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_regulatory(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_regulatory,
+		func(ctx context.Context) (any, error) {
+			return obj.Regulatory, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_regulatory(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_contractual(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_contractual,
+		func(ctx context.Context) (any, error) {
+			return obj.Contractual, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_contractual(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl_riskAssessment(ctx context.Context, field graphql.CollectedField, obj *types.AvailableStateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_AvailableStateOfApplicabilityControl_riskAssessment,
+		func(ctx context.Context) (any, error) {
+			return obj.RiskAssessment, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_AvailableStateOfApplicabilityControl_riskAssessment(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "AvailableStateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _BulkDeleteDocumentsPayload_deletedDocumentIds(ctx context.Context, field graphql.CollectedField, obj *types.BulkDeleteDocumentsPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -21162,6 +22625,8 @@ func (ec *executionContext) fieldContext_ContinualImprovement_organization(_ con
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -21855,6 +23320,35 @@ func (ec *executionContext) fieldContext_Control_exclusionJustification(_ contex
 	return fc, nil
 }
 
+func (ec *executionContext) _Control_bestPractice(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Control_bestPractice,
+		func(ctx context.Context) (any, error) {
+			return obj.BestPractice, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Control_bestPractice(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Control",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Control_framework(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -22051,6 +23545,55 @@ func (ec *executionContext) fieldContext_Control_audits(ctx context.Context, fie
 	return fc, nil
 }
 
+func (ec *executionContext) _Control_obligations(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Control_obligations,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Control().Obligations(ctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.ObligationOrderBy), fc.Args["filter"].(*types.ObligationFilter))
+		},
+		nil,
+		ec.marshalNObligationConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐObligationConnection,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Control_obligations(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Control",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "totalCount":
+				return ec.fieldContext_ObligationConnection_totalCount(ctx, field)
+			case "edges":
+				return ec.fieldContext_ObligationConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_ObligationConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ObligationConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Control_obligations_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Control_snapshots(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -22100,6 +23643,55 @@ func (ec *executionContext) fieldContext_Control_snapshots(ctx context.Context,
 	return fc, nil
 }
 
+func (ec *executionContext) _Control_stateOfApplicabilityControls(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Control_stateOfApplicabilityControls,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Control().StateOfApplicabilityControls(ctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.StateOfApplicabilityOrderBy))
+		},
+		nil,
+		ec.marshalNStateOfApplicabilityControlConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlConnection,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Control_stateOfApplicabilityControls(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Control",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "totalCount":
+				return ec.fieldContext_StateOfApplicabilityControlConnection_totalCount(ctx, field)
+			case "edges":
+				return ec.fieldContext_StateOfApplicabilityControlConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_StateOfApplicabilityControlConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityControlConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Control_stateOfApplicabilityControls_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Control_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Control) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -22326,6 +23918,8 @@ func (ec *executionContext) fieldContext_ControlEdge_node(_ context.Context, fie
 				return ec.fieldContext_Control_status(ctx, field)
 			case "exclusionJustification":
 				return ec.fieldContext_Control_exclusionJustification(ctx, field)
+			case "bestPractice":
+				return ec.fieldContext_Control_bestPractice(ctx, field)
 			case "framework":
 				return ec.fieldContext_Control_framework(ctx, field)
 			case "measures":
@@ -22334,8 +23928,12 @@ func (ec *executionContext) fieldContext_ControlEdge_node(_ context.Context, fie
 				return ec.fieldContext_Control_documents(ctx, field)
 			case "audits":
 				return ec.fieldContext_Control_audits(ctx, field)
+			case "obligations":
+				return ec.fieldContext_Control_obligations(ctx, field)
 			case "snapshots":
 				return ec.fieldContext_Control_snapshots(ctx, field)
+			case "stateOfApplicabilityControls":
+				return ec.fieldContext_Control_stateOfApplicabilityControls(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Control_createdAt(ctx, field)
 			case "updatedAt":
@@ -22662,6 +24260,76 @@ func (ec *executionContext) fieldContext_CreateControlMeasureMappingPayload_meas
 	return fc, nil
 }
 
+func (ec *executionContext) _CreateControlObligationMappingPayload_controlEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateControlObligationMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_CreateControlObligationMappingPayload_controlEdge,
+		func(ctx context.Context) (any, error) {
+			return obj.ControlEdge, nil
+		},
+		nil,
+		ec.marshalNControlEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐControlEdge,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_CreateControlObligationMappingPayload_controlEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreateControlObligationMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_ControlEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_ControlEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ControlEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _CreateControlObligationMappingPayload_obligationEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateControlObligationMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_CreateControlObligationMappingPayload_obligationEdge,
+		func(ctx context.Context) (any, error) {
+			return obj.ObligationEdge, nil
+		},
+		nil,
+		ec.marshalNObligationEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐObligationEdge,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_CreateControlObligationMappingPayload_obligationEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreateControlObligationMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_ObligationEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_ObligationEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ObligationEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _CreateControlPayload_controlEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateControlPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -23712,6 +25380,76 @@ func (ec *executionContext) fieldContext_CreateSnapshotPayload_snapshotEdge(_ co
 	return fc, nil
 }
 
+func (ec *executionContext) _CreateStateOfApplicabilityControlMappingPayload_stateOfApplicabilityControlEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateStateOfApplicabilityControlMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_CreateStateOfApplicabilityControlMappingPayload_stateOfApplicabilityControlEdge,
+		func(ctx context.Context) (any, error) {
+			return obj.StateOfApplicabilityControlEdge, nil
+		},
+		nil,
+		ec.marshalNStateOfApplicabilityControlEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlEdge,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_CreateStateOfApplicabilityControlMappingPayload_stateOfApplicabilityControlEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreateStateOfApplicabilityControlMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_StateOfApplicabilityControlEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_StateOfApplicabilityControlEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityControlEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _CreateStateOfApplicabilityPayload_stateOfApplicabilityEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateStateOfApplicabilityPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_CreateStateOfApplicabilityPayload_stateOfApplicabilityEdge,
+		func(ctx context.Context) (any, error) {
+			return obj.StateOfApplicabilityEdge, nil
+		},
+		nil,
+		ec.marshalNStateOfApplicabilityEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityEdge,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_CreateStateOfApplicabilityPayload_stateOfApplicabilityEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreateStateOfApplicabilityPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_StateOfApplicabilityEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_StateOfApplicabilityEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _CreateTaskPayload_taskEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateTaskPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -24132,6 +25870,8 @@ func (ec *executionContext) fieldContext_CustomDomain_organization(_ context.Con
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -24686,6 +26426,8 @@ func (ec *executionContext) fieldContext_DataProtectionImpactAssessment_organiza
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -25395,6 +27137,8 @@ func (ec *executionContext) fieldContext_Datum_organization(_ context.Context, f
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -25999,6 +27743,64 @@ func (ec *executionContext) fieldContext_DeleteControlMeasureMappingPayload_dele
 	return fc, nil
 }
 
+func (ec *executionContext) _DeleteControlObligationMappingPayload_deletedControlId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteControlObligationMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteControlObligationMappingPayload_deletedControlId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedControlID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteControlObligationMappingPayload_deletedControlId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteControlObligationMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _DeleteControlObligationMappingPayload_deletedObligationId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteControlObligationMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteControlObligationMappingPayload_deletedObligationId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedObligationID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteControlObligationMappingPayload_deletedObligationId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteControlObligationMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _DeleteControlPayload_deletedControlId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteControlPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -26494,6 +28296,8 @@ func (ec *executionContext) fieldContext_DeleteOrganizationHorizontalLogoPayload
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -26918,6 +28722,122 @@ func (ec *executionContext) fieldContext_DeleteSnapshotPayload_deletedSnapshotId
 	return fc, nil
 }
 
+func (ec *executionContext) _DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteStateOfApplicabilityControlMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedStateOfApplicabilityID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteStateOfApplicabilityControlMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _DeleteStateOfApplicabilityControlMappingPayload_deletedControlId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteStateOfApplicabilityControlMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedControlId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedControlID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedControlId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteStateOfApplicabilityControlMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityControlId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteStateOfApplicabilityControlMappingPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityControlId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedStateOfApplicabilityControlID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityControlId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteStateOfApplicabilityControlMappingPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _DeleteStateOfApplicabilityPayload_deletedStateOfApplicabilityId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteStateOfApplicabilityPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_DeleteStateOfApplicabilityPayload_deletedStateOfApplicabilityId,
+		func(ctx context.Context) (any, error) {
+			return obj.DeletedStateOfApplicabilityID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_DeleteStateOfApplicabilityPayload_deletedStateOfApplicabilityId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeleteStateOfApplicabilityPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _DeleteTaskPayload_deletedTaskId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteTaskPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -27677,6 +29597,8 @@ func (ec *executionContext) fieldContext_Document_organization(_ context.Context
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -29929,6 +31851,35 @@ func (ec *executionContext) fieldContext_ExportSignableDocumentVersionPDFPayload
 	return fc, nil
 }
 
+func (ec *executionContext) _ExportStateOfApplicabilityPDFPayload_data(ctx context.Context, field graphql.CollectedField, obj *types.ExportStateOfApplicabilityPDFPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ExportStateOfApplicabilityPDFPayload_data,
+		func(ctx context.Context) (any, error) {
+			return obj.Data, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ExportStateOfApplicabilityPDFPayload_data(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ExportStateOfApplicabilityPDFPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _ExportTransferImpactAssessmentsPDFPayload_data(ctx context.Context, field graphql.CollectedField, obj *types.ExportTransferImpactAssessmentsPDFPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -30308,6 +32259,8 @@ func (ec *executionContext) fieldContext_Framework_organization(_ context.Contex
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -31309,6 +33262,8 @@ func (ec *executionContext) fieldContext_Invitation_organization(_ context.Conte
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -32383,6 +34338,8 @@ func (ec *executionContext) fieldContext_Meeting_organization(_ context.Context,
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -35502,6 +37459,100 @@ func (ec *executionContext) fieldContext_Mutation_deleteControlDocumentMapping(c
 	return fc, nil
 }
 
+func (ec *executionContext) _Mutation_createStateOfApplicabilityControlMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_createStateOfApplicabilityControlMapping,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().CreateStateOfApplicabilityControlMapping(ctx, fc.Args["input"].(types.CreateStateOfApplicabilityControlMappingInput))
+		},
+		nil,
+		ec.marshalNCreateStateOfApplicabilityControlMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityControlMappingPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_createStateOfApplicabilityControlMapping(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "stateOfApplicabilityControlEdge":
+				return ec.fieldContext_CreateStateOfApplicabilityControlMappingPayload_stateOfApplicabilityControlEdge(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type CreateStateOfApplicabilityControlMappingPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_createStateOfApplicabilityControlMapping_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_deleteStateOfApplicabilityControlMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_deleteStateOfApplicabilityControlMapping,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().DeleteStateOfApplicabilityControlMapping(ctx, fc.Args["input"].(types.DeleteStateOfApplicabilityControlMappingInput))
+		},
+		nil,
+		ec.marshalNDeleteStateOfApplicabilityControlMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityControlMappingPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_deleteStateOfApplicabilityControlMapping(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "deletedStateOfApplicabilityId":
+				return ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityId(ctx, field)
+			case "deletedControlId":
+				return ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedControlId(ctx, field)
+			case "deletedStateOfApplicabilityControlId":
+				return ec.fieldContext_DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityControlId(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type DeleteStateOfApplicabilityControlMappingPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_deleteStateOfApplicabilityControlMapping_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Mutation_createControlAuditMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -35596,6 +37647,100 @@ func (ec *executionContext) fieldContext_Mutation_deleteControlAuditMapping(ctx
 	return fc, nil
 }
 
+func (ec *executionContext) _Mutation_createControlObligationMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_createControlObligationMapping,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().CreateControlObligationMapping(ctx, fc.Args["input"].(types.CreateControlObligationMappingInput))
+		},
+		nil,
+		ec.marshalNCreateControlObligationMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlObligationMappingPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_createControlObligationMapping(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "controlEdge":
+				return ec.fieldContext_CreateControlObligationMappingPayload_controlEdge(ctx, field)
+			case "obligationEdge":
+				return ec.fieldContext_CreateControlObligationMappingPayload_obligationEdge(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type CreateControlObligationMappingPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_createControlObligationMapping_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_deleteControlObligationMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_deleteControlObligationMapping,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().DeleteControlObligationMapping(ctx, fc.Args["input"].(types.DeleteControlObligationMappingInput))
+		},
+		nil,
+		ec.marshalNDeleteControlObligationMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlObligationMappingPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_deleteControlObligationMapping(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "deletedControlId":
+				return ec.fieldContext_DeleteControlObligationMappingPayload_deletedControlId(ctx, field)
+			case "deletedObligationId":
+				return ec.fieldContext_DeleteControlObligationMappingPayload_deletedObligationId(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type DeleteControlObligationMappingPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_deleteControlObligationMapping_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Mutation_createControlSnapshotMapping(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -36964,6 +39109,186 @@ func (ec *executionContext) fieldContext_Mutation_deleteMeeting(ctx context.Cont
 	return fc, nil
 }
 
+func (ec *executionContext) _Mutation_createStateOfApplicability(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_createStateOfApplicability,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().CreateStateOfApplicability(ctx, fc.Args["input"].(types.CreateStateOfApplicabilityInput))
+		},
+		nil,
+		ec.marshalNCreateStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_createStateOfApplicability(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "stateOfApplicabilityEdge":
+				return ec.fieldContext_CreateStateOfApplicabilityPayload_stateOfApplicabilityEdge(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type CreateStateOfApplicabilityPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_createStateOfApplicability_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_updateStateOfApplicability(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_updateStateOfApplicability,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().UpdateStateOfApplicability(ctx, fc.Args["input"].(types.UpdateStateOfApplicabilityInput))
+		},
+		nil,
+		ec.marshalNUpdateStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateStateOfApplicabilityPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_updateStateOfApplicability(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "stateOfApplicability":
+				return ec.fieldContext_UpdateStateOfApplicabilityPayload_stateOfApplicability(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type UpdateStateOfApplicabilityPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_updateStateOfApplicability_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_deleteStateOfApplicability(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_deleteStateOfApplicability,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().DeleteStateOfApplicability(ctx, fc.Args["input"].(types.DeleteStateOfApplicabilityInput))
+		},
+		nil,
+		ec.marshalNDeleteStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_deleteStateOfApplicability(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "deletedStateOfApplicabilityId":
+				return ec.fieldContext_DeleteStateOfApplicabilityPayload_deletedStateOfApplicabilityId(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type DeleteStateOfApplicabilityPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_deleteStateOfApplicability_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_exportStateOfApplicabilityPDF(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Mutation_exportStateOfApplicabilityPDF,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Mutation().ExportStateOfApplicabilityPDF(ctx, fc.Args["input"].(types.ExportStateOfApplicabilityPDFInput))
+		},
+		nil,
+		ec.marshalNExportStateOfApplicabilityPDFPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportStateOfApplicabilityPDFPayload,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Mutation_exportStateOfApplicabilityPDF(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "data":
+				return ec.fieldContext_ExportStateOfApplicabilityPDFPayload_data(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ExportStateOfApplicabilityPDFPayload", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_exportStateOfApplicabilityPDF_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Mutation_publishDocumentVersion(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -39925,6 +42250,8 @@ func (ec *executionContext) fieldContext_Nonconformity_organization(_ context.Co
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -40710,6 +43037,8 @@ func (ec *executionContext) fieldContext_Obligation_organization(_ context.Conte
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -41040,6 +43369,35 @@ func (ec *executionContext) fieldContext_Obligation_status(_ context.Context, fi
 	return fc, nil
 }
 
+func (ec *executionContext) _Obligation_type(ctx context.Context, field graphql.CollectedField, obj *types.Obligation) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Obligation_type,
+		func(ctx context.Context) (any, error) {
+			return obj.Type, nil
+		},
+		nil,
+		ec.marshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Obligation_type(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Obligation",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ObligationType does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Obligation_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Obligation) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -41280,6 +43638,8 @@ func (ec *executionContext) fieldContext_ObligationEdge_node(_ context.Context,
 				return ec.fieldContext_Obligation_dueDate(ctx, field)
 			case "status":
 				return ec.fieldContext_Obligation_status(ctx, field)
+			case "type":
+				return ec.fieldContext_Obligation_type(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Obligation_createdAt(ctx, field)
 			case "updatedAt":
@@ -41997,6 +44357,55 @@ func (ec *executionContext) fieldContext_Organization_meetings(ctx context.Conte
 	return fc, nil
 }
 
