security-requirement-extraction

Feed STRIDE-categorized threats into the RequirementExtractor, which maps each threat category to security domains and generates requirements with acceptance criteria and test cases. Priority is calculated automatically from impact and likelihood scores.

Use the SecurityUserStoryGenerator to turn each requirement into a story with role-specific framing, acceptance criteria, definition of done, and traceability links to threats and compliance controls. Stories can be grouped into epics per security domain.

The ComplianceMapper includes control mappings for PCI DSS, HIPAA, GDPR, and OWASP ASVS, organized by security domain. It can generate a compliance traceability matrix and run gap analysis to identify missing or weakly covered controls.

Priority is derived by multiplying numeric scores for impact and likelihood (LOW through CRITICAL). Combined scores of 12 or more yield CRITICAL priority, 6 or more HIGH, 3 or more MEDIUM, and lower scores LOW.

The extractor uses fixed pattern templates per STRIDE category, so generated requirements are generic starting points that need review and tailoring. It does not cover threats outside the six STRIDE categories or organization-specific control requirements.