NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software 2.1: Threat model early and use it to focus verification

What does 2.1 require?

Threat modelling is done early in development to surface design-level security issues, and repeated as new capabilities are added so that new threats are captured and the model improves. The model directs the rest of verification: test cases are made more thorough where the consequences are greatest, variations of the inputs the model flags get priority, and code the model identifies as sensitive is marked for manual review of questions such as whether authorisation is required where it should be and whether interfaces check and validate input.