Skip to content

Threat Model — Completion checklist

Template: TPL-03-06 ../02-Templates/Threat-Model-Template.md | Version: 0.3
How to use: tick an item only after inspecting the completed record and its evidence. Every unticked item needs an OPEN- entry with an owner, or a written, approved disposition.

Content checks

  • [ ] 01. Scope assets and protected data — Every high-sensitivity DPIA element is an asset here.
  • [ ] 02. Architecture and trust boundaries — Boundaries match the data-flow record.
  • [ ] 03. Data flow ID source destination and protocol — Every DF ID from the data-flow record is present.
  • [ ] 04. STRIDE threats per flow or boundary — Each DF has all six STRIDE categories considered (N/A needs a reason).
  • [ ] 05. Abuse cases and attacker assumptions — Insider and external attackers are both considered.
  • [ ] 06. Mitigations and control owners — Every High-impact threat has a mitigation with an owner and REQ.
  • [ ] 07. Verification evidence and residual risks — Each mitigation has a TC; residual risk is accepted by a named owner.
  • [ ] 08. Review date and change triggers — Triggers include new flow, new boundary, new vendor and incidents.

Record control checks

  • [x] Document ID follows KAI-<PRODUCT>-THM-NNN and is unique in the product.
  • [x] Product, version and commit SHA match the related records.
  • [x] No placeholder rows remain; every gap names an owner and an OPEN- item.
  • [x] Every cited link, file path and ID resolves.
  • [ ] Security, privacy, AI/ML and medical-software applicability checked and routed to qualified reviewers where relevant.
  • [x] No patient identifiers, secrets or production data copied into the record.
  • [x] Nothing was taken from the worked examples as if it were evidence.
  • [ ] Named independent reviewer completed review; approval recorded with date.

Reviewer: Technical reviewer (name to be assigned — OPEN-001) | Date: Pending | Outcome: [Complete / Returned with actions]

Self-check by Claude Code, 2026-10-28, at a6b4429. Ticked items were verified mechanically in this session: sdlc.py validate 0 errors (75 records, stages 01–10); sdlc.py trace no duplicate IDs and every REQ linked to design and test; code citations resolve at a6b4429 (except files in the separate Visionary_oral_ML repository, labelled as external). Content checks are left for the named reviewer; every gap is an owned OPEN- item in the record. Reviewer and approval items are for people.