+func (ec *executionContext) _Organization_statesOfApplicability(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Organization_statesOfApplicability,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.Organization().StatesOfApplicability(ctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.StateOfApplicabilityOrderBy), fc.Args["filter"].(*types.StateOfApplicabilityFilter))
+		},
+		nil,
+		ec.marshalNStateOfApplicabilityConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityConnection,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Organization_statesOfApplicability(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Organization",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "totalCount":
+				return ec.fieldContext_StateOfApplicabilityConnection_totalCount(ctx, field)
+			case "edges":
+				return ec.fieldContext_StateOfApplicabilityConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_StateOfApplicabilityConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Organization_statesOfApplicability_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Organization_measures(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -43184,6 +45593,8 @@ func (ec *executionContext) fieldContext_OrganizationEdge_node(_ context.Context
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -43967,6 +46378,8 @@ func (ec *executionContext) fieldContext_ProcessingActivity_organization(_ conte
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -45798,6 +48211,8 @@ func (ec *executionContext) fieldContext_RightsRequest_organization(_ context.Co
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -46779,6 +49194,8 @@ func (ec *executionContext) fieldContext_Risk_organization(_ context.Context, fi
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -47374,6 +49791,8 @@ func (ec *executionContext) fieldContext_SAMLConfiguration_organization(_ contex
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -48973,6 +51392,8 @@ func (ec *executionContext) fieldContext_Snapshot_organization(_ context.Context
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -49149,19 +51570,607 @@ func (ec *executionContext) fieldContext_Snapshot_controls(ctx context.Context,
 		}
 	}()
 	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Snapshot_controls_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+	if fc.Args, err = ec.field_Snapshot_controls_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Snapshot_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Snapshot) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_Snapshot_createdAt,
+		func(ctx context.Context) (any, error) {
+			return obj.CreatedAt, nil
+		},
+		nil,
+		ec.marshalNDatetime2timeᚐTime,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_Snapshot_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Snapshot",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _SnapshotConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_SnapshotConnection_totalCount,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.SnapshotConnection().TotalCount(ctx, obj)
+		},
+		nil,
+		ec.marshalNInt2int,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_SnapshotConnection_totalCount(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "SnapshotConnection",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _SnapshotConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_SnapshotConnection_edges,
+		func(ctx context.Context) (any, error) {
+			return obj.Edges, nil
+		},
+		nil,
+		ec.marshalNSnapshotEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐSnapshotEdgeᚄ,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_SnapshotConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "SnapshotConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_SnapshotEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_SnapshotEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type SnapshotEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _SnapshotConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_SnapshotConnection_pageInfo,
+		func(ctx context.Context) (any, error) {
+			return obj.PageInfo, nil
+		},
+		nil,
+		ec.marshalNPageInfo2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐPageInfo,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_SnapshotConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "SnapshotConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _SnapshotEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_SnapshotEdge_cursor,
+		func(ctx context.Context) (any, error) {
+			return obj.Cursor, nil
+		},
+		nil,
+		ec.marshalNCursorKey2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_SnapshotEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "SnapshotEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type CursorKey does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _SnapshotEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_SnapshotEdge_node,
+		func(ctx context.Context) (any, error) {
+			return obj.Node, nil
+		},
+		nil,
+		ec.marshalNSnapshot2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐSnapshot,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_SnapshotEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "SnapshotEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Snapshot_id(ctx, field)
+			case "organization":
+				return ec.fieldContext_Snapshot_organization(ctx, field)
+			case "name":
+				return ec.fieldContext_Snapshot_name(ctx, field)
+			case "description":
+				return ec.fieldContext_Snapshot_description(ctx, field)
+			case "type":
+				return ec.fieldContext_Snapshot_type(ctx, field)
+			case "controls":
+				return ec.fieldContext_Snapshot_controls(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Snapshot_createdAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Snapshot", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_id(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_id,
+		func(ctx context.Context) (any, error) {
+			return obj.ID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_name(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_name,
+		func(ctx context.Context) (any, error) {
+			return obj.Name, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_name(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_sourceId(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_sourceId,
+		func(ctx context.Context) (any, error) {
+			return obj.SourceID, nil
+		},
+		nil,
+		ec.marshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_sourceId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_snapshotId(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_snapshotId,
+		func(ctx context.Context) (any, error) {
+			return obj.SnapshotID, nil
+		},
+		nil,
+		ec.marshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_snapshotId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_organization(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_organization,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.StateOfApplicability().Organization(ctx, obj)
+		},
+		nil,
+		ec.marshalOOrganization2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrganization,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_organization(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Organization_id(ctx, field)
+			case "name":
+				return ec.fieldContext_Organization_name(ctx, field)
+			case "logoUrl":
+				return ec.fieldContext_Organization_logoUrl(ctx, field)
+			case "horizontalLogoUrl":
+				return ec.fieldContext_Organization_horizontalLogoUrl(ctx, field)
+			case "description":
+				return ec.fieldContext_Organization_description(ctx, field)
+			case "websiteUrl":
+				return ec.fieldContext_Organization_websiteUrl(ctx, field)
+			case "email":
+				return ec.fieldContext_Organization_email(ctx, field)
+			case "headquarterAddress":
+				return ec.fieldContext_Organization_headquarterAddress(ctx, field)
+			case "context":
+				return ec.fieldContext_Organization_context(ctx, field)
+			case "memberships":
+				return ec.fieldContext_Organization_memberships(ctx, field)
+			case "invitations":
+				return ec.fieldContext_Organization_invitations(ctx, field)
+			case "slackConnections":
+				return ec.fieldContext_Organization_slackConnections(ctx, field)
+			case "frameworks":
+				return ec.fieldContext_Organization_frameworks(ctx, field)
+			case "controls":
+				return ec.fieldContext_Organization_controls(ctx, field)
+			case "vendors":
+				return ec.fieldContext_Organization_vendors(ctx, field)
+			case "peoples":
+				return ec.fieldContext_Organization_peoples(ctx, field)
+			case "documents":
+				return ec.fieldContext_Organization_documents(ctx, field)
+			case "meetings":
+				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
+			case "measures":
+				return ec.fieldContext_Organization_measures(ctx, field)
+			case "risks":
+				return ec.fieldContext_Organization_risks(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Organization_tasks(ctx, field)
+			case "assets":
+				return ec.fieldContext_Organization_assets(ctx, field)
+			case "data":
+				return ec.fieldContext_Organization_data(ctx, field)
+			case "audits":
+				return ec.fieldContext_Organization_audits(ctx, field)
+			case "nonconformities":
+				return ec.fieldContext_Organization_nonconformities(ctx, field)
+			case "obligations":
+				return ec.fieldContext_Organization_obligations(ctx, field)
+			case "continualImprovements":
+				return ec.fieldContext_Organization_continualImprovements(ctx, field)
+			case "rightsRequests":
+				return ec.fieldContext_Organization_rightsRequests(ctx, field)
+			case "processingActivities":
+				return ec.fieldContext_Organization_processingActivities(ctx, field)
+			case "dataProtectionImpactAssessments":
+				return ec.fieldContext_Organization_dataProtectionImpactAssessments(ctx, field)
+			case "transferImpactAssessments":
+				return ec.fieldContext_Organization_transferImpactAssessments(ctx, field)
+			case "snapshots":
+				return ec.fieldContext_Organization_snapshots(ctx, field)
+			case "trustCenterFiles":
+				return ec.fieldContext_Organization_trustCenterFiles(ctx, field)
+			case "trustCenter":
+				return ec.fieldContext_Organization_trustCenter(ctx, field)
+			case "customDomain":
+				return ec.fieldContext_Organization_customDomain(ctx, field)
+			case "samlConfigurations":
+				return ec.fieldContext_Organization_samlConfigurations(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Organization_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Organization_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Organization", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_owner(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_owner,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.StateOfApplicability().Owner(ctx, obj)
+		},
+		nil,
+		ec.marshalNPeople2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐPeople,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_owner(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_People_id(ctx, field)
+			case "fullName":
+				return ec.fieldContext_People_fullName(ctx, field)
+			case "primaryEmailAddress":
+				return ec.fieldContext_People_primaryEmailAddress(ctx, field)
+			case "additionalEmailAddresses":
+				return ec.fieldContext_People_additionalEmailAddresses(ctx, field)
+			case "kind":
+				return ec.fieldContext_People_kind(ctx, field)
+			case "position":
+				return ec.fieldContext_People_position(ctx, field)
+			case "contractStartDate":
+				return ec.fieldContext_People_contractStartDate(ctx, field)
+			case "contractEndDate":
+				return ec.fieldContext_People_contractEndDate(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_People_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_People_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type People", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_controls(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_controls,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.resolvers.StateOfApplicability().Controls(ctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey), fc.Args["orderBy"].(*types.ControlOrderBy), fc.Args["filter"].(*types.ControlFilter))
+		},
+		nil,
+		ec.marshalNControlConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐControlConnection,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_controls(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "totalCount":
+				return ec.fieldContext_ControlConnection_totalCount(ctx, field)
+			case "edges":
+				return ec.fieldContext_ControlConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_ControlConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ControlConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_StateOfApplicability_controls_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
 		return fc, err
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Snapshot_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Snapshot) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicability_availableControls(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_Snapshot_createdAt,
+		ec.fieldContext_StateOfApplicability_availableControls,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.StateOfApplicability().AvailableControls(ctx, obj)
+		},
+		nil,
+		ec.marshalNAvailableStateOfApplicabilityControl2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐAvailableStateOfApplicabilityControlᚄ,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_availableControls(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "controlId":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_controlId(ctx, field)
+			case "sectionTitle":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_sectionTitle(ctx, field)
+			case "name":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_name(ctx, field)
+			case "frameworkId":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_frameworkId(ctx, field)
+			case "frameworkName":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_frameworkName(ctx, field)
+			case "organizationId":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_organizationId(ctx, field)
+			case "stateOfApplicabilityId":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_stateOfApplicabilityId(ctx, field)
+			case "applicability":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_applicability(ctx, field)
+			case "justification":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_justification(ctx, field)
+			case "bestPractice":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_bestPractice(ctx, field)
+			case "regulatory":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_regulatory(ctx, field)
+			case "contractual":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_contractual(ctx, field)
+			case "riskAssessment":
+				return ec.fieldContext_AvailableStateOfApplicabilityControl_riskAssessment(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type AvailableStateOfApplicabilityControl", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicability_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicability_createdAt,
 		func(ctx context.Context) (any, error) {
 			return obj.CreatedAt, nil
 		},
@@ -49172,9 +52181,9 @@ func (ec *executionContext) _Snapshot_createdAt(ctx context.Context, field graph
 	)
 }
 
-func (ec *executionContext) fieldContext_Snapshot_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicability_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Snapshot",
+		Object:     "StateOfApplicability",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -49185,14 +52194,43 @@ func (ec *executionContext) fieldContext_Snapshot_createdAt(_ context.Context, f
 	return fc, nil
 }
 
-func (ec *executionContext) _SnapshotConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicability_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicability) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_SnapshotConnection_totalCount,
+		ec.fieldContext_StateOfApplicability_updatedAt,
 		func(ctx context.Context) (any, error) {
-			return ec.resolvers.SnapshotConnection().TotalCount(ctx, obj)
+			return obj.UpdatedAt, nil
+		},
+		nil,
+		ec.marshalNDatetime2timeᚐTime,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicability_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicability",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityConnection_totalCount,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.StateOfApplicabilityConnection().TotalCount(ctx, obj)
 		},
 		nil,
 		ec.marshalNInt2int,
@@ -49201,9 +52239,9 @@ func (ec *executionContext) _SnapshotConnection_totalCount(ctx context.Context,
 	)
 }
 
-func (ec *executionContext) fieldContext_SnapshotConnection_totalCount(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicabilityConnection_totalCount(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "SnapshotConnection",
+		Object:     "StateOfApplicabilityConnection",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: true,
@@ -49214,47 +52252,47 @@ func (ec *executionContext) fieldContext_SnapshotConnection_totalCount(_ context
 	return fc, nil
 }
 
-func (ec *executionContext) _SnapshotConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicabilityConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_SnapshotConnection_edges,
+		ec.fieldContext_StateOfApplicabilityConnection_edges,
 		func(ctx context.Context) (any, error) {
 			return obj.Edges, nil
 		},
 		nil,
-		ec.marshalNSnapshotEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐSnapshotEdgeᚄ,
+		ec.marshalNStateOfApplicabilityEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityEdgeᚄ,
 		true,
 		true,
 	)
 }
 
-func (ec *executionContext) fieldContext_SnapshotConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicabilityConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "SnapshotConnection",
+		Object:     "StateOfApplicabilityConnection",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "cursor":
-				return ec.fieldContext_SnapshotEdge_cursor(ctx, field)
+				return ec.fieldContext_StateOfApplicabilityEdge_cursor(ctx, field)
 			case "node":
-				return ec.fieldContext_SnapshotEdge_node(ctx, field)
+				return ec.fieldContext_StateOfApplicabilityEdge_node(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type SnapshotEdge", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityEdge", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _SnapshotConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotConnection) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicabilityConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityConnection) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_SnapshotConnection_pageInfo,
+		ec.fieldContext_StateOfApplicabilityConnection_pageInfo,
 		func(ctx context.Context) (any, error) {
 			return obj.PageInfo, nil
 		},
@@ -49265,9 +52303,9 @@ func (ec *executionContext) _SnapshotConnection_pageInfo(ctx context.Context, fi
 	)
 }
 
-func (ec *executionContext) fieldContext_SnapshotConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicabilityConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "SnapshotConnection",
+		Object:     "StateOfApplicabilityConnection",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -49288,12 +52326,311 @@ func (ec *executionContext) fieldContext_SnapshotConnection_pageInfo(_ context.C
 	return fc, nil
 }
 
-func (ec *executionContext) _SnapshotEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotEdge) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicabilityControl_id(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_SnapshotEdge_cursor,
+		ec.fieldContext_StateOfApplicabilityControl_id,
+		func(ctx context.Context) (any, error) {
+			return obj.ID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControl_stateOfApplicabilityId(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControl_stateOfApplicabilityId,
+		func(ctx context.Context) (any, error) {
+			return obj.StateOfApplicabilityID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_stateOfApplicabilityId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControl_controlId(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControl_controlId,
+		func(ctx context.Context) (any, error) {
+			return obj.ControlID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_controlId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControl_stateOfApplicability(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControl_stateOfApplicability,
+		func(ctx context.Context) (any, error) {
+			return ec.resolvers.StateOfApplicabilityControl().StateOfApplicability(ctx, obj)
+		},
+		nil,
+		ec.marshalNStateOfApplicability2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicability,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_stateOfApplicability(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_StateOfApplicability_id(ctx, field)
+			case "name":
+				return ec.fieldContext_StateOfApplicability_name(ctx, field)
+			case "sourceId":
+				return ec.fieldContext_StateOfApplicability_sourceId(ctx, field)
+			case "snapshotId":
+				return ec.fieldContext_StateOfApplicability_snapshotId(ctx, field)
+			case "organization":
+				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
+			case "owner":
+				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
+			case "controls":
+				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
+			case "availableControls":
+				return ec.fieldContext_StateOfApplicability_availableControls(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_StateOfApplicability_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_StateOfApplicability_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicability", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControl_applicability(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControl_applicability,
+		func(ctx context.Context) (any, error) {
+			return obj.Applicability, nil
+		},
+		nil,
+		ec.marshalNBoolean2bool,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_applicability(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControl_justification(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControl) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControl_justification,
+		func(ctx context.Context) (any, error) {
+			return obj.Justification, nil
+		},
+		nil,
+		ec.marshalOString2ᚖstring,
+		true,
+		false,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControl_justification(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControl",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControlConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControlConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControlConnection_totalCount,
+		func(ctx context.Context) (any, error) {
+			return obj.TotalCount, nil
+		},
+		nil,
+		ec.marshalNInt2int,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControlConnection_totalCount(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControlConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControlConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControlConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControlConnection_edges,
+		func(ctx context.Context) (any, error) {
+			return obj.Edges, nil
+		},
+		nil,
+		ec.marshalNStateOfApplicabilityControlEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlEdgeᚄ,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControlConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControlConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_StateOfApplicabilityControlEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_StateOfApplicabilityControlEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityControlEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControlConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControlConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControlConnection_pageInfo,
+		func(ctx context.Context) (any, error) {
+			return obj.PageInfo, nil
+		},
+		nil,
+		ec.marshalNPageInfo2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐPageInfo,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityControlConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityControlConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityControlEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControlEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityControlEdge_cursor,
 		func(ctx context.Context) (any, error) {
 			return obj.Cursor, nil
 		},
@@ -49304,9 +52641,9 @@ func (ec *executionContext) _SnapshotEdge_cursor(ctx context.Context, field grap
 	)
 }
 
-func (ec *executionContext) fieldContext_SnapshotEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicabilityControlEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "SnapshotEdge",
+		Object:     "StateOfApplicabilityControlEdge",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -49317,46 +52654,124 @@ func (ec *executionContext) fieldContext_SnapshotEdge_cursor(_ context.Context,
 	return fc, nil
 }
 
-func (ec *executionContext) _SnapshotEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.SnapshotEdge) (ret graphql.Marshaler) {
+func (ec *executionContext) _StateOfApplicabilityControlEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityControlEdge) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
 		ec.OperationContext,
 		field,
-		ec.fieldContext_SnapshotEdge_node,
+		ec.fieldContext_StateOfApplicabilityControlEdge_node,
 		func(ctx context.Context) (any, error) {
 			return obj.Node, nil
 		},
 		nil,
-		ec.marshalNSnapshot2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐSnapshot,
+		ec.marshalNStateOfApplicabilityControl2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControl,
 		true,
 		true,
 	)
 }
 
-func (ec *executionContext) fieldContext_SnapshotEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_StateOfApplicabilityControlEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "SnapshotEdge",
+		Object:     "StateOfApplicabilityControlEdge",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_Snapshot_id(ctx, field)
-			case "organization":
-				return ec.fieldContext_Snapshot_organization(ctx, field)
+				return ec.fieldContext_StateOfApplicabilityControl_id(ctx, field)
+			case "stateOfApplicabilityId":
+				return ec.fieldContext_StateOfApplicabilityControl_stateOfApplicabilityId(ctx, field)
+			case "controlId":
+				return ec.fieldContext_StateOfApplicabilityControl_controlId(ctx, field)
+			case "stateOfApplicability":
+				return ec.fieldContext_StateOfApplicabilityControl_stateOfApplicability(ctx, field)
+			case "applicability":
+				return ec.fieldContext_StateOfApplicabilityControl_applicability(ctx, field)
+			case "justification":
+				return ec.fieldContext_StateOfApplicabilityControl_justification(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicabilityControl", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityEdge_cursor,
+		func(ctx context.Context) (any, error) {
+			return obj.Cursor, nil
+		},
+		nil,
+		ec.marshalNCursorKey2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type CursorKey does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _StateOfApplicabilityEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.StateOfApplicabilityEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_StateOfApplicabilityEdge_node,
+		func(ctx context.Context) (any, error) {
+			return obj.Node, nil
+		},
+		nil,
+		ec.marshalNStateOfApplicability2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicability,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_StateOfApplicabilityEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "StateOfApplicabilityEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_StateOfApplicability_id(ctx, field)
 			case "name":
-				return ec.fieldContext_Snapshot_name(ctx, field)
-			case "description":
-				return ec.fieldContext_Snapshot_description(ctx, field)
-			case "type":
-				return ec.fieldContext_Snapshot_type(ctx, field)
+				return ec.fieldContext_StateOfApplicability_name(ctx, field)
+			case "sourceId":
+				return ec.fieldContext_StateOfApplicability_sourceId(ctx, field)
+			case "snapshotId":
+				return ec.fieldContext_StateOfApplicability_snapshotId(ctx, field)
+			case "organization":
+				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
+			case "owner":
+				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
 			case "controls":
-				return ec.fieldContext_Snapshot_controls(ctx, field)
+				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
+			case "availableControls":
+				return ec.fieldContext_StateOfApplicability_availableControls(ctx, field)
 			case "createdAt":
-				return ec.fieldContext_Snapshot_createdAt(ctx, field)
+				return ec.fieldContext_StateOfApplicability_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_StateOfApplicability_updatedAt(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Snapshot", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicability", field.Name)
 		},
 	}
 	return fc, nil
@@ -49647,6 +53062,8 @@ func (ec *executionContext) fieldContext_Task_organization(_ context.Context, fi
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -50217,6 +53634,8 @@ func (ec *executionContext) fieldContext_TransferImpactAssessment_organization(_
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -50884,6 +54303,8 @@ func (ec *executionContext) fieldContext_TrustCenter_organization(_ context.Cont
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -52321,6 +55742,8 @@ func (ec *executionContext) fieldContext_TrustCenterFile_organization(_ context.
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -53161,6 +56584,8 @@ func (ec *executionContext) fieldContext_UpdateControlPayload_control(_ context.
 				return ec.fieldContext_Control_status(ctx, field)
 			case "exclusionJustification":
 				return ec.fieldContext_Control_exclusionJustification(ctx, field)
+			case "bestPractice":
+				return ec.fieldContext_Control_bestPractice(ctx, field)
 			case "framework":
 				return ec.fieldContext_Control_framework(ctx, field)
 			case "measures":
@@ -53169,8 +56594,12 @@ func (ec *executionContext) fieldContext_UpdateControlPayload_control(_ context.
 				return ec.fieldContext_Control_documents(ctx, field)
 			case "audits":
 				return ec.fieldContext_Control_audits(ctx, field)
+			case "obligations":
+				return ec.fieldContext_Control_obligations(ctx, field)
 			case "snapshots":
 				return ec.fieldContext_Control_snapshots(ctx, field)
+			case "stateOfApplicabilityControls":
+				return ec.fieldContext_Control_stateOfApplicabilityControls(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Control_createdAt(ctx, field)
 			case "updatedAt":
@@ -53707,6 +57136,8 @@ func (ec *executionContext) fieldContext_UpdateObligationPayload_obligation(_ co
 				return ec.fieldContext_Obligation_dueDate(ctx, field)
 			case "status":
 				return ec.fieldContext_Obligation_status(ctx, field)
+			case "type":
+				return ec.fieldContext_Obligation_type(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Obligation_createdAt(ctx, field)
 			case "updatedAt":
@@ -53813,6 +57244,8 @@ func (ec *executionContext) fieldContext_UpdateOrganizationPayload_organization(
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -54201,6 +57634,57 @@ func (ec *executionContext) fieldContext_UpdateSAMLConfigurationPayload_samlConf
 	return fc, nil
 }
 
