From 7a04e959066b963ef3ff909e1221df66bc4e99a8 Mon Sep 17 00:00:00 2001
From: Petra <petra@devarmor.com>
Date: Sun, 23 Nov 2025 22:33:58 +0000
Subject: [PATCH 1/3] Modified risk and model schemas

---
 .../model/cyclonedx-blueprint-2.0.schema.json | 308 ++++++++++++-
 .../2.0/model/cyclonedx-risk-2.0.schema.json  | 409 +++++++++++++-----
 2 files changed, 595 insertions(+), 122 deletions(-)

diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
index d8c7dc5df..0659c6599 100644
--- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
@@ -46,6 +46,20 @@
       },
       "description": "The assets (components, services, data, actors) included in the model"
     },
+    "dataStores": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/dataStore"
+      },
+      "description": "Structured description of data stores used in the model"
+    },
+    "dataSets": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/dataSet"
+      },
+      "description": "Datasets handled by the system, including placements and sensitivity"
+    },
     "zones": {
       "type": "array",
       "items": {
@@ -321,6 +335,9 @@
             "compliance",
             "risk",
             "stakeholder",
+            "use-case",
+            "abuse-case",
+            "design-review",
             "custom"
           ],
           "meta:enum": {
@@ -340,6 +357,8 @@
             "compliance": "Regulatory compliance perspective",
             "risk": "Risk management perspective",
             "stakeholder": "General stakeholder perspective",
+            "use-case": "A high level persepctive that captures the data-flows of the use case, rather than deep granularity of systems",
+            "abuse-case": "A high level persepctive that captures the data-flows of a certain abuse case, rather than deep granularity of systems",
             "custom": "Custom or other perspective"
           }
         },
@@ -535,7 +554,7 @@
             "component": "Software component or application",
             "service": "Service or microservice",
             "dataStore": "Database, file system, or data repository",
-            "data": "Data asset or dataset",
+            "data": "Dataset",
             "actor": "User, system, or external entity",
             "process": "Business or system process",
             "infrastructure": "Infrastructure component",
@@ -616,8 +635,8 @@
           "description": "Authentication methods supported/required"
         },
         "authorization": {
-          "$ref": "#/$defs/authorizationType",
-          "description": "Authorization model used"
+          "$ref": "#/$defs/accessControlType",
+          "description": "Access control model used"
         },
         "encryption": {
           "$ref": "#/$defs/encryptionType"
@@ -636,6 +655,169 @@
         }
       }
     },
+    "dataStore": {
+      "type": "object",
+      "required": ["bom-ref", "name", "type"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name of the data store"
+        },
+        "description": {
+          "type": "string",
+          "description": "Purpose and contents of the store"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "sql",
+            "keyValue",
+            "document",
+            "object",
+            "graph",
+            "timeSeries",
+            "file",
+            "blob",
+            "cache",
+            "custom"
+          ],
+          "meta:enum": {
+            "sql": "Relational database",
+            "keyValue": "Key-value store",
+            "document": "Document database (e.g., MongoDB)",
+            "object": "Object storage",
+            "graph": "Graph database",
+            "timeSeries": "Time-series database",
+            "file": "File system or NAS",
+            "blob": "Binary/blob storage",
+            "cache": "Caching tier",
+            "custom": "Other or mixed storage technology"
+          }
+        },
+        "vendor": {
+          "type": "string"
+        },
+        "product": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "environment": {
+          "type": "string",
+          "description": "Deployment environment (prod, test, etc.)"
+        },
+        "trustZone": {
+          "$ref": "#/$defs/trustZoneRef"
+        },
+        "location": {
+          "type": "string",
+          "description": "Physical or logical hosting location"
+        },
+        "technologies": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Supporting technologies or services"
+        },
+        "dataSets": {
+          "type": "array",
+          "items": {
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+          },
+          "description": "References to data sets stored here"
+        },
+        "accessControl": {
+          "$ref": "#/$defs/accessControlType"
+        },
+        "encryption": {
+          "$ref": "#/$defs/encryptionType"
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        }
+      }
+    },
+    "dataSet": {
+      "type": "object",
+      "required": ["bom-ref", "name", "description"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name of the dataset"
+        },
+        "description": {
+          "type": "string",
+          "description": "What information is contained and why it exists"
+        },
+        "classification": {
+          "$ref": "#/$defs/dataClassification"
+        },
+        "dataTypes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/dataObjectType"
+          },
+          "description": "Categories of data stored (PII, PHI, etc.)"
