From fac5276486970bb9e0e990ba6dd45c84ba21f5d8 Mon Sep 17 00:00:00 2001 From: Petra Date: Thu, 20 Aug 2026 15:32:57 +0100 Subject: [PATCH 1/3] Add threat model library parity --- schema/2.0/THREAT-MODEL-MAPPING.md | 20 +++ .../model/cyclonedx-blueprint-2.0.schema.json | 58 +------- .../model/cyclonedx-common-2.0.schema.json | 56 ++++++++ .../model/cyclonedx-metadata-2.0.schema.json | 49 +++++++ .../2.0/model/cyclonedx-risk-2.0.schema.json | 128 ++++++++++++++++++ .../model/cyclonedx-threat-2.0.schema.json | 22 +++ .../resources/2.0/valid-risk-ai-bias-2.0.json | 26 +++- .../2.0/valid-threatmodel-simple-2.0.json | 31 +++++ 8 files changed, 332 insertions(+), 58 deletions(-) create mode 100644 schema/2.0/THREAT-MODEL-MAPPING.md diff --git a/schema/2.0/THREAT-MODEL-MAPPING.md b/schema/2.0/THREAT-MODEL-MAPPING.md new file mode 100644 index 000000000..3aef850c8 --- /dev/null +++ b/schema/2.0/THREAT-MODEL-MAPPING.md @@ -0,0 +1,20 @@ +# OWASP Threat Model Library Mapping + +This note records mappings from the OWASP Threat Model Library to CycloneDX 2.0 threat-model structures. + +## Control Status + +Map OWASP Threat Model Library control statuses to `controls[].status` as follows: + +| OWASP status | CycloneDX status | +| --- | --- | +| `assumed` | `{ "name": "assumed", "description": "Inherited or presumed to be in effect; implementation has not been independently verified." }` | +| `active` | `implemented` | +| `suggested` | `recommended` | +| `under_review` | `proposed` | +| `approved` | `approved` | +| `scheduled` | `planned` | +| `retired` | `decommissioned` | +| `wont_do` | `rejected` | + +`assumed` remains a custom status because it expresses an evidentiary condition that is not equivalent to implementation. This preserves the source meaning without expanding the global implementation-status vocabulary. diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 6c1d4d324..abf77f5e5 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -52,7 +52,7 @@ } }, "scope": { - "$ref": "#/$defs/scope" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope" }, "assets": { "type": "array", @@ -341,62 +341,6 @@ } } }, - "scope": { - "type": "object", - "title": "Scope", - "description": "Specifies what is included and excluded from the blueprint model, establishing the boundaries within which the modelling and analysis is performed.", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "name": { - "type": "string", - "title": "Name", - "minLength": 1, - "description": "Name of the scope." - }, - "description": { - "type": "string", - "title": "Description", - "description": "Description of what is included and excluded from the model." - }, - "boundaries": { - "type": "array", - "title": "Boundaries", - "uniqueItems": true, - "items": { - "type": "string", - "minLength": 1 - }, - "description": "Explicit boundaries of the model." - }, - "includedComponents": { - "type": "array", - "title": "Included Components", - "uniqueItems": true, - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to components explicitly included." - }, - "excludedComponents": { - "type": "array", - "title": "Excluded Components", - "uniqueItems": true, - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to components explicitly excluded." - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - } - }, "asset": { "type": "object", "title": "Asset", diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 71174e76e..2542d3c3b 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -15,6 +15,62 @@ "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.", "$ref": "#/$defs/refType" }, + "modelScope": { + "type": "object", + "title": "Model Scope", + "description": "Specifies what is included and excluded from a model or analysis, establishing the boundaries within which it is performed.", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "bom-ref": { + "$ref": "#/$defs/refType" + }, + "name": { + "type": "string", + "title": "Name", + "minLength": 1, + "description": "Name of the scope." + }, + "description": { + "type": "string", + "title": "Description", + "description": "Description of what is included and excluded from the model." + }, + "boundaries": { + "type": "array", + "title": "Boundaries", + "uniqueItems": true, + "items": { + "type": "string", + "minLength": 1 + }, + "description": "Explicit