From 8a147167db06ccbe56a74a12c09431ac5ba786b2 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Fri, 5 Jun 2026 15:49:25 -0500 Subject: [PATCH 01/14] WIP 2.0 threat-modeling schema set - threat: rewrite into `threat` (catalog) plus `threatScenario` (realization); add attackTree, methodology-gated categories, trustBoundary, threatProfiles - weakness: created new cyclonedx-weakness-2.0 model - vulnerability: replace `cwes` with `weaknesses` - profile: added threatProfiles to threat model; - risk: add `risks` collection, fix kebab-case, drop orphan control - behavior, usecase, requirement: refLinkType refs, required bom-ref, uniqueItems - root: wire in `threats` and `risks` - tests: update vulnerability test for 2.0 BREAKING: removes vulnerability.cwes and common.weakness. Signed-off-by: Steve Springett --- schema/2.0/cyclonedx-2.0.schema.json | 6 + .../model/cyclonedx-behavior-2.0.schema.json | 16 +- .../model/cyclonedx-profile-2.0.schema.json | 5 +- .../cyclonedx-requirement-2.0.schema.json | 15 +- .../2.0/model/cyclonedx-risk-2.0.schema.json | 55 +- .../model/cyclonedx-threat-2.0.schema.json | 1414 ++++++++++------- .../model/cyclonedx-usecase-2.0.schema.json | 2 + .../cyclonedx-vulnerability-2.0.schema.json | 17 +- .../model/cyclonedx-weakness-2.0.schema.json | 71 + .../2.0/valid-vulnerability-2.0.json | 12 +- 10 files changed, 946 insertions(+), 667 deletions(-) create mode 100644 schema/2.0/model/cyclonedx-weakness-2.0.schema.json diff --git a/schema/2.0/cyclonedx-2.0.schema.json b/schema/2.0/cyclonedx-2.0.schema.json index bcd14808c..806d82581 100644 --- a/schema/2.0/cyclonedx-2.0.schema.json +++ b/schema/2.0/cyclonedx-2.0.schema.json @@ -64,6 +64,12 @@ "vulnerabilities": { "$ref": "model/cyclonedx-vulnerability-2.0.schema.json#/$defs/vulnerabilities" }, + "threats": { + "$ref": "model/cyclonedx-threat-2.0.schema.json#/$defs/threats" + }, + "risks": { + "$ref": "model/cyclonedx-risk-2.0.schema.json#/$defs/risks" + }, "annotations": { "$ref": "model/cyclonedx-annotation-2.0.schema.json#/$defs/annotations" }, diff --git a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json index c9ac42d7a..abc489e66 100644 --- a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json @@ -55,19 +55,19 @@ "actors": { "type": "array", "title": "Actors", - "description": "References to objects that perform this behavior.", + "description": "References using bom-link or bom-ref to objects that perform this behavior.", "uniqueItems": true, "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" } }, "targets": { "type": "array", "title": "Targets", - "description": "References to objects affected by this behavior.", + "description": "References using bom-link or bom-ref to objects affected by this behavior.", "uniqueItems": true, "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" } } } @@ -220,19 +220,19 @@ "actors": { "type": "array", "title": "Actors", - "description": "References to objects that perform this step.", + "description": "References using bom-link or bom-ref to objects that perform this step.", "uniqueItems": true, "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" } }, "targets": { "type": "array", "title": "Targets", - "description": "References to objects affected by this step.", + "description": "References using bom-link or bom-ref to objects affected by this step.", "uniqueItems": true, "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" } } }, diff --git a/schema/2.0/model/cyclonedx-profile-2.0.schema.json b/schema/2.0/model/cyclonedx-profile-2.0.schema.json index 8f92babe6..0adbe8eb1 100644 --- a/schema/2.0/model/cyclonedx-profile-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-profile-2.0.schema.json @@ -8,11 +8,14 @@ "profiles": { "type": "object", "title": "Profiles", - "description": "A reusable, named characterization of how a subject behaves or is governed within a domain. Profiles separate characterization from identity: identity describes who or what the subject is; the profile describes the durable attributes that characterize it.", + "description": "A registry of reusable, named characterizations of how a subject behaves or is governed within a domain. Profiles separate characterization from identity: identity describes who or what the subject is; the profile describes the durable attributes that characterize it. A profile is referenced by its bom-ref from the elements it characterizes, so a single profile can be reused by many subjects.", "additionalProperties": false, "properties": { "dataProfiles": { "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataProfiles" + }, + "threatProfiles": { + "$ref": "cyclonedx-threat-2.0.schema.json#/$defs/threatProfiles" } } } diff --git a/schema/2.0/model/cyclonedx-requirement-2.0.schema.json b/schema/2.0/model/cyclonedx-requirement-2.0.schema.json index 94c22b000..d141b1b67 100644 --- a/schema/2.0/model/cyclonedx-requirement-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-requirement-2.0.schema.json @@ -18,6 +18,9 @@ "type": "object", "title": "Requirement", "description": "A requirement represents a specific need, constraint, or capability that must be met.", + "required": [ + "bom-ref" + ], "additionalProperties": false, "properties": { "bom-ref": { @@ -72,7 +75,8 @@ "description": "The individuals or groups who have an interest in the requirement.", "items": { "type": "string" - } + }, + "uniqueItems": true }, "acceptanceCriteria": { "type": "array", @@ -80,7 +84,8 @@ "description": "Criteria that must be met for the requirement to be considered satisfied.", "items": { "$ref": "#/$defs/acceptanceCriterion" - } + }, + "uniqueItems": true }, "dependencies": { "type": "array", @@ -88,7 +93,8 @@ "description": "Other requirements that this requirement depends on.", "items": { "$ref": "#/$defs/dependency" - } + }, + "uniqueItems": true }, "parent": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -127,7 +133,8 @@ "description": "Files or documents attached to the requirement.", "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment" - } + }, + "uniqueItems": true }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index 6a7f83065..eecea7e61 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -4,51 +4,16 @@ "type": "null", "title": "CycloneDX Risk Model", "$comment": "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "description": "An optional identifier which can be used to reference the risk assessment elsewhere in the BOM" - }, - "domains": { - "type": "array", - "description": "Risk domains covered by this assessment", - "items": { - "$ref": "#/$defs/riskDomain" - } - }, - "scenarios": { - "type": "array", - "items": { - "$ref": "#/$defs/scenario" - }, - "description": "Risk scenarios identified" - }, + "$defs": { "risks": { "type": "array", + "title": "Risks", + "uniqueItems": true, "items": { "$ref": "#/$defs/risk" }, - "description": "Documented risks derived from scenarios" + "description": "The documented risks identified through risk analysis." }, - "mitigations": { - "type": "array", - "items": { - "$ref": "#/$defs/mitigation" - }, - "description": "Controls, countermeasures, or mitigations to address identified risks" - }, - "assessments": { - "type": "array", - "items": { - "$ref": "#/$defs/assessment" - }, - "description": "Risk assessments and evaluations" - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - }, - "$defs": { "riskDomain": { "type": "object", "required": [ @@ -68,7 +33,7 @@ "reputational", "safety", "environmental", - "supply_chain", + "supply-chain", "technical", "project" ], @@ -82,7 +47,7 @@ "reputational": "Brand and reputation damage risks", "safety": "Human safety and physical security risks", "environmental": "Environmental impact and sustainability risks", - "supply_chain": "Supply chain and third-party risks", + "supply-chain": "Supply chain and third-party risks", "technical": "Technical and technology risks", "project": "Project delivery and execution risks" } @@ -109,13 +74,13 @@ "confidentiality", "connectivity", "control", - "data_subject_rights", + "data-subject-rights", "integrity", "minimisation", "non-repudiation", "possession", "privacy", - "purpose_limitation", + "purpose-limitation", "transparency", "utility" ], @@ -129,13 +94,13 @@ "confidentiality": "Preventing unauthorised access to or disclosure of information", "connectivity": "Maintaining secure and reliable communication between systems or components", "control": "Enabling individuals to manage how their personal data is used and shared", - "data_subject_rights": "Guaranteeing individuals' rights to access, correct, delete, or restrict their personal data", + "data-subject-rights": "Guaranteeing individuals' rights to access, correct, delete, or restrict their personal data", "integrity": "Ensuring information is accurate, complete, and unaltered by unauthorised actors", "minimisation": "Limiting data collection and retention to what is strictly necessary for the intended purpose", "non-repudiation": "Providing proof of origin and delivery to prevent denial of actions or communications", "possession": "Ensuring control or custody over data or assets, regardless of ownership", "privacy": "Protecting individuals' personal information in accordance with legal and ethical standards", - "purpose_limitation": "Ensuring that personal data is only used for the purpose explicitly specified at collection", + "purpose-limitation": "Ensuring that personal data is only used for the purpose explicitly specified at collection", "transparency": "Ensuring individuals are informed about data practices, including collection, use, and sharing", "utility": "Ensuring data is usable and in a format suitable for the intended purpose" } diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index eb4655331..a254b1609 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -5,179 +5,355 @@ "title": "CycloneDX Threat Model", "$comment": "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", "$defs": { - "threatScenario": { + "threats": { "type": "object", - "allOf": [ - { - "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/scenario" - }, - { - "properties": { - "threatCategory": { - "type": "string", - "description": "Threat category based on methodology (e.g., STRIDE category)" - }, - "threatActor": { - "$ref": "#/$defs/threatActorProfile" - }, - "attackVector": { - "$ref": "#/$defs/attackVector" - }, - "attackPattern": { - "$ref": "#/$defs/attackPatternReference" - }, - "abuseCases": { - "type": "array", - "items": { - "$ref": "#/$defs/abuseCase" - }, - "description": "Abuse or misuse cases that illustrate how this threat can be exercised" - }, - "weakness": { - "$ref": "#/$defs/weaknessReference" - }, - "exploitability": { - "$ref": "#/$defs/exploitability" - }, - "indicators": { - "$ref": "#/$defs/indicators" - }, - "killChainPhase": { - "type": "string", - "enum": [ - "reconnaissance", - "weaponization", - "delivery", - "exploitation", - "installation", - "command-and-control", - "actions-on-objectives" - ], - "meta:enum": { - "reconnaissance": "Gathering information about the target", - "weaponization": "Creating malicious payloads", - "delivery": "Transmitting weapon to target", - "exploitation": "Exploiting vulnerabilities", - "installation": "Installing malware or backdoors", - "command-and-control": "Establishing C2 channel", - "actions-on-objectives": "Achieving attack goals" - } - }, - "technicalImpact": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "unauthorized-access", - "data-breach", - "data-corruption", - "service-disruption", - "privilege-escalation", - "code-execution", - "information-disclosure", - "denial-of-service" - ] - } - } - } + "title": "Threats", + "description": "Threat-modelling content, including the documented threats, the scenarios that realize them, the attack patterns and attack trees that describe how they are carried out, the trust boundaries they cross, and the security policies that govern the system.", + "additionalProperties": false, + "properties": { + "threats": { + "type": "array", + "title": "Threats", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/threat" + }, + "description": "The documented threats. Each describes what can go wrong, independent of any specific actor or occurrence." + }, + "scenarios": { + "type": "array", + "title": "Scenarios", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/threatScenario" + }, + "description": "The threat scenarios, each realizing one or more documented threats in a specific way." + }, + "attackPatterns": { + "type": "array", + "title": "Attack Patterns", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/attackPattern" + }, + "description": "A library of attack patterns, typically aligned with CAPEC, that threats and scenarios can reference." + }, + "attackTrees": { + "type": "array", + "title": "Attack Trees", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/attackTree" + }, + "description": "Attack trees that decompose attacker goals into sub-goals and techniques." + }, + "abuseCases": { + "type": "array", + "title": "Abuse Cases", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/abuseCase" + }, + "description": "Abuse or misuse cases that describe how the system can be exercised by an adversary." + }, + "trustBoundaries": { + "type": "array", + "title": "Trust Boundaries", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/trustBoundary" + }, + "description": "The trust boundaries of the system, extending the architectural boundaries defined in a blueprint with trust semantics." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } - ] + } }, - "threatActor": { + "threat": { "type": "object", + "title": "Threat", + "description": "A documented threat, describing what can go wrong independent of any specific actor or occurrence. A threat can be catalogued on its own; a threat scenario references it to describe a specific realization.", + "additionalProperties": false, "required": [ "bom-ref", - "name", - "type" + "name" ], - "additionalProperties": false, "properties": { "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the threat elsewhere using a bom-ref or bom-link." }, "name": { "type": "string", - "description": "Name or identifier of the threat actor" + "minLength": 1, + "title": "Name", + "description": "The name of the threat." }, "description": { "type": "string", - "description": "Description of the threat actor" + "title": "Description", + "description": "A description of the threat." }, - "type": { + "source": { + "type": "string", + "title": "Source", + "description": "The source of the threat, such as a threat intelligence feed, a threat catalogue, or an analysis activity." + }, + "categories": { + "type": "array", + "title": "Categories", + "uniqueItems": true, + "description": "The methodology-specific categories that this threat falls under. A threat may be categorized under more than one methodology, for example STRIDE and MAESTRO. The methodology is one of the supported threat-modelling methodologies, and it determines which category values are permitted.", + "items": { + "type": "object", + "title": "Threat Category", + "description": "A threat category. The methodology determines the permitted category values.", + "additionalProperties": false, + "required": ["methodology", "category"], + "properties": { + "methodology": { + "type": "string", + "title": "Methodology", + "description": "The threat-modelling methodology that the category is drawn from.", + "enum": ["STRIDE", "LINDDUN", "MAESTRO", "MITRE-ATTACK"], + "meta:enum": { + "STRIDE": "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.", + "LINDDUN": "Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, and Non-compliance.", + "MAESTRO": "Multi-Agent Environment, Security, Threat, Risk, and Outcome, whose categories are its seven architectural layers.", + "MITRE-ATTACK": "The MITRE ATT&CK framework, whose categories are its Enterprise tactics." + } + }, + "category": { + "type": "string", + "minLength": 1, + "title": "Category", + "description": "The category within the methodology. The permitted values are determined by the methodology." + } + }, + "allOf": [ + { + "if": { + "required": ["methodology"], + "properties": { "methodology": { "const": "STRIDE" } } + }, + "then": { + "properties": { + "category": { + "enum": ["spoofing", "tampering", "repudiation", "information-disclosure", "denial-of-service", "elevation-of-privilege"], + "meta:enum": { + "spoofing": "Impersonating something or someone, violating authenticity.", + "tampering": "Modifying data or code, violating integrity.", + "repudiation": "Denying having performed an action, violating non-repudiation.", + "information-disclosure": "Exposing information to unauthorized parties, violating confidentiality.", + "denial-of-service": "Denying or degrading service to legitimate users, violating availability.", + "elevation-of-privilege": "Gaining capabilities without proper authorization, violating authorization." + } + } + } + } + }, + { + "if": { + "required": ["methodology"], + "properties": { "methodology": { "const": "LINDDUN" } } + }, + "then": { + "properties": { + "category": { + "enum": ["linkability", "identifiability", "non-repudiation", "detectability", "disclosure-of-information", "unawareness", "non-compliance"], + "meta:enum": { + "linkability": "Linking data items to learn more about an individual.", + "identifiability": "Identifying an individual from data.", + "non-repudiation": "Being unable to deny a claim, harming plausible deniability.", + "detectability": "Detecting that an item of interest exists.", + "disclosure-of-information": "Revealing personal data, violating confidentiality.", + "unawareness": "Individuals being unaware of the processing of their data.", + "non-compliance": "Deviating from policy, regulation, or best practice." + } + } + } + } + }, + { + "if": { + "required": ["methodology"], + "properties": { "methodology": { "const": "MAESTRO" } } + }, + "then": { + "properties": { + "category": { + "enum": ["foundation-models", "data-operations", "agent-frameworks", "deployment-and-infrastructure", "evaluation-and-observability", "security-and-compliance", "agent-ecosystem"], + "meta:enum": { + "foundation-models": "Layer 1. The core models that provide the agent's capabilities.", + "data-operations": "Layer 2. Storage, retrieval, and processing of the agent's data.", + "agent-frameworks": "Layer 3. The frameworks and tools that build and run agents.", + "deployment-and-infrastructure": "Layer 4. The infrastructure on which agents are deployed and scaled.", + "evaluation-and-observability": "Layer 5. Evaluation, monitoring, and observability of agent behaviour.", + "security-and-compliance": "Layer 6. The cross-cutting security and compliance controls.", + "agent-ecosystem": "Layer 7. The applications and marketplace where agents deliver value to end-users." + } + } + } + } + }, + { + "if": { + "required": ["methodology"], + "properties": { "methodology": { "const": "MITRE-ATTACK" } } + }, + "then": { + "properties": { + "category": { + "enum": ["reconnaissance", "resource-development", "initial-access", "execution", "persistence", "privilege-escalation", "defense-evasion", "credential-access", "discovery", "lateral-movement", "collection", "command-and-control", "exfiltration", "impact"] + } + } + } + } + ] + } + }, + "weaknesses": { + "$ref": "cyclonedx-weakness-2.0.schema.json#/$defs/weaknesses", + "description": "The weaknesses, such as CWE classifications, that this threat exploits." + }, + "attackPatterns": { + "type": "array", + "title": "Attack Patterns", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the attack patterns by which this threat is carried out." + }, + "attackTrees": { + "type": "array", + "title": "Attack Trees", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the attack trees that decompose this threat." + }, + "abuseCases": { + "type": "array", + "title": "Abuse Cases", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the abuse cases that illustrate how this threat can be exercised." + }, + "killChainPhase": { "type": "string", + "title": "Kill Chain Phase", + "description": "The phase of the cyber kill chain at which this threat operates.", "enum": [ - "individual", - "group", - "organization", - "nation-state", - "unknown" + "reconnaissance", + "weaponization", + "delivery", + "exploitation", + "installation", + "command-and-control", + "actions-on-objectives" ], "meta:enum": { - "individual": "Individual threat actor", - "group": "Organized group or collective", - "organization": "Corporate or criminal organization", - "nation-state": "Nation-state sponsored actor", - "unknown": "Unknown threat actor type" + "reconnaissance": "Gathering information about the target.", + "weaponization": "Creating a malicious payload.", + "delivery": "Transmitting the payload to the target.", + "exploitation": "Exploiting a vulnerability or weakness.", + "installation": "Installing malicious software or establishing a foothold.", + "command-and-control": "Establishing a command and control channel.", + "actions-on-objectives": "Achieving the goals of the attack." } }, - "aliases": { + "behaviors": { "type": "array", + "title": "Behaviors", + "uniqueItems": true, "items": { - "type": "string" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Known aliases or alternative names" + "description": "References using bom-link or bom-ref to the declared behaviors that constitute the intent of this threat, drawn from the behavior taxonomy." }, - "profile": { - "$ref": "#/$defs/threatActorProfile" + "indicators": { + "$ref": "#/$defs/indicators" }, - "observedTTPs": { + "affectedAssets": { "type": "array", + "title": "Affected Assets", + "uniqueItems": true, "items": { - "$ref": "#/$defs/ttp" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Observed tactics, techniques, and procedures" + "description": "References using bom-link or bom-ref to the kinds of assets this threat affects." }, - "attributedAttacks": { + "mitigations": { "type": "array", + "title": "Mitigations", + "uniqueItems": true, "items": { - "type": "string" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Attacks attributed to this actor" - }, - "targeting": { - "$ref": "#/$defs/targeting" + "description": "References using bom-link or bom-ref to the controls that mitigate this threat." }, "externalReferences": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" - } + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences" + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } }, - "threatActorProfile": { + "threatScenario": { "type": "object", + "title": "Threat Scenario", + "description": "A specific realization of a threat, in which an actor seeks to cause harm. The scenario references the threat it realizes, supplies the actor by reference to a party, and carries the scenario-specific traits and risk assessment, such as motivation, intent, access level, likelihood, and impact.", "additionalProperties": false, + "required": [ + "bom-ref", + "name", + "threats" + ], "properties": { - "sophistication": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the threat scenario elsewhere using a bom-ref or bom-link." + }, + "name": { "type": "string", - "enum": [ - "none", - "minimal", - "intermediate", - "advanced", - "expert" - ], - "meta:enum": { - "none": "No technical sophistication", - "minimal": "Script kiddie level", - "intermediate": "Intermediate technical skills", - "advanced": "Advanced persistent threat", - "expert": "Nation-state level capabilities" - } + "minLength": 1, + "title": "Name", + "description": "The name of the threat scenario." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the threat scenario." + }, + "threats": { + "type": "array", + "title": "Threats", + "uniqueItems": true, + "minItems": 1, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the threats that this scenario realizes. A scenario realizes one or more threats." + }, + "actor": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the party that is the actor in this scenario. Named adversary groups are organizations and abstract attacker classes are personas." + }, + "threatProfile": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to a reusable threat profile that describes the durable capabilities of the actor." }, "motivation": { "type": "array", + "title": "Motivation", + "uniqueItems": true, + "description": "The motivations of the actor in this scenario.", "items": { "type": "string", "enum": [ @@ -193,33 +369,44 @@ "competitive", "revenge", "activism" - ] - }, - "description": "Primary motivations" + ], + "meta:enum": { + "financial": "Motivated by financial gain.", + "political": "Motivated by political objectives.", + "personal": "Motivated by personal reasons.", + "ideological": "Motivated by ideology or belief.", + "espionage": "Motivated by intelligence gathering.", + "destruction": "Motivated by the desire to destroy.", + "disruption": "Motivated by the desire to disrupt operations.", + "reputation": "Motivated by reputational gain or harm.", + "curiosity": "Motivated by curiosity.", + "competitive": "Motivated by competitive advantage.", + "revenge": "Motivated by revenge.", + "activism": "Motivated by activism." + } + } }, "intent": { "type": "string", + "title": "Intent", + "description": "The intent of the actor in this scenario.", "enum": [ "accidental", "opportunistic", "targeted", "persistent" ], - "description": "Intent level" - }, - "resources": { - "type": "string", - "enum": [ - "minimal", - "limited", - "moderate", - "substantial", - "unlimited" - ], - "description": "Resource availability" + "meta:enum": { + "accidental": "The harm is caused without intent.", + "opportunistic": "The actor takes advantage of an opportunity as it arises.", + "targeted": "The actor deliberately targets the subject.", + "persistent": "The actor pursues the target persistently over time." + } }, "accessLevel": { "type": "string", + "title": "Access Level", + "description": "The level of access the actor is assumed to have in this scenario.", "enum": [ "none", "external", @@ -227,23 +414,147 @@ "privileged", "physical" ], - "description": "Level of access to target systems" + "meta:enum": { + "none": "No access.", + "external": "External access only.", + "internal": "Internal access, such as that of an ordinary user.", + "privileged": "Privileged or administrative access.", + "physical": "Physical access to the target." + } + }, + "attackVector": { + "$ref": "#/$defs/attackVector" + }, + "exploitability": { + "$ref": "#/$defs/exploitability" + }, + "likelihood": { + "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/likelihood" + }, + "impact": { + "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/impact" + }, + "riskScore": { + "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/riskScore" + }, + "riskAttributes": { + "type": "array", + "title": "Risk Attributes", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-risk-2.0.schema.json#/$defs/riskAttribute" + }, + "description": "The security and privacy attributes that this threat would compromise if realized." + }, + "affectedAssets": { + "type": "array", + "title": "Affected Assets", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the assets affected in this scenario." + }, + "relatedRisks": { + "type": "array", + "title": "Related Risks", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the risks that this scenario contributes to." + }, + "externalReferences": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences" + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "threatProfiles": { + "type": "array", + "title": "Threat Profiles", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/threatProfile" + }, + "description": "Reusable threat profiles, each describing the durable characteristics of an actor that may pose a threat." + }, + "threatProfile": { + "type": "object", + "title": "Threat Profile", + "description": "A durable, actor-level characterization of the capability to pose a threat, capturing attributes that persist across scenarios. Scenario-specific attributes, such as motivation, intent, and access level, belong on a threat scenario rather than on this profile.", + "additionalProperties": false, + "required": [ + "bom-ref" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference this threat profile elsewhere using a bom-ref or bom-link." + }, + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the threat profile." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the threat profile." + }, + "sophistication": { + "type": "string", + "title": "Sophistication", + "description": "The level of technical sophistication an actor characterized by this profile is assumed to possess.", + "enum": ["none", "minimal", "intermediate", "advanced", "expert"], + "meta:enum": { + "none": "No technical sophistication.", + "minimal": "Minimal sophistication, relying on readily available tools and techniques.", + "intermediate": "Intermediate technical skills.", + "advanced": "Advanced skills consistent with a persistent and well-resourced actor.", + "expert": "Expert skills consistent with the most capable actors." + } + }, + "resources": { + "type": "string", + "title": "Resources", + "description": "The level of resources an actor characterized by this profile is assumed to have available.", + "enum": ["minimal", "limited", "moderate", "substantial", "unlimited"], + "meta:enum": { + "minimal": "Minimal resources.", + "limited": "Limited resources.", + "moderate": "Moderate resources.", + "substantial": "Substantial resources.", + "unlimited": "Effectively unlimited resources." + } }, "skillSet": { "type": "array", + "title": "Skill Set", + "uniqueItems": true, "items": { "type": "string" }, - "description": "Specific skills possessed" + "description": "The specific skills an actor characterized by this profile is assumed to possess." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } }, "attackVector": { "type": "object", + "title": "Attack Vector", + "description": "The conditions under which an attack is possible, following the convention of common vulnerability scoring systems.", "additionalProperties": false, "properties": { "type": { "type": "string", + "title": "Type", + "description": "The context by which an attack is possible.", "enum": [ "network", "adjacent", @@ -251,289 +562,421 @@ "physical" ], "meta:enum": { - "network": "Remotely exploitable via network", - "adjacent": "Exploitable from adjacent network", - "local": "Requires local access", - "physical": "Requires physical access" + "network": "Remotely exploitable via a network.", + "adjacent": "Exploitable from an adjacent network.", + "local": "Requires local access.", + "physical": "Requires physical access." } }, "complexity": { "type": "string", + "title": "Complexity", + "description": "The complexity of the attack.", "enum": [ "low", "high" ], - "description": "Attack complexity" + "meta:enum": { + "low": "The attack has low complexity.", + "high": "The attack has high complexity." + } }, "privileges": { "type": "string", + "title": "Privileges", + "description": "The level of privileges required to carry out the attack.", "enum": [ "none", "low", "high" ], - "description": "Privileges required" + "meta:enum": { + "none": "No privileges are required.", + "low": "Low privileges are required.", + "high": "High privileges are required." + } }, "userInteraction": { "type": "string", + "title": "User Interaction", + "description": "Whether the attack requires interaction from a user other than the attacker.", "enum": [ "none", "required" ], - "description": "User interaction requirement" + "meta:enum": { + "none": "No user interaction is required.", + "required": "User interaction is required." + } }, "scope": { "type": "string", + "title": "Scope", + "description": "Whether a successful attack affects resources beyond the vulnerable component.", "enum": [ "unchanged", "changed" ], - "description": "Scope impact" - } - } - }, - "abuseCase": { - "type": "object", - "required": [ - "bom-ref", - "name" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "name": { - "type": "string", - "description": "Name of the abuse case" - }, - "description": { - "type": "string", - "description": "Narrative describing how the system can be misused or abused" - }, - "abuser": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to a threat actor involved in the abuse case." - }, - "targets": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to assets or flows targeted in this abuse case." - }, - "steps": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Ordered steps the abuser follows" + "meta:enum": { + "unchanged": "The attack affects only the vulnerable component.", + "changed": "The attack affects resources beyond the vulnerable component." + } } } }, "attackPattern": { "type": "object", + "title": "Attack Pattern", + "description": "A description of the common attributes and approach of an attack, typically aligned with CAPEC. Techniques are aligned with MITRE ATT&CK.", + "additionalProperties": false, "required": [ "bom-ref", "name" ], - "additionalProperties": false, "properties": { "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the attack pattern elsewhere using a bom-ref or bom-link." }, "capecId": { "type": "integer", - "description": "CAPEC (Common Attack Pattern Enumeration and Classification) ID" + "minimum": 1, + "title": "CAPEC Identifier", + "description": "The Common Attack Pattern Enumeration and Classification (CAPEC) identifier for this attack pattern." }, "name": { "type": "string", - "description": "Name of the attack pattern" + "minLength": 1, + "title": "Name", + "description": "The name of the attack pattern." }, "description": { "type": "string", - "description": "Description of the attack pattern" + "title": "Description", + "description": "A description of the attack pattern." }, "prerequisites": { "type": "array", + "title": "Prerequisites", + "uniqueItems": true, "items": { "type": "string" }, - "description": "Prerequisites for the attack" + "description": "The conditions that must hold for the attack to be possible." }, "techniques": { "type": "array", + "title": "Techniques", + "uniqueItems": true, "items": { "$ref": "#/$defs/technique" }, - "description": "Techniques used in the attack" + "description": "The techniques used to carry out the attack, typically aligned with MITRE ATT&CK." }, "mitigations": { "type": "array", + "title": "Mitigations", + "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to mitigations." + "description": "References using bom-link or bom-ref to the controls that mitigate this attack pattern." }, "examples": { "type": "array", + "title": "Examples", + "uniqueItems": true, "items": { "type": "string" }, - "description": "Real-world examples" - } - } - }, - "attackPatternReference": { - "type": "object", - "additionalProperties": false, - "properties": { - "patternRef": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to an attack pattern." - }, - "capecId": { - "type": "integer", - "description": "CAPEC ID if not referencing internal pattern" - }, - "customization": { - "type": "string", - "description": "How this pattern is customized for the specific scenario" + "description": "Real-world examples of the attack pattern." } } }, "technique": { "type": "object", + "title": "Technique", + "description": "A specific technique used to carry out an attack, typically aligned with MITRE ATT&CK.", "additionalProperties": false, "properties": { "id": { "type": "string", - "description": "Technique ID (e.g., MITRE ATT&CK ID)" + "title": "Identifier", + "description": "The identifier of the technique, such as a MITRE ATT&CK technique identifier." }, "name": { "type": "string", - "description": "Name of the technique" + "title": "Name", + "description": "The name of the technique." }, "tactic": { "type": "string", - "description": "Associated tactic" + "title": "Tactic", + "description": "The tactic that the technique supports, such as a MITRE ATT&CK tactic." }, "procedure": { "type": "string", - "description": "Specific procedure" - }, - "tools": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Tools used with this technique" + "title": "Procedure", + "description": "The specific procedure by which the technique is carried out." } } }, - "weakness": { + "attackTree": { "type": "object", + "title": "Attack Tree", + "description": "A decomposition of an attacker goal into sub-goals and techniques, expressed as a flat collection of nodes. Each node lists its child nodes by reference together with an operator that says how those children combine, so the tree is expressed without nesting. One node is the root, representing the attacker goal.", + "additionalProperties": false, "required": [ - "bom-ref" + "bom-ref", + "nodes" ], - "additionalProperties": false, "properties": { "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "cweId": { - "type": "integer", - "description": "CWE (Common Weakness Enumeration) ID" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the attack tree elsewhere using a bom-ref or bom-link." }, "name": { "type": "string", - "description": "Name of the weakness" + "title": "Name", + "description": "The name of the attack tree." }, "description": { "type": "string", - "description": "Description of the weakness" + "title": "Description", + "description": "A description of the attack tree." }, - "abstraction": { - "type": "string", - "enum": [ - "pillar", - "class", - "base", - "variant", - "compound" - ], - "meta:enum": { - "pillar": "Most abstract type of weakness", - "class": "Weakness described in generic terms", - "base": "Weakness described in abstract terms", - "variant": "Weakness specific to a resource/technology", - "compound": "Combination of two or more weaknesses" - } + "root": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "title": "Root BOM Reference", + "description": "Optional reference using bom-link or bom-ref to the root node within nodes, representing the attacker goal. When omitted, the root is the node that no other node lists as a child." + }, + "nodes": { + "type": "array", + "title": "Nodes", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/attackTreeNode" + }, + "description": "The nodes of the attack tree. Each node references its child nodes, which are themselves entries in this array, forming the hierarchy without nesting." + } + } + }, + "attackTreeNode": { + "type": "object", + "title": "Attack Tree Node", + "description": "A node in an attack tree, representing an attacker goal, sub-goal, or technique. A node references its child nodes and carries an operator that says how those children combine. The hierarchy is expressed by these references rather than by nesting.", + "additionalProperties": false, + "required": [ + "bom-ref", + "name" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the node elsewhere using a bom-ref or bom-link." }, - "ordinality": { + "name": { "type": "string", + "minLength": 1, + "title": "Name", + "description": "The goal, sub-goal, or technique that the node represents." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the node." + }, + "operator": { + "type": "string", + "title": "Operator", + "description": "Specifies how the nodes listed in 'children' combine to achieve this node. A value of 'and' requires every child node; a value of 'or' requires any single child node. For example, a node whose children are a phishing node and a credential-stuffing node uses 'or' when either alone achieves it, or 'and' when both are needed together. A node with no children is a leaf and omits this property.", "enum": [ - "primary", - "resultant", - "indirect" + "and", + "or" ], "meta:enum": { - "primary": "Weakness exists independent of other weaknesses", - "resultant": "Weakness is caused by another weakness", - "indirect": "Weakness is indirectly caused by another weakness" + "and": "All child nodes are required to achieve this node.", + "or": "Any one child node is sufficient to achieve this node." } }, - "affectedAssets": { + "children": { "type": "array", + "title": "Children", + "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to assets affected by this weakness." + "description": "References using bom-link or bom-ref to the child nodes that decompose this node. Each child node is a separate entry in the same nodes array, so the hierarchy is expressed without nesting. A child node may be shared by more than one parent." + }, + "attackPattern": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the attack pattern that this node represents." + }, + "weakness": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the weakness that this node exploits." }, - "exploitationDifficulty": { + "cost": { "type": "string", + "title": "Cost", + "description": "The relative cost to an attacker of achieving this node.", "enum": [ - "trivial", - "easy", + "negligible", + "low", + "moderate", + "high", + "prohibitive" + ], + "meta:enum": { + "negligible": "Negligible cost.", + "low": "Low cost.", + "moderate": "Moderate cost.", + "high": "High cost.", + "prohibitive": "Prohibitive cost." + } + }, + "skill": { + "type": "string", + "title": "Skill", + "description": "The skill level required to achieve this node.", + "enum": [ + "none", + "basic", + "intermediate", + "advanced", + "expert" + ], + "meta:enum": { + "none": "No special skill is required.", + "basic": "Basic skill is required.", + "intermediate": "Intermediate skill is required.", + "advanced": "Advanced skill is required.", + "expert": "Expert skill is required." + } + }, + "detectability": { + "type": "string", + "title": "Detectability", + "description": "How readily an attempt to achieve this node can be detected.", + "enum": [ + "undetectable", + "low", "moderate", - "difficult", - "impractical" + "high" ], - "description": "Difficulty of exploiting this weakness" + "meta:enum": { + "undetectable": "The attempt is effectively undetectable.", + "low": "The attempt is difficult to detect.", + "moderate": "The attempt is moderately detectable.", + "high": "The attempt is readily detectable." + } }, - "detectionMethods": { + "mitigations": { "type": "array", + "title": "Mitigations", + "uniqueItems": true, "items": { - "$ref": "#/$defs/detectionMethod" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Methods for detecting this weakness" + "description": "References using bom-link or bom-ref to the controls that mitigate this node." } } }, - "weaknessReference": { + "abuseCase": { "type": "object", + "title": "Abuse Case", + "description": "A description of how an adversary can misuse the system to achieve a malicious goal. An abuse case is the security counterpart of a use case and reuses its flow structure.", "additionalProperties": false, + "required": [ + "bom-ref", + "name" + ], "properties": { - "weaknessRef": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to a weakness." + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the abuse case elsewhere using a bom-ref or bom-link." }, - "cweId": { - "type": "integer", - "description": "CWE ID if not referencing internal weakness" + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the abuse case, typically expressed as a malicious goal." }, - "instance": { + "description": { "type": "string", - "description": "Specific instance or manifestation of the weakness" + "title": "Description", + "description": "A narrative describing how the system can be misused or abused." + }, + "abuser": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the party that abuses the system, typically an attacker persona." + }, + "realizes": { + "type": "array", + "title": "Realizes", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the threats that this abuse case realizes." + }, + "preconditions": { + "type": "array", + "title": "Preconditions", + "uniqueItems": true, + "items": { + "type": "string" + }, + "description": "The conditions that must hold before the abuse case can begin." + }, + "mainFlow": { + "type": "array", + "title": "Main Flow", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-usecase-2.0.schema.json#/$defs/step" + }, + "description": "The ordered steps the abuser follows." + }, + "targets": { + "type": "array", + "title": "Targets", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the assets or flows targeted in this abuse case." + }, + "detectionOpportunities": { + "type": "array", + "title": "Detection Opportunities", + "uniqueItems": true, + "items": { + "type": "string" + }, + "description": "The signals, logs, or controls that present an opportunity to detect the abuse." + }, + "mitigations": { + "type": "array", + "title": "Mitigations", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the controls that mitigate this abuse case." } } }, "exploitability": { "type": "object", + "title": "Exploitability", + "description": "The degree to which a threat can be exploited in practice.", "additionalProperties": false, "properties": { "level": { "type": "string", + "title": "Level", + "description": "The maturity of available exploitation capability.", "enum": [ "theoretical", "proof-of-concept", @@ -541,14 +984,16 @@ "weaponized" ], "meta:enum": { - "theoretical": "Theoretically possible but not demonstrated", - "proof-of-concept": "Proof of concept exists", - "functional": "Functional exploit exists", - "weaponized": "Weaponized exploit in the wild" + "theoretical": "Exploitation is theoretically possible but has not been demonstrated.", + "proof-of-concept": "A proof of concept exists.", + "functional": "A functional exploit exists.", + "weaponized": "A weaponized exploit is in use." } }, "complexity": { "type": "string", + "title": "Complexity", + "description": "The complexity of exploitation.", "enum": [ "trivial", "low", @@ -556,10 +1001,18 @@ "high", "very-high" ], - "description": "Complexity to exploit" + "meta:enum": { + "trivial": "Exploitation is trivial.", + "low": "Exploitation has low complexity.", + "medium": "Exploitation has medium complexity.", + "high": "Exploitation has high complexity.", + "very-high": "Exploitation has very high complexity." + } }, "skillRequired": { "type": "string", + "title": "Skill Required", + "description": "The skill level required to exploit the threat.", "enum": [ "none", "basic", @@ -567,79 +1020,70 @@ "advanced", "expert" ], - "description": "Skill level required" - }, - "toolsRequired": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Tools required for exploitation" - }, - "timeRequired": { - "type": "string", - "description": "Estimated time to develop exploit" - }, - "reliability": { - "type": "string", - "enum": [ - "unreliable", - "occasional", - "reliable", - "highly-reliable" - ], - "description": "Reliability of exploitation" + "meta:enum": { + "none": "No special skill is required.", + "basic": "Basic skill is required.", + "intermediate": "Intermediate skill is required.", + "advanced": "Advanced skill is required.", + "expert": "Expert skill is required." + } }, "automatable": { "type": "boolean", - "description": "Whether exploitation can be automated" + "title": "Automatable", + "description": "Whether exploitation can be automated." } } }, "indicators": { "type": "object", + "title": "Indicators", + "description": "The observable indicators associated with a threat.", "additionalProperties": false, "properties": { "compromise": { "type": "array", + "title": "Indicators of Compromise", + "uniqueItems": true, "items": { "type": "string" }, - "description": "Indicators of compromise" + "description": "The indicators that a compromise has occurred." }, "attack": { "type": "array", + "title": "Indicators of Attack", + "uniqueItems": true, "items": { "type": "string" }, - "description": "Indicators of attack" - }, - "behavioral": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Behavioral indicators" + "description": "The indicators that an attack is under way." }, "signatures": { "type": "array", + "title": "Signatures", + "uniqueItems": true, "items": { "$ref": "#/$defs/signature" }, - "description": "Detection signatures" + "description": "The detection signatures associated with the threat." } } }, "signature": { "type": "object", + "title": "Signature", + "description": "A detection signature for a threat.", + "additionalProperties": false, "required": [ "type", "value" ], - "additionalProperties": false, "properties": { "type": { "type": "string", + "title": "Type", + "description": "The type of signature.", "enum": [ "yara", "snort", @@ -647,321 +1091,107 @@ "hash", "behavior" ], - "description": "Type of signature" + "meta:enum": { + "yara": "A YARA rule.", + "snort": "A Snort rule.", + "regex": "A regular expression.", + "hash": "A cryptographic hash.", + "behavior": "A behavioural signature." + } }, "value": { "type": "string", - "description": "Signature value or pattern" + "minLength": 1, + "title": "Value", + "description": "The signature value or pattern." }, "description": { "type": "string", - "description": "Description of what the signature detects" + "title": "Description", + "description": "A description of what the signature detects." }, "confidence": { "type": "string", + "title": "Confidence", + "description": "The confidence level of a detection by this signature.", "enum": [ "low", "medium", "high" ], - "description": "Confidence level of detection" - } - } - }, - "ttp": { - "type": "object", - "additionalProperties": false, - "properties": { - "tactic": { - "type": "string", - "description": "High-level tactic" - }, - "technique": { - "$ref": "#/$defs/technique" - }, - "procedure": { - "type": "string", - "description": "Specific implementation" - }, - "tools": { - "type": "array", - "items": { - "$ref": "#/$defs/tool" - }, - "description": "Tools used" - }, - "infrastructure": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Infrastructure used" - } - } - }, - "tool": { - "type": "object", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "description": "Tool name" - }, - "type": { - "type": "string", - "enum": [ - "exploit", - "scanner", - "fuzzer", - "proxy", - "framework", - "custom" - ], - "description": "Type of tool" - }, - "version": { - "type": "string", - "description": "Tool version" - }, - "capabilities": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Tool capabilities" + "meta:enum": { + "low": "Low confidence.", + "medium": "Medium confidence.", + "high": "High confidence." + } } } }, - "targeting": { + "trustBoundary": { "type": "object", + "title": "Trust Boundary", + "description": "A security annotation marking an architectural boundary as one across which trust changes. It references a boundary defined in a blueprint, where the zones, type, and crossing requirements already live, and adds only the trust differential and the threats and controls at that boundary.", "additionalProperties": false, - "properties": { - "sectors": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Targeted sectors or industries" - }, - "regions": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Targeted geographic regions" - }, - "technologies": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Targeted technologies or platforms" - }, - "dataTypes": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Types of data targeted" - } - } - }, - "detectionMethod": { - "type": "object", - "required": [ - "method" - ], - "additionalProperties": false, - "properties": { - "method": { - "type": "string", - "enum": [ - "static-analysis", - "dynamic-analysis", - "penetration-test", - "code-review", - "architecture-review", - "automated-scan" - ], - "description": "Detection method type" - }, - "description": { - "type": "string", - "description": "Description of the detection method" - }, - "effectiveness": { - "type": "string", - "enum": [ - "low", - "medium", - "high" - ], - "description": "Effectiveness of the method" - }, - "tools": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Tools that implement this method" - } - } - }, - "securityPolicy": { - "type": "object", "required": [ "bom-ref", - "name", - "type" + "boundary" ], - "additionalProperties": false, "properties": { "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An identifier which can be used to reference the trust boundary elsewhere using a bom-ref or bom-link." + }, + "boundary": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the blueprint boundary that this trust boundary annotates." }, "name": { "type": "string", - "description": "Policy name" - }, - "type": { - "type": "string", - "enum": [ - "access-control", - "data-protection", - "network-security", - "application-security", - "operational-security", - "compliance" - ], - "description": "Type of security policy" + "title": "Name", + "description": "The name of the trust boundary." }, "description": { "type": "string", - "description": "Policy description" + "title": "Description", + "description": "A description of the trust boundary." }, - "requirements": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Policy requirements" - }, - "enforcement": { + "trustLevel": { "type": "string", + "title": "Trust Level", + "description": "The trust level differential across the boundary.", "enum": [ - "mandatory", - "recommended", - "optional" + "untrusted", + "semi-trusted", + "trusted", + "highly-trusted" ], - "description": "Enforcement level" + "meta:enum": { + "untrusted": "The boundary separates an untrusted zone.", + "semi-trusted": "The boundary separates a semi-trusted zone.", + "trusted": "The boundary separates a trusted zone.", + "highly-trusted": "The boundary separates a highly trusted zone." + } }, - "appliesTo": { + "threatsAtBoundary": { "type": "array", + "title": "Threats At Boundary", + "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to assets this policy applies to." + "description": "References using bom-link or bom-ref to the threats that could exploit this boundary." }, - "exceptions": { + "controlsAtBoundary": { "type": "array", + "title": "Controls At Boundary", + "uniqueItems": true, "items": { - "type": "string" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Policy exceptions" - } - } - }, - "trustBoundary": { - "type": "object", - "allOf": [ - { - "$ref": "cyclonedx-blueprint-2.0.schema.json#/$defs/boundary" - }, - { - "properties": { - "trustLevel": { - "type": "string", - "enum": [ - "untrusted", - "semi-trusted", - "trusted", - "highly-trusted" - ], - "description": "Trust level differential" - }, - "securityRequirements": { - "$ref": "#/$defs/boundarySecurityRequirements" - }, - "threatsAtBoundary": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to threats that could exploit this boundary." - }, - "controlsAtBoundary": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to controls implemented at this boundary." - } - } - } - ] - }, - "boundarySecurityRequirements": { - "type": "object", - "additionalProperties": false, - "properties": { - "authenticationStrength": { - "type": "string", - "enum": [ - "none", - "weak", - "moderate", - "strong", - "very-strong" - ], - "description": "Required authentication strength" - }, - "authorizationGranularity": { - "type": "string", - "enum": [ - "coarse", - "medium", - "fine", - "very-fine" - ], - "description": "Authorization granularity required" - }, - "integrityVerification": { - "type": "boolean", - "description": "Whether integrity verification is required" + "description": "References using bom-link or bom-ref to the controls implemented at this boundary." }, - "confidentialityProtection": { - "type": "boolean", - "description": "Whether confidentiality protection is required" - }, - "auditingLevel": { - "type": "string", - "enum": [ - "none", - "basic", - "detailed", - "comprehensive" - ], - "description": "Level of auditing required" - }, - "dataValidationRules": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Data validation rules at boundary" + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } } diff --git a/schema/2.0/model/cyclonedx-usecase-2.0.schema.json b/schema/2.0/model/cyclonedx-usecase-2.0.schema.json index e3fb3350c..a04c62e02 100644 --- a/schema/2.0/model/cyclonedx-usecase-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-usecase-2.0.schema.json @@ -19,6 +19,7 @@ "title": "Use Case", "description": "A structured description of how one or more actors interact with the system to achieve a specific goal, including the primary flow, alternative paths, and exception scenarios.", "required": [ + "bom-ref", "name" ], "additionalProperties": false, @@ -67,6 +68,7 @@ "mainFlow": { "type": "array", "title": "Main Flow", + "uniqueItems": true, "items": { "$ref": "#/$defs/step" }, diff --git a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json index cd9e7fd00..fc72dad9a 100644 --- a/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json @@ -74,14 +74,9 @@ "$ref": "#/$defs/rating" } }, - "cwes": { - "type": "array", - "title": "CWEs", - "description": "List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability.", - "examples": [399], - "items": { - "$ref": "#/$defs/cwe" - } + "weaknesses": { + "$ref": "cyclonedx-weakness-2.0.schema.json#/$defs/weaknesses", + "description": "The weaknesses, such as CWE classifications, that give rise to this vulnerability." }, "description": { "type": "string", @@ -346,12 +341,6 @@ } } }, - "cwe": { - "type": "integer", - "minimum": 1, - "title": "CWE", - "description": "Integer representation of a Common Weaknesses Enumerations (CWE). For example 399 (of https://cwe.mitre.org/data/definitions/399.html)" - }, "severity": { "type": "string", "title": "Severity", diff --git a/schema/2.0/model/cyclonedx-weakness-2.0.schema.json b/schema/2.0/model/cyclonedx-weakness-2.0.schema.json new file mode 100644 index 000000000..6680e8d07 --- /dev/null +++ b/schema/2.0/model/cyclonedx-weakness-2.0.schema.json @@ -0,0 +1,71 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-weakness-2.0.schema.json", + "type": "null", + "title": "CycloneDX Weakness Model", + "$comment": "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", + "$defs": { + "weaknesses": { + "type": "array", + "title": "Weaknesses", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/weakness" + }, + "description": "A collection of weaknesses, such as CWE classifications, that classify an underlying flaw." + }, + "weakness": { + "title": "Weakness", + "description": "A classification of an underlying weakness, given either by a Common Weakness Enumeration (CWE) identifier or by a free-text name with an optional description. The exploitability and the affected scope are expressed by the vulnerability or threat that references the weakness, not on the weakness itself.", + "oneOf": [ + { + "type": "object", + "title": "CWE Weakness", + "description": "A weakness identified by its CWE identifier.", + "additionalProperties": false, + "required": [ + "cweId" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An optional identifier which can be used to reference the weakness elsewhere using a bom-ref or bom-link." + }, + "cweId": { + "type": "integer", + "minimum": 1, + "title": "CWE Identifier", + "description": "The Common Weakness Enumeration (CWE) identifier that classifies this weakness." + } + } + }, + { + "type": "object", + "title": "Named Weakness", + "description": "A weakness identified by a free-text name, used where no CWE classification applies.", + "additionalProperties": false, + "required": [ + "name" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "An optional identifier which can be used to reference the weakness elsewhere using a bom-ref or bom-link." + }, + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the weakness." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the weakness." + } + } + } + ] + } + } +} diff --git a/tools/src/test/resources/2.0/valid-vulnerability-2.0.json b/tools/src/test/resources/2.0/valid-vulnerability-2.0.json index 6fbe030a7..dbdf49796 100644 --- a/tools/src/test/resources/2.0/valid-vulnerability-2.0.json +++ b/tools/src/test/resources/2.0/valid-vulnerability-2.0.json @@ -44,9 +44,15 @@ "justification": "An optional reason for rating the vulnerability as it was" } ], - "cwes": [ - 184, - 502 + "weaknesses": [ + { + "bom-ref": "weakness-184", + "cweId": 184 + }, + { + "bom-ref": "weakness-502", + "cweId": 502 + } ], "description": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.", "detail": "", From cf91c5c969bd6b5cdd22399b2ff23f878d7f7123 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Fri, 5 Jun 2026 20:42:31 -0500 Subject: [PATCH 02/14] Minor refactor and expansion of risk schema Signed-off-by: Steve Springett --- .../2.0/model/cyclonedx-risk-2.0.schema.json | 1096 ++++++++++------- 1 file changed, 664 insertions(+), 432 deletions(-) diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index eecea7e61..d00650029 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -12,7 +12,7 @@ "items": { "$ref": "#/$defs/risk" }, - "description": "The documented risks identified through risk analysis." + "description": "A collection of risks identified through risk analysis. The risk model is methodology-neutral and can document risk regardless of the risk rating framework used. It supports qualitative, semi-quantitative, and quantitative approaches by recording a qualitative `level`, a numeric `score`, or quantified loss, with the originating methodology identified on each score. Each risk distinguishes the risk before responses are applied (`inherentRisk`) from the risk that remains after them (`residualRisk`), with an optional `targetRisk` reflecting risk appetite, consistent with the process described in [ISO 31000](https://www.iso.org/iso-31000-risk-management.html). Specific rating techniques are not prescribed; [IEC 31010](https://www.iso.org/standard/72140.html) catalogues the available techniques." }, "riskDomain": { "type": "object", @@ -22,88 +22,153 @@ "additionalProperties": false, "properties": { "type": { - "type": "string", - "enum": [ - "security", - "privacy", - "operational", - "financial", - "compliance", - "strategic", - "reputational", - "safety", - "environmental", - "supply-chain", - "technical", - "project" - ], - "meta:enum": { - "security": "Information security and cybersecurity risks", - "privacy": "Data protection and privacy risks", - "operational": "Business operations and continuity risks", - "financial": "Financial loss and economic impact risks", - "compliance": "Regulatory and legal compliance risks", - "strategic": "Strategic business and market risks", - "reputational": "Brand and reputation damage risks", - "safety": "Human safety and physical security risks", - "environmental": "Environmental impact and sustainability risks", - "supply-chain": "Supply chain and third-party risks", - "technical": "Technical and technology risks", - "project": "Project delivery and execution risks" - } + "title": "Type", + "description": "The domain or category of risk. Use the custom option for domains specific to an organization's risk taxonomy.", + "oneOf": [ + { + "title": "Predefined Risk Domain", + "type": "string", + "enum": [ + "security", + "privacy", + "operational", + "financial", + "compliance", + "strategic", + "reputational", + "safety", + "environmental", + "supply-chain", + "technical", + "project", + "ethical", + "societal", + "human-rights", + "health", + "legal" + ], + "meta:enum": { + "security": "Information security and cybersecurity risks.", + "privacy": "Data protection and privacy risks.", + "operational": "Business operations and continuity risks.", + "financial": "Financial loss and economic impact risks.", + "compliance": "Regulatory and legal compliance risks.", + "strategic": "Strategic business and market risks.", + "reputational": "Brand and reputation damage risks.", + "safety": "Human safety and physical security risks.", + "environmental": "Environmental impact and sustainability risks.", + "supply-chain": "Supply chain and third-party risks.", + "technical": "Technical and technology risks.", + "project": "Project delivery and execution risks.", + "ethical": "Ethical risks, including the responsible use of automated decision-making and artificial intelligence.", + "societal": "Risks to society, communities, or democratic and civic processes.", + "human-rights": "Risks to fundamental human rights, including discrimination and loss of autonomy.", + "health": "Risks to physical or mental health and wellbeing.", + "legal": "Legal exposure, including liability and contractual risks." + } + }, + { + "title": "Custom Risk Domain", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom risk domain." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom risk domain." + } + } + } + ] }, "priority": { "$ref": "#/$defs/priority" }, "description": { "type": "string", - "description": "Additional context for this risk domain" + "description": "Additional context for this risk domain." } } }, "riskAttribute": { - "type": "string", - "description": "A classification of security and privacy attributes that represent potential impact areas when a risk is realized", - "enum": [ - "accountability", - "authentication", - "authorization", - "authenticity", - "availability", - "compliance", - "confidentiality", - "connectivity", - "control", - "data-subject-rights", - "integrity", - "minimisation", - "non-repudiation", - "possession", - "privacy", - "purpose-limitation", - "transparency", - "utility" - ], - "meta:enum": { - "accountability": "Assigning responsibility for actions and decisions to individuals or entities", - "authentication": "Verifying the identity of users, devices, or systems before granting access", - "authorization": "Granting permissions based on identity and roles to perform specific actions or access resources", - "authenticity": "Ensuring that data, communications, or entities are genuine and can be verified", - "availability": "Ensuring systems, data, and services are accessible and operational when needed", - "compliance": "Adherence to applicable laws, regulations, policies, and standards", - "confidentiality": "Preventing unauthorised access to or disclosure of information", - "connectivity": "Maintaining secure and reliable communication between systems or components", - "control": "Enabling individuals to manage how their personal data is used and shared", - "data-subject-rights": "Guaranteeing individuals' rights to access, correct, delete, or restrict their personal data", - "integrity": "Ensuring information is accurate, complete, and unaltered by unauthorised actors", - "minimisation": "Limiting data collection and retention to what is strictly necessary for the intended purpose", - "non-repudiation": "Providing proof of origin and delivery to prevent denial of actions or communications", - "possession": "Ensuring control or custody over data or assets, regardless of ownership", - "privacy": "Protecting individuals' personal information in accordance with legal and ethical standards", - "purpose-limitation": "Ensuring that personal data is only used for the purpose explicitly specified at collection", - "transparency": "Ensuring individuals are informed about data practices, including collection, use, and sharing", - "utility": "Ensuring data is usable and in a format suitable for the intended purpose" - } + "title": "Risk Attribute", + "description": "A security or privacy attribute representing a potential impact area when a risk is realized. Use the custom option for attributes specific to an organization's risk taxonomy.", + "oneOf": [ + { + "title": "Predefined Risk Attribute", + "type": "string", + "enum": [ + "accountability", + "authentication", + "authorization", + "authenticity", + "availability", + "compliance", + "confidentiality", + "connectivity", + "control", + "data-subject-rights", + "integrity", + "minimisation", + "non-repudiation", + "possession", + "privacy", + "purpose-limitation", + "transparency", + "utility" + ], + "meta:enum": { + "accountability": "Assigning responsibility for actions and decisions to individuals or entities.", + "authentication": "Verifying the identity of users, devices, or systems before granting access.", + "authorization": "Granting permissions based on identity and roles to perform specific actions or access resources.", + "authenticity": "Ensuring that data, communications, or entities are genuine and can be verified.", + "availability": "Ensuring systems, data, and services are accessible and operational when needed.", + "compliance": "Adherence to applicable laws, regulations, policies, and standards.", + "confidentiality": "Preventing unauthorised access to or disclosure of information.", + "connectivity": "Maintaining secure and reliable communication between systems or components.", + "control": "Enabling individuals to manage how their personal data is used and shared.", + "data-subject-rights": "Guaranteeing individuals' rights to access, correct, delete, or restrict their personal data.", + "integrity": "Ensuring information is accurate, complete, and unaltered by unauthorised actors.", + "minimisation": "Limiting data collection and retention to what is strictly necessary for the intended purpose.", + "non-repudiation": "Providing proof of origin and delivery to prevent denial of actions or communications.", + "possession": "Ensuring control or custody over data or assets, regardless of ownership.", + "privacy": "Protecting individuals' personal information in accordance with legal and ethical standards.", + "purpose-limitation": "Ensuring that personal data is only used for the purpose explicitly specified at collection.", + "transparency": "Ensuring individuals are informed about data practices, including collection, use, and sharing.", + "utility": "Ensuring data is usable and in a format suitable for the intended purpose." + } + }, + { + "title": "Custom Risk Attribute", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom risk attribute." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom risk attribute." + } + } + } + ] }, "scenario": { "type": "object", @@ -119,32 +184,60 @@ }, "name": { "type": "string", - "description": "Name of the risk scenario" + "description": "The name of the scenario." }, "description": { "type": "string", - "description": "Detailed description of the scenario" + "description": "A description of the scenario." }, "type": { - "type": "string", - "enum": [ - "threat", - "vulnerability", - "weakness", - "risk", - "incident", - "opportunity", - "hazard" - ], - "meta:enum": { - "threat": "Threat scenario", - "vulnerability": "Exploitable vulnerability", - "weakness": "System or design weakness", - "risk": "General risk scenario", - "incident": "Potential incident scenario", - "opportunity": "Positive risk (opportunity)", - "hazard": "Safety hazard scenario" - } + "title": "Type", + "description": "The kind of scenario. Use the custom option for kinds specific to an organization's methodology.", + "oneOf": [ + { + "title": "Predefined Scenario Type", + "type": "string", + "enum": [ + "threat", + "vulnerability", + "weakness", + "risk", + "incident", + "opportunity", + "hazard" + ], + "meta:enum": { + "threat": "Threat scenario.", + "vulnerability": "Exploitable vulnerability.", + "weakness": "System or design weakness.", + "risk": "General risk scenario.", + "incident": "Potential incident scenario.", + "opportunity": "Positive risk, an opportunity.", + "hazard": "Safety hazard scenario." + } + }, + { + "title": "Custom Scenario Type", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom scenario type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom scenario type." + } + } + } + ] }, "domain": { "$ref": "#/$defs/riskDomain" @@ -163,7 +256,7 @@ "items": { "$ref": "#/$defs/riskAttribute" }, - "description": "Risk attributes affected by this scenario" + "description": "The risk attributes affected by this scenario." }, "affectedAssets": { "type": "array", @@ -197,23 +290,23 @@ "properties": { "framework": { "type": "string", - "description": "Name of the compliance program or framework" + "description": "The name of the compliance program or framework." }, "controlId": { "type": "string", - "description": "Identifier of the control within the framework" + "description": "The identifier of the control within the framework." }, "reference": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference", - "description": "Link or citation to the requirement or control documentation" + "description": "A link or citation to the requirement or control documentation." }, "description": { "type": "string", - "description": "Optional notes describing the mapping" + "description": "Optional notes describing the mapping." } } }, - "description": "Compliance frameworks and control references this mitigation supports" + "description": "Compliance frameworks and control references this scenario maps to." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -234,78 +327,112 @@ }, "name": { "type": "string", - "description": "Name or identifier for the risk" + "description": "A human-readable name for the risk." }, "statement": { "type": "string", - "description": "Structured risk statement describing source, event, and impact" + "description": "Structured risk statement describing source, event, and impact." }, "description": { "type": "string", - "description": "Additional narrative about the risk" + "description": "Additional narrative about the risk." }, "domains": { "type": "array", "items": { "$ref": "#/$defs/riskDomain" }, - "description": "Risk domains impacted" + "description": "The risk domains this risk affects." }, - "scenarios": { + "affects": { "type": "array", - "minItems": 1, + "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to scenarios this risk addresses." - }, - "likelihood": { - "$ref": "#/$defs/likelihood" - }, - "impact": { - "$ref": "#/$defs/impact" - }, - "riskScore": { - "$ref": "#/$defs/riskScore" + "description": "References using bom-link or bom-ref to the subjects this risk concerns. A subject may be a component, service, dataset, or model, or a party such as a person, persona, or organization, including a group at risk of being systematically disadvantaged." }, - "riskAttributes": { + "relatedScenarios": { "type": "array", + "uniqueItems": true, "items": { - "$ref": "#/$defs/riskAttribute" - } + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the risk scenarios related to this risk. A risk scenario is a scenario object in this model and may be of type vulnerability, weakness, incident, opportunity, or hazard. Threat scenarios from a threat model are referenced separately through relatedThreats." }, - "responses": { + "relatedThreats": { "type": "array", + "uniqueItems": true, "items": { - "$ref": "#/$defs/riskResponse" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Risk responses or mitigation plans applied to this risk" + "description": "References using bom-link or bom-ref to the threats or threat scenarios from a threat model that inform this risk. A reference may point to a discrete threat or to a threat scenario." }, - "relatedThreats": { + "inherentRisk": { + "$ref": "#/$defs/rating", + "description": "The assessed risk before any responses are applied." + }, + "residualRisk": { + "$ref": "#/$defs/rating", + "description": "The assessed risk remaining after responses are applied." + }, + "targetRisk": { + "$ref": "#/$defs/rating", + "description": "The risk level the organization aims to reach, reflecting its risk appetite." + }, + "responses": { "type": "array", "items": { - "$ref": "cyclonedx-threat-2.0.schema.json#/$defs/threatScenario" + "$ref": "#/$defs/riskResponse" }, - "description": "Related threat scenarios informing this risk" + "description": "The responses applied to this risk." }, "status": { - "type": "string", - "enum": [ - "identified", - "assessed", - "mitigated", - "accepted", - "transferred", - "retired" - ], - "meta:enum": { - "identified": "Risk has been identified but not yet evaluated", - "assessed": "Risk has been assessed and prioritized", - "mitigated": "Mitigations are in place reducing this risk", - "accepted": "Risk has been formally accepted", - "transferred": "Risk has been transferred to another party", - "retired": "Risk no longer applies" - } + "title": "Status", + "description": "The lifecycle status of the risk. Use the custom option for a status specific to an organization's risk process.", + "oneOf": [ + { + "title": "Predefined Risk Status", + "type": "string", + "enum": [ + "identified", + "assessed", + "mitigated", + "accepted", + "transferred", + "retired" + ], + "meta:enum": { + "identified": "Risk has been identified but not yet evaluated.", + "assessed": "Risk has been assessed and prioritized.", + "mitigated": "Responses are in place reducing this risk.", + "accepted": "Risk has been formally accepted.", + "transferred": "Risk has been transferred to another party.", + "retired": "Risk no longer applies." + } + }, + { + "title": "Custom Risk Status", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom status." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom status." + } + } + } + ] }, "owner": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", @@ -316,6 +443,35 @@ } } }, + "rating": { + "type": "object", + "title": "Rating", + "description": "A methodology-neutral assessment of risk along likelihood and impact, with an overall score. The same shape expresses inherent, residual, and target risk so reductions can be compared. A rating can be qualitative (a `level`), semi-quantitative (a numeric `score` on a bounded scale), or quantitative (for example a probable monetary loss under [FAIR](https://www.fairinstitute.org/)). For a catalogue of assessment techniques, see [IEC 31010](https://www.iso.org/standard/72140.html).", + "additionalProperties": false, + "properties": { + "likelihood": { + "$ref": "#/$defs/likelihood" + }, + "impact": { + "$ref": "#/$defs/impact" + }, + "score": { + "$ref": "#/$defs/riskScore" + }, + "confidence": { + "type": "number", + "minimum": 0, + "maximum": 1, + "title": "Confidence", + "description": "Confidence in this rating, expressed as a decimal from 0 to 1, where 1 is full confidence. Supports quantitative methods that reason over uncertainty." + }, + "rationale": { + "type": "string", + "title": "Rationale", + "description": "The justification for this rating, including the method and the evidence considered." + } + } + }, "likelihood": { "type": "object", "required": [ @@ -328,51 +484,50 @@ "title": "Level", "description": "The qualitative likelihood level representing the overall assessed probability of the risk or scenario being realized.", "enum": [ - "certain", - "high", + "very-low", "low", "medium", - "veryHigh", - "veryLow" + "high", + "very-high", + "certain" ], "meta:enum": { - "certain": "Almost certain to occur (> 90% probability).", - "high": "Likely to occur (60-90% probability).", - "low": "Unlikely to occur (10-30% probability).", - "medium": "Possible to occur (30-60% probability).", - "veryHigh": "Very likely to occur (75-90% probability).", - "veryLow": "Very unlikely to occur (< 10% probability)." + "very-low": "Very unlikely to occur (less than 10% probability).", + "low": "Unlikely to occur (10 to 30% probability).", + "medium": "Possible to occur (30 to 60% probability).", + "high": "Likely to occur (60 to 85% probability).", + "very-high": "Very likely to occur (85 to 99% probability).", + "certain": "Almost certain to occur (greater than 99% probability)." } }, "score": { "type": "number", "minimum": 0, - "maximum": 5, - "description": "Numeric likelihood score" + "description": "Numeric likelihood score on the scale defined by the methodology." }, "probability": { "type": "number", "minimum": 0, "maximum": 1, - "description": "Probability as a decimal (0-1)" + "description": "Probability as a decimal from 0 to 1." }, "factors": { "type": "array", "items": { "$ref": "#/$defs/likelihoodFactor" }, - "description": "Factors considered when determining the likelihood level" + "description": "The factors considered when determining the likelihood level." }, "rationale": { "type": "string", - "description": "Justification for the likelihood rating" + "description": "The justification for the likelihood rating." } } }, "likelihoodFactor": { "type": "object", "title": "Likelihood Factor", - "description": "An individual contributing factor used to determine the overall likelihood of a risk or scenario being realized. Likelihood is rarely a single judgment — it is typically derived from multiple independent factors such as threat actor capability, exploit maturity, attack surface exposure, and control effectiveness. Each factor captures a discrete dimension of likelihood with its own rating, enabling transparent, auditable, and methodology-aligned risk assessments.", + "description": "An individual contributing factor used to determine the overall likelihood of a risk or scenario being realized. Likelihood is rarely a single judgment. It is typically derived from multiple independent factors such as threat actor capability, exploit maturity, attack surface exposure, and control effectiveness. Each factor captures a discrete dimension of likelihood with its own rating, enabling transparent, auditable, and methodology-aligned risk assessments.", "required": [ "name", "type" @@ -391,29 +546,34 @@ "oneOf": [ { "title": "Predefined Likelihood Factor Type", - "description": "A likelihood factor type defined by the CycloneDX standard, aligned with established risk assessment methodologies.", + "description": "A likelihood factor type defined by the CycloneDX standard, aligned with established risk assessment methodologies including FAIR, OWASP Risk Rating, and NIST SP 800-30.", "type": "string", - "additionalProperties": false, "enum": [ - "attackVector", - "controlEffectiveness", - "exploitMaturity", + "attack-vector", + "contact-frequency", + "control-effectiveness", + "detectability", + "discoverability", + "exploit-maturity", "exposure", "motivation", "opportunity", - "other", - "threatCapability", + "targeting", + "threat-capability", "vulnerability" ], "meta:enum": { - "attackVector": "Accessibility of the attack path to the threat actor, considering network proximity, authentication requirements, and interaction complexity.", - "controlEffectiveness": "Strength, reliability, and coverage of existing preventive, detective, or corrective controls that reduce the probability of successful exploitation.", - "exploitMaturity": "Availability, reliability, and sophistication of known exploits, attack toolkits, or proof-of-concept code targeting the identified weakness.", + "attack-vector": "Accessibility of the attack path to the threat actor, considering network proximity, authentication requirements, and interaction complexity.", + "contact-frequency": "How often the threat actor comes into contact with the target asset, independent of any intent to act. Aligns with the FAIR contact frequency factor.", + "control-effectiveness": "Strength, reliability, and coverage of existing preventive, detective, or corrective controls that reduce the probability of successful exploitation. Corresponds to resistance strength in FAIR.", + "detectability": "Likelihood that the activity is detected before the risk is realized. Lower detectability increases the chance of a successful action. Aligns with the OWASP Risk Rating intrusion detection factor and the FMEA detection axis.", + "discoverability": "Ease with which the weakness or opportunity can be found by a potential actor. Aligns with the OWASP Risk Rating ease of discovery factor.", + "exploit-maturity": "Availability, reliability, and sophistication of known exploits, attack toolkits, or proof-of-concept code targeting the identified weakness.", "exposure": "Degree to which the target asset, system, or service is visible, discoverable, or reachable by potential threat actors.", "motivation": "Level of incentive, intent, or determination driving the threat actor to pursue exploitation, including financial gain, ideology, or competitive advantage.", "opportunity": "Availability of the conditions, timing, or circumstances required for the threat actor to act, including access windows, environmental factors, and resource availability.", - "other": "A likelihood factor type not defined by the CycloneDX standard. Use the custom type option for factors specific to an organization's risk methodology.", - "threatCapability": "Technical skill, resources, tooling, and sophistication of the threat actor relative to the complexity of the attack required.", + "targeting": "Degree to which the threat actor specifically selects this asset or organization rather than acting opportunistically. Aligns with the NIST SP 800-30 targeting factor.", + "threat-capability": "Technical skill, resources, tooling, and sophistication of the threat actor relative to the complexity of the attack required.", "vulnerability": "Presence, severity, and exploitability of weaknesses in the target system, application, or process that could be leveraged by a threat actor." } }, @@ -446,28 +606,27 @@ "title": "Level", "description": "The qualitative rating assigned to this factor, representing the assessed degree to which this factor contributes to the overall likelihood of the risk being realized.", "enum": [ - "certain", - "high", + "very-low", "low", "medium", - "veryHigh", - "veryLow" + "high", + "very-high", + "certain" ], "meta:enum": { - "certain": "This factor almost certainly contributes to risk realization (> 90% influence).", - "high": "This factor strongly contributes to risk realization (60-90% influence).", - "low": "This factor has