+        },
+        "recordCount": {
+          "type": "integer",
+          "description": "Approximate number of records"
+        },
+        "owners": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntityOrContact"
+        },
+        "regulations": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Applicable regulations or contracts"
+        },
+        "accessControl": {
+          "$ref": "#/$defs/accessControlType"
+        },
+        "placements": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["dataStore"],
+            "additionalProperties": false,
+            "properties": {
+              "dataStore": {
+                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+                "description": "Reference to the store holding this dataset"
+              },
+              "encrypted": {
+                "type": "boolean",
+                "description": "Whether the dataset is encrypted at this location"
+              },
+              "retention": {
+                "type": "string",
+                "description": "Retention policy for this placement"
+              },
+              "replicated": {
+                "type": "boolean",
+                "description": "Indicates if this placement is a replica"
+              }
+            }
+          },
+          "description": "Where the dataset resides"
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        }
+      }
+    },
     "interface": {
       "type": "object",
       "required": ["name", "type"],
@@ -787,8 +969,8 @@
           "description": "Authentication required to cross this boundary"
         },
         "authorization": {
-          "$ref": "#/$defs/authorizationType",
-          "description": "Authorization model at this boundary"
+          "$ref": "#/$defs/accessControlType",
+          "description": "Access control model at this boundary"
         },
         "dataValidation": {
           "type": "boolean",
@@ -888,6 +1070,13 @@
         "classification": {
           "$ref": "#/$defs/dataClassification"
         },
+        "dataObjects": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/dataObject"
+          },
+          "description": "The data object(s) transported in this flow"
+        },
         "authentication": {
           "type": "array",
           "items": {
@@ -897,6 +1086,11 @@
         "encryption": {
           "$ref": "#/$defs/encryptionType"
         },
+        "sequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Ordering hint so flows can be assembled into sequence diagrams"
+        },
         "properties": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
@@ -914,10 +1108,10 @@
           "type": "string",
           "description": "The assumption being made"
         },
-        "category": {
+        "topic": {
           "type": "string",
           "enum": ["technical", "business", "operational", "security", "compliance", "performance", "availability"],
-          "description": "Category of the assumption"
+          "description": "Topic of the assumption"
         },
         "relatedAssets": {
           "type": "array",
@@ -1071,9 +1265,6 @@
         "criticality": {
           "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/criticality"
         },
-        "sensitivity": {
-          "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/dataSensitivity"
-        },
         "dataClassification": {
           "$ref": "#/$defs/dataClassification"
         },
@@ -1108,8 +1299,16 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "sensitivity": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/dataSensitivity"
+        "level": {
+          "type": "string",
+          "enum": ["public", "internal", "confidential", "restricted"],
+          "description": "Data sensitivity classification",
+          "meta:enum": {
+            "public": "Public information that can be freely shared",
+            "internal": "Internal use only within the organization",
+            "confidential": "Confidential information requiring protection",
+            "restricted": "Highly restricted information with limited access and special protection measures"
+          }
         },
         "dataTypes": {
           "type": "array",
@@ -1139,6 +1338,85 @@
         }
       }
     },
+    "dataObject": {
+      "type": "object",
+      "required": ["name"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Unique identifier for this data object"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name of the transported data object"
+        },
+        "description": {
+          "type": "string",
+          "description": "Additional details about the data contents"
+        },
+        "classification": {
+          "$ref": "#/$defs/dataClassification",
+          "description": "Inline classification details for this data object"
+        },
+        "classificationRef": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Reference to a shared classification definition elsewhere in the model"
+        },
+        "type": {
+          "$ref": "#/$defs/dataObjectType",
+          "description": "Type of data (PII, PHI, PCI, etc.)"
+        },
+        "schema": {
+          "type": "string",
+          "description": "Reference to a schema contract or document describing the data structure"
+        },
+        "format": {
+          "type": "string",
+          "description": "Serialization or encoding format (JSON, HL7, CSV, etc.)"