boundaries of the model." + }, + "includedComponents": { + "type": "array", + "title": "Included Components", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to components explicitly included." + }, + "excludedComponents": { + "type": "array", + "title": "Excluded Components", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to components explicitly excluded." + }, + "properties": { + "$ref": "#/$defs/properties" + } + } + }, "bomLinkDocumentType": { "title": "BOM-Link Document", "description": "Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/", diff --git a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json index 1ddcd24e7..257d81467 100644 --- a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json @@ -47,6 +47,14 @@ "description": "The component that the BOM describes.", "$ref": "cyclonedx-component-2.0.schema.json#/$defs/component" }, + "scope": { + "description": "The scope of the analysis represented by this BOM, including what is in and out of scope.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope" + }, + "modelLifecycle": { + "description": "Lifecycle metadata for the model represented by this BOM.", + "$ref": "#/$defs/modelLifecycle" + }, "supplier": { "title": "Supplier", "description": " The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.", @@ -65,6 +73,47 @@ } } }, + "modelLifecycle": { + "type": "object", + "title": "Model Lifecycle", + "description": "Version, release, review, and freeze information for the model represented by this BOM.", + "additionalProperties": false, + "properties": { + "version": { + "type": "string", + "pattern": "^\\d+(\\.\\d+)*$", + "description": "The structured version of the model." + }, + "frozen": { + "type": "boolean", + "description": "Whether the model is frozen and must be versioned before modification." + }, + "releasedAt": { + "$ref": "#/$defs/dateOrDateTime", + "description": "When the model was released." + }, + "productReleaseDate": { + "$ref": "#/$defs/dateOrDateTime", + "description": "When the product release modeled by this BOM was released." + }, + "reviewedAt": { + "$ref": "#/$defs/dateOrDateTime", + "description": "When the model was last reviewed." + } + } + }, + "dateOrDateTime": { + "oneOf": [ + { + "type": "string", + "format": "date" + }, + { + "type": "string", + "format": "date-time" + } + ] + }, "distributionConstraints": { "title": "Distribution Constraints", "description": "Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.", diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index b32be1e6b..58e63619b 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -38,11 +38,130 @@ }, "description": "The risk appetites that apply to this collection. Multiple entries support a document covering more than one party." }, + "qualitativeMatrices": { + "type": "array", + "title": "Qualitative Matrices", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/qualitativeMatrix" + }, + "description": "Named qualitative risk matrices available to ratings in this collection." + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } }, + "qualitativeMatrix": { + "type": "object", + "title": "Qualitative Matrix", + "description": "A named risk matrix that defines likelihood and impact scales and the resulting score and level for each combination.", + "required": [ + "bom-ref", + "name", + "likelihoodLevels", + "impactLevels", + "outcomes" + ], + "additionalProperties": false, + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "name": { + "type": "string", + "minLength": 1, + "description": "The name of the matrix." + }, + "description": { + "type": "string", + "description": "A description of the matrix and its intended use." + }, + "likelihoodLevels": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/qualitativeMatrixAxisLevel" + }, + "description": "The ordered likelihood levels used by the matrix." + }, + "impactLevels": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/qualitativeMatrixAxisLevel" + }, + "description": "The ordered impact levels used by the matrix." + }, + "outcomes": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/qualitativeMatrixOutcome" + }, + "description": "The score and named result for each likelihood and impact combination." + } + } + }, + "qualitativeMatrixAxisLevel": { + "type": "object", + "required": [ + "name", + "value" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "description": "The stable name of this level." + }, + "value": { + "type": "number", + "minimum": 0, + "description": "The ordinal or numeric value of this level." + }, + "description": { + "type": "string", + "description": "The meaning of this level." + } + } + }, + "qualitativeMatrixOutcome": { + "type": "object", + "required": [ + "likelihood", + "impact", + "score", + "level" + ], + "additionalProperties": false, + "properties": { + "likelihood": { + "type": "string", + "minLength": 1, + "description": "The name of a level from the matrix likelihood scale." + }, + "impact": { + "type": "string", + "minLength": 1, + "description": "The name of a level from the matrix impact scale." + }, + "score": { + "type": "number", + "minimum": 0, + "description": "The numeric score assigned by this combination." + }, + "level": { + "type": "string", + "minLength": 1, + "description": "The matrix-specific qualitative result." + } + } + }, "riskDomain": { "type": "object", "required": [ @@ -895,6 +1014,15 @@ "type": "string", "description": "A textual representation of the metric values used to derive the score, in the format defined by the methodology." }, + "qualitativeMatrix": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference to the qualitative matrix used to derive this score." + }, + "matrixLevel": { + "type": "string", + "minLength": 1, + "description": "The matrix-specific qualitative result, such as very-low or very-high." + }, "methodology": { "title": "Methodology", "description": "The risk rating methodology used to derive this score. Only methodologies that define a scoring calculation are listed; governance frameworks such as [ISO 31000](https://www.iso.org/iso-31000-risk-management.html) are recorded as standards rather than as a score methodology. Use the custom option for methodologies not listed.", diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index edc8748c3..e4641b916 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -166,6 +166,11 @@ "title": "Description", "description": "A description of the threat." }, + "event": { + "type": "string", + "title": "Event", + "description": "The event that realizes or triggers the threat." + }, "source": { "type": "string", "title": "Source", @@ -514,6 +519,23 @@ "persistent": "The actor pursues the target persistently over time." } }, + "maliciousIntent": { + "type": "boolean", + "title": "Malicious Intent", + "description": "Whether the actor intends to cause harm in this scenario." + }, + "applicability": { + "type": "string", + "title": "Applicability", + "description": "The applicability of this scenario to the organization.", + "enum": [ + "minimal", + "low", + "moderate", + "high", + "maximal" + ] + }, "accessLevel": { "type": "string", "title": "Access Level", diff --git a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json index 01bb1fb28..5bc3d29e4 100644 --- a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json +++ b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json @@ -4,6 +4,30 @@ "serialNumber": "urn:uuid:7c9e6679-7425-40de-944b-e07fc1f90ae7", "version": 1, "risks": { + "qualitativeMatrices": [ + { + "bom-ref": "matrix-owasp-tml-5x5", + "name": "OWASP Threat Model Library 5x5", + "description": "The qualitative matrix used by the OWASP Threat Model Library.", + "likelihoodLevels": [ + { "name": "rare", "value": 1 }, + { "name": "unlikely", "value": 2 }, + { "name": "possible", "value": 3 }, + { "name": "likely", "value": 4 }, + { "name": "certain", "value": 5 } + ], + "impactLevels": [ + { "name": "negligible", "value": 1 }, + { "name": "minor", "value": 2 }, + { "name": "moderate", "value": 3 }, + { "name": "major", "value": 4 }, + { "name": "severe", "value": 5 } + ], + "outcomes": [ + { "likelihood": "likely", "impact": "major", "score": 16, "level": "very-high" } + ] + } + ], "risks": [ { "bom-ref": "risk-model-bias", @@ -48,7 +72,7 @@ }, "description": "Potential regulatory action and harm to affected applicants." }, - "score": { "level": "high", "score": 8, "methodology": "owasp-risk-rating" }, + "score": { "level": "high", "score": 16, "methodology": "qualitative-matrix", "qualitativeMatrix": "matrix-owasp-tml-5x5", "matrixLevel": "very-high" }, "detectability": { "score": 