Did we do a good enough job? A threat model review checklist

The fourth threat modeling question, "did we do a good enough job?", is a short review at the end of the session. Check that the diagram is accurate, the threats are complete enough, every threat has an agreed response, mitigations are adequate and testable, and the model is stored where the team can reach it. Ten minutes is usually enough.

What the cheat sheet asks for

The OWASP Threat Modeling Cheat Sheet describes the review and validation step. It asks all stakeholders to confirm that the data flow diagram is accurate, that all threats are identified, that each threat has an agreed response, that the mitigations are adequate and testable, and that the model is documented with appropriate access.

That list converts neatly into a checklist you can run at the end of every session.

The checklist

The diagram

• Does it match what is actually deployed, not what the design doc said last quarter?
• Are trust boundaries, data stores, external entities and flows all shown?
• Did someone who operates the system look at it?

The threats

• Did we walk every trust boundary crossing?
• Did we consider business misuse as well as technical attacks?
• Is there anything we skipped because it felt awkward to raise?

The responses

• Does each threat have one of mitigate, eliminate, transfer or accept?
• Does each accepted threat have an owner, a reason and a review date?
• Do transferred threats name the other party and what they actually cover?

The mitigations

• Can each one be tested, and is there a ticket or test linked?
• Is the cost reasonable compared with the harm?

The record

• Is the model saved where the team can update it?
• Who can see it? Models describe weak points, so access should be sensible.

Good enough is a real standard

The question says "good enough", not "perfect". The Manifesto warns against seeking a single perfect representation and prefers continuous refinement. A model that covers the main flows, produces owned actions and gets updated next sprint is good enough. One that is complete but never revisited is not.

Signals you are not done

• Nobody can say who will do the first action.
• The diagram has an unlabeled box that "just handles stuff".
• The only mitigation listed is "be careful".
• Everyone agreed quickly, which can mean nobody was thinking about misuse.

After the review

Put the next review date on the model. Link tickets. Tell the champion or security contact where it lives. If the review found a significant gap, schedule a short follow up instead of stretching today's meeting.

Quick check

Sources

• OWASP Threat Modeling Cheat Sheet
• Threat Modeling Manifesto

Last reviewed: 19 October 2026.