+func (ec *executionContext) _UpdateStateOfApplicabilityPayload_stateOfApplicability(ctx context.Context, field graphql.CollectedField, obj *types.UpdateStateOfApplicabilityPayload) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_UpdateStateOfApplicabilityPayload_stateOfApplicability,
+		func(ctx context.Context) (any, error) {
+			return obj.StateOfApplicability, nil
+		},
+		nil,
+		ec.marshalNStateOfApplicability2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicability,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_UpdateStateOfApplicabilityPayload_stateOfApplicability(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "UpdateStateOfApplicabilityPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_StateOfApplicability_id(ctx, field)
+			case "name":
+				return ec.fieldContext_StateOfApplicability_name(ctx, field)
+			case "sourceId":
+				return ec.fieldContext_StateOfApplicability_sourceId(ctx, field)
+			case "snapshotId":
+				return ec.fieldContext_StateOfApplicability_snapshotId(ctx, field)
+			case "organization":
+				return ec.fieldContext_StateOfApplicability_organization(ctx, field)
+			case "owner":
+				return ec.fieldContext_StateOfApplicability_owner(ctx, field)
+			case "controls":
+				return ec.fieldContext_StateOfApplicability_controls(ctx, field)
+			case "availableControls":
+				return ec.fieldContext_StateOfApplicability_availableControls(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_StateOfApplicability_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_StateOfApplicability_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type StateOfApplicability", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _UpdateTaskPayload_task(ctx context.Context, field graphql.CollectedField, obj *types.UpdateTaskPayload) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -55581,6 +59065,8 @@ func (ec *executionContext) fieldContext_Vendor_organization(_ context.Context,
 				return ec.fieldContext_Organization_documents(ctx, field)
 			case "meetings":
 				return ec.fieldContext_Organization_meetings(ctx, field)
+			case "statesOfApplicability":
+				return ec.fieldContext_Organization_statesOfApplicability(ctx, field)
 			case "measures":
 				return ec.fieldContext_Organization_measures(ctx, field)
 			case "risks":
@@ -61663,7 +65149,7 @@ func (ec *executionContext) unmarshalInputCreateControlInput(ctx context.Context
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"frameworkId", "sectionTitle", "name", "description", "status", "exclusionJustification"}
+	fieldsInOrder := [...]string{"frameworkId", "sectionTitle", "name", "description", "status", "exclusionJustification", "bestPractice"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -61712,6 +65198,13 @@ func (ec *executionContext) unmarshalInputCreateControlInput(ctx context.Context
 				return it, err
 			}
 			it.ExclusionJustification = data
+		case "bestPractice":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("bestPractice"))
+			data, err := ec.unmarshalNBoolean2bool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.BestPractice = data
 		}
 	}
 
@@ -61752,6 +65245,40 @@ func (ec *executionContext) unmarshalInputCreateControlMeasureMappingInput(ctx c
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputCreateControlObligationMappingInput(ctx context.Context, obj any) (types.CreateControlObligationMappingInput, error) {
+	var it types.CreateControlObligationMappingInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"controlId", "obligationId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "controlId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("controlId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ControlID = data
+		case "obligationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("obligationId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ObligationID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputCreateControlSnapshotMappingInput(ctx context.Context, obj any) (types.CreateControlSnapshotMappingInput, error) {
 	var it types.CreateControlSnapshotMappingInput
 	asMap := map[string]any{}
@@ -62343,7 +65870,7 @@ func (ec *executionContext) unmarshalInputCreateObligationInput(ctx context.Cont
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"organizationId", "area", "source", "requirement", "actionsToBeImplemented", "regulator", "ownerId", "lastReviewDate", "dueDate", "status"}
+	fieldsInOrder := [...]string{"organizationId", "area", "source", "requirement", "actionsToBeImplemented", "regulator", "ownerId", "lastReviewDate", "dueDate", "status", "type"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -62420,6 +65947,13 @@ func (ec *executionContext) unmarshalInputCreateObligationInput(ctx context.Cont
 				return it, err
 			}
 			it.Status = data
+		case "type":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("type"))
+			data, err := ec.unmarshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Type = data
 		}
 	}
 
@@ -62841,269 +66375,365 @@ func (ec *executionContext) unmarshalInputCreateRiskInput(ctx context.Context, o
 				return it, err
 			}
 			it.Description = data
-		case "category":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("category"))
-			data, err := ec.unmarshalNString2string(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.Category = data
-		case "ownerId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
-			data, err := ec.unmarshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.OwnerID = data
-		case "treatment":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("treatment"))
-			data, err := ec.unmarshalNRiskTreatment2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐRiskTreatment(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.Treatment = data
-		case "inherentLikelihood":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("inherentLikelihood"))
-			data, err := ec.unmarshalNInt2int(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.InherentLikelihood = data
-		case "inherentImpact":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("inherentImpact"))
-			data, err := ec.unmarshalNInt2int(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.InherentImpact = data
-		case "residualLikelihood":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("residualLikelihood"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.ResidualLikelihood = data
-		case "residualImpact":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("residualImpact"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.ResidualImpact = data
-		case "note":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("note"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.Note = data
-		}
-	}
-
-	return it, nil
-}
-
-func (ec *executionContext) unmarshalInputCreateRiskMeasureMappingInput(ctx context.Context, obj any) (types.CreateRiskMeasureMappingInput, error) {
-	var it types.CreateRiskMeasureMappingInput
-	asMap := map[string]any{}
-	for k, v := range obj.(map[string]any) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"riskId", "measureId"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "riskId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("riskId"))
-			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.RiskID = data
-		case "measureId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("measureId"))
-			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+		case "category":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("category"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Category = data
+		case "ownerId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
+			data, err := ec.unmarshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OwnerID = data
+		case "treatment":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("treatment"))
+			data, err := ec.unmarshalNRiskTreatment2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐRiskTreatment(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Treatment = data
+		case "inherentLikelihood":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("inherentLikelihood"))
+			data, err := ec.unmarshalNInt2int(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.InherentLikelihood = data
+		case "inherentImpact":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("inherentImpact"))
+			data, err := ec.unmarshalNInt2int(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.InherentImpact = data
+		case "residualLikelihood":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("residualLikelihood"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ResidualLikelihood = data
+		case "residualImpact":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("residualImpact"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ResidualImpact = data
+		case "note":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("note"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Note = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateRiskMeasureMappingInput(ctx context.Context, obj any) (types.CreateRiskMeasureMappingInput, error) {
+	var it types.CreateRiskMeasureMappingInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"riskId", "measureId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "riskId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("riskId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.RiskID = data
+		case "measureId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("measureId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.MeasureID = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateRiskObligationMappingInput(ctx context.Context, obj any) (types.CreateRiskObligationMappingInput, error) {
+	var it types.CreateRiskObligationMappingInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"riskId", "obligationId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "riskId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("riskId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.RiskID = data
+		case "obligationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("obligationId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ObligationID = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx context.Context, obj any) (types.CreateSAMLConfigurationInput, error) {
+	var it types.CreateSAMLConfigurationInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "organizationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OrganizationID = data
+		case "emailDomain":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("emailDomain"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.EmailDomain = data
+		case "enforcementPolicy":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("enforcementPolicy"))
+			data, err := ec.unmarshalNSAMLEnforcementPolicy2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSAMLEnforcementPolicy(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.EnforcementPolicy = data
+		case "spCertificate":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("spCertificate"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.SpCertificate = data
+		case "spPrivateKey":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("spPrivateKey"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.SpPrivateKey = data
+		case "idpMetadataXml":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpMetadataXml"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdpMetadataXML = data
+		case "idpEntityId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpEntityId"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdpEntityID = data
+		case "idpSsoUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpSsoUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdpSsoURL = data
+		case "idpCertificate":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpCertificate"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdpCertificate = data
+		case "idpMetadataUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpMetadataUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdpMetadataURL = data
+		case "attributeEmail":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeEmail"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AttributeEmail = data
+		case "attributeFirstname":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeFirstname"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AttributeFirstname = data
+		case "attributeLastname":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeLastname"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AttributeLastname = data
+		case "attributeRole":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeRole"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AttributeRole = data
+		case "autoSignupEnabled":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AutoSignupEnabled = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateSnapshotInput(ctx context.Context, obj any) (types.CreateSnapshotInput, error) {
+	var it types.CreateSnapshotInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"organizationId", "name", "description", "type"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "organizationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OrganizationID = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "description":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Description = data
+		case "type":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("type"))
+			data, err := ec.unmarshalNSnapshotsType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSnapshotsType(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.MeasureID = data
+			it.Type = data
 		}
 	}
 
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputCreateRiskObligationMappingInput(ctx context.Context, obj any) (types.CreateRiskObligationMappingInput, error) {
-	var it types.CreateRiskObligationMappingInput
+func (ec *executionContext) unmarshalInputCreateStateOfApplicabilityControlMappingInput(ctx context.Context, obj any) (types.CreateStateOfApplicabilityControlMappingInput, error) {
+	var it types.CreateStateOfApplicabilityControlMappingInput
 	asMap := map[string]any{}
 	for k, v := range obj.(map[string]any) {
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"riskId", "obligationId"}
+	fieldsInOrder := [...]string{"stateOfApplicabilityId", "controlId", "applicability", "justification"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
 			continue
 		}
 		switch k {
-		case "riskId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("riskId"))
-			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.RiskID = data
-		case "obligationId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("obligationId"))
+		case "stateOfApplicabilityId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("stateOfApplicabilityId"))
 			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.ObligationID = data
-		}
-	}
-
-	return it, nil
-}
-
-func (ec *executionContext) unmarshalInputCreateSAMLConfigurationInput(ctx context.Context, obj any) (types.CreateSAMLConfigurationInput, error) {
-	var it types.CreateSAMLConfigurationInput
-	asMap := map[string]any{}
-	for k, v := range obj.(map[string]any) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"organizationId", "emailDomain", "enforcementPolicy", "spCertificate", "spPrivateKey", "idpMetadataXml", "idpEntityId", "idpSsoUrl", "idpCertificate", "idpMetadataUrl", "attributeEmail", "attributeFirstname", "attributeLastname", "attributeRole", "autoSignupEnabled"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "organizationId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			it.StateOfApplicabilityID = data
+		case "controlId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("controlId"))
 			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.OrganizationID = data
-		case "emailDomain":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("emailDomain"))
-			data, err := ec.unmarshalNString2string(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.EmailDomain = data
-		case "enforcementPolicy":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("enforcementPolicy"))
-			data, err := ec.unmarshalNSAMLEnforcementPolicy2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSAMLEnforcementPolicy(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.EnforcementPolicy = data
-		case "spCertificate":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("spCertificate"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.SpCertificate = data
-		case "spPrivateKey":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("spPrivateKey"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.SpPrivateKey = data
-		case "idpMetadataXml":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpMetadataXml"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.IdpMetadataXML = data
-		case "idpEntityId":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpEntityId"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.IdpEntityID = data
-		case "idpSsoUrl":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpSsoUrl"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.IdpSsoURL = data
-		case "idpCertificate":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpCertificate"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.IdpCertificate = data
-		case "idpMetadataUrl":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idpMetadataUrl"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.IdpMetadataURL = data
-		case "attributeEmail":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeEmail"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.AttributeEmail = data
-		case "attributeFirstname":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeFirstname"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.AttributeFirstname = data
-		case "attributeLastname":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeLastname"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			it.ControlID = data
+		case "applicability":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("applicability"))
+			data, err := ec.unmarshalNBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AttributeLastname = data
-		case "attributeRole":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("attributeRole"))
+			it.Applicability = data
+		case "justification":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("justification"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AttributeRole = data
-		case "autoSignupEnabled":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("autoSignupEnabled"))
-			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.AutoSignupEnabled = data
+			it.Justification = data
 		}
 	}
 
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputCreateSnapshotInput(ctx context.Context, obj any) (types.CreateSnapshotInput, error) {
-	var it types.CreateSnapshotInput
+func (ec *executionContext) unmarshalInputCreateStateOfApplicabilityInput(ctx context.Context, obj any) (types.CreateStateOfApplicabilityInput, error) {
+	var it types.CreateStateOfApplicabilityInput
 	asMap := map[string]any{}
 	for k, v := range obj.(map[string]any) {
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"organizationId", "name", "description", "type"}
+	fieldsInOrder := [...]string{"organizationId", "name", "ownerId"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -63124,20 +66754,13 @@ func (ec *executionContext) unmarshalInputCreateSnapshotInput(ctx context.Contex
 				return it, err
 			}
 			it.Name = data
-		case "description":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.Description = data
-		case "type":
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("type"))
-			data, err := ec.unmarshalNSnapshotsType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSnapshotsType(ctx, v)
+		case "ownerId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Type = data
+			it.OwnerID = data
 		}
 	}
 
@@ -64117,6 +67740,40 @@ func (ec *executionContext) unmarshalInputDeleteControlMeasureMappingInput(ctx c
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputDeleteControlObligationMappingInput(ctx context.Context, obj any) (types.DeleteControlObligationMappingInput, error) {
+	var it types.DeleteControlObligationMappingInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"controlId", "obligationId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "controlId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("controlId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ControlID = data
+		case "obligationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("obligationId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ObligationID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputDeleteControlSnapshotMappingInput(ctx context.Context, obj any) (types.DeleteControlSnapshotMappingInput, error) {
 	var it types.DeleteControlSnapshotMappingInput
 	asMap := map[string]any{}
@@ -64793,6 +68450,67 @@ func (ec *executionContext) unmarshalInputDeleteSnapshotInput(ctx context.Contex
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputDeleteStateOfApplicabilityControlMappingInput(ctx context.Context, obj any) (types.DeleteStateOfApplicabilityControlMappingInput, error) {
+	var it types.DeleteStateOfApplicabilityControlMappingInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"stateOfApplicabilityId", "controlId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "stateOfApplicabilityId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("stateOfApplicabilityId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.StateOfApplicabilityID = data
+		case "controlId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("controlId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ControlID = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputDeleteStateOfApplicabilityInput(ctx context.Context, obj any) (types.DeleteStateOfApplicabilityInput, error) {
+	var it types.DeleteStateOfApplicabilityInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"stateOfApplicabilityId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "stateOfApplicabilityId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("stateOfApplicabilityId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.StateOfApplicabilityID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputDeleteTaskInput(ctx context.Context, obj any) (types.DeleteTaskInput, error) {
 	var it types.DeleteTaskInput
 	asMap := map[string]any{}
@@ -65558,6 +69276,33 @@ func (ec *executionContext) unmarshalInputExportSignableDocumentVersionPDFInput(
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputExportStateOfApplicabilityPDFInput(ctx context.Context, obj any) (types.ExportStateOfApplicabilityPDFInput, error) {
+	var it types.ExportStateOfApplicabilityPDFInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"stateOfApplicabilityId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "stateOfApplicabilityId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("stateOfApplicabilityId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.StateOfApplicabilityID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputExportTransferImpactAssessmentsPDFInput(ctx context.Context, obj any) (types.ExportTransferImpactAssessmentsPDFInput, error) {
 	var it types.ExportTransferImpactAssessmentsPDFInput
 	asMap := map[string]any{}
@@ -66727,6 +70472,108 @@ func (ec *executionContext) unmarshalInputSnapshotOrder(ctx context.Context, obj
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputStateOfApplicabilityControlInput(ctx context.Context, obj any) (types.StateOfApplicabilityControlInput, error) {
+	var it types.StateOfApplicabilityControlInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"controlId", "applicability", "justification"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "controlId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("controlId"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ControlID = data
+		case "applicability":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("applicability"))
+			data, err := ec.unmarshalNBoolean2bool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Applicability = data
+		case "justification":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("justification"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Justification = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputStateOfApplicabilityFilter(ctx context.Context, obj any) (types.StateOfApplicabilityFilter, error) {
+	var it types.StateOfApplicabilityFilter
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"snapshotId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "snapshotId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("snapshotId"))
+			data, err := ec.unmarshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.SnapshotID = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputStateOfApplicabilityOrder(ctx context.Context, obj any) (types.StateOfApplicabilityOrderBy, error) {
+	var it types.StateOfApplicabilityOrderBy
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"direction", "field"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "direction":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("direction"))
+			data, err := ec.unmarshalNOrderDirection2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐOrderDirection(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Direction = data
+		case "field":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
+			data, err := ec.unmarshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Field = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputTaskOrder(ctx context.Context, obj any) (types.TaskOrderBy, error) {
 	var it types.TaskOrderBy
 	asMap := map[string]any{}
@@ -67206,7 +71053,7 @@ func (ec *executionContext) unmarshalInputUpdateControlInput(ctx context.Context
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"id", "sectionTitle", "name", "description", "status", "exclusionJustification"}
+	fieldsInOrder := [...]string{"id", "sectionTitle", "name", "description", "status", "exclusionJustification", "bestPractice"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -67255,6 +71102,13 @@ func (ec *executionContext) unmarshalInputUpdateControlInput(ctx context.Context
 				return it, err
 			}
 			it.ExclusionJustification = data
+		case "bestPractice":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("bestPractice"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.BestPractice = data
 		}
 	}
 
@@ -67777,7 +71631,7 @@ func (ec *executionContext) unmarshalInputUpdateObligationInput(ctx context.Cont
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"id", "area", "source", "requirement", "actionsToBeImplemented", "regulator", "ownerId", "lastReviewDate", "dueDate", "status"}
+	fieldsInOrder := [...]string{"id", "area", "source", "requirement", "actionsToBeImplemented", "regulator", "ownerId", "lastReviewDate", "dueDate", "status", "type"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -67854,6 +71708,13 @@ func (ec *executionContext) unmarshalInputUpdateObligationInput(ctx context.Cont
 				return it, err
 			}
 			it.Status = data
+		case "type":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("type"))
+			data, err := ec.unmarshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Type = data
 		}
 	}
 
@@ -68504,6 +72365,47 @@ func (ec *executionContext) unmarshalInputUpdateSAMLConfigurationInput(ctx conte
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputUpdateStateOfApplicabilityInput(ctx context.Context, obj any) (types.UpdateStateOfApplicabilityInput, error) {
+	var it types.UpdateStateOfApplicabilityInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"id", "name", "ownerId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "id":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
+			data, err := ec.unmarshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ID = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "ownerId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("ownerId"))
+			data, err := ec.unmarshalOID2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OwnerID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputUpdateTaskInput(ctx context.Context, obj any) (types.UpdateTaskInput, error) {
 	var it types.UpdateTaskInput
 	asMap := map[string]any{}
@@ -69838,6 +73740,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
 			return graphql.Null
 		}
 		return ec._Task(ctx, sel, obj)
+	case types.StateOfApplicability:
+		return ec._StateOfApplicability(ctx, sel, &obj)
+	case *types.StateOfApplicability:
+		if obj == nil {
+			return graphql.Null
+		}
+		return ec._StateOfApplicability(ctx, sel, obj)
 	case types.Snapshot:
 		return ec._Snapshot(ctx, sel, &obj)
 	case *types.Snapshot:
@@ -70804,6 +74713,96 @@ func (ec *executionContext) _AuditEdge(ctx context.Context, sel ast.SelectionSet
 	return out
 }
 
+var availableStateOfApplicabilityControlImplementors = []string{"AvailableStateOfApplicabilityControl"}
+
+func (ec *executionContext) _AvailableStateOfApplicabilityControl(ctx context.Context, sel ast.SelectionSet, obj *types.AvailableStateOfApplicabilityControl) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, availableStateOfApplicabilityControlImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("AvailableStateOfApplicabilityControl")
+		case "controlId":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_controlId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "sectionTitle":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_sectionTitle(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "name":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "frameworkId":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_frameworkId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "frameworkName":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_frameworkName(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "organizationId":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_organizationId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "stateOfApplicabilityId":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_stateOfApplicabilityId(ctx, field, obj)
+		case "applicability":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_applicability(ctx, field, obj)
+		case "justification":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_justification(ctx, field, obj)
+		case "bestPractice":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_bestPractice(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "regulatory":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_regulatory(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "contractual":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_contractual(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "riskAssessment":
+			out.Values[i] = ec._AvailableStateOfApplicabilityControl_riskAssessment(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var bulkDeleteDocumentsPayloadImplementors = []string{"BulkDeleteDocumentsPayload"}
 
 func (ec *executionContext) _BulkDeleteDocumentsPayload(ctx context.Context, sel ast.SelectionSet, obj *types.BulkDeleteDocumentsPayload) graphql.Marshaler {
@@ -71348,6 +75347,11 @@ func (ec *executionContext) _Control(ctx context.Context, sel ast.SelectionSet,
 			}
 		case "exclusionJustification":
 			out.Values[i] = ec._Control_exclusionJustification(ctx, field, obj)
+		case "bestPractice":
+			out.Values[i] = ec._Control_bestPractice(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
 		case "framework":
 			field := field
 
@@ -71456,7 +75460,43 @@ func (ec *executionContext) _Control(ctx context.Context, sel ast.SelectionSet,
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "audits":
+		case "audits":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Control_audits(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "obligations":
 			field := field
 
