A security threat and risk assessment (STRA) evaluates threats, vulnerabilities, and potential consequences associated with a system or change. It helps expose security flaws before they reach a live environment and supports stronger incident preparedness. section 9.1
Use security assessment to connect technical safeguards with organizational risk:
- Assess proposed system changes with the necessary stakeholders so vulnerabilities are not introduced without review. section 9.1
- Examine security controls, access restrictions, vulnerability assessments, and monitoring as proactive measures against threats. section 9.1
- Use findings to strengthen security practices and support continuous improvement across development and security teams. section 7.4.5
Change oversight scenario
An engineering team changes a system without involving the required stakeholders. Sensitive data becomes exposed without sufficient authentication or authorization, and no STRA identifies the flaw before deployment. The assessment process therefore becomes a practical control within change management, not merely a compliance exercise. section 9.1
