DS-1 Conduct threat modeling
Perform threat modelling to identify potential threats and enumerate mitigating controls, covering both the running application and the artefacts and pipeline that produce it.
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Coverage of build artefacts and pipeline in the model · Source control / CI pipeline
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Threat models for in-scope applications with dates · Policy repository / GRC workspace
- Identified threats mapped to mitigating controls · Document repository
- Trigger conditions requiring a model refresh · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Source control / CI pipeline); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- threat model produced once at design and never revisited
- model covers the application but not the pipeline that deploys it
- threats enumerated with no owner for the mitigations
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDP-8 Ensure security of key and certificate repository · DS-2 Ensure software supply chain security