 			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
@@ -71465,7 +75505,7 @@ func (ec *executionContext) _Control(ctx context.Context, sel ast.SelectionSet,
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Control_audits(ctx, field, obj)
+				res = ec._Control_obligations(ctx, field, obj)
 				if res == graphql.Null {
 					atomic.AddUint32(&fs.Invalids, 1)
 				}
@@ -71527,6 +75567,42 @@ func (ec *executionContext) _Control(ctx context.Context, sel ast.SelectionSet,
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "stateOfApplicabilityControls":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Control_stateOfApplicabilityControls(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "createdAt":
 			out.Values[i] = ec._Control_createdAt(ctx, field, obj)
@@ -71934,6 +76010,50 @@ func (ec *executionContext) _CreateControlMeasureMappingPayload(ctx context.Cont
 	return out
 }
 
+var createControlObligationMappingPayloadImplementors = []string{"CreateControlObligationMappingPayload"}
+
+func (ec *executionContext) _CreateControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateControlObligationMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, createControlObligationMappingPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("CreateControlObligationMappingPayload")
+		case "controlEdge":
+			out.Values[i] = ec._CreateControlObligationMappingPayload_controlEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "obligationEdge":
+			out.Values[i] = ec._CreateControlObligationMappingPayload_obligationEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var createControlPayloadImplementors = []string{"CreateControlPayload"}
 
 func (ec *executionContext) _CreateControlPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateControlPayload) graphql.Marshaler {
@@ -72856,6 +76976,84 @@ func (ec *executionContext) _CreateSnapshotPayload(ctx context.Context, sel ast.
 	return out
 }
 
+var createStateOfApplicabilityControlMappingPayloadImplementors = []string{"CreateStateOfApplicabilityControlMappingPayload"}
+
+func (ec *executionContext) _CreateStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, createStateOfApplicabilityControlMappingPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("CreateStateOfApplicabilityControlMappingPayload")
+		case "stateOfApplicabilityControlEdge":
+			out.Values[i] = ec._CreateStateOfApplicabilityControlMappingPayload_stateOfApplicabilityControlEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var createStateOfApplicabilityPayloadImplementors = []string{"CreateStateOfApplicabilityPayload"}
+
+func (ec *executionContext) _CreateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateStateOfApplicabilityPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, createStateOfApplicabilityPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("CreateStateOfApplicabilityPayload")
+		case "stateOfApplicabilityEdge":
+			out.Values[i] = ec._CreateStateOfApplicabilityPayload_stateOfApplicabilityEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var createTaskPayloadImplementors = []string{"CreateTaskPayload"}
 
 func (ec *executionContext) _CreateTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateTaskPayload) graphql.Marshaler {
@@ -74173,6 +78371,50 @@ func (ec *executionContext) _DeleteControlMeasureMappingPayload(ctx context.Cont
 	return out
 }
 
+var deleteControlObligationMappingPayloadImplementors = []string{"DeleteControlObligationMappingPayload"}
+
+func (ec *executionContext) _DeleteControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteControlObligationMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteControlObligationMappingPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("DeleteControlObligationMappingPayload")
+		case "deletedControlId":
+			out.Values[i] = ec._DeleteControlObligationMappingPayload_deletedControlId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletedObligationId":
+			out.Values[i] = ec._DeleteControlObligationMappingPayload_deletedObligationId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var deleteControlPayloadImplementors = []string{"DeleteControlPayload"}
 
 func (ec *executionContext) _DeleteControlPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteControlPayload) graphql.Marshaler {
@@ -74724,19 +78966,97 @@ func (ec *executionContext) _DeleteObligationPayload(ctx context.Context, sel as
 	return out
 }
 
-var deleteOrganizationHorizontalLogoPayloadImplementors = []string{"DeleteOrganizationHorizontalLogoPayload"}
+var deleteOrganizationHorizontalLogoPayloadImplementors = []string{"DeleteOrganizationHorizontalLogoPayload"}
+
+func (ec *executionContext) _DeleteOrganizationHorizontalLogoPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteOrganizationHorizontalLogoPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteOrganizationHorizontalLogoPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("DeleteOrganizationHorizontalLogoPayload")
+		case "organization":
+			out.Values[i] = ec._DeleteOrganizationHorizontalLogoPayload_organization(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var deleteOrganizationPayloadImplementors = []string{"DeleteOrganizationPayload"}
+
+func (ec *executionContext) _DeleteOrganizationPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteOrganizationPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteOrganizationPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("DeleteOrganizationPayload")
+		case "deletedOrganizationId":
+			out.Values[i] = ec._DeleteOrganizationPayload_deletedOrganizationId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var deletePeoplePayloadImplementors = []string{"DeletePeoplePayload"}
 
-func (ec *executionContext) _DeleteOrganizationHorizontalLogoPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteOrganizationHorizontalLogoPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteOrganizationHorizontalLogoPayloadImplementors)
+func (ec *executionContext) _DeletePeoplePayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeletePeoplePayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deletePeoplePayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteOrganizationHorizontalLogoPayload")
-		case "organization":
-			out.Values[i] = ec._DeleteOrganizationHorizontalLogoPayload_organization(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeletePeoplePayload")
+		case "deletedPeopleId":
+			out.Values[i] = ec._DeletePeoplePayload_deletedPeopleId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74763,19 +79083,19 @@ func (ec *executionContext) _DeleteOrganizationHorizontalLogoPayload(ctx context
 	return out
 }
 
-var deleteOrganizationPayloadImplementors = []string{"DeleteOrganizationPayload"}
+var deleteProcessingActivityPayloadImplementors = []string{"DeleteProcessingActivityPayload"}
 
-func (ec *executionContext) _DeleteOrganizationPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteOrganizationPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteOrganizationPayloadImplementors)
+func (ec *executionContext) _DeleteProcessingActivityPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteProcessingActivityPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteProcessingActivityPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteOrganizationPayload")
-		case "deletedOrganizationId":
-			out.Values[i] = ec._DeleteOrganizationPayload_deletedOrganizationId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteProcessingActivityPayload")
+		case "deletedProcessingActivityId":
+			out.Values[i] = ec._DeleteProcessingActivityPayload_deletedProcessingActivityId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74802,19 +79122,19 @@ func (ec *executionContext) _DeleteOrganizationPayload(ctx context.Context, sel
 	return out
 }
 
-var deletePeoplePayloadImplementors = []string{"DeletePeoplePayload"}
+var deleteRightsRequestPayloadImplementors = []string{"DeleteRightsRequestPayload"}
 
-func (ec *executionContext) _DeletePeoplePayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeletePeoplePayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deletePeoplePayloadImplementors)
+func (ec *executionContext) _DeleteRightsRequestPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRightsRequestPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRightsRequestPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeletePeoplePayload")
-		case "deletedPeopleId":
-			out.Values[i] = ec._DeletePeoplePayload_deletedPeopleId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteRightsRequestPayload")
+		case "deletedRightsRequestId":
+			out.Values[i] = ec._DeleteRightsRequestPayload_deletedRightsRequestId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74841,19 +79161,24 @@ func (ec *executionContext) _DeletePeoplePayload(ctx context.Context, sel ast.Se
 	return out
 }
 
-var deleteProcessingActivityPayloadImplementors = []string{"DeleteProcessingActivityPayload"}
+var deleteRiskDocumentMappingPayloadImplementors = []string{"DeleteRiskDocumentMappingPayload"}
 
-func (ec *executionContext) _DeleteProcessingActivityPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteProcessingActivityPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteProcessingActivityPayloadImplementors)
+func (ec *executionContext) _DeleteRiskDocumentMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskDocumentMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskDocumentMappingPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteProcessingActivityPayload")
-		case "deletedProcessingActivityId":
-			out.Values[i] = ec._DeleteProcessingActivityPayload_deletedProcessingActivityId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteRiskDocumentMappingPayload")
+		case "deletedRiskId":
+			out.Values[i] = ec._DeleteRiskDocumentMappingPayload_deletedRiskId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletedDocumentId":
+			out.Values[i] = ec._DeleteRiskDocumentMappingPayload_deletedDocumentId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74880,19 +79205,24 @@ func (ec *executionContext) _DeleteProcessingActivityPayload(ctx context.Context
 	return out
 }
 
-var deleteRightsRequestPayloadImplementors = []string{"DeleteRightsRequestPayload"}
+var deleteRiskMeasureMappingPayloadImplementors = []string{"DeleteRiskMeasureMappingPayload"}
 
-func (ec *executionContext) _DeleteRightsRequestPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRightsRequestPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRightsRequestPayloadImplementors)
+func (ec *executionContext) _DeleteRiskMeasureMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskMeasureMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskMeasureMappingPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteRightsRequestPayload")
-		case "deletedRightsRequestId":
-			out.Values[i] = ec._DeleteRightsRequestPayload_deletedRightsRequestId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteRiskMeasureMappingPayload")
+		case "deletedMeasureId":
+			out.Values[i] = ec._DeleteRiskMeasureMappingPayload_deletedMeasureId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletedRiskId":
+			out.Values[i] = ec._DeleteRiskMeasureMappingPayload_deletedRiskId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74919,24 +79249,24 @@ func (ec *executionContext) _DeleteRightsRequestPayload(ctx context.Context, sel
 	return out
 }
 
-var deleteRiskDocumentMappingPayloadImplementors = []string{"DeleteRiskDocumentMappingPayload"}
+var deleteRiskObligationMappingPayloadImplementors = []string{"DeleteRiskObligationMappingPayload"}
 
-func (ec *executionContext) _DeleteRiskDocumentMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskDocumentMappingPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskDocumentMappingPayloadImplementors)
+func (ec *executionContext) _DeleteRiskObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskObligationMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskObligationMappingPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteRiskDocumentMappingPayload")
+			out.Values[i] = graphql.MarshalString("DeleteRiskObligationMappingPayload")
 		case "deletedRiskId":
-			out.Values[i] = ec._DeleteRiskDocumentMappingPayload_deletedRiskId(ctx, field, obj)
+			out.Values[i] = ec._DeleteRiskObligationMappingPayload_deletedRiskId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
-		case "deletedDocumentId":
-			out.Values[i] = ec._DeleteRiskDocumentMappingPayload_deletedDocumentId(ctx, field, obj)
+		case "deletedObligationId":
+			out.Values[i] = ec._DeleteRiskObligationMappingPayload_deletedObligationId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -74963,24 +79293,19 @@ func (ec *executionContext) _DeleteRiskDocumentMappingPayload(ctx context.Contex
 	return out
 }
 
-var deleteRiskMeasureMappingPayloadImplementors = []string{"DeleteRiskMeasureMappingPayload"}
+var deleteRiskPayloadImplementors = []string{"DeleteRiskPayload"}
 
-func (ec *executionContext) _DeleteRiskMeasureMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskMeasureMappingPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskMeasureMappingPayloadImplementors)
+func (ec *executionContext) _DeleteRiskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteRiskMeasureMappingPayload")
-		case "deletedMeasureId":
-			out.Values[i] = ec._DeleteRiskMeasureMappingPayload_deletedMeasureId(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
+			out.Values[i] = graphql.MarshalString("DeleteRiskPayload")
 		case "deletedRiskId":
-			out.Values[i] = ec._DeleteRiskMeasureMappingPayload_deletedRiskId(ctx, field, obj)
+			out.Values[i] = ec._DeleteRiskPayload_deletedRiskId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -75007,24 +79332,19 @@ func (ec *executionContext) _DeleteRiskMeasureMappingPayload(ctx context.Context
 	return out
 }
 
-var deleteRiskObligationMappingPayloadImplementors = []string{"DeleteRiskObligationMappingPayload"}
+var deleteSAMLConfigurationPayloadImplementors = []string{"DeleteSAMLConfigurationPayload"}
 
-func (ec *executionContext) _DeleteRiskObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskObligationMappingPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskObligationMappingPayloadImplementors)
+func (ec *executionContext) _DeleteSAMLConfigurationPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteSAMLConfigurationPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteSAMLConfigurationPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteRiskObligationMappingPayload")
-		case "deletedRiskId":
-			out.Values[i] = ec._DeleteRiskObligationMappingPayload_deletedRiskId(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				out.Invalids++
-			}
-		case "deletedObligationId":
-			out.Values[i] = ec._DeleteRiskObligationMappingPayload_deletedObligationId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteSAMLConfigurationPayload")
+		case "deletedSAMLConfigurationId":
+			out.Values[i] = ec._DeleteSAMLConfigurationPayload_deletedSAMLConfigurationId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -75051,19 +79371,19 @@ func (ec *executionContext) _DeleteRiskObligationMappingPayload(ctx context.Cont
 	return out
 }
 
-var deleteRiskPayloadImplementors = []string{"DeleteRiskPayload"}
+var deleteSnapshotPayloadImplementors = []string{"DeleteSnapshotPayload"}
 
-func (ec *executionContext) _DeleteRiskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteRiskPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteRiskPayloadImplementors)
+func (ec *executionContext) _DeleteSnapshotPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteSnapshotPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteSnapshotPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteRiskPayload")
-		case "deletedRiskId":
-			out.Values[i] = ec._DeleteRiskPayload_deletedRiskId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteSnapshotPayload")
+		case "deletedSnapshotId":
+			out.Values[i] = ec._DeleteSnapshotPayload_deletedSnapshotId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -75090,19 +79410,29 @@ func (ec *executionContext) _DeleteRiskPayload(ctx context.Context, sel ast.Sele
 	return out
 }
 
-var deleteSAMLConfigurationPayloadImplementors = []string{"DeleteSAMLConfigurationPayload"}
+var deleteStateOfApplicabilityControlMappingPayloadImplementors = []string{"DeleteStateOfApplicabilityControlMappingPayload"}
 
-func (ec *executionContext) _DeleteSAMLConfigurationPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteSAMLConfigurationPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteSAMLConfigurationPayloadImplementors)
+func (ec *executionContext) _DeleteStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteStateOfApplicabilityControlMappingPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteSAMLConfigurationPayload")
-		case "deletedSAMLConfigurationId":
-			out.Values[i] = ec._DeleteSAMLConfigurationPayload_deletedSAMLConfigurationId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteStateOfApplicabilityControlMappingPayload")
+		case "deletedStateOfApplicabilityId":
+			out.Values[i] = ec._DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletedControlId":
+			out.Values[i] = ec._DeleteStateOfApplicabilityControlMappingPayload_deletedControlId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletedStateOfApplicabilityControlId":
+			out.Values[i] = ec._DeleteStateOfApplicabilityControlMappingPayload_deletedStateOfApplicabilityControlId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -75129,19 +79459,19 @@ func (ec *executionContext) _DeleteSAMLConfigurationPayload(ctx context.Context,
 	return out
 }
 
-var deleteSnapshotPayloadImplementors = []string{"DeleteSnapshotPayload"}
+var deleteStateOfApplicabilityPayloadImplementors = []string{"DeleteStateOfApplicabilityPayload"}
 
-func (ec *executionContext) _DeleteSnapshotPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteSnapshotPayload) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, deleteSnapshotPayloadImplementors)
+func (ec *executionContext) _DeleteStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteStateOfApplicabilityPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deleteStateOfApplicabilityPayloadImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("DeleteSnapshotPayload")
-		case "deletedSnapshotId":
-			out.Values[i] = ec._DeleteSnapshotPayload_deletedSnapshotId(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("DeleteStateOfApplicabilityPayload")
+		case "deletedStateOfApplicabilityId":
+			out.Values[i] = ec._DeleteStateOfApplicabilityPayload_deletedStateOfApplicabilityId(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -77078,6 +81408,45 @@ func (ec *executionContext) _ExportSignableDocumentVersionPDFPayload(ctx context
 	return out
 }
 
+var exportStateOfApplicabilityPDFPayloadImplementors = []string{"ExportStateOfApplicabilityPDFPayload"}
+
+func (ec *executionContext) _ExportStateOfApplicabilityPDFPayload(ctx context.Context, sel ast.SelectionSet, obj *types.ExportStateOfApplicabilityPDFPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, exportStateOfApplicabilityPDFPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("ExportStateOfApplicabilityPDFPayload")
+		case "data":
+			out.Values[i] = ec._ExportStateOfApplicabilityPDFPayload_data(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var exportTransferImpactAssessmentsPDFPayloadImplementors = []string{"ExportTransferImpactAssessmentsPDFPayload"}
 
 func (ec *executionContext) _ExportTransferImpactAssessmentsPDFPayload(ctx context.Context, sel ast.SelectionSet, obj *types.ExportTransferImpactAssessmentsPDFPayload) graphql.Marshaler {
@@ -79298,6 +83667,20 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
+		case "createStateOfApplicabilityControlMapping":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_createStateOfApplicabilityControlMapping(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deleteStateOfApplicabilityControlMapping":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_deleteStateOfApplicabilityControlMapping(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "createControlAuditMapping":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_createControlAuditMapping(ctx, field)
@@ -79312,6 +83695,20 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
+		case "createControlObligationMapping":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_createControlObligationMapping(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deleteControlObligationMapping":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_deleteControlObligationMapping(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "createControlSnapshotMapping":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_createControlSnapshotMapping(ctx, field)
@@ -79522,6 +83919,34 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
+		case "createStateOfApplicability":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_createStateOfApplicability(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "updateStateOfApplicability":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_updateStateOfApplicability(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deleteStateOfApplicability":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_deleteStateOfApplicability(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "exportStateOfApplicabilityPDF":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_exportStateOfApplicabilityPDF(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "publishDocumentVersion":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_publishDocumentVersion(ctx, field)
@@ -80402,6 +84827,11 @@ func (ec *executionContext) _Obligation(ctx context.Context, sel ast.SelectionSe
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
+		case "type":
+			out.Values[i] = ec._Obligation_type(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
 		case "createdAt":
 			out.Values[i] = ec._Obligation_createdAt(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
@@ -81010,6 +85440,42 @@ func (ec *executionContext) _Organization(ctx context.Context, sel ast.Selection
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "statesOfApplicability":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Organization_statesOfApplicability(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "measures":
 			field := field
@@ -84300,58 +88766,602 @@ func (ec *executionContext) _Snapshot(ctx context.Context, sel ast.SelectionSet,
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "name":
-			out.Values[i] = ec._Snapshot_name(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "description":
-			out.Values[i] = ec._Snapshot_description(ctx, field, obj)
-		case "type":
-			out.Values[i] = ec._Snapshot_type(ctx, field, obj)
+		case "name":
+			out.Values[i] = ec._Snapshot_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "description":
+			out.Values[i] = ec._Snapshot_description(ctx, field, obj)
+		case "type":
+			out.Values[i] = ec._Snapshot_type(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "controls":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Snapshot_controls(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "createdAt":
+			out.Values[i] = ec._Snapshot_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var snapshotConnectionImplementors = []string{"SnapshotConnection"}
+
+func (ec *executionContext) _SnapshotConnection(ctx context.Context, sel ast.SelectionSet, obj *types.SnapshotConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, snapshotConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("SnapshotConnection")
+		case "totalCount":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._SnapshotConnection_totalCount(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "edges":
+			out.Values[i] = ec._SnapshotConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "pageInfo":
+			out.Values[i] = ec._SnapshotConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var snapshotEdgeImplementors = []string{"SnapshotEdge"}
+
+func (ec *executionContext) _SnapshotEdge(ctx context.Context, sel ast.SelectionSet, obj *types.SnapshotEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, snapshotEdgeImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("SnapshotEdge")
+		case "cursor":
+			out.Values[i] = ec._SnapshotEdge_cursor(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "node":
+			out.Values[i] = ec._SnapshotEdge_node(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var stateOfApplicabilityImplementors = []string{"StateOfApplicability", "Node"}
+
+func (ec *executionContext) _StateOfApplicability(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicability) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("StateOfApplicability")
+		case "id":
+			out.Values[i] = ec._StateOfApplicability_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "name":
+			out.Values[i] = ec._StateOfApplicability_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "sourceId":
+			out.Values[i] = ec._StateOfApplicability_sourceId(ctx, field, obj)
+		case "snapshotId":
+			out.Values[i] = ec._StateOfApplicability_snapshotId(ctx, field, obj)
+		case "organization":
+			field := field
+
+			innerFunc := func(ctx context.Context, _ *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicability_organization(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "owner":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicability_owner(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "controls":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicability_controls(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "availableControls":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicability_availableControls(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "createdAt":
+			out.Values[i] = ec._StateOfApplicability_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "updatedAt":
+			out.Values[i] = ec._StateOfApplicability_updatedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var stateOfApplicabilityConnectionImplementors = []string{"StateOfApplicabilityConnection"}
+
+func (ec *executionContext) _StateOfApplicabilityConnection(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicabilityConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("StateOfApplicabilityConnection")
+		case "totalCount":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicabilityConnection_totalCount(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "edges":
+			out.Values[i] = ec._StateOfApplicabilityConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "pageInfo":
+			out.Values[i] = ec._StateOfApplicabilityConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var stateOfApplicabilityControlImplementors = []string{"StateOfApplicabilityControl"}
+
+func (ec *executionContext) _StateOfApplicabilityControl(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicabilityControl) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityControlImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("StateOfApplicabilityControl")
+		case "id":
+			out.Values[i] = ec._StateOfApplicabilityControl_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "stateOfApplicabilityId":
+			out.Values[i] = ec._StateOfApplicabilityControl_stateOfApplicabilityId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "controlId":
+			out.Values[i] = ec._StateOfApplicabilityControl_controlId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "stateOfApplicability":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._StateOfApplicabilityControl_stateOfApplicability(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "applicability":
+			out.Values[i] = ec._StateOfApplicabilityControl_applicability(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				atomic.AddUint32(&out.Invalids, 1)
 			}
-		case "controls":
-			field := field
+		case "justification":
+			out.Values[i] = ec._StateOfApplicabilityControl_justification(ctx, field, obj)
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
 