+        },
+        "attributes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Key attributes or fields transported"
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        }
+      }
+    },
+    "dataObjectType": {
+      "type": "string",
+      "enum": [
+        "pii",
+        "phi",
+        "pci",
+        "financial",
+        "intellectualProperty",
+        "telemetry",
+        "logs",
+        "credentials",
+        "safety",
+        "operational",
+        "custom"
+      ],
+      "description": "Common data object classifications",
+      "meta:enum": {
+        "pii": "Personally identifiable information",
+        "phi": "Protected health information",
+        "pci": "Payment card industry data",
+        "financial": "Financial statements or transaction data",
+        "intellectualProperty": "Intellectual property or trade secrets",
+        "telemetry": "System or product telemetry data",
+        "logs": "Operational or security log data",
+        "credentials": "Secrets, tokens, or credentials",
+        "safety": "Safety critical data or signals",
+        "operational": "Operational or process data",
+        "custom": "Other data types not covered by the enumerated values"
+      }
+    },
     "ownership": {
       "type": "object",
       "additionalProperties": false,
@@ -1230,6 +1508,10 @@
           "description": "Whether data is encrypted during processing"
         }
       }
+    },
+    "trustZoneRef": {
+      "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+      "description": "Reference to a zone entry whose type is 'trust'"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
index 0e07128f9..2aa6783c2 100644
--- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
@@ -24,6 +24,13 @@
       },
       "description": "Risk scenarios identified"
     },
+    "risks": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/risk"
+      },
+      "description": "Documented risks derived from scenarios"
+    },
     "mitigations": {
       "type": "array",
       "items": {
@@ -164,10 +171,6 @@
         "domain": {
           "$ref": "#/$defs/riskDomain"
         },
-        "category": {
-          "type": "string",
-          "description": "Category or classification of the scenario"
-        },
         "likelihood": {
           "$ref": "#/$defs/likelihood"
         },
@@ -204,6 +207,118 @@
             "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference"
           }
         },
+        "compliance": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["framework", "controlId"],
+            "additionalProperties": false,
+            "properties": {
+              "framework": {
+                "type": "string",
+                "description": "Name of the compliance program or framework"
+              },
+              "controlId": {
+                "type": "string",
+                "description": "Identifier of the control within the framework"
+              },
+              "reference": {
+                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference",
+                "description": "Link or citation to the requirement or control documentation"
+              },
+              "description": {
+                "type": "string",
+                "description": "Optional notes describing the mapping"
+              }
+            }
+          },
+          "description": "Compliance frameworks and control references this mitigation supports"
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        }
+      }
+    },
+    "risk": {
+      "type": "object",
+      "required": ["bom-ref", "name", "statement"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name or identifier for the risk"
+        },
+        "statement": {
+          "type": "string",
+          "description": "Structured risk statement describing source, event, and impact"
+        },
+        "description": {
+          "type": "string",
+          "description": "Additional narrative about the risk"
+        },
+        "domains": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/riskDomain"
+          },
+          "description": "Risk domains impacted"
+        },
+        "scenarios": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+          },
+          "description": "References to scenarios this risk addresses"
+        },
+        "likelihood": {
+          "$ref": "#/$defs/likelihood"
+        },
+        "impact": {
+          "$ref": "#/$defs/impact"
+        },
+        "riskScore": {
+          "$ref": "#/$defs/riskScore"
+        },
+        "riskAttributes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/riskAttribute"
+          }
+        },
+        "responses": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/riskResponse"
+          },
+          "description": "Risk responses or mitigation plans applied to this risk"
+        },
+        "relatedThreats": {
+          "type": "array",
+          "items": {
+            "$ref": "cyclonedx-threat-2.0.schema.json#/$defs/threatScenario"
+          },
+          "description": "Related threat scenarios informing this risk"
+        },
+        "status": {
+          "type": "string",
+          "enum": ["identified", "assessed", "mitigated", "accepted", "transferred", "retired"],
+          "meta:enum": {
+            "identified": "Risk has been identified but not yet evaluated",
+            "assessed": "Risk has been assessed and prioritized",
