sbd.govassure.uk

Statement of Applicability (SoA) Generator

Identify the Secure by Design controls and associated risks that apply to your project, based on the data you handle, the people you serve and the technologies you use.

Project details

Capture the metadata that will appear on the front page of your Statement of Applicability.

Per the Government Security Classifications Policy 2023.

How to use this tool

  1. 1. Enter project details.
  2. 2. Select the data types your service handles.
  3. 3. Identify your stakeholders.
  4. 4. Identify the technologies in scope.
  5. 5. Review the recommended controls, set priority and capture risks.
  6. 6. Export to Word, PDF or CSV.

All data is held in your browser. Nothing is sent to a server.

Data types in scope

Tick every data category your service will create, process, store or share. Each selection drives the list of applicable controls and the legislation that applies.

Stakeholders

Tick every group that will interact with the service or whose data is processed by it.

Technologies and architecture

Tick every technology component or pattern that is part of the design.

Applicable controls and risk register

Each control below has been identified as applicable to your selected data, stakeholders and technologies. Open a control to see its mapping to Secure by Design, NCSC CAF v4.0 and the NIST SP 800-53, and capture inherent and residual risk.

The "Applicable" view filters the full control library by your data, stakeholder and technology selections. Switch to "All" to browse the complete framework, or to "Baseline" for the curated minimum.
Show

0 controls match

By default the recommended baseline is included and all other controls are excluded. Use these actions to bulk-include or reset.

Review and export

Statement of Applicability ready

Generate your document below.
Controls how much detail appears in the on-screen preview, Word export and printed PDF. The CSV register always contains every control regardless of this setting.

Export options

Generate a printable Statement of Applicability or a data file that can be imported into a project risk register.

Document preview

Configuration map

A traceability matrix of how scope becomes controls. Read across a row to see what a selection brings in; read down a column to see what put a control there. Generated live from the same gate, tier and weighting tables the tool uses to set defaults.

Scope selection → control

 
Cell: selection opens this gate universal, no gate Control: included held by tier out of scope Weight: 5 4 3 2 1

Secure by Design

What this tool maps to, what it does not cover, and where it fits in Secure by Design delivery.

Secure by Design is mandatory for government departments and arm’s length bodies. This tool produces one of the artefacts it asks for — an agreed, justified control set. It is not, on its own, evidence of Secure by Design compliance.