canon-security-assessment

To generate a security assessment packet, provide RISK, ZONE, and authored input under canon-input to start the governed run. This captures threats, risks, mitigations, and evidence gaps into a formal artifact for governance and review.

A governed security assessment packet is used to persist threats, risks, and contextual details for governance, review, and release. It captures structured sections like assessment scope, in-scope assets, trust boundaries, and evidence gaps for an existing system.

You need a threat model artifact with evidence gaps when a bounded security brief exists and you must persist risks and contextual details for governance. It satisfies requirements for structured sections including assessment scope and trust boundaries for sanctioned deployments.

No, the security assessment workflow requires a bounded security brief to exist before you start. It applies specifically when you need to persist threats, risks, and contextual details for governance, review, and release.

The best way to document threats and controls is authoring via canon-input with the --system-context existing workflow. This generates a complete, auditable packet capturing risk ratings and evidence gaps for a sanctioned deployment.

The security assessment requires the --system-context existing workflow because it generates packets for existing systems. This mandates authoring via canon-input to properly capture threats, risks, mitigations, and assumptions as a formal Canon artifact.