+            "mitigated": "Mitigations are in place reducing this risk",
+            "accepted": "Risk has been formally accepted",
+            "transferred": "Risk has been transferred to another party",
+            "retired": "Risk no longer applies"
+          }
+        },
+        "owner": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntityOrContact",
+          "description": "Owner or accountable party for this risk"
+        },
         "properties": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
@@ -219,18 +334,17 @@
           "enum": ["veryLow", "low", "medium", "high", "veryHigh", "certain"],
           "description": "Likelihood level",
           "meta:enum": {
-            "veryLow": "Very unlikely to occur (< 10%)",
-            "low": "Unlikely to occur (10-30%)",
-            "medium": "Possible to occur (30-60%)",
-            "high": "Likely to occur (60-90%)",
-            "veryHigh": "Very likely to occur (> 90%)",
-            "certain": "Will certainly occur (100%)"
+            "rare": "Very unlikely to occur (< 10%)",
+            "unlikely": "Unlikely to occur (10-30%)",
+            "possible": "Possible to occur (30-60%)",
+            "likely": "Likely to occur (60-90%)",
+            "almostCertain": "Very likely to occur (> 90%)"
           }
         },
         "score": {
           "type": "number",
           "minimum": 0,
-          "maximum": 10,
+          "maximum": 5,
           "description": "Numeric likelihood score"
         },
         "probability": {
@@ -239,6 +353,13 @@
           "maximum": 1,
           "description": "Probability as a decimal (0-1)"
         },
+        "factors": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/likelihoodFactor"
+          },
+          "description": "Factors considered when determining the likelihood level"
+        },
         "rationale": {
           "type": "string",
           "description": "Justification for the likelihood rating"
@@ -252,14 +373,13 @@
       "properties": {
         "level": {
           "type": "string",
-          "enum": ["negligible", "low", "moderate", "high", "severe", "catastrophic"],
+          "enum": ["negligible", "low", "moderate", "major", "catastrophic"],
           "description": "Impact severity level",
           "meta:enum": {
             "negligible": "Minimal impact with no significant consequences",
             "low": "Minor impact with limited consequences",
             "moderate": "Moderate impact affecting some operations",
-            "high": "Significant impact with serious consequences",
-            "severe": "Severe impact with critical consequences",
+            "major": "Significant impact with serious consequences",
             "catastrophic": "Catastrophic impact with existential consequences"
           }
         },
@@ -368,7 +488,7 @@
         },
         "score": {
           "type": "number",
-          "minimum": 0,
+          "minimum": 1,
           "description": "Numeric risk score"
         },
         "vector": {
@@ -381,46 +501,39 @@
         }
       }
     },
-    "mitigation": {
+    "riskResponse": {
       "type": "object",
-      "required": ["bom-ref", "name", "type"],
+      "required": ["bom-ref", "mitigations", "mitigationPlan"],
       "additionalProperties": false,
       "properties": {
         "bom-ref": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
         },
-        "name": {
-          "type": "string",
-          "description": "Name of the mitigation"
+        "mitigations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/mitigation"
+          },
+          "description": "Mitigations applied to this risk response"
         },
-        "description": {
-          "type": "string",
-          "description": "Description of what the mitigation does"
+        "mitigationPlan": {
+          "$ref": "#/$defs/mitigationPlan"
+        }
+      }
+    },
+    "mitigation": {
+      "type": "object",
+      "required": ["bom-ref", "reference"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Unique identifier for this mitigation entry so it can be referenced by a plan"
         },
-        "type": {
-          "type": "string",
-          "enum": [
-            "avoid",
-            "reduce",
-            "transfer",
-            "accept",
-            "control",
-            "countermeasure",
-            "safeguard",
-            "practice",
-            "procedure"
-          ],
-          "meta:enum": {
-            "avoid": "Avoid the risk entirely",
-            "reduce": "Reduce likelihood or impact",
-            "transfer": "Transfer risk to another party",
-            "accept": "Accept the risk",
-            "control": "Preventive or detective control",
-            "countermeasure": "Reactive measure to counter risks",
-            "safeguard": "Protective measure",
-            "practice": "Risk management practice",
-            "procedure": "Documented procedure"
-          }
+        "reference": {
+          "description": "Reference to a mitigation/control implementing the response.",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
         },
         "strategy": {
           "type": "string",
@@ -432,6 +545,21 @@
             "recover": "Recovers from the impact"
           }
         },
+        "type": {
+          "type": "string",
+          "enum": [
+            "control",
+            "countermeasure",
+            "procedure",
+            "removal"
+          ],
