ISO/SAE 21434 RQ-15-03: [RQ-15-03] Threat scenarios

Threat scenarios shall be identified, including the targeted asset, the compromised cybersecurity property and the cause of the compromise; methods include brainstorming and systematic approaches (misuse cases, EVITA, TVRA, PASTA, STRIDE); a damage scenario can correspond to several threat scenarios and a threat scenario to several damage scenarios.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Clause 15: Threat analysis and risk assessment methods – ISO/SAE 21434

RC-15-11 [RC-15-11] Attack feasibility method
RC-15-12 [RC-15-12] Attack-potential-based approach
RC-15-13 [RC-15-13] CVSS-based approach
RC-15-14 [RC-15-14] Attack-vector-based approach
RQ-15-01 [RQ-15-01] Damage scenarios
RQ-15-02 [RQ-15-02] Assets with cybersecurity properties
RQ-15-04 [RQ-15-04] Impact rating in four categories
RQ-15-05 [RQ-15-05] Impact rating levels

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/SAE 21434 controls