limited contribution to risk realization (10-30% influence).", - "medium": "This factor moderately contributes to risk realization (30-60% influence).", - "veryHigh": "This factor very strongly contributes to risk realization (75-90% influence).", - "veryLow": "This factor has minimal contribution to risk realization (< 10% influence)." + "very-low": "This factor has minimal contribution to risk realization (less than 10% influence).", + "low": "This factor has limited contribution to risk realization (10 to 30% influence).", + "medium": "This factor moderately contributes to risk realization (30 to 60% influence).", + "high": "This factor strongly contributes to risk realization (60 to 85% influence).", + "very-high": "This factor very strongly contributes to risk realization (85 to 99% influence).", + "certain": "This factor almost certainly contributes to risk realization (greater than 99% influence)." } }, "score": { "type": "number", "title": "Score", - "description": "A numeric score representing the assessed value of this factor on a 0-5 scale, where 0 indicates no contribution to likelihood and 5 indicates maximum contribution.", - "minimum": 0, - "maximum": 5 + "description": "A numeric score representing the assessed value of this factor on the scale defined by the methodology, where a higher value indicates a greater contribution to likelihood.", + "minimum": 0 }, "weight": { "type": "number", @@ -502,65 +661,122 @@ "major", "catastrophic" ], - "description": "Impact severity level", + "description": "The qualitative impact severity level.", "meta:enum": { - "negligible": "Minimal impact with no significant consequences", - "low": "Minor impact with limited consequences", - "moderate": "Moderate impact affecting some operations", - "major": "Significant impact with serious consequences", - "catastrophic": "Catastrophic impact with existential consequences" + "negligible": "Minimal impact with no significant consequences.", + "low": "Minor impact with limited consequences.", + "moderate": "Moderate impact affecting some operations.", + "major": "Significant impact with serious consequences.", + "catastrophic": "Catastrophic impact with existential consequences." + } + }, + "polarity": { + "type": "string", + "title": "Polarity", + "description": "Whether the impact represents a harm or a benefit. Benefits support modeling opportunities and positive risk.", + "enum": [ + "harm", + "benefit" + ], + "meta:enum": { + "harm": "A negative impact or downside.", + "benefit": "A positive impact or upside." } }, "score": { "type": "number", "minimum": 0, - "maximum": 10, - "description": "Numeric impact score" + "description": "Numeric impact score on the scale defined by the methodology." }, "categories": { "type": "array", + "uniqueItems": true, "items": { - "type": "string", - "enum": [ - "confidentiality", - "integrity", - "availability", - "financial", - "reputation", - "regulatory", - "safety", - "privacy", - "operational", - "strategic" - ], - "meta:enum": { - "confidentiality": "Impact on data confidentiality", - "integrity": "Impact on data or system integrity", - "availability": "Impact on service availability", - "financial": "Financial loss or impact", - "reputation": "Reputational damage", - "regulatory": "Regulatory compliance impact", - "safety": "Human safety impact", - "privacy": "Privacy violation impact", - "operational": "Operational disruption", - "strategic": "Strategic business impact" - } + "oneOf": [ + { + "title": "Predefined Impact Category", + "type": "string", + "enum": [ + "confidentiality", + "integrity", + "availability", + "financial", + "reputation", + "regulatory", + "safety", + "privacy", + "operational", + "strategic", + "bias", + "discrimination", + "fairness", + "human-rights", + "environmental", + "societal", + "psychological", + "physical", + "health" + ], + "meta:enum": { + "confidentiality": "Impact on data confidentiality.", + "integrity": "Impact on data or system integrity.", + "availability": "Impact on service availability.", + "financial": "Financial loss or impact.", + "reputation": "Reputational damage.", + "regulatory": "Regulatory compliance impact.", + "safety": "Human safety impact.", + "privacy": "Privacy violation impact.", + "operational": "Operational disruption.", + "strategic": "Strategic business impact.", + "bias": "Systematic bias in automated outputs or decisions.", + "discrimination": "Unfair treatment of individuals or groups, including on the basis of protected attributes.", + "fairness": "Impact on the fair and equitable treatment of affected groups.", + "human-rights": "Impact on fundamental human rights, including autonomy and dignity.", + "environmental": "Environmental impact, including energy use and carbon emissions.", + "societal": "Impact on society, communities, or civic processes.", + "psychological": "Psychological or emotional harm.", + "physical": "Physical harm to people or property.", + "health": "Impact on physical or mental health." + } + }, + { + "title": "Custom Impact Category", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom impact category." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom impact category." + } + } + } + ] }, - "description": "Categories of impact" + "description": "The categories of impact, including harms relevant to AI and societal risk." }, "riskAttributes": { "type": "array", "items": { "$ref": "#/$defs/riskAttribute" }, - "description": "Risk attributes affected" + "description": "The risk attributes affected." }, "quantification": { "$ref": "#/$defs/impactQuantification" }, "description": { "type": "string", - "description": "Description of the potential impact" + "description": "A description of the potential impact." } } }, @@ -570,35 +786,62 @@ "properties": { "financialLoss": { "type": "number", - "description": "Estimated financial loss in currency units" + "description": "The estimated financial loss, in the units given by currency." }, "currency": { "type": "string", "pattern": "^[A-Z]{3}$", - "description": "ISO 4217 currency code" + "description": "The currency of the financial values, as an [ISO 4217](https://www.iso.org/iso-4217-currency-codes.html) code." }, "affectedUsers": { "type": "integer", - "description": "Number of affected users" + "description": "The number of affected users." }, "downtime": { "type": "string", "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(\\d+H)?(\\d+M)?(\\d+(\\.\\d+)?S)?)?$", - "description": "Expected downtime as ISO 8601 duration" + "description": "The expected downtime, as an [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) duration." }, "dataRecords": { "type": "integer", - "description": "Number of data records affected" + "description": "The number of data records affected." }, "recovery": { "type": "string", "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(\\d+H)?(\\d+M)?(\\d+(\\.\\d+)?S)?)?$", - "description": "Recovery time as ISO 8601 duration" + "description": "The recovery time, as an [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) duration." + }, + "financialLossRange": { + "type": "object", + "title": "Financial Loss Range", + "additionalProperties": false, + "description": "A distribution of estimated financial loss, supporting quantitative methods such as FAIR that reason over ranges.", + "properties": { + "minimum": { + "type": "number", + "description": "The minimum estimated financial loss." + }, + "mostLikely": { + "type": "number", + "description": "The most likely estimated financial loss." + }, + "maximum": { + "type": "number", + "description": "The maximum estimated financial loss." + } + } + }, + "affectedGroups": { + "type": "integer", + "minimum": 0, + "description": "The number of distinct groups or populations affected." } } }, "riskScore": { "type": "object", + "title": "Risk Score", + "description": "The overall risk score, expressed as a qualitative `level`, a numeric `score`, or both, with `vector` and `methodology` recording how it was derived. The scale of `score` is defined by the methodology, since rating systems differ. For example, [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology) averages factors from 0 to 9, [DREAD](https://en.wikipedia.org/wiki/DREAD_%28risk_assessment_model%29) averages five 1 to 10 ratings, [FMEA](https://asq.org/quality-resources/fmea) multiplies three 1 to 10 axes into a 1 to 1000 risk priority number, and [FAIR](https://www.fairinstitute.org/) expresses probable loss in monetary terms.", "required": [ "level" ], @@ -613,128 +856,191 @@ "high", "critical" ], - "description": "Overall risk level", + "description": "The overall qualitative risk level.", "meta:enum": { - "info": "Informational - no immediate action required", - "low": "Low risk - monitor and address in normal cycle", - "medium": "Medium risk - plan mitigation activities", - "high": "High risk - prioritize mitigation efforts", - "critical": "Critical risk - immediate action required" + "info": "Informational.", + "low": "Low risk.", + "medium": "Medium risk.", + "high": "High risk.", + "critical": "Critical risk." } }, "score": { "type": "number", - "minimum": 1, - "description": "Numeric risk score" + "minimum": 0, + "description": "Numeric risk score on the scale defined by the methodology." }, "vector": { "type": "string", - "description": "Risk scoring vector (e.g., L:H/I:M)" + "description": "A textual representation of the metric values used to derive the score, in the format defined by the methodology." }, "methodology": { - "type": "string", - "description": "Risk scoring methodology used" + "title": "Methodology", + "description": "The risk rating methodology used to derive this score. Only methodologies that define a scoring calculation are listed; governance frameworks such as [ISO 31000](https://www.iso.org/iso-31000-risk-management.html) are recorded as standards rather than as a score methodology. Use the custom option for methodologies not listed.", + "oneOf": [ + { + "title": "Predefined Risk Methodology", + "type": "string", + "enum": [ + "dread", + "fair", + "fmea", + "nist-sp-800-30", + "octave", + "owasp-risk-rating" + ], + "meta:enum": { + "dread": "[DREAD](https://en.wikipedia.org/wiki/DREAD_%28risk_assessment_model%29) risk rating model, the average of five ratings (damage, reproducibility, exploitability, affected users, discoverability) each scored 1 to 10.", + "fair": "[Factor Analysis of Information Risk (FAIR)](https://www.fairinstitute.org/), a quantitative methodology expressing risk as loss event frequency multiplied by loss magnitude.", + "fmea": "[Failure Mode and Effects Analysis (FMEA)](https://asq.org/quality-resources/fmea), using a risk priority number of severity multiplied by occurrence multiplied by detection.", + "nist-sp-800-30": "[NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final) guide for conducting risk assessments, using its exemplary likelihood and impact scales.", + "octave": "[OCTAVE Allegro](https://www.sei.cmu.edu/documents/786/2007_005_001_14885.pdf), using its relative risk score.", + "owasp-risk-rating": "[OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), averaging likelihood and impact factors each scored 0 to 9." + } + }, + { + "title": "Custom Risk Methodology", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom risk methodology." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom risk methodology." + } + } + } + ] } } }, "riskResponse": { "type": "object", + "title": "Risk Response", + "description": "An action taken to modify a risk, pairing the chosen strategy with the controls that implement it. Covers the full set of dispositions, from avoiding or reducing a risk to accepting it or, for a positive risk, pursuing it.", "required": [ "bom-ref", - "mitigations", - "mitigationPlan" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "mitigations": { - "type": "array", - "minItems": 1, - "items": { - "$ref": "#/$defs/mitigation" - }, - "description": "Mitigations applied to this risk response" - }, - "mitigationPlan": { - "$ref": "#/$defs/mitigationPlan" - } - } - }, - "mitigation": { - "type": "object", - "required": [ - "bom-ref", - "reference" + "strategy" ], "additionalProperties": false, "properties": { "bom-ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "description": "Unique identifier for this mitigation entry so it can be referenced by a plan" - }, - "reference": { - "description": "Reference using bom-link or bom-ref to a mitigation or control implementing the response.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + "description": "An identifier which can be used to reference this response elsewhere using a bom-ref or bom-link." }, "strategy": { "type": "string", + "title": "Strategy", + "description": "The disposition chosen for the risk.", "enum": [ - "prevent", - "detect", - "respond", - "recover" + "avoid", + "reduce", + "transfer", + "accept", + "exploit", + "enhance" ], "meta:enum": { - "prevent": "Prevents the risk from occurring", - "detect": "Detects when the risk occurs", - "respond": "Responds to the risk when detected", - "recover": "Recovers from the impact" + "avoid": "Eliminate the risk by removing its source or not proceeding with the activity.", + "reduce": "Lower the likelihood or impact of the risk through controls.", + "transfer": "Shift the risk to another party, for example through insurance or contract.", + "accept": "Take no further action and retain the risk.", + "exploit": "Pursue an opportunity so that a positive risk occurs.", + "enhance": "Increase the likelihood or benefit of a positive risk." } }, - "type": { + "description": { "type": "string", - "enum": [ - "control", - "countermeasure", - "procedure", - "removal" - ], - "meta:enum": { - "control": "Protective, preventive or detective control", - "countermeasure": "Reactive measure to counter risks", - "procedure": "Documented procedure", - "removal": "Removing a risky component or asset" - } + "title": "Description", + "description": "A description of the response." }, - "status": { + "controls": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the controls, requirements, or components that implement this response." + }, + "function": { "type": "string", + "title": "Function", + "description": "The control function this response performs, following a prevent, detect, respond, and recover model.", "enum": [ - "proposed", - "approved", - "planned", - "inProgress", - "implemented", - "verified" + "prevent", + "detect", + "respond", + "recover" ], "meta:enum": { - "proposed": "Mitigation has been proposed", - "approved": "Mitigation has been approved", - "planned": "Implementation is planned", - "inProgress": "Implementation is in progress", - "implemented": "Mitigation has been implemented", - "verified": "Effectiveness has been verified" + "prevent": "Prevents the risk from occurring.", + "detect": "Detects when the risk occurs.", + "respond": "Responds to the risk when detected.", + "recover": "Recovers from the impact." } }, - "priority": { - "$ref": "#/$defs/priority" + "status": { + "title": "Status", + "description": "The implementation status of the response. Use the custom option for a status specific to an organization's process.", + "oneOf": [ + { + "title": "Predefined Response Status", + "type": "string", + "enum": [ + "proposed", + "approved", + "planned", + "in-progress", + "implemented", + "verified" + ], + "meta:enum": { + "proposed": "The response has been proposed.", + "approved": "The response has been approved.", + "planned": "Implementation is planned.", + "in-progress": "Implementation is in progress.", + "implemented": "The response has been implemented.", + "verified": "Effectiveness has been verified." + } + }, + { + "title": "Custom Response Status", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom status." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom status." + } + } + } + ] }, "effectiveness": { "$ref": "#/$defs/effectiveness" }, "cost": { "type": "string", + "title": "Cost", "enum": [ "trivial", "low", @@ -743,99 +1049,33 @@ "extreme" ], "meta:enum": { - "trivial": "Minimal cost and effort", - "low": "Low cost and effort", - "medium": "Moderate cost and effort", - "high": "High cost and significant effort", - "extreme": "Extreme cost and major effort" + "trivial": "Minimal cost and effort.", + "low": "Low cost and effort.", + "medium": "Moderate cost and effort.", + "high": "High cost and significant effort.", + "extreme": "Extreme cost and major effort." } }, - "addresses": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to scenarios this plan addresses." + "priority": { + "$ref": "#/$defs/priority" }, - "implementedBy": { + "owner": { + "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", + "description": "The party accountable for this response. May be an inline party object or a reference to a previously declared party." + }, + "targetDate": { + "type": "string", + "format": "date-time", + "title": "Target Date", + "description": "The date by which this response is targeted to be implemented." + }, + "addresses": { "type": "array", + "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to assets that implement this plan." - }, - "externalReferences": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" - } - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - } - }, - "mitigationPlan": { - "type": "object", - "required": [ - "name", - "type", - "status", - "mitigations" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "description": "Name of the mitigation plan" - }, - "description": { - "type": "string", - "description": "Description of what the plan covers" - }, - "type": { - "type": "string", - "enum": [ - "avoid", - "reduce", - "transfer", - "accept", - "control", - "countermeasure", - "safeguard", - "practice", - "procedure" - ], - "meta:enum": { - "avoid": "Avoid the risk entirely", - "reduce": "Reduce likelihood or impact", - "transfer": "Transfer risk to another party", - "accept": "Accept the risk", - "control": "Protective, preventive or detective control", - "countermeasure": "Reactive measure to counter risks", - "safeguard": "Safeguards mitigating adverse events", - "practice": "Operational or governance practice", - "procedure": "Documented procedure" - } - }, - "status": { - "type": "string", - "enum": [ - "proposed", - "approved", - "planned", - "inProgress", - "implemented", - "verified" - ], - "meta:enum": { - "proposed": "Mitigation has been proposed", - "approved": "Mitigation has been approved", - "planned": "Implementation is planned", - "inProgress": "Implementation is in progress", - "implemented": "Mitigation has been implemented", - "verified": "Effectiveness has been verified" - } + "description": "References using bom-link or bom-ref to the items this response addresses, such as a threat, vulnerability, weakness, or another risk." }, "externalReferences": { "type": "array", @@ -845,14 +1085,6 @@ }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - }, - "mitigations": { - "type": "array", - "minItems": 1, - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to mitigations chosen for this plan." } } }, @@ -864,7 +1096,7 @@ "type": "number", "minimum": 0, "maximum": 1, - "description": "Effectiveness as decimal" + "description": "Effectiveness as a decimal from 0 to 1." }, "rating": { "type": "string", @@ -876,11 +1108,11 @@ "excellent" ], "meta:enum": { - "ineffective": "Does not meaningfully reduce risk", - "marginal": "Slightly reduces risk", - "adequate": "Adequately reduces risk", - "good": "Significantly reduces risk", - "excellent": "Nearly eliminates risk" + "ineffective": "Does not meaningfully reduce risk.", + "marginal": "Slightly reduces risk.", + "adequate": "Adequately reduces risk.", + "good": "Significantly reduces risk.", + "excellent": "Nearly eliminates risk." } } } @@ -906,16 +1138,16 @@ "triggered" ], "meta:enum": { - "initial": "Initial risk assessment", - "periodic": "Scheduled periodic assessment", - "continuous": "Continuous monitoring assessment", - "triggered": "Event-triggered assessment" + "initial": "Initial risk assessment.", + "periodic": "Scheduled periodic assessment.", + "continuous": "Continuous monitoring assessment.", + "triggered": "Event-triggered assessment." } }, "timestamp": { "type": "string", "format": "date-time", - "description": "When the assessment was performed" + "description": "When the assessment was performed." }, "assessor": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", @@ -923,7 +1155,7 @@ }, "summary": { "type": "string", - "description": "Executive summary of the assessment" + "description": "An executive summary of the assessment." }, "risks": { "type": "array", @@ -947,29 +1179,29 @@ "average", "custom" ], - "description": "Aggregation method used to derive the overall risk" + "description": "The aggregation method used to derive the overall risk." }, "score": { "$ref": "#/$defs/riskScore" }, "description": { "type": "string", - "description": "Optional explanation for custom aggregation approaches" + "description": "An optional explanation for custom aggregation approaches." } }, - "description": "Aggregated risk result for this assessment" + "description": "The aggregated risk result for this assessment." }, "recommendations": { "type": "array", "items": { "type": "string" }, - "description": "Recommendations from the assessment" + "description": "Recommendations from the assessment." }, "nextReview": { "type": "string", "format": "date-time", - "description": "When the next review should occur" + "description": "When the next review should occur." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -985,13 +1217,13 @@ "high", "critical" ], - "description": "Priority level", + "description": "Priority level.", "meta:enum": { - "none": "No priority assigned", - "low": "Low priority - address when convenient", - "medium": "Medium priority - address in normal cycle", - "high": "High priority - address soon", - "critical": "Critical priority - address immediately" + "none": "No priority.", + "low": "Low priority.", + "medium": "Medium priority.", + "high": "High priority.", + "critical": "Critical priority." } }, "severity": { @@ -1003,13 +1235,13 @@ "high", "critical" ], - "description": "Severity level", + "description": "Severity level.", "meta:enum": { - "info": "Informational finding", - "low": "Low severity issue", - "medium": "Medium severity issue", - "high": "High severity issue", - "critical": "Critical severity issue" + "info": "Informational finding.", + "low": "Low severity issue.", + "medium": "Medium severity issue.", + "high": "High severity issue.", + "critical": "Critical severity issue." } }, "criticality": { @@ -1021,13 +1253,13 @@ "high", "critical" ], - "description": "Business criticality level", + "description": "Business criticality level.", "meta:enum": { - "minimal": "Minimal impact on business operations", - "low": "Low impact with minor inconvenience", - "moderate": "Moderate impact affecting some operations", - "high": "High impact affecting critical operations", - "critical": "Critical impact with severe business consequences" + "minimal": "Minimal impact on business operations.", + "low": "Low impact with minor inconvenience.", + "moderate": "Moderate impact affecting some operations.", + "high": "High impact affecting critical operations.", + "critical": "Critical impact with severe business consequences." } } } From 05375fdab1ffe8038a20393c342e80c3e6e9e337 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Fri, 5 Jun 2026 21:04:51 -0500 Subject: [PATCH 03/14] Removed unnecessary risk scenario. Added related vulnerabilities and weaknesses. Added assessments - was previously orphaned. Minor other changes. Signed-off-by: Steve Springett --- .../2.0/model/cyclonedx-risk-2.0.schema.json | 478 ++++++++---------- 1 file changed, 220 insertions(+), 258 deletions(-) diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index d00650029..b3f4dbd60 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -6,13 +6,33 @@ "$comment": "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.", "$defs": { "risks": { - "type": "array", + "type": "object", "title": "Risks", - "uniqueItems": true, - "items": { - "$ref": "#/$defs/risk" - }, - "description": "A collection of risks identified through risk analysis. The risk model is methodology-neutral and can document risk regardless of the risk rating framework used. It supports qualitative, semi-quantitative, and quantitative approaches by recording a qualitative `level`, a numeric `score`, or quantified loss, with the originating methodology identified on each score. Each risk distinguishes the risk before responses are applied (`inherentRisk`) from the risk that remains after them (`residualRisk`), with an optional `targetRisk` reflecting risk appetite, consistent with the process described in [ISO 31000](https://www.iso.org/iso-31000-risk-management.html). Specific rating techniques are not prescribed; [IEC 31010](https://www.iso.org/standard/72140.html) catalogues the available techniques." + "description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The risk model is methodology-neutral and can document risk regardless of the risk rating framework used. It supports qualitative, semi-quantitative, and quantitative approaches by recording a qualitative `level`, a numeric `score`, or quantified loss, with the originating methodology identified on each score. Each risk distinguishes the risk before responses are applied (`inherentRisk`) from the risk that remains after them (`residualRisk`), with an optional `targetRisk` reflecting risk appetite, consistent with the process described in [ISO 31000](https://www.iso.org/iso-31000-risk-management.html). Specific rating techniques are not prescribed; [IEC 31010](https://www.iso.org/standard/72140.html) catalogues the available techniques.", + "additionalProperties": false, + "properties": { + "risks": { + "type": "array", + "title": "Risks", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/risk" + }, + "description": "The documented risks identified through risk analysis." + }, + "assessments": { + "type": "array", + "title": "Assessments", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/assessment" + }, + "description": "Point-in-time risk assessment events, each evaluating one or more of the documented risks." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } }, "riskDomain": { "type": "object", @@ -170,149 +190,6 @@ } ] }, - "scenario": { - "type": "object", - "required": [ - "bom-ref", - "name", - "type" - ], - "additionalProperties": false, - "properties": { - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" - }, - "name": { - "type": "string", - "description": "The name of the scenario." - }, - "description": { - "type": "string", - "description": "A description of the scenario." - }, - "type": { - "title": "Type", - "description": "The kind of scenario. Use the custom option for kinds specific to an organization's methodology.", - "oneOf": [ - { - "title": "Predefined Scenario Type", - "type": "string", - "enum": [ - "threat", - "vulnerability", - "weakness", - "risk", - "incident", - "opportunity", - "hazard" - ], - "meta:enum": { - "threat": "Threat scenario.", - "vulnerability": "Exploitable vulnerability.", - "weakness": "System or design weakness.", - "risk": "General risk scenario.", - "incident": "Potential incident scenario.", - "opportunity": "Positive risk, an opportunity.", - "hazard": "Safety hazard scenario." - } - }, - { - "title": "Custom Scenario Type", - "type": "object", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "minLength": 1, - "title": "Name", - "description": "The name of the custom scenario type." - }, - "description": { - "type": "string", - "title": "Description", - "description": "A description of the custom scenario type." - } - } - } - ] - }, - "domain": { - "$ref": "#/$defs/riskDomain" - }, - "likelihood": { - "$ref": "#/$defs/likelihood" - }, - "impact": { - "$ref": "#/$defs/impact" - }, - "riskScore": { - "$ref": "#/$defs/riskScore" - }, - "riskAttributes": { - "type": "array", - "items": { - "$ref": "#/$defs/riskAttribute" - }, - "description": "The risk attributes affected by this scenario." - }, - "affectedAssets": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to affected assets." - }, - "mitigations": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to mitigations that address this scenario." - }, - "externalReferences": { - "type": "array", - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" - } - }, - "compliance": { - "type": "array", - "items": { - "type": "object", - "required": [ - "framework", - "controlId" - ], - "additionalProperties": false, - "properties": { - "framework": { - "type": "string", - "description": "The name of the compliance program or framework." - }, - "controlId": { - "type": "string", - "description": "The identifier of the control within the framework." - }, - "reference": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference", - "description": "A link or citation to the requirement or control documentation." - }, - "description": { - "type": "string", - "description": "Optional notes describing the mapping." - } - } - }, - "description": "Compliance frameworks and control references this scenario maps to." - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - } - }, "risk": { "type": "object", "required": [ @@ -352,21 +229,29 @@ }, "description": "References using bom-link or bom-ref to the subjects this risk concerns. A subject may be a component, service, dataset, or model, or a party such as a person, persona, or organization, including a group at risk of being systematically disadvantaged." }, - "relatedScenarios": { + "relatedThreats": { "type": "array", "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to the risk scenarios related to this risk. A risk scenario is a scenario object in this model and may be of type vulnerability, weakness, incident, opportunity, or hazard. Threat scenarios from a threat model are referenced separately through relatedThreats." + "description": "References using bom-link or bom-ref to the threats or threat scenarios from a threat model that inform this risk. A reference may point to a discrete threat or to a threat scenario." }, - "relatedThreats": { + "relatedVulnerabilities": { "type": "array", "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "References using bom-link or bom-ref to the threats or threat scenarios from a threat model that inform this risk. A reference may point to a discrete threat or to a threat scenario." + "description": "References using bom-link or bom-ref to the vulnerabilities that inform this risk." + }, + "relatedWeaknesses": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the weaknesses that inform this risk." }, "inherentRisk": { "$ref": "#/$defs/rating", @@ -458,6 +343,23 @@ "score": { "$ref": "#/$defs/riskScore" }, + "detectability": { + "type": "object", + "title": "Detectability", + "additionalProperties": false, + "description": "The ease or likelihood of detecting the event before or as it is realized, used as a third axis by methodologies such as [FMEA](https://asq.org/quality-resources/fmea), whose risk priority number multiplies severity, occurrence, and detection.", + "properties": { + "score": { + "type": "number", + "minimum": 0, + "description": "The detection value on the scale defined by the methodology. For FMEA, a higher value indicates that the event is harder to detect and therefore riskier." + }, + "description": { + "type": "string", + "description": "A narrative explanation of the detectability assessment." + } + } + }, "confidence": { "type": "number", "minimum": 0, @@ -511,6 +413,21 @@ "maximum": 1, "description": "Probability as a decimal from 0 to 1." }, + "frequency": { + "type": "number", + "minimum": 0, + "title": "Frequency", + "description": "The expected number of events within the timeframe, for frequency-based methods such as the [FAIR](https://www.fairinstitute.org/) loss event frequency. Unlike a probability, a frequency may exceed 1." + }, + "timeframe": { + "type": "string", + "title": "Timeframe", + "description": "The period over which the probability or frequency is assessed, expressed as an [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) duration, for example P1Y for one year." + }, + "range": { + "$ref": "#/$defs/estimateRange", + "description": "A range for the probability or frequency, supporting quantitative methods that reason over distributions." + }, "factors": { "type": "array", "items": { @@ -692,78 +609,22 @@ "type": "array", "uniqueItems": true, "items": { - "oneOf": [ - { - "title": "Predefined Impact Category", - "type": "string", - "enum": [ - "confidentiality", - "integrity", - "availability", - "financial", - "reputation", - "regulatory", - "safety", - "privacy", - "operational", - "strategic", - "bias", - "discrimination", - "fairness", - "human-rights", - "environmental", - "societal", - "psychological", - "physical", - "health" - ], - "meta:enum": { - "confidentiality": "Impact on data confidentiality.", - "integrity": "Impact on data or system integrity.", - "availability": "Impact on service availability.", - "financial": "Financial loss or impact.", - "reputation": "Reputational damage.", - "regulatory": "Regulatory compliance impact.", - "safety": "Human safety impact.", - "privacy": "Privacy violation impact.", - "operational": "Operational disruption.", - "strategic": "Strategic business impact.", - "bias": "Systematic bias in automated outputs or decisions.", - "discrimination": "Unfair treatment of individuals or groups, including on the basis of protected attributes.", - "fairness": "Impact on the fair and equitable treatment of affected groups.", - "human-rights": "Impact on fundamental human rights, including autonomy and dignity.", - "environmental": "Environmental impact, including energy use and carbon emissions.", - "societal": "Impact on society, communities, or civic processes.", - "psychological": "Psychological or emotional harm.", - "physical": "Physical harm to people or property.", - "health": "Impact on physical or mental health." - } - }, - { - "title": "Custom Impact Category", - "type": "object", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "minLength": 1, - "title": "Name", - "description": "The name of the custom impact category." - }, - "description": { - "type": "string", - "title": "Description", - "description": "A description of the custom impact category." - } - } - } - ] + "$ref": "#/$defs/impactCategory" }, "description": "The categories of impact, including harms relevant to AI and societal risk." }, + "factors": { + "type": "array", + "title": "Factors", + "items": { + "$ref": "#/$defs/impactFactor" + }, + "description": "The factors considered when determining the impact, allowing methodologies that derive impact from multiple weighted dimensions to record the breakdown." + }, + "range": { + "$ref": "#/$defs/estimateRange", + "description": "A range for the impact score, supporting quantitative methods that reason over distributions." + }, "riskAttributes": { "type": "array", "items": { @@ -780,6 +641,141 @@ } } }, + "impactCategory": { + "title": "Impact Category", + "description": "A category of impact, including harms relevant to AI and societal risk. Use the custom option for categories specific to an organization's risk taxonomy.", + "oneOf": [ + { + "title": "Predefined Impact Category", + "type": "string", + "enum": [ + "confidentiality", + "integrity", + "availability", + "financial", + "reputation", + "regulatory", + "safety", + "privacy", + "operational", + "strategic", + "bias", + "discrimination", + "fairness", + "human-rights", + "environmental", + "societal", + "psychological", + "physical", + "health" + ], + "meta:enum": { + "confidentiality": "Impact on data confidentiality.", + "integrity": "Impact on data or system integrity.", + "availability": "Impact on service availability.", + "financial": "Financial loss or impact.", + "reputation": "Reputational damage.", + "regulatory": "Regulatory compliance impact.", + "safety": "Human safety impact.", + "privacy": "Privacy violation impact.", + "operational": "Operational disruption.", + "strategic": "Strategic business impact.", + "bias": "Systematic bias in automated outputs or decisions.", + "discrimination": "Unfair treatment of individuals or groups, including on the basis of protected attributes.", + "fairness": "Impact on the fair and equitable treatment of affected groups.", + "human-rights": "Impact on fundamental human rights, including autonomy and dignity.", + "environmental": "Environmental impact, including energy use and carbon emissions.", + "societal": "Impact on society, communities, or civic processes.", + "psychological": "Psychological or emotional harm.", + "physical": "Physical harm to people or property.", + "health": "Impact on physical or mental health." + } + }, + { + "title": "Custom Impact Category", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom impact category." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom impact category." + } + } + } + ] + }, + "impactFactor": { + "type": "object", + "title": "Impact Factor", + "description": "An individual contributing factor used to determine the overall impact of a risk or scenario. Methodologies such as OWASP Risk Rating, DREAD, and OCTAVE Allegro derive impact from several weighted dimensions, and each factor captures one dimension with its own rating.", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the impact factor being evaluated, such as 'Financial damage' or 'Reputation damage'." + }, + "category": { + "$ref": "#/$defs/impactCategory", + "description": "The impact dimension this factor measures." + }, + "score": { + "type": "number", + "minimum": 0, + "title": "Score", + "description": "A numeric score representing the assessed value of this factor on the scale defined by the methodology, where a higher value indicates a greater contribution to impact." + }, + "weight": { + "type": "number", + "minimum": 0, + "maximum": 1, + "title": "Weight", + "description": "The relative importance of this factor in the overall impact calculation, expressed as a decimal from 0 to 1. OCTAVE Allegro, for example, ranks impact areas and multiplies the ranking by the factor value." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A narrative explanation of how this factor was evaluated and how it contributes to the overall impact assessment." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "estimateRange": { + "type": "object", + "title": "Estimate Range", + "description": "A three-point estimate, supporting quantitative methods such as FAIR that reason over distributions rather than single values.", + "additionalProperties": false, + "properties": { + "minimum": { + "type": "number", + "description": "The minimum, or lower bound, estimate." + }, + "mostLikely": { + "type": "number", + "description": "The most likely estimate." + }, + "maximum": { + "type": "number", + "description": "The maximum, or upper bound, estimate." + } + } + }, "impactQuantification": { "type": "object", "additionalProperties": false, @@ -812,24 +808,8 @@ "description": "The recovery time, as an [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) duration." }, "financialLossRange": { - "type": "object", - "title": "Financial Loss Range", - "additionalProperties": false, - "description": "A distribution of estimated financial loss, supporting quantitative methods such as FAIR that reason over ranges.", - "properties": { - "minimum": { - "type": "number", - "description": "The minimum estimated financial loss." - }, - "mostLikely": { - "type": "number", - "description": "The most likely estimated financial loss." - }, - "maximum": { - "type": "number", - "description": "The maximum estimated financial loss." - } - } + "$ref": "#/$defs/estimateRange", + "description": "A distribution of estimated financial loss, supporting quantitative methods such as FAIR that reason over ranges." }, "affectedGroups": { "type": "integer", @@ -1226,24 +1206,6 @@ "critical": "Critical priority." } }, - "severity": { - "type": "string", - "enum": [ - "info", - "low", - "medium", - "high", - "critical" - ], - "description": "Severity level.", - "meta:enum": { - "info": "Informational finding.", - "low": "Low severity issue.", - "medium": "Medium severity issue.", - "high": "High severity issue.", - "critical": "Critical severity issue." - } - }, "criticality": { "type": "string", "enum": [ From e14fa3fef89a233c0689b2bf81289322cdf2350e Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Fri, 5 Jun 2026 21:14:39 -0500 Subject: [PATCH 04/14] Minor changes to incorporate risks into CDXA Signed-off-by: Steve Springett --- .../2.0/model/cyclonedx-risk-2.0.schema.json | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index b3f4dbd60..a0b0702d2 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -253,6 +253,30 @@ }, "description": "References using bom-link or bom-ref to the weaknesses that inform this risk." }, + "relatedRequirements": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the requirements whose absence or non-conformance gives rise to this risk, such as a requirement that is unmet or only partially met." + }, + "relatedStandards": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the standards whose non-conformance gives rise to this risk." + }, + "relatedClaims": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + }, + "description": "References using bom-link or bom-ref to the conformance claims that give rise to this risk, such as a [CycloneDX Attestations](https://cyclonedx.org/capabilities/attestations/) claim recording that a requirement is unmet or only partially met. The degree of conformance is carried by the claim, not by the risk." + }, "inherentRisk": { "$ref": "#/$defs/rating", "description": "The assessed risk before any responses are applied." From c6956ea579cb57c202f942833375d5d5d2054bfb Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Fri, 5 Jun 2026 21:26:10 -0500 Subject: [PATCH 05/14] Minor updates to assessment Signed-off-by: Steve Springett --- .../2.0/model/cyclonedx-risk-2.0.schema.json | 183 +++++++++++++++--- 1 file changed, 160 insertions(+), 23 deletions(-) diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index a0b0702d2..90080c1f6 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -1133,29 +1133,118 @@ "bom-ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" }, - "type": { + "name": { "type": "string", - "enum": [ - "initial", - "periodic", - "continuous", - "triggered" - ], - "meta:enum": { - "initial": "Initial risk assessment.", - "periodic": "Scheduled periodic assessment.", - "continuous": "Continuous monitoring assessment.", - "triggered": "Event-triggered assessment." - } + "title": "Name", + "description": "A human-readable name for the assessment." + }, + "type": { + "title": "Type", + "description": "The kind of risk assessment. Use the custom option for kinds specific to an organization's process.", + "oneOf": [ + { + "title": "Predefined Assessment Type", + "type": "string", + "enum": [ + "initial", + "periodic", + "continuous", + "triggered", + "ad-hoc" + ], + "meta:enum": { + "initial": "Initial, baseline risk assessment.", + "periodic": "Scheduled, recurring assessment.", + "continuous": "Continuous, automated monitoring, as in a GRC engineering or continuous controls monitoring practice.", + "triggered": "Assessment triggered by a specific event, such as a change or an incident.", + "ad-hoc": "Unplanned, one-off assessment, neither scheduled nor triggered by a defined event." + } + }, + { + "title": "Custom Assessment Type", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom assessment type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom assessment type." + } + } + } + ] }, "timestamp": { "type": "string", "format": "date-time", "description": "When the assessment was performed." }, - "assessor": { - "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party that performed the assessment. May be an inline party object or a reference to a previously declared party. The party's `roles` should include `auditor` or `assessor` (custom) depending on the assessment type." + "scope": { + "type": "string", + "title": "Scope", + "description": "The scope of the assessment, including the systems, boundaries, and what is in or out of scope." + }, + "status": { + "title": "Status", + "description": "The lifecycle status of the assessment. Use the custom option for a status specific to an organization's process.", + "oneOf": [ + { + "title": "Predefined Assessment Status", + "type": "string", + "enum": [ + "draft", + "in-progress", + "completed", + "approved", + "superseded" + ], + "meta:enum": { + "draft": "The assessment is being prepared.", + "in-progress": "The assessment is underway.", + "completed": "The assessment is finished.", + "approved": "The assessment has been reviewed and approved.", + "superseded": "The assessment has been replaced by a later one." + } + }, + { + "title": "Custom Assessment Status", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom status." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom status." + } + } + } + ] + }, + "assessors": { + "type": "array", + "title": "Assessors", + "items": { + "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" + }, + "description": "The parties that performed the assessment. Each may be an inline party or a reference to a previously declared party, and may be a person or an automated system, agent, or tool. Automated assessors support continuous and automated assessment, as in a GRC engineering practice. A party's `roles` should include `auditor` or `assessor`." }, "summary": { "type": "string", @@ -1177,13 +1266,47 @@ "additionalProperties": false, "properties": { "method": { - "type": "string", - "enum": [ - "sum", - "average", - "custom" - ], - "description": "The aggregation method used to derive the overall risk." + "title": "Method", + "description": "The aggregation method used to derive the overall risk from the assessed risks. Use the custom option for methods not listed, such as a quantitative roll-up of loss distributions under FAIR.", + "oneOf": [ + { + "title": "Predefined Aggregation Method", + "type": "string", + "enum": [ + "maximum", + "sum", + "average", + "weighted-average" + ], + "meta:enum": { + "maximum": "The overall risk equals the highest individual risk.", + "sum": "The overall risk is the sum of the individual risks, representing total exposure.", + "average": "The overall risk is the mean of the individual risks.", + "weighted-average": "The overall risk is a weighted mean of the individual risks." + } + }, + { + "title": "Custom Aggregation Method", + "type": "object", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom aggregation method." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom aggregation method." + } + } + } + ] }, "score": { "$ref": "#/$defs/riskScore" @@ -1195,6 +1318,14 @@ }, "description": "The aggregated risk result for this assessment." }, + "assumptions": { + "type": "array", + "title": "Assumptions", + "items": { + "type": "string" + }, + "description": "The assumptions, constraints, and limitations under which the assessment was made, to be re-evaluated when they change." + }, "recommendations": { "type": "array", "items": { @@ -1207,6 +1338,12 @@ "format": "date-time", "description": "When the next review should occur." }, + "externalReferences": { + "type": "array", + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" + } + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } From d305f2eea840c94b69f69fd9094cfc15d6ff9674 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 00:24:37 -0500 Subject: [PATCH 06/14] Minor refactoring of specific parts of blueprint schema along with some enhancements and corrections to the risk and threat schema. Signed-off-by: Steve Springett --- .../model/cyclonedx-blueprint-2.0.schema.json | 1080 +++++++++-------- .../2.0/model/cyclonedx-risk-2.0.schema.json | 2 +- .../model/cyclonedx-threat-2.0.schema.json | 90 +- 3 files changed, 680 insertions(+), 492 deletions(-) diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index b2abd7ca2..b313f0c6d 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -47,7 +47,7 @@ "title": "Model Types", "minItems": 1, "uniqueItems": true, - "description": "The types of models being represented", + "description": "The types of models being represented.", "items": { "$ref": "#/$defs/modelType" } @@ -56,7 +56,7 @@ "type": "array", "title": "Methodologies", "uniqueItems": true, - "description": "The modeling methodologies used", + "description": "The modeling methodologies used.", "items": { "$ref": "#/$defs/methodology" } @@ -71,7 +71,7 @@ "items": { "$ref": "#/$defs/asset" }, - "description": "The assets (components, services, data, actors) included in the model" + "description": "The assets (components, services, data, actors) included in the model." }, "behaviors": { "$ref": "cyclonedx-behavior-2.0.schema.json#/$defs/behaviors" @@ -83,7 +83,7 @@ "items": { "$ref": "#/$defs/dataStore" }, - "description": "Structured description of data stores used in the model" + "description": "Structured description of data stores used in the model." }, "dataSets": { "type": "array", @@ -92,7 +92,7 @@ "items": { "$ref": "#/$defs/dataSet" }, - "description": "Datasets handled by the system, including placements and sensitivity" + "description": "Datasets handled by the system, including placements and sensitivity." }, "zones": { "type": "array", @@ -101,7 +101,7 @@ "items": { "$ref": "#/$defs/zone" }, - "description": "Logical, physical, or trust zones that group assets with similar characteristics" + "description": "Logical, physical, or trust zones that group assets with similar characteristics." }, "boundaries": { "type": "array", @@ -110,7 +110,7 @@ "items": { "$ref": "#/$defs/boundary" }, - "description": "Boundaries between zones" + "description": "Boundaries between zones." }, "flows": { "type": "array", @@ -119,7 +119,7 @@ "items": { "$ref": "#/$defs/flow" }, - "description": "Data, control, or process flows between assets" + "description": "Data, control, or process flows between assets." }, "actors": { "type": "array", @@ -128,7 +128,7 @@ "items": { "$ref": "#/$defs/actor" }, - "description": "Human or system actors involved in the model, distinct from assets" + "description": "Human or system actors involved in the model, distinct from assets." }, "assumptions": { "type": "array", @@ -137,7 +137,7 @@ "items": { "$ref": "#/$defs/assumption" }, - "description": "Assumptions made during the modeling process" + "description": "Assumptions made during the modeling process." }, "visualizations": { "type": "array", @@ -146,7 +146,7 @@ "items": { "$ref": "#/$defs/visualization" }, - "description": "Visual representations of the model" + "description": "Visual representations of the model." }, "useCases": { "type": "array", @@ -193,10 +193,11 @@ }, "requirements": { "type": "array", + "uniqueItems": true, "items": { - "$ref": "cyclonedx-requirement-2.0.schema.json#/$defs/requirement" + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }, - "description": "Requirements derived from or related to the model" + "description": "References using bom-link or bom-ref to the requirements, declared in definitions, that are derived from or related to this model." }, "externalReferences": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences" @@ -208,7 +209,7 @@ }, "modelType": { "title": "Model Type", - "description": "The type of model being represented, either a predefined value from the enumeration or a custom name and description for types not covered by the enumeration.", + "description": "The type of model being represented, either a predefined value from the enumeration or a custom name and description for types not covered by the enumeration. Threat, risk, and privacy analyses are represented in their own models, which reference the blueprint, rather than as blueprint model types.", "oneOf": [ { "type": "string", @@ -218,33 +219,25 @@ "architecture", "behavioral", "conceptual", - "dataFlow", + "data-flow", "deployment", "logical", "network", "operational", "physical", - "privacy", - "process", - "risk", - "structural", - "threat" + "process" ], "meta:enum": { - "architecture": "System or software architecture model.", - "behavioral": "System behaviour model.", - "conceptual": "High-level conceptual model.", - "dataFlow": "Data flow model showing how data moves through the system.", - "deployment": "Deployment or infrastructure model.", - "logical": "Logical system model.", - "network": "Network topology or connectivity model.", - "operational": "Operational model.", - "physical": "Physical infrastructure model.", - "privacy": "Privacy impact assessment model.", - "process": "Business or system process model.", - "risk": "Risk assessment model.", - "structural": "System structure model.", - "threat": "Security threat model." + "architecture": "An architecture model of the system or software, capturing its major components, their responsibilities, and the interfaces and relationships between them. Broader than a single view, it frames the overall design.", + "behavioral": "A behavioural model, capturing how the system acts over time through its processes, state changes, interactions, and control flow, as opposed to its static structure.", + "conceptual": "A conceptual model at the highest level of abstraction, capturing the key entities, concepts, and relationships in technology-neutral terms without implementation detail. The first level of the conceptual, logical, and physical progression.", + "data-flow": "A data flow model showing how data moves between processes, data stores, and external entities. This is the substrate most commonly used for STRIDE per-element threat analysis.", + "deployment": "A deployment model showing how software is allocated to runtime and infrastructure, including nodes, containers, environments, and the artifacts placed on them.", + "logical": "A logical model detailing the structure and behaviour of the system independent of any specific implementation technology. The middle level of the conceptual, logical, and physical progression.", + "network": "A network model showing topology and connectivity, including segments, links, and the paths over which components communicate.", + "operational": "An operational model describing how the system is run and supported in production, including procedures, responsibilities, and operational dependencies.", + "physical": "A physical model at the implementation level, capturing the tangible realization of the system such as hardware, devices, infrastructure, topology, and physical locations. The most concrete level of the conceptual, logical, and physical progression.", + "process": "A process model describing a business or system process as an ordered set of activities and decisions and the actors that carry them out." } }, { @@ -273,7 +266,7 @@ }, "methodology": { "title": "Methodology", - "description": "The modelling methodology used, either a predefined value from the enumeration or a custom object for methodologies not covered. The object form may also be used to annotate a predefined methodology with a version or external references.", + "description": "The system or architecture modelling notation used to produce the blueprint, either a predefined value from the enumeration or a custom object. The object form may also annotate a predefined methodology with a version or external references. Threat modelling methodologies such as STRIDE and PASTA are recorded in the threat model, not here.", "oneOf": [ { "type": "string", @@ -282,56 +275,36 @@ "enum": [ "4+1", "Archimate", - "ATFAA", "BPMN", "C4", "DFD", "DODAF", "ERD", "IDEF", - "LINDDUN", - "MAESTRO", - "MITRE-ATTACK", "MODAF", "NAF", - "OWASP", - "PASTA", "SABSA", - "STRIDE", "SysML", "TOGAF", - "TRIKE", "UML", - "VAST", - "Zachman", - "attackTree" + "Zachman" ], "meta:enum": { "4+1": "4+1 Architectural View Model.", "Archimate": "Enterprise architecture modelling language.", - "ATFAA": "Advanced Threat Framework for Autonomous AI Agents.", "BPMN": "Business Process Model and Notation.", "C4": "C4 Model for software architecture.", "DFD": "Data Flow Diagrams.", "DODAF": "Department of Defense Architecture Framework.", "ERD": "Entity Relationship Diagrams.", "IDEF": "Integration Definition Methods.", - "LINDDUN": "Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance.", - "MAESTRO": "Multi-Agent Environment, Security, Threat, Risk, and Outcome.", - "MITRE-ATTACK": "MITRE ATT&CK adversarial tactics, techniques, and procedures framework.", "MODAF": "Ministry of Defence Architecture Framework.", "NAF": "NATO Architecture Framework.", - "OWASP": "OWASP threat modelling methodology.", - "PASTA": "Process for Attack Simulation and Threat Analysis.", "SABSA": "Sherwood Applied Business Security Architecture.", - "STRIDE": "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.", "SysML": "Systems Modeling Language.", "TOGAF": "The Open Group Architecture Framework.", - "TRIKE": "Risk-based threat modelling methodology.", "UML": "Unified Modeling Language.", - "VAST": "Visual, Agile, and Simple Threat modelling.", - "Zachman": "Zachman Framework.", - "attackTree": "Attack tree methodology for structured threat analysis." + "Zachman": "Zachman Framework." } }, { @@ -381,7 +354,7 @@ "type": "string", "title": "Timestamp", "format": "date-time", - "description": "When the blueprint was created or last updated" + "description": "When the blueprint was created or last updated." }, "authors": { "type": "array", @@ -400,7 +373,7 @@ "type": "string", "title": "Review Date", "format": "date-time", - "description": "When the blueprint was reviewed" + "description": "When the blueprint was reviewed." }, "approver": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", @@ -410,7 +383,7 @@ "type": "string", "title": "Approval Date", "format": "date-time", - "description": "When the blueprint was approved" + "description": "When the blueprint was approved." }, "ordinalVersion": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/ordinalVersion" @@ -433,19 +406,19 @@ "type": "string", "title": "Start", "format": "date-time", - "description": "When the blueprint becomes valid" + "description": "When the blueprint becomes valid." }, "end": { "type": "string", "title": "End", "format": "date-time", - "description": "When the blueprint expires" + "description": "When the blueprint expires." }, "reviewFrequency": { "type": "string", "title": "Review Frequency", "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?