+          "meta:enum": {
+            "control": "Protective, preventive or detective control",
+            "countermeasure": "Reactive measure to counter risks",
+            "procedure": "Documented procedure",
+            "removal": "Removing a risky component or asset"
+          }
+        },
         "status": {
           "type": "string",
           "enum": ["proposed", "approved", "planned", "inProgress", "implemented", "verified"],
@@ -466,14 +594,14 @@
           "items": {
             "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
           },
-          "description": "References to scenarios this mitigation addresses"
+          "description": "References to scenarios this plan addresses"
         },
         "implementedBy": {
           "type": "array",
           "items": {
             "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
           },
-          "description": "References to assets that implement this mitigation"
+          "description": "References to assets that implement this plan"
         },
         "externalReferences": {
           "type": "array",
@@ -486,6 +614,75 @@
         }
       }
     },
+    "mitigationPlan": {
+      "type": "object",
+      "required": ["name", "type", "status", "mitigations"],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name of the mitigation plan"
+        },
+        "description": {
+          "type": "string",
+          "description": "Description of what the plan covers"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "avoid",
+            "reduce",
+            "transfer",
+            "accept",
+            "control",
+            "countermeasure",
+            "safeguard",
+            "practice",
+            "procedure"
+          ],
+          "meta:enum": {
+            "avoid": "Avoid the risk entirely",
+            "reduce": "Reduce likelihood or impact",
+            "transfer": "Transfer risk to another party",
+            "accept": "Accept the risk",
+            "control": "Protective, preventive or detective control",
+            "countermeasure": "Reactive measure to counter risks",
+            "safeguard": "Safeguards mitigating adverse events",
+            "practice": "Operational or governance practice",
+            "procedure": "Documented procedure"
+          }
+        },
+        "status": {
+          "type": "string",
+          "enum": ["proposed", "approved", "planned", "inProgress", "implemented", "verified"],
+          "meta:enum": {
+            "proposed": "Mitigation has been proposed",
+            "approved": "Mitigation has been approved",
+            "planned": "Implementation is planned",
+            "inProgress": "Implementation is in progress",
+            "implemented": "Mitigation has been implemented",
+            "verified": "Effectiveness has been verified"
+          }
+        },
+        "externalReferences": {
+          "type": "array",
+          "items": {
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference"
+          }
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        },
+        "mitigations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+          },
+          "description": "List of mitigation bom-refs chosen for this plan"
+        }
+      }
+    },
     "effectiveness": {
       "type": "object",
       "additionalProperties": false,
@@ -493,8 +690,8 @@
         "percentage": {
           "type": "number",
           "minimum": 0,
-          "maximum": 100,
-          "description": "Effectiveness as percentage"
+          "maximum": 1,
+          "description": "Effectiveness as decimal"
         },
         "rating": {
           "type": "string",
@@ -540,16 +737,32 @@
           "type": "string",
           "description": "Executive summary of the assessment"
         },
-        "findings": {
+        "risks": {
           "type": "array",
           "items": {
-            "$ref": "#/$defs/finding"
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
           },
-          "description": "Specific findings from the assessment"
+          "description": "References to risk entries evaluated in this assessment"
         },
         "overallRisk": {
-          "$ref": "#/$defs/riskScore",
-          "description": "Overall risk score/level"
+          "type": "object",
+          "required": ["method", "score"],
+          "additionalProperties": false,
+          "properties": {
+            "method": {
+              "type": "string",
+              "enum": ["sum", "average", "custom"],
+              "description": "Aggregation method used to derive the overall risk"
+            },
+            "score": {
+              "$ref": "#/$defs/riskScore"
+            },
+            "description": {
+              "type": "string",
+              "description": "Optional explanation for custom aggregation approaches"
+            }
+          },
+          "description": "Aggregated risk result for this assessment"
         },
         "recommendations": {
           "type": "array",
@@ -568,55 +781,6 @@
         }
       }
     },
-    "finding": {
-      "type": "object",
-      "required": ["title", "severity"],
-      "additionalProperties": false,
-      "properties": {
-        "bom-ref": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
-        },
-        "title": {
-          "type": "string",
-          "description": "Title of the finding"
-        },
-        "description": {
