security-requirement-extraction

Map each threat's STRIDE category to security domains and requirement patterns, then generate requirements with rationale, acceptance criteria, and test cases. Priority is calculated from the threat's impact and likelihood scores.

Use the user story generator template, which formats each requirement as an As-a/I-want/So-that story with acceptance criteria, definition of done, test cases, and traceability links to threats and compliance controls.

The compliance mapper supports PCI DSS, HIPAA, GDPR, and OWASP, with NIST CSF, SOC 2, and ISO 27001 defined as framework options. It maps security domains to specific control IDs and generates traceability matrices.

Priority is calculated by multiplying impact and likelihood scores (LOW through CRITICAL). Combined scores of 12 or more yield CRITICAL priority, 6 or more HIGH, 3 or more MEDIUM, and below that LOW.

Extraction relies on predefined STRIDE category patterns, so threats outside standard categories fall back to generic data protection requirements. Generated acceptance criteria and test cases are templates that still need review by stakeholders.