tachi-control-analysis

Compensating controls in threat modeling are security mechanisms mapped to STRIDE categories that mitigate threats. This framework defines 8 control categories with specific mappings to evaluate residual risk and guide remediation planning.

Map STRIDE threats to security controls using the defined STRIDE-to-control mappings across 8 compensating control categories. This enables systematic detection, mapping, and scoring to determine residual risk and confidence levels for each threat scenario.

Calculate residual risk by evaluating compensating controls against evidence criteria and confidence levels during Phase 4 classification. The framework provides risk scoring templates to quantify remaining risk after control application.

Validating compensating controls in risk analysis requires evidence collected according to specified evidence collection rules and confidence levels. The framework defines criteria for what constitutes sufficient evidence to support control effectiveness claims.

Yes, this compensating controls framework is specifically applied to software project threat modeling. It provides Phase 4 classification and Phase 5 remediation templates designed for detecting, mapping, and scoring controls within software development workflows.

Generate remediation guidance using the Phase 5 remediation templates provided by the framework. These templates translate residual risk calculations and control gap analysis into actionable recommendations for addressing identified weaknesses.