-			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
-				defer func() {
-					if r := recover(); r != nil {
-						ec.Error(ctx, ec.Recover(ctx, r))
-					}
-				}()
-				res = ec._Snapshot_controls(ctx, field, obj)
-				if res == graphql.Null {
-					atomic.AddUint32(&fs.Invalids, 1)
-				}
-				return res
-			}
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
 
-			if field.Deferrable != nil {
-				dfs, ok := deferred[field.Deferrable.Label]
-				di := 0
-				if ok {
-					dfs.AddField(field)
-					di = len(dfs.Values) - 1
-				} else {
-					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
-					deferred[field.Deferrable.Label] = dfs
-				}
-				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
-					return innerFunc(ctx, dfs)
-				})
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
 
-				// don't run the out.Concurrently() call below
-				out.Values[i] = graphql.Null
-				continue
-			}
+	return out
+}
 
-			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "createdAt":
-			out.Values[i] = ec._Snapshot_createdAt(ctx, field, obj)
+var stateOfApplicabilityControlConnectionImplementors = []string{"StateOfApplicabilityControlConnection"}
+
+func (ec *executionContext) _StateOfApplicabilityControlConnection(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicabilityControlConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityControlConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("StateOfApplicabilityControlConnection")
+		case "totalCount":
+			out.Values[i] = ec._StateOfApplicabilityControlConnection_totalCount(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
+				out.Invalids++
+			}
+		case "edges":
+			out.Values[i] = ec._StateOfApplicabilityControlConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "pageInfo":
+			out.Values[i] = ec._StateOfApplicabilityControlConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
@@ -84376,62 +89386,26 @@ func (ec *executionContext) _Snapshot(ctx context.Context, sel ast.SelectionSet,
 	return out
 }
 
-var snapshotConnectionImplementors = []string{"SnapshotConnection"}
+var stateOfApplicabilityControlEdgeImplementors = []string{"StateOfApplicabilityControlEdge"}
 
-func (ec *executionContext) _SnapshotConnection(ctx context.Context, sel ast.SelectionSet, obj *types.SnapshotConnection) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, snapshotConnectionImplementors)
+func (ec *executionContext) _StateOfApplicabilityControlEdge(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicabilityControlEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityControlEdgeImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("SnapshotConnection")
-		case "totalCount":
-			field := field
-
-			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
-				defer func() {
-					if r := recover(); r != nil {
-						ec.Error(ctx, ec.Recover(ctx, r))
-					}
-				}()
-				res = ec._SnapshotConnection_totalCount(ctx, field, obj)
-				if res == graphql.Null {
-					atomic.AddUint32(&fs.Invalids, 1)
-				}
-				return res
-			}
-
-			if field.Deferrable != nil {
-				dfs, ok := deferred[field.Deferrable.Label]
-				di := 0
-				if ok {
-					dfs.AddField(field)
-					di = len(dfs.Values) - 1
-				} else {
-					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
-					deferred[field.Deferrable.Label] = dfs
-				}
-				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
-					return innerFunc(ctx, dfs)
-				})
-
-				// don't run the out.Concurrently() call below
-				out.Values[i] = graphql.Null
-				continue
-			}
-
-			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "edges":
-			out.Values[i] = ec._SnapshotConnection_edges(ctx, field, obj)
+			out.Values[i] = graphql.MarshalString("StateOfApplicabilityControlEdge")
+		case "cursor":
+			out.Values[i] = ec._StateOfApplicabilityControlEdge_cursor(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
+				out.Invalids++
 			}
-		case "pageInfo":
-			out.Values[i] = ec._SnapshotConnection_pageInfo(ctx, field, obj)
+		case "node":
+			out.Values[i] = ec._StateOfApplicabilityControlEdge_node(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
+				out.Invalids++
 			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
@@ -84456,24 +89430,24 @@ func (ec *executionContext) _SnapshotConnection(ctx context.Context, sel ast.Sel
 	return out
 }
 
-var snapshotEdgeImplementors = []string{"SnapshotEdge"}
+var stateOfApplicabilityEdgeImplementors = []string{"StateOfApplicabilityEdge"}
 
-func (ec *executionContext) _SnapshotEdge(ctx context.Context, sel ast.SelectionSet, obj *types.SnapshotEdge) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, snapshotEdgeImplementors)
+func (ec *executionContext) _StateOfApplicabilityEdge(ctx context.Context, sel ast.SelectionSet, obj *types.StateOfApplicabilityEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, stateOfApplicabilityEdgeImplementors)
 
 	out := graphql.NewFieldSet(fields)
 	deferred := make(map[string]*graphql.FieldSet)
 	for i, field := range fields {
 		switch field.Name {
 		case "__typename":
-			out.Values[i] = graphql.MarshalString("SnapshotEdge")
+			out.Values[i] = graphql.MarshalString("StateOfApplicabilityEdge")
 		case "cursor":
-			out.Values[i] = ec._SnapshotEdge_cursor(ctx, field, obj)
+			out.Values[i] = ec._StateOfApplicabilityEdge_cursor(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
 		case "node":
-			out.Values[i] = ec._SnapshotEdge_node(ctx, field, obj)
+			out.Values[i] = ec._StateOfApplicabilityEdge_node(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
@@ -87206,6 +92180,45 @@ func (ec *executionContext) _UpdateSAMLConfigurationPayload(ctx context.Context,
 	return out
 }
 
+var updateStateOfApplicabilityPayloadImplementors = []string{"UpdateStateOfApplicabilityPayload"}
+
+func (ec *executionContext) _UpdateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdateStateOfApplicabilityPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, updateStateOfApplicabilityPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("UpdateStateOfApplicabilityPayload")
+		case "stateOfApplicability":
+			out.Values[i] = ec._UpdateStateOfApplicabilityPayload_stateOfApplicability(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var updateTaskPayloadImplementors = []string{"UpdateTaskPayload"}
 
 func (ec *executionContext) _UpdateTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdateTaskPayload) graphql.Marshaler {
@@ -90473,6 +95486,60 @@ var (
 	}
 )
 
+func (ec *executionContext) marshalNAvailableStateOfApplicabilityControl2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐAvailableStateOfApplicabilityControlᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.AvailableStateOfApplicabilityControl) graphql.Marshaler {
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNAvailableStateOfApplicabilityControl2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐAvailableStateOfApplicabilityControl(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNAvailableStateOfApplicabilityControl2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐAvailableStateOfApplicabilityControl(ctx context.Context, sel ast.SelectionSet, v *types.AvailableStateOfApplicabilityControl) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._AvailableStateOfApplicabilityControl(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNBigInt2int64(ctx context.Context, v any) (int64, error) {
 	res, err := bigint.UnmarshalBigIntScalar(v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -91657,6 +96724,25 @@ func (ec *executionContext) marshalNCreateControlMeasureMappingPayload2ᚖgoᚗp
 	return ec._CreateControlMeasureMappingPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNCreateControlObligationMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlObligationMappingInput(ctx context.Context, v any) (types.CreateControlObligationMappingInput, error) {
+	res, err := ec.unmarshalInputCreateControlObligationMappingInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNCreateControlObligationMappingPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, v types.CreateControlObligationMappingPayload) graphql.Marshaler {
+	return ec._CreateControlObligationMappingPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNCreateControlObligationMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, v *types.CreateControlObligationMappingPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._CreateControlObligationMappingPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) marshalNCreateControlPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateControlPayload(ctx context.Context, sel ast.SelectionSet, v types.CreateControlPayload) graphql.Marshaler {
 	return ec._CreateControlPayload(ctx, sel, &v)
 }
@@ -92070,6 +97156,44 @@ func (ec *executionContext) marshalNCreateSnapshotPayload2ᚖgoᚗproboᚗincᚋ
 	return ec._CreateSnapshotPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNCreateStateOfApplicabilityControlMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityControlMappingInput(ctx context.Context, v any) (types.CreateStateOfApplicabilityControlMappingInput, error) {
+	res, err := ec.unmarshalInputCreateStateOfApplicabilityControlMappingInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNCreateStateOfApplicabilityControlMappingPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, v types.CreateStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	return ec._CreateStateOfApplicabilityControlMappingPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNCreateStateOfApplicabilityControlMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, v *types.CreateStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._CreateStateOfApplicabilityControlMappingPayload(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNCreateStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityInput(ctx context.Context, v any) (types.CreateStateOfApplicabilityInput, error) {
+	res, err := ec.unmarshalInputCreateStateOfApplicabilityInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNCreateStateOfApplicabilityPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v types.CreateStateOfApplicabilityPayload) graphql.Marshaler {
+	return ec._CreateStateOfApplicabilityPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNCreateStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v *types.CreateStateOfApplicabilityPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._CreateStateOfApplicabilityPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNCreateTaskInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateTaskInput(ctx context.Context, v any) (types.CreateTaskInput, error) {
 	res, err := ec.unmarshalInputCreateTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -92753,6 +97877,25 @@ func (ec *executionContext) marshalNDeleteControlMeasureMappingPayload2ᚖgoᚗp
 	return ec._DeleteControlMeasureMappingPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNDeleteControlObligationMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlObligationMappingInput(ctx context.Context, v any) (types.DeleteControlObligationMappingInput, error) {
+	res, err := ec.unmarshalInputDeleteControlObligationMappingInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNDeleteControlObligationMappingPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, v types.DeleteControlObligationMappingPayload) graphql.Marshaler {
+	return ec._DeleteControlObligationMappingPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNDeleteControlObligationMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlObligationMappingPayload(ctx context.Context, sel ast.SelectionSet, v *types.DeleteControlObligationMappingPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._DeleteControlObligationMappingPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) marshalNDeleteControlPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteControlPayload(ctx context.Context, sel ast.SelectionSet, v types.DeleteControlPayload) graphql.Marshaler {
 	return ec._DeleteControlPayload(ctx, sel, &v)
 }
@@ -93223,6 +98366,44 @@ func (ec *executionContext) marshalNDeleteSnapshotPayload2ᚖgoᚗproboᚗincᚋ
 	return ec._DeleteSnapshotPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNDeleteStateOfApplicabilityControlMappingInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityControlMappingInput(ctx context.Context, v any) (types.DeleteStateOfApplicabilityControlMappingInput, error) {
+	res, err := ec.unmarshalInputDeleteStateOfApplicabilityControlMappingInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNDeleteStateOfApplicabilityControlMappingPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, v types.DeleteStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	return ec._DeleteStateOfApplicabilityControlMappingPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNDeleteStateOfApplicabilityControlMappingPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityControlMappingPayload(ctx context.Context, sel ast.SelectionSet, v *types.DeleteStateOfApplicabilityControlMappingPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._DeleteStateOfApplicabilityControlMappingPayload(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNDeleteStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityInput(ctx context.Context, v any) (types.DeleteStateOfApplicabilityInput, error) {
+	res, err := ec.unmarshalInputDeleteStateOfApplicabilityInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNDeleteStateOfApplicabilityPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v types.DeleteStateOfApplicabilityPayload) graphql.Marshaler {
+	return ec._DeleteStateOfApplicabilityPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNDeleteStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v *types.DeleteStateOfApplicabilityPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._DeleteStateOfApplicabilityPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNDeleteTaskInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteTaskInput(ctx context.Context, v any) (types.DeleteTaskInput, error) {
 	res, err := ec.unmarshalInputDeleteTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -94227,6 +99408,25 @@ func (ec *executionContext) marshalNExportSignableDocumentVersionPDFPayload2ᚖg
 	return ec._ExportSignableDocumentVersionPDFPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNExportStateOfApplicabilityPDFInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportStateOfApplicabilityPDFInput(ctx context.Context, v any) (types.ExportStateOfApplicabilityPDFInput, error) {
+	res, err := ec.unmarshalInputExportStateOfApplicabilityPDFInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNExportStateOfApplicabilityPDFPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportStateOfApplicabilityPDFPayload(ctx context.Context, sel ast.SelectionSet, v types.ExportStateOfApplicabilityPDFPayload) graphql.Marshaler {
+	return ec._ExportStateOfApplicabilityPDFPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNExportStateOfApplicabilityPDFPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportStateOfApplicabilityPDFPayload(ctx context.Context, sel ast.SelectionSet, v *types.ExportStateOfApplicabilityPDFPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._ExportStateOfApplicabilityPDFPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNExportTransferImpactAssessmentsPDFInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐExportTransferImpactAssessmentsPDFInput(ctx context.Context, v any) (types.ExportTransferImpactAssessmentsPDFInput, error) {
 	res, err := ec.unmarshalInputExportTransferImpactAssessmentsPDFInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -95379,6 +100579,34 @@ var (
 	}
 )
 
+func (ec *executionContext) unmarshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx context.Context, v any) (coredata.ObligationType, error) {
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType[tmp]
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx context.Context, sel ast.SelectionSet, v coredata.ObligationType) graphql.Marshaler {
+	_ = sel
+	res := graphql.MarshalString(marshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType[v])
+	if res == graphql.Null {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+	}
+	return res
+}
+
+var (
+	unmarshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType = map[string]coredata.ObligationType{
+		"LEGAL":       coredata.ObligationTypeLegal,
+		"CONTRACTUAL": coredata.ObligationTypeContractual,
+	}
+	marshalNObligationType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType = map[coredata.ObligationType]string{
+		coredata.ObligationTypeLegal:       "LEGAL",
+		coredata.ObligationTypeContractual: "CONTRACTUAL",
+	}
+)
+
 func (ec *executionContext) unmarshalNOrderDirection2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐOrderDirection(ctx context.Context, v any) (page.OrderDirection, error) {
 	tmp, err := graphql.UnmarshalString(v)
 	res := unmarshalNOrderDirection2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐOrderDirection[tmp]
@@ -96807,14 +102035,15 @@ func (ec *executionContext) marshalNSnapshotsType2goᚗproboᚗincᚋproboᚋpkg
 
 var (
 	unmarshalNSnapshotsType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSnapshotsType = map[string]coredata.SnapshotsType{
-		"RISKS":                  coredata.SnapshotsTypeRisks,
-		"VENDORS":                coredata.SnapshotsTypeVendors,
-		"ASSETS":                 coredata.SnapshotsTypeAssets,
-		"DATA":                   coredata.SnapshotsTypeData,
-		"NONCONFORMITIES":        coredata.SnapshotsTypeNonconformities,
-		"OBLIGATIONS":            coredata.SnapshotsTypeObligations,
-		"CONTINUAL_IMPROVEMENTS": coredata.SnapshotsTypeContinualImprovements,
-		"PROCESSING_ACTIVITIES":  coredata.SnapshotsTypeProcessingActivities,
+		"RISKS":                   coredata.SnapshotsTypeRisks,
+		"VENDORS":                 coredata.SnapshotsTypeVendors,
+		"ASSETS":                  coredata.SnapshotsTypeAssets,
+		"DATA":                    coredata.SnapshotsTypeData,
+		"NONCONFORMITIES":         coredata.SnapshotsTypeNonconformities,
+		"OBLIGATIONS":             coredata.SnapshotsTypeObligations,
+		"CONTINUAL_IMPROVEMENTS":  coredata.SnapshotsTypeContinualImprovements,
+		"PROCESSING_ACTIVITIES":   coredata.SnapshotsTypeProcessingActivities,
+		"STATES_OF_APPLICABILITY": coredata.SnapshotsTypeStatesOfApplicability,
 	}
 	marshalNSnapshotsType2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐSnapshotsType = map[coredata.SnapshotsType]string{
 		coredata.SnapshotsTypeRisks:                 "RISKS",
@@ -96825,6 +102054,195 @@ var (
 		coredata.SnapshotsTypeObligations:           "OBLIGATIONS",
 		coredata.SnapshotsTypeContinualImprovements: "CONTINUAL_IMPROVEMENTS",
 		coredata.SnapshotsTypeProcessingActivities:  "PROCESSING_ACTIVITIES",
+		coredata.SnapshotsTypeStatesOfApplicability: "STATES_OF_APPLICABILITY",
+	}
+)
+
+func (ec *executionContext) marshalNStateOfApplicability2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicability(ctx context.Context, sel ast.SelectionSet, v types.StateOfApplicability) graphql.Marshaler {
+	return ec._StateOfApplicability(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicability2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicability(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicability) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicability(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityConnection2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityConnection(ctx context.Context, sel ast.SelectionSet, v types.StateOfApplicabilityConnection) graphql.Marshaler {
+	return ec._StateOfApplicabilityConnection(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityConnection(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicabilityConnection) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicabilityConnection(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityControl2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControl(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicabilityControl) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicabilityControl(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityControlConnection2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlConnection(ctx context.Context, sel ast.SelectionSet, v types.StateOfApplicabilityControlConnection) graphql.Marshaler {
+	return ec._StateOfApplicabilityControlConnection(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityControlConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlConnection(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicabilityControlConnection) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicabilityControlConnection(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityControlEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlEdgeᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.StateOfApplicabilityControlEdge) graphql.Marshaler {
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNStateOfApplicabilityControlEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlEdge(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityControlEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityControlEdge(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicabilityControlEdge) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicabilityControlEdge(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityEdgeᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.StateOfApplicabilityEdge) graphql.Marshaler {
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNStateOfApplicabilityEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityEdge(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityEdge(ctx context.Context, sel ast.SelectionSet, v *types.StateOfApplicabilityEdge) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._StateOfApplicabilityEdge(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField(ctx context.Context, v any) (coredata.StateOfApplicabilityOrderField, error) {
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField[tmp]
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField(ctx context.Context, sel ast.SelectionSet, v coredata.StateOfApplicabilityOrderField) graphql.Marshaler {
+	_ = sel
+	res := graphql.MarshalString(marshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField[v])
+	if res == graphql.Null {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+	}
+	return res
+}
+
+var (
+	unmarshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField = map[string]coredata.StateOfApplicabilityOrderField{
+		"NAME":       coredata.StateOfApplicabilityOrderFieldName,
+		"CREATED_AT": coredata.StateOfApplicabilityOrderFieldCreatedAt,
+	}
+	marshalNStateOfApplicabilityOrderField2goᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐStateOfApplicabilityOrderField = map[coredata.StateOfApplicabilityOrderField]string{
+		coredata.StateOfApplicabilityOrderFieldName:      "NAME",
+		coredata.StateOfApplicabilityOrderFieldCreatedAt: "CREATED_AT",
 	}
 )
 
