Skip to main content

Validation and Evidence in Threat Modelling

A threat model is only operationally valid when:

  • it has been explicitly validated;
  • it has an identified person responsible for it;
  • it produces verifiable evidence.

Without these elements, Threat Modelling remains an exploratory activity, not a security control.

1. Mandatory human validation​

Every threat model must be:

  • critically reviewed;
  • approved by an explicit role (e.g. Tech Lead, Security Architect).

Tools, methods or analytical aids do not replace this decision.

2. Minimum acceptance criteria​

A Threat Model is considered accepted when, at a minimum:

  • the system context is clearly defined;
  • the analysed architecture is identified and versioned;
  • the main threats have been identified and classified;
  • each threat has an associated decision:
    • mitigated,
    • accepted,
    • transferred,
    • or rejected with justification.

3. Minimum mandatory evidence​

The evidence associated with a Threat Model must include, at a minimum:

  • versioned architectural diagram(s);
  • a list of threats with an explicit decision;
  • a clear link to security requirements or mitigations;
  • identification of the person responsible for validation;
  • date and version of the model.

The evidence must be:

  • reproducible;
  • auditable;
  • preserved in accordance with the organisation's policies.

4. Distinction between support and decision​

It is mandatory to distinguish explicitly between:

  • artefacts that support the analysis;
  • the validated threat model.

Only the latter constitutes the basis for:

  • defining requirements;
  • risk acceptance;
  • auditing.

5. Review and invalidation​

A threat model must be reviewed whenever there is:

  • a significant change to the architecture;
  • the introduction of new dependencies;
  • a relevant change in the data flow;
  • a reclassification of the risk level (L1–L3).

Models that have not been reviewed must be considered potentially invalid.

6. Integration with other chapters​

Validated Threat Modelling constitutes:

  • direct input to Chapter 02 - Security Requirements;
  • the basis of justification for architectural decisions;
  • evidence of application proportional to the risk defined in Chapter 01.