-          "type": "string",
-          "description": "Detailed description of the finding"
-        },
-        "severity": {
-          "$ref": "#/$defs/severity"
-        },
-        "relatedScenarios": {
-          "type": "array",
-          "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
-          },
-          "description": "Scenarios related to this finding"
-        },
-        "relatedAssets": {
-          "type": "array",
-          "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
-          },
-          "description": "Assets affected by this finding"
-        },
-        "remediation": {
-          "type": "string",
-          "description": "Recommended remediation"
-        },
-        "status": {
-          "type": "string",
-          "enum": ["open", "inProgress", "resolved", "accepted"],
-          "meta:enum": {
-            "open": "Finding is open and unaddressed",
-            "inProgress": "Remediation is in progress",
-            "resolved": "Finding has been resolved",
-            "accepted": "Risk has been accepted"
-          }
-        }
-      }
-    },
     "priority": {
       "type": "string",
       "enum": ["none", "low", "medium", "high", "critical"],
@@ -653,16 +817,43 @@
         "critical": "Critical impact with severe business consequences"
       }
     },
-    "dataSensitivity": {
+    "dataClassification": {
       "type": "string",
-      "enum": ["public", "internal", "confidential", "restricted", "secret"],
+      "enum": ["public", "internal", "confidential", "restricted"],
       "description": "Data sensitivity classification",
       "meta:enum": {
         "public": "Public information that can be freely shared",
         "internal": "Internal use only within the organization",
         "confidential": "Confidential information requiring protection",
-        "restricted": "Highly restricted information with limited access",
-        "secret": "Secret information requiring special handling"
+        "restricted": "Highly restricted information with limited access and special protection measures"
+      }
+    },
+    "likelihoodFactor": {
+      "type": "string",
+      "enum": [
+        "threatCapability",
+        "threatIntent",
+        "exploitMaturity",
+        "vulnerabilityExposure",
+        "controlStrength",
+        "detectionCoverage",
+        "environmentalChange",
+        "historicalFrequency",
+        "businessCycle",
+        "custom"
+      ],
+      "description": "Elements that influence likelihood estimations",
+      "meta:enum": {
+        "threatCapability": "Attacker skill, resources, or capacity to execute the scenario",
+        "threatIntent": "Motivation or intent of threats targeting the asset",
+        "exploitMaturity": "Availability and maturity of exploits or tooling",
+        "vulnerabilityExposure": "How exposed or accessible the vulnerable asset is",
+        "controlStrength": "Effectiveness of preventive controls in place",
+        "detectionCoverage": "Ability to detect attempts before success",
+        "environmentalChange": "External conditions (regulatory, geopolitical, seasonal) that shift likelihood",
+        "historicalFrequency": "Past occurrence rate or intelligence reporting",
+        "businessCycle": "Operational cadence (peak seasons, release cycles) that increases risk",
+        "custom": "Other organization-specific factors"
       }
     }
   }

From e8f7aba603fad40c40d8d067a8957eae05bbd614 Mon Sep 17 00:00:00 2001
From: Petra <petra@devarmor.com>
Date: Sun, 7 Dec 2025 18:36:51 +0000
Subject: [PATCH 2/3] adressed comments and reviewed further the schema

---
 .../model/cyclonedx-blueprint-2.0.schema.json | 54 ++++++++++++++--
 .../2.0/model/cyclonedx-risk-2.0.schema.json  |  2 +-
 .../model/cyclonedx-threat-2.0.schema.json    | 63 ++++++++++++++-----
 3 files changed, 99 insertions(+), 20 deletions(-)

diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
index 0659c6599..967262e88 100644
--- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
@@ -81,6 +81,13 @@
       },
       "description": "Data, control, or process flows between assets"
     },
+    "actors": {
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/actor"
+      },
+      "description": "Human or system actors involved in the model, distinct from assets"
+    },
     "assumptions": {
       "type": "array",
       "items": {
@@ -88,6 +95,49 @@
       },
       "description": "Assumptions made during the modeling process"
     },
+    "actor": {
+      "type": "object",
+      "required": ["bom-ref", "name", "type"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Unique identifier for the actor"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name or title of the actor"
+        },
+        "description": {
+          "type": "string",
+          "description": "Narrative describing the actor's role and context"
+        },
+        "type": {
+          "type": "string",
+          "enum": ["user", "engineer", "administrator", "operator", "system", "external"],
+          "description": "Classification of the actor",
+          "meta:enum": {
+            "user": "End user of a client application or service",
+            "engineer": "Developer or platform/DevOps engineer",
+            "administrator": "Administrative or privileged operator",
+            "operator": "Operational staff running the system",
+            "system": "Automated system actor or service account",