@@ -98057,6 +103475,25 @@ func (ec *executionContext) marshalNUpdateSAMLConfigurationPayload2ᚖgoᚗprobo
 	return ec._UpdateSAMLConfigurationPayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNUpdateStateOfApplicabilityInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateStateOfApplicabilityInput(ctx context.Context, v any) (types.UpdateStateOfApplicabilityInput, error) {
+	res, err := ec.unmarshalInputUpdateStateOfApplicabilityInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNUpdateStateOfApplicabilityPayload2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v types.UpdateStateOfApplicabilityPayload) graphql.Marshaler {
+	return ec._UpdateStateOfApplicabilityPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNUpdateStateOfApplicabilityPayload2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateStateOfApplicabilityPayload(ctx context.Context, sel ast.SelectionSet, v *types.UpdateStateOfApplicabilityPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._UpdateStateOfApplicabilityPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNUpdateTaskInput2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateTaskInput(ctx context.Context, v any) (types.UpdateTaskInput, error) {
 	res, err := ec.unmarshalInputUpdateTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -100527,6 +105964,43 @@ var (
 	}
 )
 
+func (ec *executionContext) unmarshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx context.Context, v any) (*coredata.ObligationType, error) {
+	if v == nil {
+		return nil, nil
+	}
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType[tmp]
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType(ctx context.Context, sel ast.SelectionSet, v *coredata.ObligationType) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	_ = sel
+	_ = ctx
+	res := graphql.MarshalString(marshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType[*v])
+	return res
+}
+
+var (
+	unmarshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType = map[string]coredata.ObligationType{
+		"LEGAL":       coredata.ObligationTypeLegal,
+		"CONTRACTUAL": coredata.ObligationTypeContractual,
+	}
+	marshalOObligationType2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋcoredataᚐObligationType = map[coredata.ObligationType]string{
+		coredata.ObligationTypeLegal:       "LEGAL",
+		coredata.ObligationTypeContractual: "CONTRACTUAL",
+	}
+)
+
+func (ec *executionContext) marshalOOrganization2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrganization(ctx context.Context, sel ast.SelectionSet, v *types.Organization) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	return ec._Organization(ctx, sel, v)
+}
+
 func (ec *executionContext) marshalOOrganizationContext2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐOrganizationContext(ctx context.Context, sel ast.SelectionSet, v *types.OrganizationContext) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null
@@ -100987,6 +106461,22 @@ func (ec *executionContext) unmarshalOSnapshotOrder2ᚖgoᚗproboᚗincᚋprobo
 	return &res, graphql.ErrorOnPath(ctx, err)
 }
 
+func (ec *executionContext) unmarshalOStateOfApplicabilityFilter2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityFilter(ctx context.Context, v any) (*types.StateOfApplicabilityFilter, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputStateOfApplicabilityFilter(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) unmarshalOStateOfApplicabilityOrder2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋconsoleᚋv1ᚋtypesᚐStateOfApplicabilityOrderBy(ctx context.Context, v any) (*types.StateOfApplicabilityOrderBy, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputStateOfApplicabilityOrder(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) unmarshalOString2ᚕstringᚄ(ctx context.Context, v any) ([]string, error) {
 	if v == nil {
 		return nil, nil
diff --git a/pkg/server/api/console/v1/types/control.go b/pkg/server/api/console/v1/types/control.go
index 507865ae4..930923033 100644
--- a/pkg/server/api/console/v1/types/control.go
+++ b/pkg/server/api/console/v1/types/control.go
@@ -16,6 +16,7 @@ type Control struct {
 	Description            *string                `json:"description,omitempty"`
 	Status                 coredata.ControlStatus `json:"status"`
 	ExclusionJustification *string                `json:"exclusionJustification,omitempty"`
+	BestPractice           bool                   `json:"bestPractice"`
 	Framework              *Framework             `json:"framework"`
 	Measures               *MeasureConnection     `json:"measures"`
 	Documents              *DocumentConnection    `json:"documents"`
@@ -72,6 +73,7 @@ func NewControl(control *coredata.Control) *Control {
 		Description:            control.Description,
 		Status:                 control.Status,
 		ExclusionJustification: control.ExclusionJustification,
+		BestPractice:           control.BestPractice,
 		CreatedAt:              control.CreatedAt,
 		UpdatedAt:              control.UpdatedAt,
 	}
diff --git a/pkg/server/api/console/v1/types/state_of_applicability.go b/pkg/server/api/console/v1/types/state_of_applicability.go
new file mode 100644
index 000000000..198bb62ad
--- /dev/null
+++ b/pkg/server/api/console/v1/types/state_of_applicability.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityOrderBy OrderBy[coredata.StateOfApplicabilityOrderField]
+
+	StateOfApplicabilityConnection struct {
+		TotalCount int
+		Edges      []*StateOfApplicabilityEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+		Filters  *coredata.StateOfApplicabilityFilter
+	}
+)
+
+func NewStateOfApplicabilityConnection(
+	p *page.Page[*coredata.StateOfApplicability, coredata.StateOfApplicabilityOrderField],
+	parentType any,
+	parentID gid.GID,
+	filters *coredata.StateOfApplicabilityFilter,
+) *StateOfApplicabilityConnection {
+	var edges = make([]*StateOfApplicabilityEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewStateOfApplicabilityEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &StateOfApplicabilityConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+		Filters:  filters,
+	}
+}
+
+func NewStateOfApplicabilityEdge(soa *coredata.StateOfApplicability, orderBy coredata.StateOfApplicabilityOrderField) *StateOfApplicabilityEdge {
+	return &StateOfApplicabilityEdge{
+		Cursor: soa.CursorKey(orderBy),
+		Node:   NewStateOfApplicability(soa),
+	}
+}
+
+func NewStateOfApplicability(soa *coredata.StateOfApplicability) *StateOfApplicability {
+	return &StateOfApplicability{
+		ID:         soa.ID,
+		Name:       soa.Name,
+		SourceID:   soa.SourceID,
+		SnapshotID: soa.SnapshotID,
+		CreatedAt:  soa.CreatedAt,
+		UpdatedAt:  soa.UpdatedAt,
+	}
+}
diff --git a/pkg/server/api/console/v1/types/state_of_applicability_control_connection.go b/pkg/server/api/console/v1/types/state_of_applicability_control_connection.go
new file mode 100644
index 000000000..5af6f89b2
--- /dev/null
+++ b/pkg/server/api/console/v1/types/state_of_applicability_control_connection.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	StateOfApplicabilityControlConnection struct {
+		TotalCount int
+		Edges      []*StateOfApplicabilityControlEdge
+		PageInfo   PageInfo
+
+		Resolver any
+		ParentID gid.GID
+	}
+
+	StateOfApplicabilityControlEdge struct {
+		Cursor page.CursorKey
+		Node   *StateOfApplicabilityControl
+	}
+)
+
+func NewStateOfApplicabilityControlConnection(
+	p *page.Page[*coredata.StateOfApplicabilityControl, coredata.StateOfApplicabilityOrderField],
+	parentType any,
+	parentID gid.GID,
+) *StateOfApplicabilityControlConnection {
+	edges := make([]*StateOfApplicabilityControlEdge, len(p.Data))
+	for i, control := range p.Data {
+		edges[i] = NewStateOfApplicabilityControlEdge(control, p.Cursor.OrderBy.Field)
+	}
+
+	return &StateOfApplicabilityControlConnection{
+		Edges:    edges,
+		PageInfo: *NewPageInfo(p),
+
+		Resolver: parentType,
+		ParentID: parentID,
+	}
+}
+
+func NewStateOfApplicabilityControlEdge(
+	control *coredata.StateOfApplicabilityControl,
+	orderBy coredata.StateOfApplicabilityOrderField,
+) *StateOfApplicabilityControlEdge {
+	return &StateOfApplicabilityControlEdge{
+		Cursor: control.CursorKey(orderBy),
+		Node:   NewStateOfApplicabilityControl(control),
+	}
+}
+
+func NewStateOfApplicabilityControl(control *coredata.StateOfApplicabilityControl) *StateOfApplicabilityControl {
+	return &StateOfApplicabilityControl{
+		ID:                     control.ID,
+		StateOfApplicabilityID: control.StateOfApplicabilityID,
+		ControlID:              control.ControlID,
+		Applicability:          control.Applicability,
+		Justification:          control.Justification,
+	}
+}
diff --git a/pkg/server/api/console/v1/types/types.go b/pkg/server/api/console/v1/types/types.go
index 2f92dd76b..f79d62c98 100644
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -88,6 +88,22 @@ type AuditEdge struct {
 	Node   *Audit         `json:"node"`
 }
 
+type AvailableStateOfApplicabilityControl struct {
+	ControlID              gid.GID  `json:"controlId"`
+	SectionTitle           string   `json:"sectionTitle"`
+	Name                   string   `json:"name"`
+	FrameworkID            gid.GID  `json:"frameworkId"`
+	FrameworkName          string   `json:"frameworkName"`
+	OrganizationID         gid.GID  `json:"organizationId"`
+	StateOfApplicabilityID *gid.GID `json:"stateOfApplicabilityId,omitempty"`
+	Applicability          *bool    `json:"applicability,omitempty"`
+	Justification          *string  `json:"justification,omitempty"`
+	BestPractice           bool     `json:"bestPractice"`
+	Regulatory             bool     `json:"regulatory"`
+	Contractual            bool     `json:"contractual"`
+	RiskAssessment         bool     `json:"riskAssessment"`
+}
+
 type BulkDeleteDocumentsInput struct {
 	DocumentIds []gid.GID `json:"documentIds"`
 }
@@ -249,6 +265,7 @@ type CreateControlInput struct {
 	Description            *string                `json:"description,omitempty"`
 	Status                 coredata.ControlStatus `json:"status"`
 	ExclusionJustification *string                `json:"exclusionJustification,omitempty"`
+	BestPractice           bool                   `json:"bestPractice"`
 }
 
 type CreateControlMeasureMappingInput struct {
@@ -261,6 +278,16 @@ type CreateControlMeasureMappingPayload struct {
 	MeasureEdge *MeasureEdge `json:"measureEdge"`
 }
 
+type CreateControlObligationMappingInput struct {
+	ControlID    gid.GID `json:"controlId"`
+	ObligationID gid.GID `json:"obligationId"`
+}
+
+type CreateControlObligationMappingPayload struct {
+	ControlEdge    *ControlEdge    `json:"controlEdge"`
+	ObligationEdge *ObligationEdge `json:"obligationEdge"`
+}
+
 type CreateControlPayload struct {
 	ControlEdge *ControlEdge `json:"controlEdge"`
 }
@@ -407,6 +434,7 @@ type CreateObligationInput struct {
 	LastReviewDate         *time.Time                `json:"lastReviewDate,omitempty"`
 	DueDate                *time.Time                `json:"dueDate,omitempty"`
 	Status                 coredata.ObligationStatus `json:"status"`
+	Type                   coredata.ObligationType   `json:"type"`
 }
 
 type CreateObligationPayload struct {
@@ -560,6 +588,27 @@ type CreateSnapshotPayload struct {
 	SnapshotEdge *SnapshotEdge `json:"snapshotEdge"`
 }
 
+type CreateStateOfApplicabilityControlMappingInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+	ControlID              gid.GID `json:"controlId"`
+	Applicability          bool    `json:"applicability"`
+	Justification          *string `json:"justification,omitempty"`
+}
+
+type CreateStateOfApplicabilityControlMappingPayload struct {
+	StateOfApplicabilityControlEdge *StateOfApplicabilityControlEdge `json:"stateOfApplicabilityControlEdge"`
+}
+
+type CreateStateOfApplicabilityInput struct {
+	OrganizationID gid.GID `json:"organizationId"`
+	Name           string  `json:"name"`
+	OwnerID        gid.GID `json:"ownerId"`
+}
+
+type CreateStateOfApplicabilityPayload struct {
+	StateOfApplicabilityEdge *StateOfApplicabilityEdge `json:"stateOfApplicabilityEdge"`
+}
+
 type CreateTaskInput struct {
 	OrganizationID gid.GID        `json:"organizationId"`
 	MeasureID      *gid.GID       `json:"measureId,omitempty"`
@@ -807,6 +856,16 @@ type DeleteControlMeasureMappingPayload struct {
 	DeletedMeasureID gid.GID `json:"deletedMeasureId"`
 }
 
+type DeleteControlObligationMappingInput struct {
+	ControlID    gid.GID `json:"controlId"`
+	ObligationID gid.GID `json:"obligationId"`
+}
+
+type DeleteControlObligationMappingPayload struct {
+	DeletedControlID    gid.GID `json:"deletedControlId"`
+	DeletedObligationID gid.GID `json:"deletedObligationId"`
+}
+
 type DeleteControlPayload struct {
 	DeletedControlID gid.GID `json:"deletedControlId"`
 }
@@ -1011,6 +1070,25 @@ type DeleteSnapshotPayload struct {
 	DeletedSnapshotID gid.GID `json:"deletedSnapshotId"`
 }
 
+type DeleteStateOfApplicabilityControlMappingInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+	ControlID              gid.GID `json:"controlId"`
+}
+
+type DeleteStateOfApplicabilityControlMappingPayload struct {
+	DeletedStateOfApplicabilityID        gid.GID `json:"deletedStateOfApplicabilityId"`
+	DeletedControlID                     gid.GID `json:"deletedControlId"`
+	DeletedStateOfApplicabilityControlID gid.GID `json:"deletedStateOfApplicabilityControlId"`
+}
+
+type DeleteStateOfApplicabilityInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+}
+
+type DeleteStateOfApplicabilityPayload struct {
+	DeletedStateOfApplicabilityID gid.GID `json:"deletedStateOfApplicabilityId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -1265,6 +1343,14 @@ type ExportSignableDocumentVersionPDFPayload struct {
 	Data string `json:"data"`
 }
 
+type ExportStateOfApplicabilityPDFInput struct {
+	StateOfApplicabilityID gid.GID `json:"stateOfApplicabilityId"`
+}
+
+type ExportStateOfApplicabilityPDFPayload struct {
+	Data string `json:"data"`
+}
+
 type ExportTransferImpactAssessmentsPDFInput struct {
 	OrganizationID gid.GID                         `json:"organizationId"`
 	Filter         *TransferImpactAssessmentFilter `json:"filter,omitempty"`
@@ -1521,6 +1607,7 @@ type Obligation struct {
 	LastReviewDate         *time.Time                `json:"lastReviewDate,omitempty"`
 	DueDate                *time.Time                `json:"dueDate,omitempty"`
 	Status                 coredata.ObligationStatus `json:"status"`
+	Type                   coredata.ObligationType   `json:"type"`
 	CreatedAt              time.Time                 `json:"createdAt"`
 	UpdatedAt              time.Time                 `json:"updatedAt"`
 }
@@ -1556,6 +1643,7 @@ type Organization struct {
 	Peoples                         *PeopleConnection                         `json:"peoples"`
 	Documents                       *DocumentConnection                       `json:"documents"`
 	Meetings                        *MeetingConnection                        `json:"meetings"`
+	StatesOfApplicability           *StateOfApplicabilityConnection           `json:"statesOfApplicability"`
 	Measures                        *MeasureConnection                        `json:"measures"`
 	Risks                           *RiskConnection                           `json:"risks"`
 	Tasks                           *TaskConnection                           `json:"tasks"`
@@ -1878,6 +1966,46 @@ type SnapshotEdge struct {
 	Node   *Snapshot      `json:"node"`
 }
 
+type StateOfApplicability struct {
+	ID                gid.GID                                 `json:"id"`
+	Name              string                                  `json:"name"`
+	SourceID          *gid.GID                                `json:"sourceId,omitempty"`
+	SnapshotID        *gid.GID                                `json:"snapshotId,omitempty"`
+	Organization      *Organization                           `json:"organization,omitempty"`
+	Owner             *People                                 `json:"owner"`
+	Controls          *ControlConnection                      `json:"controls"`
+	AvailableControls []*AvailableStateOfApplicabilityControl `json:"availableControls"`
+	CreatedAt         time.Time                               `json:"createdAt"`
+	UpdatedAt         time.Time                               `json:"updatedAt"`
+}
+
+func (StateOfApplicability) IsNode()             {}
+func (this StateOfApplicability) GetID() gid.GID { return this.ID }
+
+type StateOfApplicabilityControl struct {
+	ID                     gid.GID               `json:"id"`
+	StateOfApplicabilityID gid.GID               `json:"stateOfApplicabilityId"`
+	ControlID              gid.GID               `json:"controlId"`
+	StateOfApplicability   *StateOfApplicability `json:"stateOfApplicability"`
+	Applicability          bool                  `json:"applicability"`
+	Justification          *string               `json:"justification,omitempty"`
+}
+
+type StateOfApplicabilityControlInput struct {
+	ControlID     gid.GID `json:"controlId"`
+	Applicability bool    `json:"applicability"`
+	Justification *string `json:"justification,omitempty"`
+}
+
+type StateOfApplicabilityEdge struct {
+	Cursor page.CursorKey        `json:"cursor"`
+	Node   *StateOfApplicability `json:"node"`
+}
+
+type StateOfApplicabilityFilter struct {
+	SnapshotID *gid.GID `json:"snapshotId,omitempty"`
+}
+
 type Task struct {
 	ID           gid.GID             `json:"id"`
 	Name         string              `json:"name"`
@@ -2072,6 +2200,7 @@ type UpdateControlInput struct {
 	Description            graphql.Omittable[*string] `json:"description,omitempty"`
 	Status                 *coredata.ControlStatus    `json:"status,omitempty"`
 	ExclusionJustification *string                    `json:"exclusionJustification,omitempty"`
+	BestPractice           *bool                      `json:"bestPractice,omitempty"`
 }
 
 type UpdateControlPayload struct {
@@ -2199,6 +2328,7 @@ type UpdateObligationInput struct {
 	LastReviewDate         graphql.Omittable[*time.Time] `json:"lastReviewDate,omitempty"`
 	DueDate                graphql.Omittable[*time.Time] `json:"dueDate,omitempty"`
 	Status                 *coredata.ObligationStatus    `json:"status,omitempty"`
+	Type                   *coredata.ObligationType      `json:"type,omitempty"`
 }
 
 type UpdateObligationPayload struct {
@@ -2326,6 +2456,16 @@ type UpdateSAMLConfigurationPayload struct {
 	SamlConfiguration *SAMLConfiguration `json:"samlConfiguration"`
 }
 
+type UpdateStateOfApplicabilityInput struct {
+	ID      gid.GID  `json:"id"`
+	Name    *string  `json:"name,omitempty"`
+	OwnerID *gid.GID `json:"ownerId,omitempty"`
+}
+
+type UpdateStateOfApplicabilityPayload struct {
+	StateOfApplicability *StateOfApplicability `json:"stateOfApplicability"`
+}
+
 type UpdateTaskInput struct {
 	TaskID       gid.GID                           `json:"taskId"`
 	Name         *string                           `json:"name,omitempty"`
diff --git a/pkg/server/api/console/v1/v1_resolver.go b/pkg/server/api/console/v1/v1_resolver.go
index 71f3ba268..7a72876b1 100644
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -482,6 +482,38 @@ func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first
 	return types.NewAuditConnection(page, r, obj.ID), nil
 }
 
+// Obligations is the resolver for the obligations field.
+func (r *controlResolver) Obligations(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy, filter *types.ObligationFilter) (*types.ObligationConnection, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListObligations)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
+		Field:     coredata.ObligationOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ObligationOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var snapshotID **gid.GID
+	if filter != nil {
+		snapshotID = &filter.SnapshotID
+	}
+	obligationFilter := coredata.NewObligationFilter(snapshotID)
+	page, err := prb.Obligations.ListForControlID(ctx, obj.ID, cursor, obligationFilter)
+	if err != nil {
+		panic(fmt.Errorf("cannot list control obligations: %w", err))
+	}
+
+	return types.NewObligationConnection(page, r, obj.ID, filter), nil
+}
+
 // Snapshots is the resolver for the snapshots field.
 func (r *controlResolver) Snapshots(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SnapshotOrderBy) (*types.SnapshotConnection, error) {
 	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListSnapshots)
@@ -510,6 +542,33 @@ func (r *controlResolver) Snapshots(ctx context.Context, obj *types.Control, fir
 	return types.NewSnapshotConnection(page, r, obj.ID), nil
 }
 