6, "description": "Bias surfaces only in aggregate metrics, so individual decisions are hard to flag." }, "confidence": 0.6, "rationale": "Based on offline fairness metrics." diff --git a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json index d8d14f032..2a55ba86a 100644 --- a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json +++ b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json @@ -3,6 +3,34 @@ "specVersion": "2.0", "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", "version": 1, + "metadata": { + "component": { + "type": "application", + "name": "Operator console", + "version": "1.0" + }, + "scope": { + "name": "Operator console and customer data store", + "description": "The operator console, its authentication controls, and the customer data store are in scope. Corporate identity-provider infrastructure is out of scope." + }, + "modelLifecycle": { + "version": "1.0", + "frozen": false, + "releasedAt": "2026-08-20", + "productReleaseDate": "2026-08-15", + "reviewedAt": "2026-08-19" + } + }, + "externalReferences": [ + { + "type": "documentation", + "url": "https://example.com/operator-console/release-notes" + }, + { + "type": "vcs", + "url": "https://example.com/operator-console/source" + } + ], "profiles": { "threatProfiles": [ { @@ -24,6 +52,7 @@ "bom-ref": "threat-credential-theft", "name": "Credential theft", "description": "An adversary steals operator credentials to reach protected data.", + "event": "An actor obtains and uses an operator credential.", "source": "Internal threat-modelling workshop", "categories": [ { @@ -81,6 +110,8 @@ "espionage" ], "intent": "targeted", + "maliciousIntent": true, + "applicability": "high", "accessLevel": "external", "attackVector": { "type": "network", From c6d6522eb66fb08978f8eb324cfcd36552038565 Mon Sep 17 00:00:00 2001 From: Petra Date: Mon, 24 Aug 2026 15:02:03 +0100 Subject: [PATCH 2/3] Remove threat model mapping document --- schema/2.0/THREAT-MODEL-MAPPING.md | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100644 schema/2.0/THREAT-MODEL-MAPPING.md diff --git a/schema/2.0/THREAT-MODEL-MAPPING.md b/schema/2.0/THREAT-MODEL-MAPPING.md deleted file mode 100644 index 3aef850c8..000000000 --- a/schema/2.0/THREAT-MODEL-MAPPING.md +++ /dev/null @@ -1,20 +0,0 @@ -# OWASP Threat Model Library Mapping - -This note records mappings from the OWASP Threat Model Library to CycloneDX 2.0 threat-model structures. - -## Control Status - -Map OWASP Threat Model Library control statuses to `controls[].status` as follows: - -| OWASP status | CycloneDX status | -| --- | --- | -| `assumed` | `{ "name": "assumed", "description": "Inherited or presumed to be in effect; implementation has not been independently verified." }` | -| `active` | `implemented` | -| `suggested` | `recommended` | -| `under_review` | `proposed` | -| `approved` | `approved` | -| `scheduled` | `planned` | -| `retired` | `decommissioned` | -| `wont_do` | `rejected` | - -`assumed` remains a custom status because it expresses an evidentiary condition that is not equivalent to implementation. This preserves the source meaning without expanding the global implementation-status vocabulary. From a481a613d1ee9241a11de69f244b65422cf27225 Mon Sep 17 00:00:00 2001 From: Petra Date: Tue, 8 Sep 2026 18:07:19 +0100 Subject: [PATCH 3/3] Refine threat model library parity --- .../model/cyclonedx-blueprint-2.0.schema.json | 80 ++++++++++- .../model/cyclonedx-common-2.0.schema.json | 56 -------- .../model/cyclonedx-metadata-2.0.schema.json | 49 ------- .../2.0/model/cyclonedx-risk-2.0.schema.json | 128 ------------------ .../model/cyclonedx-threat-2.0.schema.json | 27 +--- .../2.0/valid-blueprint-conceptual-2.0.json | 3 + .../2.0/valid-blueprint-data-flow-2.0.json | 3 + .../2.0/valid-blueprint-deployment-2.0.json | 1 + .../resources/2.0/valid-risk-ai-bias-2.0.json | 28 +--- .../2.0/valid-threatmodel-simple-2.0.json | 32 +---- 10 files changed, 95 insertions(+), 312 deletions(-) diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 28efbe465..dd5d17c8c 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -52,7 +52,7 @@ } }, "scope": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope" + "$ref": "#/$defs/scope" }, "assets": { "type": "array", @@ -308,6 +308,10 @@ "ordinalVersion": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/ordinalVersion" }, + "frozen": { + "type": "boolean", + "description": "Whether the blueprint is frozen and must be versioned before modification." + }, "lifecycles": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/lifecycles" }, @@ -342,6 +346,68 @@ } } }, + "scope": { + "type": "object", + "title": "Scope", + "description": "Specifies what is included and excluded from the blueprint model, establishing the boundaries within which the modelling and analysis is performed.", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "name": { + "type": "string", + "title": "Name", + "minLength": 1, + "description": "Name of the scope." + }, + "description": { + "type": "string", + "title": "Description", + "description": "Description of what is included and excluded from the model." + }, + "boundaries": { + "type": "array", + "title": "Boundaries", + "uniqueItems": true, + "items": { + "type": "string", + "minLength": 1 + }, + "description": "Explicit boundaries of the model." + }, + "includedComponents": { + "type": "array", + "title": "Included Components", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to components explicitly included." + }, + "excludedComponents": { + "type": "array", + "title": "Excluded Components", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to components explicitly excluded." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "inScope": { + "type": "boolean", + "title": "In Scope", + "description": "Whether this element is within the scope of the model.", + "default": true + }, "asset": { "type": "object", "title": "Asset", @@ -458,6 +524,9 @@ "title": "Description", "description": "Description of the asset's role and purpose." }, + "inScope": { + "$ref": "#/$defs/inScope" + }, "zone": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "description": "Reference using bom-link or bom-ref to the zone containing this asset." @@ -590,6 +659,9 @@ "title": "Description", "description": "Purpose and contents of the store." }, + "inScope": { + "$ref": "#/$defs/inScope" + }, "type": { "title": "Type", "description": "The type of data store. Use the custom option for technologies not covered by the enumeration.", @@ -1384,6 +1456,9 @@ "title": "Description", "description": "Detailed description of what flows and why." }, + "inScope": { + "$ref": "#/$defs/inScope" + }, "type": { "title": "Type", "description": "The type of flow. Use the custom option for types not covered by the enumeration.", @@ -1551,6 +1626,9 @@ "title": "Description", "description": "A narrative describing this actor's role within the modelled system, distinct from the party's identity-level description. Use to record context-specific framing such as why this actor is in scope or how it interacts with the assets in this blueprint." }, + "inScope": { + "$ref": "#/$defs/inScope" + }, "permissions": { "type": "array", "title": "Permissions", diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 9e9ab7fc3..c3db7f98e 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -16,62 +16,6 @@ "allOf": [{ "$ref": "#/$defs/refType" }], "$comment": "value-range is same as 'refType'" }, - "modelScope": { - "type": "object", - "title": "Model Scope", - "description": "Specifies what is included and excluded from a model or analysis, establishing the boundaries within which it is performed.", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "#/$defs/refType" - }, - "name": { - "type": "string", - "title": "Name", - "minLength": 1, - "description": "Name of the scope." - }, - "description": { - "type": "string", - "title": "Description", - "description": "Description of what is included and excluded from the model." - }, - "boundaries": { - "type": "array", - "title": "Boundaries", - "uniqueItems": true, - "items": { - "type": "string", - "minLength": 1 - }, - "description": "Explicit boundaries of the model." - }, - "includedComponents": { - "type": "array", - "title": "Included Components", - "uniqueItems": true, - "items": { - "$ref": "#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to components explicitly included." - }, - "excludedComponents": { - "type": "array", - "title": "Excluded Components", - "uniqueItems": true, - "items": { - "$ref": "#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to components explicitly excluded." - }, - "properties": { - "$ref": "#/$defs/properties" - } - } - }, "bomLinkDocumentType": { "title": "BOM-Link Document", "description": "Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/", diff --git a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json index 706b21b16..5da767611 100644 --- a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json @@ -47,14 +47,6 @@ "description": "The component that the BOM describes.", "$ref": "cyclonedx-component-2.0.schema.json#/$defs/component" }, - "scope": { - "description": "The scope of the analysis represented by this BOM, including what is in and out of scope.