Organisational Policies - Threat Modelling

The effective adoption of Chapter 03 - Threat Modelling - depends on the existence of formal organisational policies that sustain:

• The mandatory nature of threat modelling in medium- or high-risk contexts;
• The integration of the activity into the development lifecycle;
• Traceability between threats, requirements and the controls applied;
• The reuse and validation of models in standardised environments.

---

📌 Fundamental note

✅ Threat modelling must be treated as a mandatory activity in L2 and L3 applications, with formal criteria defined by organisational policy.

These policies:

• Make threat modelling a systematic, auditable and traceable practice;
• Sustain risk-based decision-making, as defined in Chapters 01 and 02;
• Allow technical teams to be aligned with mature secure-engineering practices.

🧩 This chapter implements, in practice, what the organisational policies determine. The policy legitimises, the chapter operationalises.

---

🧾 Recommended policies

Policy Name	Mandatory	Application	Minimum expected content
Threat Modelling Policy	✅ Yes	All applications classified as L2 or L3	Criteria for mandatory application, moments of application in the cycle, roles involved, permitted tools
Threat Model Validation Policy	⚠️ Recommended	Projects with a new architecture or critical changes	Technical review process, cross-validation by security, formal risk acceptance
Threat Model Reuse Policy	⚠️ Recommended	Organisations with standardised architectures	Criteria for the safe reuse of earlier models, validation by context

---

📋 Suggested structure of each policy

Each organisational policy must contain, at a minimum:

• Objective and scope of the policy;
• When to apply (e.g. by risk level, type of change, moment in the cycle);
• Roles and responsibilities (architecture, security, development, product);
• Requirement for traceable outputs (e.g. STRIDE model, DFD, mitigation plan);
• Validation and reuse criteria;
• Mandatory documentation by project type;
• Review periodicity of the policy itself (e.g. annual);
• Risk acceptance criteria and justified exceptions.

---

✅ Final recommendations

• These policies must be formal, approved and communicated to all technical teams;
• They must be aligned with the Requirements Catalogue of Chapter 2 and with the risk criteria defined in Chapter 1;
• They must provide for periodic review and controlled reuse of existing models;
• Their application must be integrated into the development lifecycle and validated in every critical release.

📌 The absence of these policies compromises the proportional, continuous and effective application of Threat Modelling in an organisational context.