+// StateOfApplicabilityControls is the resolver for the stateOfApplicabilityControls field.
+func (r *controlResolver) StateOfApplicabilityControls(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy) (*types.StateOfApplicabilityControlConnection, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListStatesOfApplicability)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.StateOfApplicabilityOrderField]{
+		Field:     coredata.StateOfApplicabilityOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.StateOfApplicabilityOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	p, err := prb.StatesOfApplicability.ListControlLinks(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
+	}
+
+	return types.NewStateOfApplicabilityControlConnection(p, r, obj.ID), nil
+}
+
 // TotalCount is the resolver for the totalCount field.
 func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.ControlConnection) (int, error) {
 	prb := r.ProboService(ctx, obj.ParentID.TenantID())
@@ -546,6 +605,12 @@ func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.C
 			panic(fmt.Errorf("cannot count controls: %w", err))
 		}
 		return count, nil
+	case *stateOfApplicabilityResolver:
+		count, err := prb.Controls.CountForStateOfApplicabilityID(ctx, obj.ParentID, obj.Filters)
+		if err != nil {
+			panic(fmt.Errorf("cannot count controls: %w", err))
+		}
+		return count, nil
 	}
 
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
@@ -2502,6 +2567,7 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 		SectionTitle:           input.SectionTitle,
 		Status:                 &input.Status,
 		ExclusionJustification: input.ExclusionJustification,
+		BestPractice:           input.BestPractice,
 	})
 	if err != nil {
 		var errAlreadyExists *coredata.ErrControlAlreadyExists
@@ -2529,6 +2595,7 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 		SectionTitle:           input.SectionTitle,
 		Status:                 input.Status,
 		ExclusionJustification: input.ExclusionJustification,
+		BestPractice:           input.BestPractice,
 	})
 
 	if err != nil {
@@ -2718,6 +2785,40 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp
 	}, nil
 }
 
+// CreateStateOfApplicabilityControlMapping is the resolver for the createStateOfApplicabilityControlMapping field.
+func (r *mutationResolver) CreateStateOfApplicabilityControlMapping(ctx context.Context, input types.CreateStateOfApplicabilityControlMappingInput) (*types.CreateStateOfApplicabilityControlMappingPayload, error) {
+	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateStateOfApplicabilityControlMapping)
+
+	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+
+	control, err := prb.StatesOfApplicability.LinkControl(ctx, input.StateOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
+	if err != nil {
+		panic(fmt.Errorf("cannot create state of applicability control mapping: %w", err))
+	}
+
+	return &types.CreateStateOfApplicabilityControlMappingPayload{
+		StateOfApplicabilityControlEdge: types.NewStateOfApplicabilityControlEdge(control, coredata.StateOfApplicabilityOrderFieldCreatedAt),
+	}, nil
+}
+
+// DeleteStateOfApplicabilityControlMapping is the resolver for the deleteStateOfApplicabilityControlMapping field.
+func (r *mutationResolver) DeleteStateOfApplicabilityControlMapping(ctx context.Context, input types.DeleteStateOfApplicabilityControlMappingInput) (*types.DeleteStateOfApplicabilityControlMappingPayload, error) {
+	r.MustBeAuthorized(ctx, input.StateOfApplicabilityID, authz.ActionDeleteStateOfApplicabilityControlMapping)
+
+	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+
+	deletedID, err := prb.StatesOfApplicability.DeleteControlLink(ctx, input.StateOfApplicabilityID, input.ControlID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete state of applicability control mapping: %w", err))
+	}
+
+	return &types.DeleteStateOfApplicabilityControlMappingPayload{
+		DeletedStateOfApplicabilityID:        input.StateOfApplicabilityID,
+		DeletedControlID:                     input.ControlID,
+		DeletedStateOfApplicabilityControlID: deletedID,
+	}, nil
+}
+
 // CreateControlAuditMapping is the resolver for the createControlAuditMapping field.
 func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input types.CreateControlAuditMappingInput) (*types.CreateControlAuditMappingPayload, error) {
 	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlAuditMapping)
@@ -2752,6 +2853,40 @@ func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input
 	}, nil
 }
 
+// CreateControlObligationMapping is the resolver for the createControlObligationMapping field.
+func (r *mutationResolver) CreateControlObligationMapping(ctx context.Context, input types.CreateControlObligationMappingInput) (*types.CreateControlObligationMappingPayload, error) {
+	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlObligationMapping)
+
+	prb := r.ProboService(ctx, input.ObligationID.TenantID())
+
+	control, obligation, err := prb.Controls.CreateObligationMapping(ctx, input.ControlID, input.ObligationID)
+	if err != nil {
+		panic(fmt.Errorf("cannot create control obligation mapping: %w", err))
+	}
+
+	return &types.CreateControlObligationMappingPayload{
+		ControlEdge:    types.NewControlEdge(control, coredata.ControlOrderFieldCreatedAt),
+		ObligationEdge: types.NewObligationEdge(obligation, coredata.ObligationOrderFieldCreatedAt),
+	}, nil
+}
+
+// DeleteControlObligationMapping is the resolver for the deleteControlObligationMapping field.
+func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, input types.DeleteControlObligationMappingInput) (*types.DeleteControlObligationMappingPayload, error) {
+	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlObligationMapping)
+
+	prb := r.ProboService(ctx, input.ObligationID.TenantID())
+
+	control, obligation, err := prb.Controls.DeleteObligationMapping(ctx, input.ControlID, input.ObligationID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete control obligation mapping: %w", err))
+	}
+
+	return &types.DeleteControlObligationMappingPayload{
+		DeletedControlID:    control.ID,
+		DeletedObligationID: obligation.ID,
+	}, nil
+}
+
 // CreateControlSnapshotMapping is the resolver for the createControlSnapshotMapping field.
 func (r *mutationResolver) CreateControlSnapshotMapping(ctx context.Context, input types.CreateControlSnapshotMappingInput) (*types.CreateControlSnapshotMappingPayload, error) {
 	r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlSnapshotMapping)
@@ -3396,6 +3531,100 @@ func (r *mutationResolver) DeleteMeeting(ctx context.Context, input types.Delete
 	}, nil
 }
 
+// CreateStateOfApplicability is the resolver for the createStateOfApplicability field.
+func (r *mutationResolver) CreateStateOfApplicability(ctx context.Context, input types.CreateStateOfApplicabilityInput) (*types.CreateStateOfApplicabilityPayload, error) {
+	r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateStateOfApplicability)
+
+	prb := r.ProboService(ctx, input.OrganizationID.TenantID())
+
+	stateOfApplicability, err := prb.StatesOfApplicability.Create(
+		ctx,
+		probo.CreateStateOfApplicabilityRequest{
+			OrganizationID: input.OrganizationID,
+			Name:           input.Name,
+			OwnerID:        input.OwnerID,
+		},
+	)
+	if err != nil {
+		var errAlreadyExists *coredata.ErrStateOfApplicabilityAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, gqlutils.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot create state_of_applicability: %w", err))
+	}
+
+	return &types.CreateStateOfApplicabilityPayload{
+		StateOfApplicabilityEdge: types.NewStateOfApplicabilityEdge(stateOfApplicability, coredata.StateOfApplicabilityOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateStateOfApplicability is the resolver for the updateStateOfApplicability field.
+func (r *mutationResolver) UpdateStateOfApplicability(ctx context.Context, input types.UpdateStateOfApplicabilityInput) (*types.UpdateStateOfApplicabilityPayload, error) {
+	r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateStateOfApplicability)
+
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	var name *string
+	if input.Name != nil {
+		name = input.Name
+	}
+
+	stateOfApplicability, err := prb.StatesOfApplicability.Update(
+		ctx,
+		probo.UpdateStateOfApplicabilityRequest{
+			StateOfApplicabilityID: input.ID,
+			Name:                   name,
+			OwnerID:                input.OwnerID,
+		},
+	)
+	if err != nil {
+		var errAlreadyExists *coredata.ErrStateOfApplicabilityAlreadyExists
+		if errors.As(err, &errAlreadyExists) {
+			return nil, gqlutils.Conflict(errAlreadyExists)
+		}
+		panic(fmt.Errorf("cannot update state_of_applicability: %w", err))
+	}
+
+	return &types.UpdateStateOfApplicabilityPayload{
+		StateOfApplicability: types.NewStateOfApplicability(stateOfApplicability),
+	}, nil
+}
+
+// DeleteStateOfApplicability is the resolver for the deleteStateOfApplicability field.
+func (r *mutationResolver) DeleteStateOfApplicability(ctx context.Context, input types.DeleteStateOfApplicabilityInput) (*types.DeleteStateOfApplicabilityPayload, error) {
+	r.MustBeAuthorized(ctx, input.StateOfApplicabilityID, authz.ActionDeleteStateOfApplicability)
+
+	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+
+	err := prb.StatesOfApplicability.Delete(ctx, input.StateOfApplicabilityID)
+	if err != nil {
+		panic(fmt.Errorf("cannot delete state_of_applicability: %w", err))
+	}
+
+	return &types.DeleteStateOfApplicabilityPayload{
+		DeletedStateOfApplicabilityID: input.StateOfApplicabilityID,
+	}, nil
+}
+
+// ExportStateOfApplicabilityPDF is the resolver for the exportStateOfApplicabilityPDF field.
+func (r *mutationResolver) ExportStateOfApplicabilityPDF(ctx context.Context, input types.ExportStateOfApplicabilityPDFInput) (*types.ExportStateOfApplicabilityPDFPayload, error) {
+	r.MustBeAuthorized(ctx, input.StateOfApplicabilityID, authz.ActionUpdateStateOfApplicability)
+
+	prb := r.ProboService(ctx, input.StateOfApplicabilityID.TenantID())
+
+	pdfData, err := prb.StatesOfApplicability.ExportPDF(ctx, input.StateOfApplicabilityID)
+	if err != nil {
+		panic(fmt.Errorf("cannot export state of applicability PDF: %w", err))
+	}
+
+	base64Data := base64.StdEncoding.EncodeToString(pdfData)
+	dataURI := fmt.Sprintf("data:application/pdf;base64,%s", base64Data)
+
+	return &types.ExportStateOfApplicabilityPDFPayload{
+		Data: dataURI,
+	}, nil
+}
+
 // PublishDocumentVersion is the resolver for the publishDocumentVersion field.
 func (r *mutationResolver) PublishDocumentVersion(ctx context.Context, input types.PublishDocumentVersionInput) (*types.PublishDocumentVersionPayload, error) {
 	r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionPublishDocumentVersion)
@@ -4194,7 +4423,8 @@ func (r *mutationResolver) CreateObligation(ctx context.Context, input types.Cre
 		OwnerID:                input.OwnerID,
 		LastReviewDate:         input.LastReviewDate,
 		DueDate:                input.DueDate,
-		Status:                 &input.Status,
+		Status:                 input.Status,
+		Type:                   input.Type,
 	}
 
 	obligation, err := prb.Obligations.Create(ctx, &req)
@@ -4224,6 +4454,7 @@ func (r *mutationResolver) UpdateObligation(ctx context.Context, input types.Upd
 		LastReviewDate:         UnwrapOmittable(input.LastReviewDate),
 		DueDate:                UnwrapOmittable(input.DueDate),
 		Status:                 input.Status,
+		Type:                   input.Type,
 	}
 
 	obligation, err := prb.Obligations.Update(ctx, &req)
@@ -5403,6 +5634,38 @@ func (r *organizationResolver) Meetings(ctx context.Context, obj *types.Organiza
 	return types.NewMeetingConnection(page, r, obj.ID), nil
 }
 
+// StatesOfApplicability is the resolver for the statesOfApplicability field.
+func (r *organizationResolver) StatesOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StateOfApplicabilityOrderBy, filter *types.StateOfApplicabilityFilter) (*types.StateOfApplicabilityConnection, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListStatesOfApplicability)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.StateOfApplicabilityOrderField]{
+		Field:     coredata.StateOfApplicabilityOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.StateOfApplicabilityOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var stateOfApplicabilityFilter = coredata.NewStateOfApplicabilityFilter(nil)
+	if filter != nil {
+		stateOfApplicabilityFilter = coredata.NewStateOfApplicabilityFilter(&filter.SnapshotID)
+	}
+
+	page, err := prb.StatesOfApplicability.ListForOrganizationID(ctx, obj.ID, cursor, stateOfApplicabilityFilter)
+	if err != nil {
+		panic(fmt.Errorf("cannot list organization states_of_applicability: %w", err))
+	}
+
+	return types.NewStateOfApplicabilityConnection(page, r, obj.ID, stateOfApplicabilityFilter), nil
+}
+
 // Measures is the resolver for the measures field.
 func (r *organizationResolver) Measures(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
 	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListMeasures)
@@ -6334,6 +6597,17 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewRightsRequest(rightsRequest), nil
+	case coredata.StateOfApplicabilityEntityType:
+		stateOfApplicability, err := prb.StatesOfApplicability.Get(ctx, id)
+		if err != nil {
+			var errNotFound *coredata.ErrStateOfApplicabilityNotFound
+			if errors.As(err, &errNotFound) {
+				return nil, gqlutils.NotFound(errNotFound)
+			}
+			panic(fmt.Errorf("cannot get state_of_applicability: %w", err))
+		}
+
+		return types.NewStateOfApplicability(stateOfApplicability), nil
 	default:
 	}
 
@@ -6804,6 +7078,151 @@ func (r *snapshotConnectionResolver) TotalCount(ctx context.Context, obj *types.
 	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
 }
 
+// Organization is the resolver for the organization field.
+func (r *stateOfApplicabilityResolver) Organization(ctx context.Context, obj *types.StateOfApplicability) (*types.Organization, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	stateOfApplicability, err := prb.StatesOfApplicability.Get(ctx, obj.ID)
+	if err != nil {
+		var errNotFound *coredata.ErrStateOfApplicabilityNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load state_of_applicability: %w", err))
+	}
+
+	organization, err := prb.Organizations.Get(ctx, stateOfApplicability.OrganizationID)
+	if err != nil {
+		var errNotFound *coredata.ErrOrganizationNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load organization: %w", err))
+	}
+
+	return types.NewOrganization(organization), nil
+}
+
+// Owner is the resolver for the owner field.
+func (r *stateOfApplicabilityResolver) Owner(ctx context.Context, obj *types.StateOfApplicability) (*types.People, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	stateOfApplicability, err := prb.StatesOfApplicability.Get(ctx, obj.ID)
+	if err != nil {
+		var errNotFound *coredata.ErrStateOfApplicabilityNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load state_of_applicability: %w", err))
+	}
+
+	people, err := prb.Peoples.Get(ctx, stateOfApplicability.OwnerID)
+	if err != nil {
+		var errNotFound *coredata.ErrPeopleNotFound
+		if errors.As(err, &errNotFound) {
+			return nil, gqlutils.NotFound(errNotFound)
+		}
+		panic(fmt.Errorf("cannot load owner: %w", err))
+	}
+
+	return types.NewPeople(people), nil
+}
+
+// Controls is the resolver for the controls field.
+func (r *stateOfApplicabilityResolver) Controls(ctx context.Context, obj *types.StateOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListControls)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
+		Field:     coredata.ControlOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ControlOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	var controlFilter = coredata.NewControlFilter(nil)
+	if filter != nil {
+		controlFilter = coredata.NewControlFilter(filter.Query)
+	}
+
+	page, err := prb.Controls.ListForStateOfApplicabilityID(ctx, obj.ID, cursor, controlFilter)
+	if err != nil {
+		panic(fmt.Errorf("cannot list state of applicability controls: %w", err))
+	}
+
+	return types.NewControlConnection(page, r, obj.ID, controlFilter), nil
+}
+
+// AvailableControls is the resolver for the availableControls field.
+func (r *stateOfApplicabilityResolver) AvailableControls(ctx context.Context, obj *types.StateOfApplicability) ([]*types.AvailableStateOfApplicabilityControl, error) {
+	r.MustBeAuthorized(ctx, obj.ID, authz.ActionListControls)
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	availableControls, err := prb.StatesOfApplicability.ListAvailableControls(ctx, obj.ID)
+	if err != nil {
+		panic(fmt.Errorf("cannot list available controls: %w", err))
+	}
+
+	result := make([]*types.AvailableStateOfApplicabilityControl, 0, len(availableControls))
+	for _, ac := range availableControls {
+		result = append(result, &types.AvailableStateOfApplicabilityControl{
+			ControlID:              ac.ControlID,
+			SectionTitle:           ac.SectionTitle,
+			Name:                   ac.Name,
+			FrameworkID:            ac.FrameworkID,
+			FrameworkName:          ac.FrameworkName,
+			OrganizationID:         ac.OrganizationID,
+			StateOfApplicabilityID: ac.StateOfApplicabilityID,
+			Applicability:          ac.Applicability,
+			Justification:          ac.Justification,
+			BestPractice:           ac.BestPractice,
+			Regulatory:             ac.Regulatory,
+			Contractual:            ac.Contractual,
+			RiskAssessment:         ac.RiskAssessment,
+		})
+	}
+
+	return result, nil
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *stateOfApplicabilityConnectionResolver) TotalCount(ctx context.Context, obj *types.StateOfApplicabilityConnection) (int, error) {
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	switch obj.Resolver.(type) {
+	case *organizationResolver:
+		count, err := prb.StatesOfApplicability.CountForOrganizationID(ctx, obj.ParentID, obj.Filters)
+		if err != nil {
+			panic(fmt.Errorf("cannot count states_of_applicability: %w", err))
+		}
+		return count, nil
+	}
+
+	panic(fmt.Errorf("unsupported resolver: %T", obj.Resolver))
+}
+
+// StateOfApplicability is the resolver for the stateOfApplicability field.
+func (r *stateOfApplicabilityControlResolver) StateOfApplicability(ctx context.Context, obj *types.StateOfApplicabilityControl) (*types.StateOfApplicability, error) {
+	r.MustBeAuthorized(ctx, obj.StateOfApplicabilityID, authz.ActionGet)
+
+	prb := r.ProboService(ctx, obj.StateOfApplicabilityID.TenantID())
+
+	soa, err := prb.StatesOfApplicability.Get(ctx, obj.StateOfApplicabilityID)
+	if err != nil {
+		panic(fmt.Errorf("cannot get state of applicability: %w", err))
+	}
+
+	return types.NewStateOfApplicability(soa), nil
+}
+
 // AssignedTo is the resolver for the assignedTo field.
 func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.People, error) {
 	r.MustBeAuthorized(ctx, obj.ID, authz.ActionGetAssignedTo)
@@ -8055,6 +8474,21 @@ func (r *Resolver) SnapshotConnection() schema.SnapshotConnectionResolver {
 	return &snapshotConnectionResolver{r}
 }
 
+// StateOfApplicability returns schema.StateOfApplicabilityResolver implementation.
+func (r *Resolver) StateOfApplicability() schema.StateOfApplicabilityResolver {
+	return &stateOfApplicabilityResolver{r}
+}
+
+// StateOfApplicabilityConnection returns schema.StateOfApplicabilityConnectionResolver implementation.
+func (r *Resolver) StateOfApplicabilityConnection() schema.StateOfApplicabilityConnectionResolver {
+	return &stateOfApplicabilityConnectionResolver{r}
+}
+
+// StateOfApplicabilityControl returns schema.StateOfApplicabilityControlResolver implementation.
+func (r *Resolver) StateOfApplicabilityControl() schema.StateOfApplicabilityControlResolver {
+	return &stateOfApplicabilityControlResolver{r}
+}
+
 // Task returns schema.TaskResolver implementation.
 func (r *Resolver) Task() schema.TaskResolver { return &taskResolver{r} }
 
@@ -8197,6 +8631,9 @@ type sAMLConfigurationResolver struct{ *Resolver }
 type signableDocumentResolver struct{ *Resolver }
 type snapshotResolver struct{ *Resolver }
 type snapshotConnectionResolver struct{ *Resolver }
+type stateOfApplicabilityResolver struct{ *Resolver }
+type stateOfApplicabilityConnectionResolver struct{ *Resolver }
+type stateOfApplicabilityControlResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type taskConnectionResolver struct{ *Resolver }
 type transferImpactAssessmentResolver struct{ *Resolver }
diff --git a/pkg/server/api/mcp/v1/schema.resolvers.go b/pkg/server/api/mcp/v1/schema.resolvers.go
index e861245a8..12b2bb6dd 100644
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -868,7 +868,8 @@ func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolReque
 			OwnerID:                input.OwnerID,
 			LastReviewDate:         input.LastReviewDate,
 			DueDate:                input.DueDate,
-			Status:                 input.Status,
+			Status:                 *input.Status,
+			Type:                   *input.Type,
 		},
 	)
 	if err != nil {
@@ -898,6 +899,7 @@ func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRe
 			LastReviewDate:         UnwrapOmittable(input.LastReviewDate),
 			DueDate:                UnwrapOmittable(input.DueDate),
 			Status:                 input.Status,
+			Type:                   input.Type,
 		},
 	)
 	if err != nil {
diff --git a/pkg/server/api/mcp/v1/specification.yaml b/pkg/server/api/mcp/v1/specification.yaml
index 26a46dd4b..0bae6f6c8 100644
--- a/pkg/server/api/mcp/v1/specification.yaml
+++ b/pkg/server/api/mcp/v1/specification.yaml
@@ -1759,6 +1759,13 @@ components:
         - COMPLIANT
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ObligationStatus
 