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope" - }, - "modelLifecycle": { - "description": "Lifecycle metadata for the model represented by this BOM.", - "$ref": "#/$defs/modelLifecycle" - }, "supplier": { "title": "Supplier", "description": " The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.", @@ -73,47 +65,6 @@ } } }, - "modelLifecycle": { - "type": "object", - "title": "Model Lifecycle", - "description": "Version, release, review, and freeze information for the model represented by this BOM.", - "additionalProperties": false, - "properties": { - "version": { - "type": "string", - "pattern": "^\\d+(\\.\\d+)*$", - "description": "The structured version of the model." - }, - "frozen": { - "type": "boolean", - "description": "Whether the model is frozen and must be versioned before modification." - }, - "releasedAt": { - "$ref": "#/$defs/dateOrDateTime", - "description": "When the model was released." - }, - "productReleaseDate": { - "$ref": "#/$defs/dateOrDateTime", - "description": "When the product release modeled by this BOM was released." - }, - "reviewedAt": { - "$ref": "#/$defs/dateOrDateTime", - "description": "When the model was last reviewed." - } - } - }, - "dateOrDateTime": { - "oneOf": [ - { - "type": "string", - "format": "date" - }, - { - "type": "string", - "format": "date-time" - } - ] - }, "distributionConstraints": { "title": "Distribution Constraints", "description": "Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.", diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index 58e63619b..b32be1e6b 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -38,130 +38,11 @@ }, "description": "The risk appetites that apply to this collection. Multiple entries support a document covering more than one party." }, - "qualitativeMatrices": { - "type": "array", - "title": "Qualitative Matrices", - "uniqueItems": true, - "items": { - "$ref": "#/$defs/qualitativeMatrix" - }, - "description": "Named qualitative risk matrices available to ratings in this collection." - }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } }, - "qualitativeMatrix": { - "type": "object", - "title": "Qualitative Matrix", - "description": "A named risk matrix that defines likelihood and impact scales and the resulting score and level for each combination.", - "required": [ - "bom-ref", - "name", - "likelihoodLevels", - "impactLevels", - "outcomes" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "name": { - "type": "string", - "minLength": 1, - "description": "The name of the matrix." - }, - "description": { - "type": "string", - "description": "A description of the matrix and its intended use." - }, - "likelihoodLevels": { - "type": "array", - "minItems": 1, - "uniqueItems": true, - "items": { - "$ref": "#/$defs/qualitativeMatrixAxisLevel" - }, - "description": "The ordered likelihood levels used by the matrix." - }, - "impactLevels": { - "type": "array", - "minItems": 1, - "uniqueItems": true, - "items": { - "$ref": "#/$defs/qualitativeMatrixAxisLevel" - }, - "description": "The ordered impact levels used by the matrix." - }, - "outcomes": { - "type": "array", - "minItems": 1, - "uniqueItems": true, - "items": { - "$ref": "#/$defs/qualitativeMatrixOutcome" - }, - "description": "The score and named result for each likelihood and impact combination." - } - } - }, - "qualitativeMatrixAxisLevel": { - "type": "object", - "required": [ - "name", - "value" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "minLength": 1, - "description": "The stable name of this level." - }, - "value": { - "type": "number", - "minimum": 0, - "description": "The ordinal or numeric value of this level." - }, - "description": { - "type": "string", - "description": "The