+            "external": "Third-party or external entity"
+          }
+        },
+        "permissions": {
+          "type": "string",
+          "description": "Key permissions, capabilities, or duties the actor holds"
+        },
+        "trustZone": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Reference to the trust zone where the actor resides"
+        },
+        "properties": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+        }
+      }
+    },
     "visualizations": {
       "type": "array",
       "items": {
@@ -335,8 +385,6 @@
             "compliance",
             "risk",
             "stakeholder",
-            "use-case",
-            "abuse-case",
             "design-review",
             "custom"
           ],
@@ -357,8 +405,6 @@
             "compliance": "Regulatory compliance perspective",
             "risk": "Risk management perspective",
             "stakeholder": "General stakeholder perspective",
-            "use-case": "A high level persepctive that captures the data-flows of the use case, rather than deep granularity of systems",
-            "abuse-case": "A high level persepctive that captures the data-flows of a certain abuse case, rather than deep granularity of systems",
             "custom": "Custom or other perspective"
           }
         },
diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
index 2aa6783c2..2f46e5b3a 100644
--- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
@@ -159,7 +159,7 @@
           "type": "string",
           "enum": ["threat", "vulnerability", "weakness", "risk", "incident", "opportunity", "hazard"],
           "meta:enum": {
-            "threat": "Security threat scenario",
+            "threat": "Threat scenario",
             "vulnerability": "Exploitable vulnerability",
             "weakness": "System or design weakness",
             "risk": "General risk scenario",
diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
index 51d3173ef..63c50aeb9 100644
--- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
@@ -26,6 +26,13 @@
             "attackPattern": {
               "$ref": "#/$defs/attackPatternReference"
             },
+            "abuseCases": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/abuseCase"
+              },
+              "description": "Abuse or misuse cases that illustrate how this threat can be exercised"
+            },
             "weakness": {
               "$ref": "#/$defs/weaknessReference"
             },
@@ -174,11 +181,6 @@
           },
           "description": "Primary motivations"
         },
-        "capability": {
-          "type": "string",
-          "enum": ["minimal", "limited", "moderate", "significant", "advanced"],
-          "description": "Overall capability level"
-        },
         "intent": {
           "type": "string",
           "enum": ["accidental", "opportunistic", "targeted", "persistent"],
@@ -219,7 +221,10 @@
         },
         "complexity": {
           "type": "string",
-          "enum": ["low", "high"],
+          "enum": [
+            "low",
+            "high"
+          ],
           "description": "Attack complexity"
         },
         "privileges": {
@@ -239,6 +244,42 @@
         }
       }
     },
+    "abuseCase": {
+      "type": "object",
+      "required": ["bom-ref", "name"],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "description": "Name of the abuse case"
+        },
+        "description": {
+          "type": "string",
+          "description": "Narrative describing how the system can be misused or abused"
+        },
+        "abuser": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "description": "Reference (bom-ref) to a threat actor involved in the abuse case"
+        },
+        "targets": {
+          "type": "array",
+          "items": {
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+          },
+          "description": "References (bom-refs) to assets or flows targeted in this abuse case"
+        },
+        "steps": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Ordered steps the abuser follows"
+        }
+      }
+    },
     "attackPattern": {
       "type": "object",
       "required": ["bom-ref", "name"],
@@ -259,14 +300,6 @@
           "type": "string",
           "description": "Description of the attack pattern"
         },
-        "severity": {
-          "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/severity"
-        },
-        "likelihood": {
-          "type": "string",
-          "enum": ["low", "medium", "high"],
-          "description": "Likelihood of this pattern being used"
-        },
         "prerequisites": {
           "type": "array",
           "items": {
@@ -768,4 +801,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}

From 53cfdd1286ecf3908a9a6d79c6642fec929b10d6 Mon Sep 17 00:00:00 2001
From: Petra <petra@devarmor.com>
Date: Sun, 7 Dec 2025 18:46:53 +0000
Subject: [PATCH 3/3] fixed naming inconsistency

---
 schema/2.0/model/cyclonedx-blueprint-2.0.schema.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
index 967262e88..cd64d1a3b 100644
--- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
@@ -130,7 +130,7 @@
           "description": "Key permissions, capabilities, or duties the actor holds"
         },
         "trustZone": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "#/$defs/trustZoneRef",
           "description": "Reference to the trust zone where the actor resides"
         },
         "properties": {