+    ObligationType:
+      type: string
+      enum:
+        - LEGAL
+        - CONTRACTUAL
+      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.ObligationType
+
     ObligationOrderField:
       type: string
       enum:
@@ -1921,6 +1928,7 @@ components:
         - organization_id
         - owner_id
         - status
+        - type
       properties:
         organization_id:
           $ref: "#/components/schemas/GID"
@@ -1958,6 +1966,13 @@ components:
             - type: "null"
               description: No status
           description: Status
+        type:
+          anyOf:
+            - $ref: "#/components/schemas/ObligationType"
+              description: Obligation type
+            - type: "null"
+              description: No type
+          description: Type
 
     AddObligationOutput:
       type: object
@@ -2018,6 +2033,13 @@ components:
             - type: "null"
               description: No status
           description: Status
+        type:
+          anyOf:
+            - $ref: "#/components/schemas/ObligationType"
+              description: Obligation type
+            - type: "null"
+              description: No type
+          description: Type
 
     UpdateObligationOutput:
       type: object
@@ -3150,6 +3172,7 @@ components:
         - OBLIGATIONS
         - CONTINUAL_IMPROVEMENTS
         - PROCESSING_ACTIVITIES
+        - STATES_OF_APPLICABILITY
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.SnapshotsType
 
     SnapshotOrderField:
diff --git a/pkg/server/api/mcp/v1/types/types.go b/pkg/server/api/mcp/v1/types/types.go
index c3a5ebf54..a62fe5dac 100644
--- a/pkg/server/api/mcp/v1/types/types.go
+++ b/pkg/server/api/mcp/v1/types/types.go
@@ -31,7 +31,7 @@ var (
 	AddMeasureToolOutputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","required":["measure"],"properties":{"measure":{"type":"object","required":["id","category","name","state","created_at","updated_at"],"properties":{"category":{"type":"string","description":"Measure category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Measure description"},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Measure name"},"state":{"type":"string","enum":["NOT_STARTED","IN_PROGRESS","NOT_APPLICABLE","IMPLEMENTED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	AddNonconformityToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","reference_id","root_cause","owner_id","status"],"properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No audit"}]},"corrective_action":{"type":"string","description":"Corrective action"},"date_identified":{"type":"string","description":"Date identified","format":"date-time"},"description":{"type":"string","description":"Description"},"due_date":{"type":"string","description":"Due date","format":"date-time"},"effectiveness_check":{"type":"string","description":"Effectiveness check"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]},{"type":"null","description":"No status"}]}}}`)
 	AddNonconformityToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","required":["nonconformity"],"properties":{"nonconformity":{"type":"object","required":["id","organization_id","reference_id","root_cause","owner_id","status","created_at","updated_at"],"properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No audit"}]},"corrective_action":{"description":"Corrective action"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
-	AddObligationToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","owner_id","status"],"properties":{"actions_to_be_implemented":{"type":"string","description":"Actions to be implemented"},"area":{"type":"string","description":"Area"},"due_date":{"type":"string","description":"Due date","format":"date-time"},"last_review_date":{"type":"string","description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"type":"string","description":"Regulator"},"requirement":{"type":"string","description":"Requirement"},"source":{"type":"string","description":"Source"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},{"type":"null","description":"No status"}]}}}`)
+	AddObligationToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","owner_id","status","type"],"properties":{"actions_to_be_implemented":{"type":"string","description":"Actions to be implemented"},"area":{"type":"string","description":"Area"},"due_date":{"type":"string","description":"Due date","format":"date-time"},"last_review_date":{"type":"string","description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"type":"string","description":"Regulator"},"requirement":{"type":"string","description":"Requirement"},"source":{"type":"string","description":"Source"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},{"type":"null","description":"No status"}]},"type":{"description":"Type","anyOf":[{"type":"string","enum":["LEGAL","CONTRACTUAL"]},{"type":"null","description":"No type"}]}}}`)
 	AddObligationToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","required":["obligation"],"properties":{"obligation":{"type":"object","required":["id","organization_id","owner_id","status","created_at","updated_at"],"properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"source":{"description":"Source"},"source_id":{"description":"Source ID"},"status":{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	AddPeopleToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","full_name","primary_email_address","kind"],"properties":{"additional_email_addresses":{"type":"array","description":"Additional email addresses","items":{"type":"string","format":"string"}},"contract_end_date":{"type":"string","description":"Contract end date","format":"date-time"},"contract_start_date":{"type":"string","description":"Contract start date","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"type":"string","description":"Position"},"primary_email_address":{"type":"string","format":"string"}}}`)
 	AddPeopleToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","required":["people"],"properties":{"people":{"type":"object","required":["id","organization_id","full_name","primary_email_address","additional_email_addresses","kind","created_at","updated_at"],"properties":{"additional_email_addresses":{"type":"array","description":"Additional email addresses","items":{"type":"string","format":"string"}},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"primary_email_address":{"type":"string","format":"string"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
@@ -80,7 +80,7 @@ var (
 	GetRiskToolInputSchema                          = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"id":{"type":"string","format":"string"}}}`)
 	GetRiskToolOutputSchema                         = mcp.MustUnmarshalSchema(`{"type":"object","required":["risk"],"properties":{"risk":{"type":"object","required":["id","organization_id","name","category","treatment","inherent_likelihood","inherent_impact","inherent_risk_score","residual_likelihood","residual_impact","residual_risk_score","note","created_at","updated_at"],"properties":{"category":{"type":"string","description":"Risk category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"inherent_risk_score":{"type":"integer","description":"Inherent risk score"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"organization_id":{"type":"string","format":"string"},"owner_id":{"anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No owner"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"residual_risk_score":{"type":"integer","description":"Residual risk score"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	GetSnapshotToolInputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"id":{"type":"string","format":"string"}}}`)
-	GetSnapshotToolOutputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshot"],"properties":{"snapshot":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES"]}}}}}`)
+	GetSnapshotToolOutputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshot"],"properties":{"snapshot":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}}}}}`)
 	GetTaskToolInputSchema                          = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"id":{"type":"string","format":"string"}}}`)
 	GetTaskToolOutputSchema                         = mcp.MustUnmarshalSchema(`{"type":"object","required":["task"],"properties":{"task":{"type":"object","required":["id","organization_id","name","state","created_at","updated_at"],"properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	LinkControlAuditToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","required":["control_id","audit_id"],"properties":{"audit_id":{"type":"string","format":"string"},"control_id":{"type":"string","format":"string"}}}`)
@@ -122,7 +122,7 @@ var (
 	ListRisksToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id"],"properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"query":{"type":"string","description":"Search query"},"snapshot_id":{"type":"string","format":"string"}}},"order_by":{"type":"object","required":["field","direction"],"properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","UPDATED_AT","NAME","CATEGORY","TREATMENT","INHERENT_RISK_SCORE","RESIDUAL_RISK_SCORE","OWNER_FULL_NAME"]}}},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}}}`)
 	ListRisksToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","required":["risks"],"properties":{"next_cursor":{"type":"string","format":"string"},"risks":{"type":"array","items":{"type":"object","required":["id","organization_id","name","category","treatment","inherent_likelihood","inherent_impact","inherent_risk_score","residual_likelihood","residual_impact","residual_risk_score","note","created_at","updated_at"],"properties":{"category":{"type":"string","description":"Risk category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Risk description"},"id":{"type":"string","format":"string"},"inherent_impact":{"type":"integer","description":"Inherent impact"},"inherent_likelihood":{"type":"integer","description":"Inherent likelihood"},"inherent_risk_score":{"type":"integer","description":"Inherent risk score"},"name":{"type":"string","description":"Risk name"},"note":{"type":"string","description":"Risk note"},"organization_id":{"type":"string","format":"string"},"owner_id":{"anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No owner"}]},"residual_impact":{"type":"integer","description":"Residual impact"},"residual_likelihood":{"type":"integer","description":"Residual likelihood"},"residual_risk_score":{"type":"integer","description":"Residual risk score"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"treatment":{"type":"string","enum":["MITIGATED","ACCEPTED","AVOIDED","TRANSFERRED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}}`)
 	ListSnapshotsToolInputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id"],"properties":{"cursor":{"type":"string","format":"string"},"order_by":{"type":"object","required":["field","direction"],"properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","NAME","TYPE"]}}},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}}}`)
-	ListSnapshotsToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshots"],"properties":{"next_cursor":{"description":"Next page cursor","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"snapshots":{"type":"array","description":"List of snapshots","items":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES"]}}}}}}`)
+	ListSnapshotsToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshots"],"properties":{"next_cursor":{"description":"Next page cursor","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"snapshots":{"type":"array","description":"List of snapshots","items":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}}}}}}`)
 	ListTasksToolInputSchema                        = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id"],"properties":{"cursor":{"type":"string","format":"string"},"measure_id":{"type":"string","format":"string"},"order_by":{"type":"object","required":["field","direction"],"properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT"]}}},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}}}`)
 	ListTasksToolOutputSchema                       = mcp.MustUnmarshalSchema(`{"type":"object","required":["tasks"],"properties":{"next_cursor":{"description":"Next page cursor","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"tasks":{"type":"array","description":"List of tasks","items":{"type":"object","required":["id","organization_id","name","state","created_at","updated_at"],"properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}}`)
 	ListVendorsToolInputSchema                      = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id"],"properties":{"cursor":{"type":"string","format":"string"},"filter":{"type":"object","properties":{"snapshot_id":{"type":"string","format":"string"}}},"order_by":{"type":"object","required":["field","direction"],"properties":{"direction":{"type":"string","enum":["ASC","DESC"]},"field":{"type":"string","enum":["CREATED_AT","UPDATED_AT","NAME"]}}},"organization_id":{"type":"string","format":"string"},"size":{"type":"integer","description":"Page size"}}}`)
@@ -131,8 +131,8 @@ var (
 	PublishDocumentVersionToolOutputSchema          = mcp.MustUnmarshalSchema(`{"type":"object","required":["document","document_version"],"properties":{"document":{"type":"object","required":["id","organization_id","owner_id","title","document_type","classification","trust_center_visibility","created_at","updated_at"],"properties":{"classification":{"type":"string","enum":["PUBLIC","INTERNAL","CONFIDENTIAL","SECRET"]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"current_published_version":{"description":"Current published version number"},"document_type":{"type":"string","enum":["OTHER","ISMS","POLICY","PROCEDURE"]},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"title":{"type":"string","description":"Document title"},"trust_center_visibility":{"type":"string","enum":["NONE","PRIVATE","PUBLIC"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}},"document_version":{"type":"object","required":["id","organization_id","document_id","title","owner_id","version_number","classification","content","changelog","status","created_at","updated_at"],"properties":{"changelog":{"type":"string","description":"Changelog"},"classification":{"type":"string","enum":["PUBLIC","INTERNAL","CONFIDENTIAL","SECRET"]},"content":{"type":"string","description":"Document content"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"document_id":{"type":"string","format":"string"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"published_at":{"description":"Published timestamp","format":"date-time"},"status":{"type":"string","enum":["DRAFT","PUBLISHED"]},"title":{"type":"string","description":"Document version title"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"},"version_number":{"type":"integer","description":"Version number"}}}}}`)
 	RequestDocumentVersionSignatureToolInputSchema  = mcp.MustUnmarshalSchema(`{"type":"object","required":["document_version_id","signatory_id"],"properties":{"document_version_id":{"type":"string","format":"string"},"signatory_id":{"type":"string","format":"string"}}}`)
 	RequestDocumentVersionSignatureToolOutputSchema = mcp.MustUnmarshalSchema(`{"type":"object","required":["document_version_signature"],"properties":{"document_version_signature":{"type":"object","required":["id","organization_id","document_version_id","state","signed_by","requested_at","created_at","updated_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"document_version_id":{"type":"string","format":"string"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"requested_at":{"type":"string","description":"Requested timestamp","format":"date-time"},"signed_at":{"description":"Signed timestamp","format":"date-time"},"signed_by":{"type":"string","format":"string"},"state":{"type":"string","enum":["REQUESTED","SIGNED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
-	TakeSnapshotToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","name","type"],"properties":{"description":{"type":"string","description":"Snapshot description"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES"]}}}`)
-	TakeSnapshotToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshot"],"properties":{"snapshot":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES"]}}}}}`)
+	TakeSnapshotToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["organization_id","name","type"],"properties":{"description":{"type":"string","description":"Snapshot description"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}}}`)
+	TakeSnapshotToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["snapshot"],"properties":{"snapshot":{"type":"object","required":["id","organization_id","name","type","created_at"],"properties":{"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Snapshot description","anyOf":[{"type":"string","description":"Snapshot description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Snapshot name"},"organization_id":{"type":"string","format":"string"},"type":{"type":"string","enum":["RISKS","VENDORS","ASSETS","DATA","NONCONFORMITIES","OBLIGATIONS","CONTINUAL_IMPROVEMENTS","PROCESSING_ACTIVITIES","STATES_OF_APPLICABILITY"]}}}}}`)
 	UnassignTaskToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"id":{"type":"string","format":"string"}}}`)
 	UnassignTaskToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["task"],"properties":{"task":{"type":"object","required":["id","organization_id","name","state","created_at","updated_at"],"properties":{"assigned_to_id":{"description":"Assigned to person ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"Not assigned"}]},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"deadline":{"description":"Deadline","anyOf":[{"type":"string","description":"Deadline","format":"date-time"},{"type":"null","description":"No deadline"}]},"description":{"description":"Task description","anyOf":[{"type":"string","description":"Task description"},{"type":"null","description":"No description"}]},"id":{"type":"string","format":"string"},"measure_id":{"description":"Measure ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No measure"}]},"name":{"type":"string","description":"Task name"},"organization_id":{"type":"string","format":"string"},"state":{"type":"string","enum":["TODO","DONE"]},"time_estimate":{"description":"Time estimate","anyOf":[{"type":"string","description":"A duration"},{"type":"null","description":"No time estimate"}]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	UnlinkControlAuditToolInputSchema               = mcp.MustUnmarshalSchema(`{"type":"object","required":["control_id","audit_id"],"properties":{"audit_id":{"type":"string","format":"string"},"control_id":{"type":"string","format":"string"}}}`)
@@ -163,7 +163,7 @@ var (
 	UpdateMeasureToolOutputSchema                   = mcp.MustUnmarshalSchema(`{"type":"object","required":["measure"],"properties":{"measure":{"type":"object","required":["id","category","name","state","created_at","updated_at"],"properties":{"category":{"type":"string","description":"Measure category"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"description":{"description":"Measure description"},"id":{"type":"string","format":"string"},"name":{"type":"string","description":"Measure name"},"state":{"type":"string","enum":["NOT_STARTED","IN_PROGRESS","NOT_APPLICABLE","IMPLEMENTED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	UpdateNonconformityToolInputSchema              = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"corrective_action":{"description":"Corrective action"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]}}}`)
 	UpdateNonconformityToolOutputSchema             = mcp.MustUnmarshalSchema(`{"type":"object","required":["nonconformity"],"properties":{"nonconformity":{"type":"object","required":["id","organization_id","reference_id","root_cause","owner_id","status","created_at","updated_at"],"properties":{"audit_id":{"description":"Audit ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No audit"}]},"corrective_action":{"description":"Corrective action"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"date_identified":{"description":"Date identified","format":"date-time"},"description":{"description":"Description"},"due_date":{"description":"Due date","format":"date-time"},"effectiveness_check":{"description":"Effectiveness check"},"id":{"type":"string","format":"string"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"reference_id":{"type":"string","description":"Reference ID"},"root_cause":{"type":"string","description":"Root cause"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"status":{"type":"string","enum":["OPEN","IN_PROGRESS","CLOSED"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
-	UpdateObligationToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"source":{"description":"Source"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},{"type":"null","description":"No status"}]}}}`)
+	UpdateObligationToolInputSchema                 = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"owner_id":{"description":"Owner ID","anyOf":[{"type":"string","format":"string"},{"type":"null"}]},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"source":{"description":"Source"},"status":{"description":"Status","anyOf":[{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},{"type":"null","description":"No status"}]},"type":{"description":"Type","anyOf":[{"type":"string","enum":["LEGAL","CONTRACTUAL"]},{"type":"null","description":"No type"}]}}}`)
 	UpdateObligationToolOutputSchema                = mcp.MustUnmarshalSchema(`{"type":"object","required":["obligation"],"properties":{"obligation":{"type":"object","required":["id","organization_id","owner_id","status","created_at","updated_at"],"properties":{"actions_to_be_implemented":{"description":"Actions to be implemented"},"area":{"description":"Area"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"due_date":{"description":"Due date","format":"date-time"},"id":{"type":"string","format":"string"},"last_review_date":{"description":"Last review date","format":"date-time"},"organization_id":{"type":"string","format":"string"},"owner_id":{"type":"string","format":"string"},"regulator":{"description":"Regulator"},"requirement":{"description":"Requirement"},"snapshot_id":{"description":"Snapshot ID","anyOf":[{"type":"string","format":"string"},{"type":"null","description":"No snapshot"}]},"source":{"description":"Source"},"source_id":{"description":"Source ID"},"status":{"type":"string","enum":["NON_COMPLIANT","PARTIALLY_COMPLIANT","COMPLIANT"]},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
 	UpdatePeopleToolInputSchema                     = mcp.MustUnmarshalSchema(`{"type":"object","required":["id"],"properties":{"additional_email_addresses":{"description":"Additional email addresses","anyOf":[{"type":"array","items":{"type":"string","format":"string"}},{"type":"null","description":"No additional email addresses"}]},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"position":{"description":"Position"},"primary_email_address":{"type":"string","format":"string"}}}`)
 	UpdatePeopleToolOutputSchema                    = mcp.MustUnmarshalSchema(`{"type":"object","required":["people"],"properties":{"people":{"type":"object","required":["id","organization_id","full_name","primary_email_address","additional_email_addresses","kind","created_at","updated_at"],"properties":{"additional_email_addresses":{"type":"array","description":"Additional email addresses","items":{"type":"string","format":"string"}},"contract_end_date":{"description":"Contract end date","format":"date-time"},"contract_start_date":{"description":"Contract start date","format":"date-time"},"created_at":{"type":"string","description":"Creation timestamp","format":"date-time"},"full_name":{"type":"string","description":"Full name"},"id":{"type":"string","format":"string"},"kind":{"type":"string","enum":["EMPLOYEE","CONTRACTOR","SERVICE_ACCOUNT"]},"organization_id":{"type":"string","format":"string"},"position":{"description":"Position"},"primary_email_address":{"type":"string","format":"string"},"updated_at":{"type":"string","description":"Update timestamp","format":"date-time"}}}}}`)
@@ -395,6 +395,8 @@ type AddObligationInput struct {
 	Source *string `json:"source,omitempty"`
 	// Status
 	Status *coredata.ObligationStatus `json:"status"`
+	// Type
+	Type *coredata.ObligationType `json:"type"`
 }
 
 // AddObligationOutput represents the schema
@@ -2016,6 +2018,8 @@ type UpdateObligationInput struct {
 	Source mcp.Omittable[*string] `json:"source,omitempty"`
 	// Status
 	Status *coredata.ObligationStatus `json:"status,omitempty"`
+	// Type
+	Type *coredata.ObligationType `json:"type,omitempty"`
 }
 
 // UpdateObligationOutput represents the schema