What evidence do auditors commonly ask for on TVM-04 Threat Analysis and Modelling?

Threat analysis procedure with inputs, outputs and review frequency; Threat models for key cloud systems, for example using STRIDE, PASTA or MITRE ATT&CK; Threat landscape reports or intelligence summaries; Records linking threat model outputs to risk treatment decisions; Review history of the threat models.

What is the most common gap auditors find on TVM-04?

Threat models built for one system at launch and never updated

CSA CCM v4.1 · TVM - Threat & Vulnerability Management

`TVM-04` Threat Analysis and Modelling

The organisation sets up, operates and evaluates a process and procedures for analysing threats, so it can identify, assess and review the threats facing its cloud systems. It produces threat models following recognised industry methods and uses them to shape how it mitigates risk.

Source: CSA CCM v4.1, TVM-04. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CSA CCM v4.1 in the compliance library.

Version 4.1 adds 11 controls (among them API security, log sanitisation and a service bill of materials) and renumbers several domains. CSA accepts v4.0.x during its transition; if your STAR assessment is still on v4.0.1, check the numbering against it.

artefacts

held by a system

at each review

moderate

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Records linking threat model outputs to risk treatment decisions · Policy repository / GRC workspace
Review history of the threat models · Document repository

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Threat analysis procedure with inputs, outputs and review frequency · Policy repository / GRC workspace
Threat models for key cloud systems, for example using STRIDE, PASTA or MITRE ATT&CK · Policy repository / GRC workspace
Threat landscape reports or intelligence summaries · Document repository

First move

Start with the 2 of 5 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Threat models built for one system at launch and never updated
No link from threats identified to risk mitigation
Method not documented, so results cannot be repeated

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

TVM-03 Vulnerability Identification · TVM-05 Detection Updates