THREAT-MODEL WORKSHEET — BLANK TEMPLATE
Adapt to your system. Keep completed assessments in an appropriate private workspace.

REVIEW CONTEXT
System / feature:
Scope and exclusions:
Owner / reviewers / decision-maker:
Review date / version / next review trigger:
Business purpose and critical operations:

SYSTEM MODEL
Assets and data sensitivity:
Actors and their permitted actions:
Entry points and external dependencies:
Data stores, background work, caches, exports:
Data flows and trust boundaries (attach a versioned diagram):
Assumptions / evidence supporting each / unresolved questions:

REPEAT FOR EACH THREAT
Threat ID:
Scenario (actor, action, target, outcome):
Preconditions:
Affected asset, flow, or trust boundary:
Potential impact and affected population:
Existing controls / evidence / known gaps:
Response (mitigate, avoid, transfer/share, or accept) and rationale:
Action, owner, target date:
Verification method and linked test IDs:
Residual risk / acceptance authority if relevant:
Status and evidence references:
Review trigger:

REVIEW CHECK
[ ] The model matches the current design and business rules.
[ ] Assumptions are separate from controls with evidence.
[ ] Each action has an owner and a measurable verification method.
[ ] Unanswered questions and residual risks remain visible.
[ ] Material changes have a defined reassessment trigger.

Companion guide: https://www.brandoneckert.com/threat-model-worksheet/