SFS 8 / SF 0

Back to SFS 8

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented threat modeling been completed for all new software systems before design approval during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented threat model exists for each new system prior to design approval

Assessment criterion and evidence

Actor: Organization. Scope: All new software systems entering design phase. Evidence period: Review period. Required evidence: Threat model document dated before design sign-off; Evidence linking model to specific system version. Negative criterion: No documented threat model exists for any new system at design approval stage. Missing evidence: Pending determination when records are unavailable but systems exist

View the JSON record (opens in a new tab).

Assessment result: unset.