meaning of this level." - } - } - }, - "qualitativeMatrixOutcome": { - "type": "object", - "required": [ - "likelihood", - "impact", - "score", - "level" - ], - "additionalProperties": false, - "properties": { - "likelihood": { - "type": "string", - "minLength": 1, - "description": "The name of a level from the matrix likelihood scale." - }, - "impact": { - "type": "string", - "minLength": 1, - "description": "The name of a level from the matrix impact scale." - }, - "score": { - "type": "number", - "minimum": 0, - "description": "The numeric score assigned by this combination." - }, - "level": { - "type": "string", - "minLength": 1, - "description": "The matrix-specific qualitative result." - } - } - }, "riskDomain": { "type": "object", "required": [ @@ -1014,15 +895,6 @@ "type": "string", "description": "A textual representation of the metric values used to derive the score, in the format defined by the methodology." }, - "qualitativeMatrix": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference to the qualitative matrix used to derive this score." - }, - "matrixLevel": { - "type": "string", - "minLength": 1, - "description": "The matrix-specific qualitative result, such as very-low or very-high." - }, "methodology": { "title": "Methodology", "description": "The risk rating methodology used to derive this score. Only methodologies that define a scoring calculation are listed; governance frameworks such as [ISO 31000](https://www.iso.org/iso-31000-risk-management.html) are recorded as standards rather than as a score methodology. Use the custom option for methodologies not listed.", diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index e4641b916..b4b23f5a3 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -166,11 +166,6 @@ "title": "Description", "description": "A description of the threat." }, - "event": { - "type": "string", - "title": "Event", - "description": "The event that realizes or triggers the threat." - }, "source": { "type": "string", "title": "Source", @@ -447,6 +442,11 @@ "title": "Description", "description": "A description of the threat scenario." }, + "event": { + "type": "string", + "title": "Event", + "description": "The event that realizes or triggers the threat in this scenario." + }, "threats": { "type": "array", "title": "Threats", @@ -519,23 +519,6 @@ "persistent": "The actor pursues the target persistently over time." } }, - "maliciousIntent": { - "type": "boolean", - "title": "Malicious Intent", - "description": "Whether the actor intends to cause harm in this scenario." - }, - "applicability": { - "type": "string", - "title": "Applicability", - "description": "The applicability of this scenario to the organization.", - "enum": [ - "minimal", - "low", - "moderate", - "high", - "maximal" - ] - }, "accessLevel": { "type": "string", "title": "Access Level", diff --git a/tools/src/test/resources/2.0/valid-blueprint-conceptual-2.0.json b/tools/src/test/resources/2.0/valid-blueprint-conceptual-2.0.json index 8b105148a..9176a1078 100644 --- a/tools/src/test/resources/2.0/valid-blueprint-conceptual-2.0.json +++ b/tools/src/test/resources/2.0/valid-blueprint-conceptual-2.0.json @@ -14,6 +14,7 @@ ], "metadata": { "timestamp": "2026-06-05T12:05:00Z", + "frozen": false, "authors": [ { "roles": [ @@ -36,6 +37,7 @@ "bom-ref": "cap-membership", "type": "subsystem", "name": "Membership", + "inScope": false, "description": "The capability concerned with enrolling and identifying members." }, { @@ -48,6 +50,7 @@ "bom-ref": "cap-lending", "type": "subsystem", "name": "Lending", + "inScope": true, "description": "The capability concerned with loans, due dates, and returns." } ], diff --git a/tools/src/test/resources/2.0/valid-blueprint-data-flow-2.0.json b/tools/src/test/resources/2.0/valid-blueprint-data-flow-2.0.json index 3c82aae85..2b604828f 100644 --- a/tools/src/test/resources/2.0/valid-blueprint-data-flow-2.0.json +++ b/tools/src/test/resources/2.0/valid-blueprint-data-flow-2.0.json @@ -93,6 +93,7 @@ } }, "description": "A retail banking customer initiating a transfer.", + "inScope": false, "zone": "zone-internet", "permissions": [ "initiate-transfer" @@ -104,6 +105,7 @@ "bom-ref": "asset-portal", "type": "service", "name": "Web portal", + "inScope": true, "zone": "zone-dmz" }, { @@ -142,6 +144,7 @@ "bom-ref": "df-login", "name": "Login and transfer request", "type": "data", + "inScope": true, "source": "act-customer", "destination": "asset-portal", "synchronous": true, diff --git a/tools/src/test/resources/2.0/valid-blueprint-deployment-2.0.json b/tools/src/test/resources/2.0/valid-blueprint-deployment-2.0.json index a0c9424d1..dba57efab 100644 --- a/tools/src/test/resources/2.0/valid-blueprint-deployment-2.0.json +++ b/tools/src/test/resources/2.0/valid-blueprint-deployment-2.0.json @@ -85,6 +85,7 @@ "bom-ref": "ds-postgres", "name": "Managed PostgreSQL", "type": "relational", + "inScope": true, "environment": "production", "zone": "zone-prod", "location": "east region" diff --git a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json index 5bc3d29e4..0e213ce44 100644 --- a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json +++ b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json @@ -4,30 +4,6 @@ "serialNumber": "urn:uuid:7c9e6679-7425-40de-944b-e07fc1f90ae7", "version": 1, "risks": { - "qualitativeMatrices": [ - { - "bom-ref": "matrix-owasp-tml-5x5", - "name": "OWASP Threat Model Library 5x5", - "description": "The qualitative matrix used by the OWASP Threat Model Library.", - "likelihoodLevels": [ - { "name": "rare", "value": 1 }, - { "name": "unlikely", "value": 2 }, - { "name": "possible", "value": 3 }, - { "name": "likely", "value": 4 }, - { "name": "certain", "value": 5 } - ], - "impactLevels": [ - { "name": "negligible", "value": 1 }, - { "name": "minor", "value": 2 }, - { "name": "moderate", "value": 3 }, - { "name": "major", "value": 4 }, - { "name": "severe", "value": 5 } - ], - "outcomes": [ - { "likelihood": "likely", "impact": "major", "score": 16, "level": "very-high" } - ] - } - ], "risks": [ { "bom-ref": "risk-model-bias", @@ -47,6 +23,7 @@ "inherentRisk": { "likelihood": { "level": "high", + "score": 4, "probability": 0.7, "timeframe": "P1Y", "factors": [ @@ -58,6 +35,7 @@ }, "impact": { "level": "major", + "score": 4, "polarity": "harm", "categories": [ "bias", "discrimination", "human-rights", { "name": "brand-trust" } ], "factors": [ @@ -72,7 +50,7 @@ }, "description": "Potential regulatory action and harm to affected applicants." }, - "score": { "level": "high", "score": 16, "methodology": "qualitative-matrix", "qualitativeMatrix": "matrix-owasp-tml-5x5", "matrixLevel": "very-high" }, + "score": { "level": "high", "score": 16, "methodology": "qualitative-matrix" }, "detectability": { "score": 6, "description": "Bias surfaces only in aggregate metrics, so individual decisions are hard to flag." }, "confidence": 0.6, "rationale": "Based on offline fairness metrics." diff --git a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json index 2a55ba86a..33015bfa9 100644 --- a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json +++ b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json @@ -3,34 +3,6 @@ "specVersion": "2.0", "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", "version": 1, - "metadata": { - "component": { - "type": "application", - "name": "Operator console", - "version": "1.0" - }, - "scope": { - "name": "Operator console and customer data store", - "description": "The operator console, its authentication controls, and the customer data store are in scope. Corporate identity-provider infrastructure is out of scope." - }, - "modelLifecycle": { - "version": "1.0", - "frozen": false, - "releasedAt": "2026-08-20", - "productReleaseDate": "2026-08-15", - "reviewedAt": "2026-08-19" - } - }, - "externalReferences": [ - { - "type": "documentation", - "url": "https://example.com/operator-console/release-notes" - }, - { - "type": "vcs", - "url": "https://example.com/operator-console/source" - } - ], "profiles": { "threatProfiles": [ { @@ -52,7 +24,6 @@ "bom-ref": "threat-credential-theft", "name": "Credential theft", "description": "An adversary steals operator credentials to reach protected data.", - "event": "An actor obtains and uses an operator credential.", "source": "Internal threat-modelling workshop", "categories": [ { @@ -110,8 +81,7 @@ "espionage" ], "intent": "targeted", - "maliciousIntent": true, - "applicability": "high", + "event": "An actor obtains and uses an operator credential.", "accessLevel": "external", "attackVector": { "type": "network",