$", - "description": "ISO 8601 duration for review frequency (e.g., P3M for quarterly)" + "description": "ISO 8601 duration for review frequency (e.g., P3M for quarterly)." } } }, @@ -465,12 +438,12 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the scope" + "description": "Name of the scope." }, "description": { "type": "string", "title": "Description", - "description": "Description of what is included and excluded from the model" + "description": "Description of what is included and excluded from the model." }, "boundaries": { "type": "array", @@ -480,7 +453,7 @@ "type": "string", "minLength": 1 }, - "description": "Explicit boundaries of the model" + "description": "Explicit boundaries of the model." }, "includedComponents": { "type": "array", @@ -508,12 +481,12 @@ "asset": { "type": "object", "title": "Asset", - "description": "A component, service, data store, or other element included in the blueprint model.", + "description": "A component, service, data store, actor, or other element included in the blueprint model. An actor asset references a party, since a party such as a person, persona, system, or organization may itself be an asset, including a person in the intelligence sense of a human source.", "additionalProperties": false, "properties": { "bom-ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "description": "Unique identifier for the asset" + "description": "Unique identifier for the asset." }, "componentRef": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -523,76 +496,107 @@ "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "description": "Reference using bom-link or bom-ref to the service this asset represents." }, + "partyRef": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "description": "Reference using bom-link or bom-ref to the party this asset represents, such as a person, persona, system, or organization. Used when the asset is an actor." + }, "type": { - "type": "string", "title": "Asset Type", - "enum": [ - "actor", - "agent", - "api", - "broker", - "cache", - "component", - "container", - "data", - "dataStore", - "device", - "endpoint", - "function", - "gateway", - "infrastructure", - "interface", - "model", - "module", - "network", - "other", - "process", - "queue", - "resource", - "service", - "stream", - "subsystem", - "system" - ], - "meta:enum": { - "actor": "User, system, or external entity", - "agent": "Autonomous AI or software agent", - "api": "API endpoint or interface", - "broker": "Message broker or event bus infrastructure", - "cache": "Caching layer or in-memory data store", - "component": "Software component or application", - "container": "Container or orchestration unit", - "data": "Dataset", - "dataStore": "Database, file system, or data repository", - "device": "Physical or IoT device", - "endpoint": "Service endpoint or URL", - "function": "Serverless function or lambda", - "gateway": "API gateway, load balancer, or proxy", - "infrastructure": "Infrastructure component", - "interface": "System interface or contract", - "model": "AI or machine learning model", - "module": "Software module or package", - "network": "Network segment or resource", - "other": "Asset type not covered by predefined values", - "process": "Business or system process", - "queue": "Message queue or task queue", - "resource": "Generic resource or artifact", - "service": "Service or microservice", - "stream": "Data stream or event stream", - "subsystem": "Part of a larger system", - "system": "Complete system or application" - } + "description": "The kind of asset. Use the custom option for kinds not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Asset Type", + "enum": [ + "actor", + "agent", + "api", + "broker", + "cache", + "component", + "container", + "data", + "data-store", + "device", + "endpoint", + "function", + "gateway", + "infrastructure", + "interface", + "model", + "module", + "network", + "process", + "queue", + "resource", + "service", + "stream", + "subsystem", + "system", + "tool" + ], + "meta:enum": { + "actor": "An actor that is an asset in its own right, referencing a party via partyRef. A party such as a system or organization is commonly an asset, and a person may be an asset in the intelligence sense of a human source.", + "agent": "Autonomous AI or software agent.", + "api": "API endpoint or interface.", + "broker": "Message broker or event bus infrastructure.", + "cache": "Caching layer or in-memory data store.", + "component": "Software component or application.", + "container": "Container or orchestration unit.", + "data": "Dataset.", + "data-store": "Database, file system, or data repository.", + "device": "Physical or IoT device.", + "endpoint": "Service endpoint or URL.", + "function": "Serverless function or lambda.", + "gateway": "API gateway, load balancer, or proxy.", + "infrastructure": "Infrastructure component.", + "interface": "System interface or contract.", + "model": "AI or machine learning model.", + "module": "Software module or package.", + "network": "Network segment or resource.", + "process": "Business or system process.", + "queue": "Message queue or task queue.", + "resource": "Generic resource or artifact.", + "service": "Service or microservice.", + "stream": "Data stream or event stream.", + "subsystem": "Part of a larger system.", + "system": "Complete system or application.", + "tool": "A tool or capability invoked by an agent, such as a function, API, or service exposed to an AI agent." + } + }, + { + "type": "object", + "title": "Custom Asset Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom asset type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom asset type." + } + } + } + ] }, "name": { "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the asset" + "description": "Name of the asset." }, "description": { "type": "string", "title": "Description", - "description": "Description of the asset's role and purpose" + "description": "Description of the asset's role and purpose." }, "zone": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -616,7 +620,7 @@ "type": "string", "minLength": 1 }, - "description": "Responsibilities or functions of this asset" + "description": "Responsibilities or functions of this asset." }, "interfaces": { "type": "array", @@ -625,7 +629,7 @@ "items": { "$ref": "#/$defs/interface" }, - "description": "Interfaces exposed by this asset" + "description": "Interfaces exposed by this asset." }, "dependencies": { "type": "array", @@ -652,7 +656,7 @@ "items": { "$ref": "#/$defs/authenticationType" }, - "description": "Authentication methods supported/required" + "description": "Authentication methods supported/required." }, "authorization": { "type": "array", @@ -661,7 +665,7 @@ "items": { "$ref": "#/$defs/authorizationType" }, - "description": "Authorization models supported/required" + "description": "Authorization models supported/required." }, "ownership": { "$ref": "#/$defs/ownership" @@ -690,6 +694,14 @@ "serviceRef" ] }, + { + "title": "Party Reference Asset", + "description": "An asset defined by reference to a party declared elsewhere in the BOM, such as a person, persona, system, or organization that is itself an asset.", + "required": [ + "bom-ref", + "partyRef" + ] + }, { "title": "Inline Asset", "description": "An asset defined inline within the blueprint with an explicit type and name.", @@ -719,84 +731,113 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the data store" + "description": "Name of the data store." }, "description": { "type": "string", "title": "Description", - "description": "Purpose and contents of the store" + "description": "Purpose and contents of the store." }, "type": { - "type": "string", "title": "Type", - "enum": [ - "blob", - "blockchain", - "cache", - "columnFamily", - "custom", - "dataLake", - "dataWarehouse", - "document", - "eventLog", - "file", - "graph", - "inMemory", - "keyValue", - "messageQueue", - "object", - "other", - "registry", - "search", - "spatial", - "sql", - "timeSeries", - "vector" - ], - "meta:enum": { - "blob": "Binary/blob storage", - "blockchain": "Distributed ledger or blockchain storage", - "cache": "Caching tier", - "columnFamily": "Wide-column or column-family store (e.g., Cassandra, HBase)", - "custom": "Custom or mixed storage technology", - "dataLake": "Data lake or lakehouse for raw and semi-structured data", - "dataWarehouse": "Analytical data warehouse optimised for OLAP workloads", - "document": "Document database (e.g., MongoDB)", - "eventLog": "Event log or append-only streaming store (e.g., Kafka)", - "file": "File system or NAS", - "graph": "Graph database", - "inMemory": "In-memory data store used as a primary store", - "keyValue": "Key-value store", - "messageQueue": "Message queue or broker with persistent storage", - "object": "Object storage", - "other": "Other storage technology not listed", - "registry": "Configuration or service registry (e.g., etcd, Consul)", - "search": "Search index or full-text search engine (e.g., Elasticsearch)", - "spatial": "Spatial or geospatial database", - "sql": "Relational database", - "timeSeries": "Time-series database", - "vector": "Vector database for embeddings and similarity search" - } + "description": "The type of data store. Use the custom option for technologies not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Data Store Type", + "enum": [ + "block", + "blockchain", + "cache", + "column-family", + "data-lake", + "data-warehouse", + "document", + "event-log", + "file", + "graph", + "hierarchical", + "in-memory", + "key-value", + "ledger", + "message-queue", + "multi-model", + "object", + "registry", + "relational", + "search", + "spatial", + "time-series", + "vector" + ], + "meta:enum": { + "block": "Block storage exposing raw volumes.", + "blockchain": "Distributed ledger or blockchain storage.", + "cache": "Caching tier.", + "column-family": "Wide-column or column-family store.", + "data-lake": "Data lake or lakehouse for raw and semi-structured data.", + "data-warehouse": "Analytical data warehouse optimised for OLAP workloads.", + "document": "Document database.", + "event-log": "Event log or append-only streaming store.", + "file": "File system or network-attached storage.", + "graph": "Graph database.", + "hierarchical": "Hierarchical or tree-structured database, such as a directory store.", + "in-memory": "In-memory data store used as a primary store.", + "key-value": "Key-value store.", + "ledger": "Immutable, append-only ledger database.", + "message-queue": "Message queue or broker with persistent storage.", + "multi-model": "A store supporting multiple data models.", + "object": "Object storage.", + "registry": "Configuration or service registry.", + "relational": "Relational database.", + "search": "Search index or full-text search engine.", + "spatial": "Spatial or geospatial database.", + "time-series": "Time-series database.", + "vector": "Vector database for embeddings and similarity search." + } + }, + { + "type": "object", + "title": "Custom Data Store Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom data store type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom data store type." + } + } + } + ] }, "vendor": { "type": "string", "title": "Vendor", - "description": "The vendor or publisher of the data store product" + "description": "The vendor or publisher of the data store product." }, "product": { "type": "string", "title": "Product", - "description": "The name of the data store product" + "description": "The name of the data store product." }, "version": { "type": "string", "title": "Version", - "description": "The version of the data store product" + "description": "The version of the data store product." }, "environment": { "type": "string", "title": "Environment", - "description": "Deployment environment (prod, test, etc.)" + "description": "Deployment environment (prod, test, etc.)." }, "zone": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -805,7 +846,7 @@ "location": { "type": "string", "title": "Location", - "description": "Physical or logical hosting location" + "description": "Physical or logical hosting location." }, "technologies": { "type": "array", @@ -814,7 +855,7 @@ "items": { "type": "string" }, - "description": "Supporting technologies or services" + "description": "Supporting technologies or services." }, "dataSets": { "type": "array", @@ -832,7 +873,7 @@ "items": { "$ref": "#/$defs/authorizationType" }, - "description": "Authorization models supported/required" + "description": "Authorization models supported/required." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -857,13 +898,13 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the dataset" + "description": "Name of the dataset." }, "description": { "type": "string", "title": "Description", "minLength": 1, - "description": "What information is contained and why it exists" + "description": "What information is contained and why it exists." }, "dataProfiles": { "type": "array", @@ -904,7 +945,7 @@ "items": { "$ref": "#/$defs/authorizationType" }, - "description": "Authorization models supported/required" + "description": "Authorization models supported/required." }, "placements": { "type": "array", @@ -926,21 +967,21 @@ "encrypted": { "type": "boolean", "title": "Encrypted", - "description": "Whether the dataset is encrypted at this location" + "description": "Whether the dataset is encrypted at this location." }, "retention": { "type": "string", "title": "Retention", - "description": "Retention policy for this placement" + "description": "Retention policy for this placement." }, "replicated": { "type": "boolean", "title": "Replicated", - "description": "Indicates if this placement is a replica" + "description": "Indicates if this placement is a replica." } } }, - "description": "Where the dataset resides" + "description": "Where the dataset resides." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -957,41 +998,68 @@ "properties": { "name": { "type": "string", - "description": "Name of the interface" + "description": "Name of the interface." }, "type": { - "type": "string", - "enum": [ - "rest", - "graphql", - "grpc", - "soap", - "messaging", - "file", - "database", - "cli", - "gui", - "api", - "event", - "stream" - ], - "description": "Type of interface" + "title": "Type", + "description": "The type of interface. Use the custom option for types not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Interface Type", + "enum": [ + "rest", + "graphql", + "grpc", + "soap", + "messaging", + "file", + "database", + "cli", + "gui", + "api", + "event", + "stream" + ] + }, + { + "type": "object", + "title": "Custom Interface Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom interface type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom interface type." + } + } + } + ] }, "description": { "type": "string", - "description": "Description of the interface" + "description": "Description of the interface." }, "specification": { "type": "string", - "description": "Link or reference to interface specification" + "description": "Link or reference to interface specification." }, "protocol": { "type": "string", - "description": "Communication protocol used" + "description": "Communication protocol used." }, "dataFormat": { "type": "string", - "description": "Data format (e.g., JSON, XML, Protocol Buffers)" + "description": "Data format (e.g., JSON, XML, Protocol Buffers)." }, "authentication": { "type": "array", @@ -1004,14 +1072,14 @@ "items": { "type": "string" }, - "description": "Operations or methods exposed" + "description": "Operations or methods exposed." } } }, "zone": { "type": "object", "title": "Zone", - "description": "A logical, physical, or trust zone that groups assets sharing common characteristics, security posture, or administrative control within the modelled system.", + "description": "A grouping of assets that share a common characteristic, security posture, or administrative control, so they can be reasoned about as a unit. A zone may be logical, physical, network, trust, or another kind, may nest within a parent zone, and is connected to or separated from other zones by boundaries.", "required": [ "bom-ref", "name", @@ -1026,36 +1094,73 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the zone" + "description": "Name of the zone." }, "description": { "type": "string", "title": "Description", - "description": "Description of the zone's characteristics" + "description": "Description of the zone's characteristics." }, "type": { - "type": "string", "title": "Type", - "enum": [ - "deployment", - "functional", - "logical", - "network", - "organizational", - "other", - "physical", - "trust" - ], - "meta:enum": { - "deployment": "Deployment environment (e.g., dev, staging, prod)", - "functional": "Functional grouping", - "logical": "Logical grouping or boundary", - "network": "Network segmentation zone", - "organizational": "Organizational or administrative boundary", - "other": "Other zone type not listed", - "physical": "Physical location or boundary", - "trust": "Security trust zone" - } + "description": "The type of zone. Use the custom option for types not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Zone Type", + "enum": [ + "availability", + "compliance", + "data", + "deployment", + "functional", + "geographic", + "logical", + "network", + "organizational", + "physical", + "process", + "tenant", + "trust" + ], + "meta:enum": { + "availability": "An availability or fault-isolation zone, such as a cloud availability zone, used to bound the blast radius of failures and reason about redundancy and resilience.", + "compliance": "A compliance scope zone whose assets fall under a specific regulatory regime, such as PCI DSS, HIPAA, or FedRAMP, delineating what is in scope and the controls applied.", + "data": "A data classification zone grouping assets by the sensitivity of the data they hold or process, such as public, internal, confidential, or restricted.", + "deployment": "A deployment environment grouping assets by lifecycle stage, such as development, staging, or production.", + "functional": "A functional grouping of assets that serve a common purpose or capability, independent of where or how they are deployed.", + "geographic": "A geographic or data-residency zone bounding assets to a region, country, or jurisdiction, used to reason about sovereignty and cross-border data flows.", + "logical": "A logical grouping of assets defined by architecture or design rather than physical placement.", + "network": "A network segmentation zone, such as a subnet, VLAN, or security group, within which assets share network-level reachability and controls.", + "organizational": "An organizational or administrative zone grouping assets under a common owner, team, or authority.", + "physical": "A physical zone bounding assets to a tangible location, such as a data centre, building, or device enclosure.", + "process": "A process or execution isolation zone, such as a sandbox, container runtime, or trusted execution environment, within which code runs with a defined level of isolation.", + "tenant": "A tenancy isolation zone separating the assets and data of one tenant from another in a multi-tenant system.", + "trust": "A security trust zone whose assets share a common level of trust, so that movement between trust zones is where authentication, authorization, and validation are enforced." + } + }, + { + "type": "object", + "title": "Custom Zone Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom zone type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom zone type." + } + } + } + ] }, "parent": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -1068,7 +1173,7 @@ "items": { "type": "string" }, - "description": "Key characteristics of this zone" + "description": "Key characteristics of this zone." }, "constraints": { "type": "array", @@ -1077,7 +1182,7 @@ "items": { "type": "string" }, - "description": "Constraints or limitations of this zone" + "description": "Constraints or limitations of this zone." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -1087,7 +1192,7 @@ "boundary": { "type": "object", "title": "Boundary", - "description": "Defines a boundary that separates or connects two or more zones, representing a point where security controls, policies, or trust levels change.", + "description": "An edge that separates or connects two or more zones, marking a point where security controls, policies, or trust levels change. The controls expected when data or actors cross it are captured in crossingRequirements, and the threat model's trust boundary extends a boundary with trust semantics.", "required": [ "bom-ref", "zones" @@ -1101,31 +1206,56 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name of the boundary" + "description": "Name of the boundary." }, "type": { - "type": "string", "title": "Type", - "enum": [ - "data", - "functional", - "network", - "organizational", - "other", - "physical", - "process", - "trust" - ], - "meta:enum": { - "data": "Data classification boundary", - "functional": "Functional boundary", - "network": "Network boundary or firewall", - "organizational": "Organizational boundary", - "other": "A boundary type not covered by the predefined enumeration", - "physical": "Physical security boundary", - "process": "Process or execution boundary", - "trust": "Trust boundary between different security zones" - } + "description": "The type of boundary. Use the custom option for types not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Boundary Type", + "enum": [ + "data", + "functional", + "network", + "organizational", + "physical", + "process", + "trust" + ], + "meta:enum": { + "data": "A data classification boundary, crossed when data moves between zones of differing sensitivity, where reclassification, masking, or validation may apply.", + "functional": "A functional boundary between areas of differing responsibility or capability.", + "network": "A network boundary, such as a firewall, gateway, or security group, controlling reachability between network zones.", + "organizational": "An organizational or administrative boundary between assets under different ownership or authority.", + "physical": "A physical security boundary, such as a facility perimeter or device enclosure, between physical zones.", + "process": "A process or execution boundary between isolation contexts, such as between a sandbox and its host.", + "trust": "A trust boundary between zones of differing trust, the primary point at which authentication, authorization, and input validation are enforced and a key trigger for threat analysis." + } + }, + { + "type": "object", + "title": "Custom Boundary Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom boundary type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom boundary type." + } + } + } + ] }, "zones": { "type": "array", @@ -1158,7 +1288,7 @@ "items": { "$ref": "#/$defs/authenticationType" }, - "description": "Authentication required to cross this boundary" + "description": "Authentication required to cross this boundary." }, "authorization": { "type": "array", @@ -1167,32 +1297,32 @@ "items": { "$ref": "#/$defs/authorizationType" }, - "description": "Authorization models enforced at this boundary" + "description": "Authorization models enforced at this boundary." }, "dataValidation": { "type": "boolean", "title": "Data Validation", - "description": "Whether data is validated when crossing this boundary" + "description": "Whether data is validated when crossing this boundary." }, "dataTransformation": { "type": "boolean", "title": "Data Transformation", - "description": "Whether data is transformed when crossing this boundary" + "description": "Whether data is transformed when crossing this boundary." }, "logging": { "type": "boolean", "title": "Logging", - "description": "Whether crossings are logged" + "description": "Whether crossings are logged." }, "monitoring": { "type": "boolean", "title": "Monitoring", - "description": "Whether crossings are monitored" + "description": "Whether crossings are monitored." }, "rateLimit": { "type": "string", "title": "Rate Limit", - "description": "Rate limiting policy" + "description": "Rate limiting policy." }, "protocols": { "type": "array", @@ -1201,7 +1331,7 @@ "items": { "type": "string" }, - "description": "Allowed protocols for crossing" + "description": "Allowed protocols for crossing." } } }, @@ -1225,40 +1355,65 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name or description of the flow" + "description": "Name or description of the flow." }, "description": { "type": "string", "title": "Description", - "description": "Detailed description of what flows and why" + "description": "Detailed description of what flows and why." }, "type": { - "type": "string", "title": "Type", - "enum": [ - "control", - "data", - "dependency", - "event", - "interaction", - "message", - "other", - "physical", - "process", - "signal" - ], - "meta:enum": { - "control": "Control or command flow", - "data": "Data or information flow", - "dependency": "Dependency relationship", - "event": "Event or notification flow", - "interaction": "User or system interaction", - "message": "Message or communication flow", - "other": "A flow type not covered by the predefined enumeration", - "physical": "Physical movement of goods or materials", - "process": "Business process flow", - "signal": "Hardware or system signal" - } + "description": "The type of flow. Use the custom option for types not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Flow Type", + "enum": [ + "control", + "data", + "energy", + "event", + "financial", + "message", + "physical", + "process", + "signal" + ], + "meta:enum": { + "control": "Control or command flow.", + "data": "Data or information flow.", + "energy": "Power or energy flow.", + "event": "Event or notification flow.", + "financial": "Financial, value, or payment flow.", + "message": "Message or communication flow.", + "physical": "Physical movement of goods or materials.", + "process": "Business process flow.", + "signal": "Hardware or system signal." + } + }, + { + "type": "object", + "title": "Custom Flow Type", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom flow type." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom flow type." + } + } + } + ] }, "source": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -1272,22 +1427,22 @@ "type": "boolean", "title": "Bidirectional", "default": false, - "description": "Whether flow occurs in both directions" + "description": "Whether flow occurs in both directions." }, "synchronous": { "type": "boolean", "title": "Synchronous", - "description": "Whether the flow is synchronous or asynchronous" + "description": "Whether the flow is synchronous or asynchronous." }, "volume": { "type": "string", "title": "Volume", - "description": "Expected volume or frequency of flow" + "description": "Expected volume or frequency of flow." }, "timing": { "type": "string", "title": "Timing", - "description": "Timing characteristics (real-time, batch, scheduled)" + "description": "Timing characteristics (real-time, batch, scheduled)." }, "protocols": { "type": "array", @@ -1296,7 +1451,7 @@ "items": { "type": "string" }, - "description": "Communication protocols used by this flow" + "description": "Communication protocols used by this flow." }, "dataProfiles": { "type": "array", @@ -1323,7 +1478,7 @@ "items": { "$ref": "#/$defs/authenticationType" }, - "description": "Authentication required for this flow" + "description": "Authentication required for this flow." }, "authorization": { "type": "array", @@ -1332,13 +1487,13 @@ "items": { "$ref": "#/$defs/authorizationType" }, - "description": "Authorization models enforced on this flow" + "description": "Authorization models enforced on this flow." }, "sequence": { "type": "integer", "title": "Sequence", "minimum": 0, - "description": "Ordering hint so flows can be assembled into sequence diagrams" + "description": "Ordering hint so flows can be assembled into sequence diagrams." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -1404,31 +1559,56 @@ "type": "string", "title": "Description", "minLength": 1, - "description": "A clear statement of the assumption being made, including the believed condition, the reasoning or evidence behind it, and any constraints or scope under which it applies" + "description": "A clear statement of the assumption being made, including the believed condition, the reasoning or evidence behind it, and any constraints or scope under which it applies." }, "topic": { - "type": "string", "title": "Topic", - "enum": [ - "availability", - "business", - "compliance", - "operational", - "other", - "performance", - "security", - "technical" - ], - "meta:enum": { - "availability": "Assumption about system uptime, redundancy, or failover capabilities", - "business": "Assumption about business requirements, constraints, or organizational context", - "compliance": "Assumption about regulatory, legal, or policy compliance obligations", - "operational": "Assumption about operational procedures, staffing, or maintenance practices", - "other": "An assumption topic not covered by the predefined enumeration", - "performance": "Assumption about throughput, latency, capacity, or scalability characteristics", - "security": "Assumption about threat landscape, trust boundaries, or security controls", - "technical": "Assumption about technology choices, capabilities, or technical constraints" - } + "description": "The topic of the assumption. Use the custom option for topics not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Assumption Topic", + "enum": [ + "availability", + "business", + "compliance", + "operational", + "performance", + "security", + "technical" + ], + "meta:enum": { + "availability": "Assumption about system uptime, redundancy, or failover capabilities.", + "business": "Assumption about business requirements, constraints, or organizational context.", + "compliance": "Assumption about regulatory, legal, or policy compliance obligations.", + "operational": "Assumption about operational procedures, staffing, or maintenance practices.", + "performance": "Assumption about throughput, latency, capacity, or scalability characteristics.", + "security": "Assumption about threat landscape, trust boundaries, or security controls.", + "technical": "Assumption about technology choices, capabilities, or technical constraints." + } + }, + { + "type": "object", + "title": "Custom Assumption Topic", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom assumption topic." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom assumption topic." + } + } + } + ] }, "relatedAssets": { "type": "array", @@ -1449,18 +1629,18 @@ "verified" ], "meta:enum": { - "invalid": "The assumption has been disproven or is no longer applicable", - "unknown": "The validity of the assumption has not yet been assessed", - "unverified": "The assumption has been identified but not yet validated", - "verified": "The assumption has been confirmed as true through validation" + "invalid": "The assumption has been disproven or is no longer applicable.", + "unknown": "The validity of the assumption has not yet been assessed.", + "unverified": "The assumption has been identified but not yet validated.", + "verified": "The assumption has been confirmed as true through validation." }, "default": "unknown", - "description": "The current validation state of the assumption, tracked over time to ensure that modelling decisions built on this assumption remain sound" + "description": "The current validation state of the assumption, tracked over time to ensure that modelling decisions built on this assumption remain sound." }, "impact": { "type": "string", "title": "Impact", - "description": "A narrative describing the consequences to the model, its assets, or the broader system if this assumption proves false, including the severity and scope of affected components" + "description": "A narrative describing the consequences to the model, its assets, or the broader system if this assumption proves false, including the severity and scope of affected components." }, "owner": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", @@ -1469,20 +1649,20 @@ "validationMethod": { "type": "string", "title": "Validation Method", - "description": "The approach, test, or evidence that can be used to confirm or disprove this assumption, such as a review, audit, penetration test, or empirical measurement" + "description": "The approach, test, or evidence that can be used to confirm or disprove this assumption, such as a review, audit, penetration test, or empirical measurement." }, "validationDate": { "type": "string", "title": "Validation Date", "format": "date-time", - "description": "The date and time when the assumption was last validated or reviewed, used to track staleness and trigger re-evaluation" + "description": "The date and time when the assumption was last validated or reviewed, used to track staleness and trigger re-evaluation." } } }, "visualization": { "type": "object", "title": "Visualization", - "description": "A visual representation of the model or a subset of its elements, capturing diagram type, rendering format, and the elements depicted.", + "description": "A visual representation of the model or a subset of its elements, capturing the diagram type, its content, and the elements depicted.", "required": [ "name", "type" @@ -1496,29 +1676,24 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "Name or title of the visualization" + "description": "Name or title of the visualization." }, "description": { "type": "string", "title": "Description", - "description": "Description of what the visualization shows" + "description": "Description of what the visualization shows." }, "type": { "$ref": "#/$defs/visualizationType" }, - "format": { - "$ref": "#/$defs/visualizationFormat" - }, - "content": { - "type": "string", - "title": "Content", - "description": "The diagram content (source code or base64 encoded image)" + "attachment": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment" }, "url": { "type": "string", "title": "URL", "format": "iri-reference", - "description": "URL to the diagram if stored externally" + "description": "URL to the diagram if stored externally." }, "level": { "type": "string", @@ -1530,12 +1705,12 @@ "overview" ], "meta:enum": { - "detailed": "Fine-grained view showing implementation-level specifics", - "high": "High-level view showing major components and relationships", - "medium": "Intermediate view balancing breadth and depth", - "overview": "Top-level summary providing a broad perspective of the system" + "detailed": "Fine-grained view showing implementation-level specifics.", + "high": "High-level view showing major components and relationships.", + "medium": "Intermediate view balancing breadth and depth.", + "overview": "Top-level summary providing a broad perspective of the system." }, - "description": "Level of detail in the visualization" + "description": "Level of detail in the visualization." }, "elements": { "type": "array", @@ -1549,7 +1724,7 @@ "interactive": { "type": "boolean", "title": "Interactive", - "description": "Whether the visualization is interactive" + "description": "Whether the visualization is interactive." }, "layers": { "type": "array", @@ -1558,7 +1733,7 @@ "items": { "type": "string" }, - "description": "Layers or views available in the visualization" + "description": "Layers or views available in the visualization." }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" @@ -1584,38 +1759,50 @@ "enum": [ "activity", "architecture", + "attack-tree", + "block", "class", "code", - "collaboration", + "communication", "component", "container", "context", - "dataFlow", + "data-flow", "deployment", "entity", + "flowchart", + "matrix", + "mind-map", "network", "process", "sequence", "state", - "useCase" + "timing", + "use-case" ], "meta:enum": { - "activity": "Activity or workflow diagram", - "architecture": "System architecture diagram", - "class": "Class or object diagram", - "code": "Code structure diagram", - "collaboration": "Collaboration diagram", - "component": "Component diagram", - "container": "Container diagram (C4)", - "context": "Context diagram", - "dataFlow": "Data flow diagram (DFD)", - "deployment": "Deployment or infrastructure diagram", - "entity": "Entity relationship diagram", - "network": "Network topology diagram", - "process": "Business process diagram", - "sequence": "Sequence or interaction diagram", - "state": "State machine diagram", - "useCase": "Use case diagram" + "activity": "Activity or workflow diagram.", + "architecture": "System architecture diagram.", + "attack-tree": "Attack tree diagram showing alternative paths to a goal.", + "block": "Block diagram, including SysML block definition and internal block diagrams.", + "class": "Class or object diagram.", + "code": "Code structure diagram.", + "communication": "Communication diagram, formerly known as the collaboration diagram.", + "component": "Component diagram.", + "container": "Container diagram, as in C4.", + "context": "Context diagram.", + "data-flow": "Data flow diagram, or DFD.", + "deployment": "Deployment or infrastructure diagram.", + "entity": "Entity relationship diagram.", + "flowchart": "Flowchart depicting steps or decision logic.", + "matrix": "Matrix diagram, such as a dependency structure or traceability matrix.", + "mind-map": "Mind map diagram for decomposition or brainstorming.", + "network": "Network topology diagram.", + "process": "Business process diagram.", + "sequence": "Sequence or interaction diagram.", + "state": "State machine diagram.", + "timing": "Timing diagram showing state changes over time.", + "use-case": "Use case diagram." } } } @@ -1632,80 +1819,12 @@ "type": "string", "title": "Name", "minLength": 1, - "description": "The name of the custom visualization type" - }, - "description": { - "type": "string", - "title": "Description", - "description": "A description of the custom visualization type" - } - } - } - ] - }, - "visualizationFormat": { - "type": "object", - "title": "Visualization Format", - "description": "The rendering format or toolchain used to produce the visualization.", - "oneOf": [ - { - "title": "Predefined Visualization Format", - "description": "A visualization format selected from a predefined set of well-known diagram formats and tools.", - "required": [ - "format" - ], - "additionalProperties": false, - "properties": { - "format": { - "type": "string", - "title": "Format", - "enum": [ - "archimate", - "cytoscape", - "d3", - "drawio", - "graphviz", - "jpeg", - "mermaid", - "plantuml", - "png", - "svg", - "visio" - ], - "meta:enum": { - "archimate": "ArchiMate model format", - "cytoscape": "Cytoscape graph format", - "d3": "D3.js visualization", - "drawio": "Draw.io/diagrams.net format", - "graphviz": "GraphViz DOT language", - "jpeg": "JPEG image format", - "mermaid": "Mermaid diagram language", - "plantuml": "PlantUML diagram language", - "png": "Portable Network Graphics", - "svg": "Scalable Vector Graphics", - "visio": "Microsoft Visio format" - } - } - } - }, - { - "title": "Custom Visualization Format", - "description": "A custom visualization format not covered by the predefined enumeration.", - "required": [ - "name" - ], - "additionalProperties": false, - "properties": { - "name": { - "type": "string", - "title": "Name", - "minLength": 1, - "description": "The name of the custom visualization format" + "description": "The name of the custom visualization type." }, "description": { "type": "string", "title": "Description", - "description": "A description of the custom visualization format" + "description": "A description of the custom visualization type." } } } @@ -1721,36 +1840,19 @@ "classification": { "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataClassification" }, - "tier": { - "type": "string", - "enum": [ - "tier0", - "tier1", - "tier2", - "tier3", - "tier4" - ], - "meta:enum": { - "tier0": "Mission critical - highest priority", - "tier1": "Business critical - high priority", - "tier2": "Business important - medium priority", - "tier3": "Business supporting - low priority", - "tier4": "Non-critical - minimal priority" - } - }, "categories": { "type": "array", "items": { "type": "string" }, - "description": "Business or technical categories" + "description": "Business or technical categories." }, "tags": { "type": "array", "items": { "type": "string" }, - "description": "Tags for classification and search" + "description": "Tags for classification and search." } } }, @@ -1772,44 +1874,66 @@ "title": "Predefined Authentication Type", "description": "A predefined authentication method from the enumeration.", "enum": [ - "apiKey", + "api-key", "basic", "bearer", + "biometric", "certificate", "digest", + "eap", "fido2", + "form", + "hmac", "jwt", "kerberos", "ldap", - "mfa", - "mTLS", + "magic-link", + "mtls", "none", "ntlm", "oauth1", "oauth2", "oidc", + "pin", + "psk", + "push", + "radius", "saml", - "ssh" + "scram", + "session", + "ssh", + "totp" ], "meta:enum": { - "apiKey": "API key authentication.", - "basic": "Basic authentication (username and password).", + "api-key": "API key authentication.", + "basic": "HTTP Basic authentication (RFC 7617), where the browser presents a native credential dialog and the username and password are sent on each request.", "bearer": "Bearer token authentication.", + "biometric": "Biometric authentication, such as fingerprint or face recognition.", "certificate": "Certificate-based authentication.", "digest": "Digest authentication.", + "eap": "Extensible Authentication Protocol, commonly used with IEEE 802.1X.", "fido2": "FIDO2 or WebAuthn passwordless authentication.", + "form": "Form-based authentication, where credentials such as a username and password are submitted through an application login form rather than the browser-native HTTP Basic dialog.", + "hmac": "HMAC request signing using a shared secret key.", "jwt": "JSON Web Token authentication.", "kerberos": "Kerberos authentication.", "ldap": "LDAP directory authentication.", - "mfa": "Multi-factor authentication.", - "mTLS": "Mutual TLS authentication.", + "magic-link": "Passwordless authentication using a single-use link.", + "mtls": "Mutual TLS authentication.", "none": "No authentication required.", "ntlm": "NTLM authentication.", "oauth1": "OAuth 1.0 authentication.", "oauth2": "OAuth 2.0 authentication.", "oidc": "OpenID Connect authentication.", + "pin": "Personal identification number, a short secret used as a knowledge factor, such as a device or application unlock PIN.", + "psk": "Pre-shared key authentication.", + "push": "Out-of-band push approval, where a prompt is sent to a registered device or application for the user to approve or deny, optionally confirmed by matching a displayed number.", + "radius": "RADIUS authentication.", "saml": "SAML authentication.", - "ssh": "SSH key authentication." + "scram": "Salted Challenge Response Authentication Mechanism.", + "session": "Session authentication, typically using a server-side session and cookie.", + "ssh": "SSH key authentication.", + "totp": "Time-based one-time password authentication." } }, { @@ -1847,22 +1971,24 @@ "enum": [ "abac", "acl", - "cbac", + "capability", "dac", "mac", "none", "pbac", + "radac", "rbac", "rebac" ], "meta:enum": { "abac": "Attribute-Based Access Control.", "acl": "Access Control Lists.", - "cbac": "Claims-Based Access Control.", + "capability": "Capability-Based Access Control.", "dac": "Discretionary Access Control.", "mac": "Mandatory Access Control.", "none": "No authorization controls.", "pbac": "Policy-Based Access Control.", + "radac": "Risk-Adaptive Access Control.", "rbac": "Role-Based Access Control.", "rebac": "Relationship-Based Access Control." } diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index 90080c1f6..f3d47965b 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -8,7 +8,7 @@ "risks": { "type": "object", "title": "Risks", - "description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The risk model is methodology-neutral and can document risk regardless of the risk rating framework used. It supports qualitative, semi-quantitative, and quantitative approaches by recording a qualitative `level`, a numeric `score`, or quantified loss, with the originating methodology identified on each score. Each risk distinguishes the risk before responses are applied (`inherentRisk`) from the risk that remains after them (`residualRisk`), with an optional `targetRisk` reflecting risk appetite, consistent with the process described in [ISO 31000](https://www.iso.org/iso-31000-risk-management.html). Specific rating techniques are not prescribed; [IEC 31010](https://www.iso.org/standard/72140.html) catalogues the available techniques.", + "description": "A collection of risks identified through risk analysis, together with the assessments that evaluate them. The model is framework-neutral and can document risk regardless of the risk management framework in use, including [ISO 31000](https://www.iso.org/iso-31000-risk-management.html), [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework), [COSO ERM](https://www.coso.org/), [ISO/IEC 27005](https://www.iso.org/standard/80585.html), and OCTAVE. It accommodates qualitative, semi-quantitative, and quantitative assessment, and each rating records the scoring methodology used, such as [FAIR](https://www.fairinstitute.org/), [OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), DREAD, [FMEA](https://asq.org/quality-resources/fmea), NIST SP 800-30, or OCTAVE Allegro. Each risk separates inherent, residual, and target ratings so risk reduction is explicit.", "additionalProperties": false, "properties": { "risks": { diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index a254b1609..694e8c402 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -65,11 +65,73 @@ }, "description": "The trust boundaries of the system, extending the architectural boundaries defined in a blueprint with trust semantics." }, + "methodologies": { + "type": "array", + "title": "Methodologies", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/methodology" + }, + "description": "The threat modeling methodologies applied to produce this threat model, such as STRIDE, LINDDUN, PASTA, or attack trees." + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } } }, + "methodology": { + "title": "Threat Modeling Methodology", + "description": "A threat modeling methodology applied to produce this threat model. Use the custom option for methodologies not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Threat Modeling Methodology", + "enum": [ + "STRIDE", + "LINDDUN", + "PASTA", + "MAESTRO", + "OWASP", + "TRIKE", + "VAST", + "ATFAA", + "attack-tree" + ], + "meta:enum": { + "STRIDE": "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.", + "LINDDUN": "Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance.", + "PASTA": "Process for Attack Simulation and Threat Analysis.", + "MAESTRO": "Multi-Agent Environment, Security, Threat, Risk, and Outcome.", + "OWASP": "OWASP threat modelling methodology.", + "TRIKE": "Risk-based threat modelling methodology.", + "VAST": "Visual, Agile, and Simple Threat modelling.", + "ATFAA": "Advanced Threat Framework for Autonomous AI Agents.", + "attack-tree": "Attack tree methodology, decomposing attacker goals into sub-goals and techniques." + } + }, + { + "type": "object", + "title": "Custom Threat Modeling Methodology", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom threat modeling methodology." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom threat modeling methodology." + } + } + } + ] + }, "threat": { "type": "object", "title": "Threat", @@ -108,14 +170,14 @@ "items": { "type": "object", "title": "Threat Category", - "description": "A threat category. The methodology determines the permitted category values.", + "description": "A threat category. The taxonomy determines the permitted category values.", "additionalProperties": false, - "required": ["methodology", "category"], + "required": ["taxonomy", "category"], "properties": { - "methodology": { + "taxonomy": { "type": "string", - "title": "Methodology", - "description": "The threat-modelling methodology that the category is drawn from.", + "title": "Taxonomy", + "description": "The threat classification taxonomy that the category is drawn from.", "enum": ["STRIDE", "LINDDUN", "MAESTRO", "MITRE-ATTACK"], "meta:enum": { "STRIDE": "Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.", @@ -128,14 +190,14 @@ "type": "string", "minLength": 1, "title": "Category", - "description": "The category within the methodology. The permitted values are determined by the methodology." + "description": "The category within the taxonomy. The permitted values are determined by the taxonomy." } }, "allOf": [ { "if": { - "required": ["methodology"], - "properties": { "methodology": { "const": "STRIDE" } } + "required": ["taxonomy"], + "properties": { "taxonomy": { "const": "STRIDE" } } }, "then": { "properties": { @@ -155,8 +217,8 @@ }, { "if": { - "required": ["methodology"], - "properties": { "methodology": { "const": "LINDDUN" } } + "required": ["taxonomy"], + "properties": { "taxonomy": { "const": "LINDDUN" } } }, "then": { "properties": { @@ -177,8 +239,8 @@ }, { "if": { - "required": ["methodology"], - "properties": { "methodology": { "const": "MAESTRO" } } + "required": ["taxonomy"], + "properties": { "taxonomy": { "const": "MAESTRO" } } }, "then": { "properties": { @@ -199,8 +261,8 @@ }, { "if": { - "required": ["methodology"], - "properties": { "methodology": { "const": "MITRE-ATTACK" } } + "required": ["taxonomy"], + "properties": { "taxonomy": { "const": "MITRE-ATTACK" } } }, "then": { "properties": { From 354baf4c6368ad11b762508915bf44ee8ed08f2e Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 00:40:20 -0500 Subject: [PATCH 07/14] Corrected mediaType reference issue Signed-off-by: Steve Springett --- schema/2.0/model/cyclonedx-data-2.0.schema.json | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/schema/2.0/model/cyclonedx-data-2.0.schema.json b/schema/2.0/model/cyclonedx-data-2.0.schema.json index 3175c01c6..a783800cf 100644 --- a/schema/2.0/model/cyclonedx-data-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-data-2.0.schema.json @@ -347,14 +347,7 @@ "description": "URL or URN pointing to the format specification." }, "mediaType": { - "type": "string", - "title": "Media Type", - "description": "Media type or encoding format, for example application/json, text/csv, application/hl7-v2.", - "examples": [ - "application/json", - "text/csv", - "application/hl7-v2" - ] + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/mediaType" }, "comment": { "type": "string", From f30e142bbd324d9fecafdbb4ea5b5937d23a5602 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 00:51:00 -0500 Subject: [PATCH 08/14] Removed methodology. Provided little value Signed-off-by: Steve Springett --- .../model/cyclonedx-blueprint-2.0.schema.json | 94 +------------------ 1 file changed, 2 insertions(+), 92 deletions(-) diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index b313f0c6d..102faf657 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -20,8 +20,7 @@ "description": "A versatile, machine-readable model designed to support a wide range of analytical activities, from use case documentation and behavioural analysis to comprehensive system-level threat and risk modelling.", "required": [ "name", - "modelTypes", - "methodologies" + "modelTypes" ], "additionalProperties": false, "properties": { @@ -52,15 +51,6 @@ "$ref": "#/$defs/modelType" } }, - "methodologies": { - "type": "array", - "title": "Methodologies", - "uniqueItems": true, - "description": "The modeling methodologies used.", - "items": { - "$ref": "#/$defs/methodology" - } - }, "scope": { "$ref": "#/$defs/scope" }, @@ -243,7 +233,7 @@ { "type": "object", "title": "Custom Model Type", - "description": "A custom model type not covered by the predefined enumeration, allowing organisations to define methodology-specific or domain-specific model categories.", + "description": "A custom model type not covered by the predefined enumeration, allowing organisations to define domain-specific model categories.", "additionalProperties": false, "required": [ "name" @@ -264,86 +254,6 @@ } ] }, - "methodology": { - "title": "Methodology", - "description": "The system or architecture modelling notation used to produce the blueprint, either a predefined value from the enumeration or a custom object. The object form may also annotate a predefined methodology with a version or external references. Threat modelling methodologies such as STRIDE and PASTA are recorded in the threat model, not here.", - "oneOf": [ - { - "type": "string", - "title": "Predefined Methodology", - "description": "A predefined methodology from the enumeration.", - "enum": [ - "4+1", - "Archimate", - "BPMN", - "C4", - "DFD", - "DODAF", - "ERD", - "IDEF", - "MODAF", - "NAF", - "SABSA", - "SysML", - "TOGAF", - "UML", - "Zachman" - ], - "meta:enum": { - "4+1": "4+1 Architectural View Model.", - "Archimate": "Enterprise architecture modelling language.", - "BPMN": "Business Process Model and Notation.", - "C4": "C4 Model for software architecture.", - "DFD": "Data Flow Diagrams.", - "DODAF": "Department of Defense Architecture Framework.", - "ERD": "Entity Relationship Diagrams.", - "IDEF": "Integration Definition Methods.", - "MODAF": "Ministry of Defence Architecture Framework.", - "NAF": "NATO Architecture Framework.", - "SABSA": "Sherwood Applied Business Security Architecture.", - "SysML": "Systems Modeling Language.", - "TOGAF": "The Open Group Architecture Framework.", - "UML": "Unified Modeling Language.", - "Zachman": "Zachman Framework." - } - }, - { - "type": "object", - "title": "Custom Methodology", - "description": "A custom methodology not covered by the predefined enumeration, or a predefined methodology that needs to carry a version or external references.", - "additionalProperties": false, - "required": [ - "name" - ], - "properties": { - "name": { - "type": "string", - "title": "Name", - "minLength": 1, - "description": "The name of the methodology. May reference a predefined methodology by its enumerated identifier or a custom methodology name." - }, - "version": { - "type": "string", - "title": "Version", - "description": "The version of the methodology." - }, - "description": { - "type": "string", - "title": "Description", - "description": "A description of the methodology." - }, - "externalReferences": { - "type": "array", - "title": "External References", - "uniqueItems": true, - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference" - } - } - } - } - ] - }, "metadata": { "type": "object", "title": "Blueprint Metadata", From d5aa9b0b8cb40d207e91301936d44040e42e9d17 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 02:27:41 -0500 Subject: [PATCH 09/14] Refactor of how behaviors are represented to account for truly event-based scenarios (eg state machines) which cannot be represented in linear flows. Signed-off-by: Steve Springett --- .../model/cyclonedx-behavior-2.0.schema.json | 289 +++++++++++++++--- 1 file changed, 244 insertions(+), 45 deletions(-) diff --git a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json index abc489e66..74caf6df1 100644 --- a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json @@ -20,13 +20,13 @@ "$ref": "#/$defs/behaviorInstance" } }, - "flows": { + "graphs": { "type": "array", - "title": "Flows", - "description": "Behavior flows that organise behaviors into operational patterns.", + "title": "Graphs", + "description": "Behavior graphs that model behaviour over time as activity flows, state machines, or a mixture of the two.", "uniqueItems": true, "items": { - "$ref": "#/$defs/behaviorFlow" + "$ref": "#/$defs/behaviorGraph" } } } @@ -106,25 +106,22 @@ "ordering": { "type": "string", "title": "Ordering", - "description": "Execution semantics for steps within a flow.", - "default": "sequential", + "description": "Execution semantics for the nodes of a graph when transitions do not fully specify the order.", "enum": [ "sequential", "unordered", - "parallel", - "conditional" + "parallel" ], "meta:enum": { - "sequential": "Steps execute in ordinal order. Each completes before the next begins.", - "unordered": "All steps execute, but order is not guaranteed.", - "parallel": "Steps may execute concurrently.", - "conditional": "Step execution is determined by runtime conditions." + "sequential": "Nodes execute in ordinal order. Each completes before the next begins.", + "unordered": "All nodes execute, but the order is not guaranteed.", + "parallel": "Nodes may execute concurrently." } }, "acknowledgment": { "type": "array", "title": "Acknowledgment", - "description": "Indicates how the behavior or flow was identified. Multiple values indicate the behavior was both declared and observed.", + "description": "Indicates how the behavior or graph was identified. Multiple values indicate the behavior was both declared and observed.", "uniqueItems": true, "items": { "type": "string", @@ -138,16 +135,49 @@ } } }, - "behaviorFlow": { + "behaviorGraph": { "type": "object", - "title": "Behavior Flow", - "description": "An organised collection of behaviors forming a coherent process.", + "title": "Behavior Graph", + "description": "A graph of nodes joined by transitions that models behaviour over time. A node may be an activity, a state, an event, a gateway, or a start or end point, so the same construct expresses an activity or process flow (where the nodes are activities), a state machine (where the nodes are states), or a mixture of the two.", "additionalProperties": false, - "required": ["bom-ref", "steps"], + "required": [ + "bom-ref", + "nodes" + ], "properties": { "bom-ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" }, + "name": { + "type": "string", + "title": "Name", + "description": "The name of the graph." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the graph and the behaviour it models." + }, + "kind": { + "type": "string", + "title": "Kind", + "description": "An optional hint at the intent of the graph.", + "enum": [ + "activity", + "state-machine", + "mixed" + ], + "meta:enum": { + "activity": "The graph models a process or activity flow whose nodes are activities.", + "state-machine": "The graph models a state machine whose nodes are states.", + "mixed": "The graph mixes activity and state nodes." + } + }, + "subject": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "title": "Subject", + "description": "Reference using bom-link or bom-ref to the object whose behaviour this graph describes." + }, "acknowledgment": { "$ref": "#/$defs/acknowledgment" }, @@ -157,29 +187,45 @@ "trigger": { "$ref": "#/$defs/trigger" }, - "steps": { + "nodes": { "type": "array", - "title": "Steps", - "description": "The steps that comprise this flow.", + "title": "Nodes", + "description": "The nodes of the graph.", "minItems": 1, + "uniqueItems": true, "items": { - "$ref": "#/$defs/flowStep" + "$ref": "#/$defs/behaviorNode" + } + }, + "transitions": { + "type": "array", + "title": "Transitions", + "description": "The transitions between nodes. Transitions express the ordering of an activity flow and the triggered, guarded moves of a state machine.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/transition" } } }, "allOf": [ { "if": { - "anyOf": [ - { "properties": { "ordering": { "const": "sequential" } }, "required": ["ordering"] }, - { "not": { "required": ["ordering"] } } + "properties": { + "ordering": { + "const": "sequential" + } + }, + "required": [ + "ordering" ] }, "then": { "properties": { - "steps": { + "nodes": { "items": { - "required": ["ordinal"] + "required": [ + "ordinal" + ] } } } @@ -187,40 +233,75 @@ } ] }, - "flowStep": { + "behaviorNode": { "type": "object", - "title": "Flow Step", - "description": "A single step within a behavior flow.", + "title": "Behavior Node", + "description": "A single node in a behavior graph. The kind determines what the node represents and which additional properties apply.", "additionalProperties": false, + "required": [ + "bom-ref", + "kind" + ], "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "kind": { + "type": "string", + "title": "Kind", + "description": "The kind of node.", + "enum": [ + "activity", + "state", + "event", + "gateway", + "initial", + "final" + ], + "meta:enum": { + "activity": "An action that is performed, identified by a behavior, a behavior-instance reference, or a nested graph. The activity-flow counterpart of a step.", + "state": "A durable condition the subject rests in until a transition fires. The state-machine counterpart of a node. A composite state references its nested region through 'graph'.", + "event": "An intermediate event that occurs during the graph.", + "gateway": "A branch or merge point whose outgoing transitions carry the guards.", + "initial": "The starting point of the graph or of a composite node.", + "final": "A completion point of the graph or of a composite node." + } + }, + "name": { + "type": "string", + "title": "Name", + "description": "The name of the node." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the node." + }, "ordinal": { "type": "integer", "title": "Ordinal", - "description": "Position within the flow. Required when ordering is 'sequential' or omitted.", - "minimum": 1 + "minimum": 1, + "description": "Position within a sequential graph. Required when the graph ordering is 'sequential'. Ignored when transitions define the order." }, "behavior": { "$ref": "../behavior-taxonomy.schema.json", "title": "Behavior", - "description": "The behavior performed in this step. Mutually exclusive with 'ref' and 'flow'." - }, - "trigger": { - "$ref": "#/$defs/trigger" + "description": "For an activity node, the behavior performed, drawn from the taxonomy. Mutually exclusive with 'ref' and 'graph'." }, "ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", "title": "Behavior Reference", - "description": "Reference to a behavior instance. Mutually exclusive with 'behavior' and 'flow'." + "description": "For an activity node, a reference to a behavior instance. Mutually exclusive with 'behavior' and 'graph'." }, - "flow": { + "graph": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "title": "Flow Reference", - "description": "Reference to a nested flow. Mutually exclusive with 'behavior' and 'ref'." + "title": "Graph Reference", + "description": "A reference to a nested behavior graph. For an activity node it is the sub-process performed and is mutually exclusive with 'behavior' and 'ref'; for a composite node it is the nested region." }, "actors": { "type": "array", "title": "Actors", - "description": "References using bom-link or bom-ref to objects that perform this step.", + "description": "References using bom-link or bom-ref to objects that perform this node.", "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" @@ -229,18 +310,136 @@ "targets": { "type": "array", "title": "Targets", - "description": "References using bom-link or bom-ref to objects affected by this step.", + "description": "References using bom-link or bom-ref to objects affected by this node.", "uniqueItems": true, "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" } + }, + "eventType": { + "$ref": "#/$defs/trigger", + "title": "Event Type", + "description": "For an event node, the nature of the event, reusing the trigger vocabulary, such as signal, scheduled, or event-driven." + }, + "gatewayKind": { + "type": "string", + "title": "Gateway Kind", + "description": "For a gateway node, the branching semantics applied across its outgoing transitions.", + "enum": [ + "exclusive", + "inclusive", + "parallel", + "complex" + ], + "meta:enum": { + "exclusive": "Exactly one outgoing transition is taken, the first whose guard holds.", + "inclusive": "Every outgoing transition whose guard holds is taken.", + "parallel": "All outgoing transitions are taken concurrently, forking and later joining execution.", + "complex": "Branch selection follows a complex condition described in the transition guards." + } + }, + "onEntry": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "On Entry", + "description": "For a state node, a reference to a behavior instance performed when the state is entered." + }, + "onExit": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "On Exit", + "description": "For a state node, a reference to a behavior instance performed when the state is exited." + }, + "doActivity": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "Do Activity", + "description": "For a state node, a reference to a behavior instance performed while the subject remains in the state." } }, - "oneOf": [ - { "required": ["behavior"] }, - { "required": ["ref"] }, - { "required": ["flow"] } + "allOf": [ + { + "if": { + "properties": { + "kind": { + "const": "activity" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "oneOf": [ + { + "required": [ + "behavior" + ] + }, + { + "required": [ + "ref" + ] + }, + { + "required": [ + "graph" + ] + } + ] + } + } ] + }, + "transition": { + "type": "object", + "title": "Transition", + "description": "A directed edge from one node to another. In an activity flow it expresses ordering; in a state machine it expresses a triggered, guarded move between states.", + "additionalProperties": false, + "required": [ + "source", + "target" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "name": { + "type": "string", + "title": "Name", + "description": "The name of the transition." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the transition." + }, + "source": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "Source", + "description": "Reference to the source node." + }, + "target": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "Target", + "description": "Reference to the target node." + }, + "trigger": { + "$ref": "#/$defs/trigger" + }, + "guard": { + "type": "string", + "title": "Guard", + "description": "A guard condition; the transition fires only when it evaluates to true." + }, + "default": { + "type": "boolean", + "title": "Default", + "description": "Whether this transition is taken when no other guard from the same source node holds." + }, + "effect": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "Effect", + "description": "Reference to a behavior instance performed when the transition fires." + } + } } } } From 3dca97b3c739ef8b68db648a5584a45e20ac866d Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 02:28:36 -0500 Subject: [PATCH 10/14] Minor refactor to introduce blueprint relaltionships. Signed-off-by: Steve Springett --- .../model/cyclonedx-blueprint-2.0.schema.json | 168 ++++++++++++++++-- 1 file changed, 155 insertions(+), 13 deletions(-) diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 102faf657..3b9def2b4 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -111,6 +111,15 @@ }, "description": "Data, control, or process flows between assets." }, + "relationships": { + "type": "array", + "title": "Relationships", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/relationship" + }, + "description": "Static, structural relationships between elements of the model, complementing the runtime exchanges captured by flows." + }, "actors": { "type": "array", "title": "Actors", @@ -512,10 +521,6 @@ "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "description": "Reference using bom-link or bom-ref to the zone containing this asset." }, - "parent": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to the parent asset if this is a sub-component." - }, "classification": { "$ref": "#/$defs/assetClassification" }, @@ -541,15 +546,6 @@ }, "description": "Interfaces exposed by this asset." }, - "dependencies": { - "type": "array", - "title": "Dependencies", - "uniqueItems": true, - "items": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" - }, - "description": "References using bom-link or bom-ref to assets this asset depends on." - }, "useCases": { "type": "array", "title": "Use Cases", @@ -1245,6 +1241,152 @@ } } }, + "relationship": { + "type": "object", + "title": "Relationship", + "description": "A typed structural relationship from one element to one or more others, complementing the runtime exchanges captured by flows. The subject is `ref`, and the kind of relationship is expressed as a single typed property whose value lists the targets, mirroring the dependency graph for readability.", + "additionalProperties": false, + "required": [ + "ref" + ], + "oneOf": [ + { + "required": [ + "aggregates" + ] + }, + { + "required": [ + "associates" + ] + }, + { + "required": [ + "composes" + ] + }, + { + "required": [ + "contains" + ] + }, + { + "required": [ + "dependsOn" + ] + }, + { + "required": [ + "generalizes" + ] + }, + { + "required": [ + "realizes" + ] + }, + { + "required": [ + "serves" + ] + }, + { + "required": [ + "custom" + ] + } + ], + "properties": { + "ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "title": "Reference", + "description": "Reference using bom-link or bom-ref to the subject element of the relationship." + }, + "aggregates": { + "$ref": "#/$defs/relationshipTargets", + "title": "Aggregates", + "description": "The subject is the whole in a whole-part relationship in which each target part may exist independently of the whole." + }, + "associates": { + "$ref": "#/$defs/relationshipTargets", + "title": "Associates", + "description": "The subject has a general association with each target." + }, + "composes": { + "$ref": "#/$defs/relationshipTargets", + "title": "Composes", + "description": "The subject is the whole in a whole-part relationship in which each target part cannot exist without the whole." + }, + "contains": { + "$ref": "#/$defs/relationshipTargets", + "title": "Contains", + "description": "The subject contains or nests each target." + }, + "dependsOn": { + "$ref": "#/$defs/relationshipTargets", + "title": "Depends On", + "description": "The subject depends on each target." + }, + "generalizes": { + "$ref": "#/$defs/relationshipTargets", + "title": "Generalizes", + "description": "The subject is a generalisation of each target, as in inheritance." + }, + "realizes": { + "$ref": "#/$defs/relationshipTargets", + "title": "Realizes", + "description": "The subject realises or implements each target." + }, + "serves": { + "$ref": "#/$defs/relationshipTargets", + "title": "Serves", + "description": "The subject provides a service to each target." + }, + "custom": { + "type": "array", + "title": "Custom Relationships", + "description": "Relationships whose kind is not covered by the predefined properties. Each entry names the kind and lists its targets.", + "uniqueItems": true, + "items": { + "type": "object", + "title": "Custom Relationship", + "additionalProperties": false, + "required": [ + "type", + "targets" + ], + "properties": { + "type": { + "type": "string", + "title": "Type", + "minLength": 1, + "description": "The name of the custom relationship kind." + }, + "targets": { + "$ref": "#/$defs/relationshipTargets", + "title": "Targets", + "description": "The targets of the custom relationship." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom relationship kind." + } + } + } + } + } + }, + "relationshipTargets": { + "type": "array", + "title": "Relationship Targets", + "description": "References using bom-link or bom-ref to the target elements of a relationship.", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + } + }, "flow": { "type": "object", "title": "Flow", From d262ad89453c18e3d678a06bc84817adf9192b5b Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 02:29:55 -0500 Subject: [PATCH 11/14] Added data relationships and a few minor other things Signed-off-by: Steve Springett --- .../2.0/model/cyclonedx-data-2.0.schema.json | 101 ++++++++++++++++++ 1 file changed, 101 insertions(+) diff --git a/schema/2.0/model/cyclonedx-data-2.0.schema.json b/schema/2.0/model/cyclonedx-data-2.0.schema.json index a783800cf..cb4ee9b29 100644 --- a/schema/2.0/model/cyclonedx-data-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-data-2.0.schema.json @@ -365,6 +365,15 @@ "$ref": "#/$defs/dataAttribute" } }, + "relationships": { + "type": "array", + "title": "Relationships", + "description": "Relationships from this data object to other data objects, such as the associations between entities in a logical or conceptual data model.", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/dataRelationship" + } + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } @@ -379,6 +388,10 @@ ], "additionalProperties": false, "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "description": "Unique identifier for this attribute, enabling it to be referenced as a key target." + }, "name": { "type": "string", "title": "Name", @@ -411,6 +424,94 @@ "title": "Sensitive", "description": "Indicates whether the attribute carries sensitive content that warrants extra protection beyond the object-level classification, such as masking in logs or stricter access controls." }, + "key": { + "type": "string", + "title": "Key", + "enum": [ + "primary", + "foreign", + "unique" + ], + "meta:enum": { + "primary": "The attribute is part of the primary key that uniquely identifies the data object.", + "foreign": "The attribute is a foreign key referencing another data object.", + "unique": "The attribute carries a uniqueness constraint." + }, + "description": "The key role of the attribute within the data object." + }, + "references": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "title": "References", + "description": "For a foreign key, a reference using bom-link or bom-ref to the data object or attribute it refers to." + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, + "dataRelationship": { + "type": "object", + "title": "Data Relationship", + "description": "A relationship from one data object to another, such as an association between entities in a logical or conceptual data model, carrying its cardinality and optionally the attributes that participate.", + "additionalProperties": false, + "required": [ + "target", + "cardinality" + ], + "properties": { + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType" + }, + "name": { + "type": "string", + "title": "Name", + "description": "The name of the relationship, such as the role or verb that describes it." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the relationship." + }, + "target": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", + "title": "Target", + "description": "Reference using bom-link or bom-ref to the related data object." + }, + "cardinality": { + "type": "string", + "title": "Cardinality", + "enum": [ + "one-to-one", + "one-to-many", + "many-to-one", + "many-to-many" + ], + "meta:enum": { + "one-to-one": "Each record of the source relates to at most one record of the target, and the reverse.", + "one-to-many": "Each record of the source relates to many records of the target.", + "many-to-one": "Many records of the source relate to one record of the target.", + "many-to-many": "Many records of the source relate to many records of the target." + }, + "description": "The cardinality of the relationship." + }, + "sourceAttributes": { + "type": "array", + "title": "Source Attributes", + "description": "References using bom-link or bom-ref to the attributes on this data object that participate in the relationship, such as the foreign key columns.", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + } + }, + "targetAttributes": { + "type": "array", + "title": "Target Attributes", + "description": "References using bom-link or bom-ref to the attributes on the target data object that the relationship refers to, such as the primary key columns.", + "uniqueItems": true, + "items": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" + } + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } From 43e84554775f7d7df581287ba313bcef3fec0700 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 21:06:04 -0500 Subject: [PATCH 12/14] Added session management and a few other minor changes Signed-off-by: Steve Springett --- .../model/cyclonedx-blueprint-2.0.schema.json | 71 ++++++++++++++++++- 1 file changed, 68 insertions(+), 3 deletions(-) diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 3b9def2b4..0f84730be 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -1176,6 +1176,9 @@ "crossingRequirements": { "$ref": "#/$defs/crossingRequirements" }, + "sessionManagement": { + "$ref": "#/$defs/sessionManagement" + }, "properties": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" } @@ -1184,7 +1187,7 @@ "crossingRequirements": { "type": "object", "title": "Crossing Requirements", - "description": "Defines the security controls, policies, and constraints that must be satisfied when data or actors cross a boundary between zones.", + "description": "The security controls, policies, and constraints applied when data or actors cross a boundary between zones, such as the authentication and authorization enforced, the protocols permitted, and the validation, logging, and monitoring performed at the crossing.", "additionalProperties": false, "properties": { "authentication": { @@ -1241,6 +1244,63 @@ } } }, + "sessionManagement": { + "type": "object", + "title": "Session Management", + "description": "The lifecycle of the authenticated session established at this boundary, covering session timeouts, access and refresh token validity, and logout behaviour. These properties characterize the session that results from authenticating, independently of the authentication method used.", + "additionalProperties": false, + "properties": { + "accessTokenExpires": { + "type": "boolean", + "title": "Access Token Expires", + "description": "Whether access tokens issued for this boundary expire." + }, + "accessTokenTtl": { + "type": "integer", + "title": "Access Token Time To Live", + "minimum": 0, + "description": "Validity period of an access token, in seconds." + }, + "refreshToken": { + "type": "boolean", + "title": "Refresh Token", + "description": "Whether refresh tokens are issued for this boundary." + }, + "refreshTokenExpires": { + "type": "boolean", + "title": "Refresh Token Expires", + "description": "Whether refresh tokens expire." + }, + "refreshTokenTtl": { + "type": "integer", + "title": "Refresh Token Time To Live", + "minimum": 0, + "description": "Validity period of a refresh token, in seconds." + }, + "idleTimeout": { + "type": "integer", + "title": "Idle Timeout", + "minimum": 0, + "description": "Period of inactivity after which the session ends, in seconds." + }, + "absoluteTimeout": { + "type": "integer", + "title": "Absolute Timeout", + "minimum": 0, + "description": "Period after session creation after which the session ends regardless of activity, in seconds." + }, + "userLogout": { + "type": "boolean", + "title": "User Logout", + "description": "Whether a user can explicitly end the session." + }, + "systemLogout": { + "type": "boolean", + "title": "System Logout", + "description": "Whether the system can end the session without user action." + } + } + }, "relationship": { "type": "object", "title": "Relationship", @@ -1486,6 +1546,11 @@ "title": "Synchronous", "description": "Whether the flow is synchronous or asynchronous." }, + "encrypted": { + "type": "boolean", + "title": "Encrypted", + "description": "Whether the data carried by this flow is encrypted in transit." + }, "volume": { "type": "string", "title": "Volume", @@ -1952,7 +2017,7 @@ "radius", "saml", "scram", - "session", + "session-cookie", "ssh", "totp" ], @@ -1983,7 +2048,7 @@ "radius": "RADIUS authentication.", "saml": "SAML authentication.", "scram": "Salted Challenge Response Authentication Mechanism.", - "session": "Session authentication, typically using a server-side session and cookie.", + "session-cookie": "Session authentication using a server-side session identified by a cookie.", "ssh": "SSH key authentication.", "totp": "Time-based one-time password authentication." } From 67358768b82b65a16cd8b938cf810af905c61ffd Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 21:06:26 -0500 Subject: [PATCH 13/14] Added qualitative-matrix Signed-off-by: Steve Springett --- schema/2.0/model/cyclonedx-risk-2.0.schema.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json index f3d47965b..f57b26a8d 100644 --- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json @@ -891,7 +891,8 @@ "fmea", "nist-sp-800-30", "octave", - "owasp-risk-rating" + "owasp-risk-rating", + "qualitative-matrix" ], "meta:enum": { "dread": "[DREAD](https://en.wikipedia.org/wiki/DREAD_%28risk_assessment_model%29) risk rating model, the average of five ratings (damage, reproducibility, exploitability, affected users, discoverability) each scored 1 to 10.", @@ -899,7 +900,8 @@ "fmea": "[Failure Mode and Effects Analysis (FMEA)](https://asq.org/quality-resources/fmea), using a risk priority number of severity multiplied by occurrence multiplied by detection.", "nist-sp-800-30": "[NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final) guide for conducting risk assessments, using its exemplary likelihood and impact scales.", "octave": "[OCTAVE Allegro](https://www.sei.cmu.edu/documents/786/2007_005_001_14885.pdf), using its relative risk score.", - "owasp-risk-rating": "[OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), averaging likelihood and impact factors each scored 0 to 9." + "owasp-risk-rating": "[OWASP Risk Rating](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology), averaging likelihood and impact factors each scored 0 to 9.", + "qualitative-matrix": "A qualitative risk matrix that derives a risk level by plotting a likelihood band against an impact band, such as a five by five matrix producing a score from 1 to 25." } }, { From f0114234258c3ee0f82a7f6a170653084b22bd08 Mon Sep 17 00:00:00 2001 From: Steve Springett Date: Sun, 7 Jun 2026 21:06:55 -0500 Subject: [PATCH 14/14] Added threat origin Signed-off-by: Steve Springett --- .../model/cyclonedx-threat-2.0.schema.json | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json index 694e8c402..eac2b252a 100644 --- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json @@ -162,6 +162,49 @@ "title": "Source", "description": "The source of the threat, such as a threat intelligence feed, a threat catalogue, or an analysis activity." }, + "origin": { + "title": "Origin", + "description": "The nature of the threat source that gives rise to this threat, following the threat source types of [NIST SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final). Use the custom option for an origin not covered by the enumeration.", + "oneOf": [ + { + "type": "string", + "title": "Predefined Origin", + "enum": [ + "adversarial", + "accidental", + "structural", + "environmental" + ], + "meta:enum": { + "adversarial": "An adversary acting with intent, such as an individual, group, organization, or nation state.", + "accidental": "An erroneous action taken without malicious intent, such as a mistake by a privileged user or administrator.", + "structural": "A failure of equipment, software, or environmental controls, such as resource exhaustion or expiry of a component.", + "environmental": "A natural or human-made event outside the control of the organization, such as a fire, flood, or wide-area infrastructure outage." + } + }, + { + "type": "object", + "title": "Custom Origin", + "required": [ + "name" + ], + "additionalProperties": false, + "properties": { + "name": { + "type": "string", + "minLength": 1, + "title": "Name", + "description": "The name of the custom origin." + }, + "description": { + "type": "string", + "title": "Description", + "description": "A description of the custom origin." + } + } + } + ] + }, "categories": { "type": "array", "title": "Categories",