soa-first-draft
Use this after the risk assessment and treatment plan exist, not before: an applicability statement written first is a guess dressed as a decision. You get two files in a new folder, ./soa-first-draft/: a draft statement of applicability as a spreadsheet you can open in Excel, one row per control saying whether it applies, why, how far along it is and where the proof sits (soa.csv), and a short note with the status scale, the mismatches found and the questions for owners (soa-notes.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Control selection is a management decision; the agent proposes it.
Inputs to gather
Read: the scope statement, the risk register and treatment plan, the register of legal, regulatory and contractual obligations if one exists, customer contracts and questionnaire answers that promise specific practices, policies and procedures, and any evidence index or compliance platform export. Then load the list of control identifiers from the reader's licensed copy of the standard or their compliance platform. If neither is available, stop and ask; never reconstruct the control list or its titles from memory. Ask the reader who approves the statement and when the next audit is.
Step 1: collect the reasons to include
For every control identifier, collect every reason it is needed, each with an id, as the first columns of the draft statement (soa.csv):
- Risk: a treated risk in the register whose treatment names this control or an action it covers (R-012).
- Obligation: a law, regulation or contract clause that calls for the practice (OBL-04, or the contract reference).
- Commitment: a customer questionnaire answer, trust page claim or certification promise that says the company does it.
- Baseline: a practice the company runs as a matter of policy even without a specific risk; say why.
A control with at least one reason is included. Record all reasons, not only the first; the auditor reads the reasons to judge whether the risk assessment drove the selection.