@dollhousemcp/mcp-server 1.3.0

package/data/templates/threat-assessment-report.md

@@ -0,0 +1,774 @@
+---
+name: "Threat Assessment Report"
+description: "Comprehensive threat modeling and risk assessment report with mitigation strategies"
+type: "template"
+version: "1.0.0"
+author: "DollhouseMCP"
+created: "2025-07-23"
+category: "security"
+tags: ["threat-modeling", "risk-assessment", "security-analysis", "threat-intelligence"]
+variables:
+  system_name:
+    type: "string"
+    description: "Name of the system being assessed"
+    required: true
+  assessment_date:
+    type: "string"
+    description: "Date of the threat assessment"
+    required: true
+    default: "{{TODAY}}"
+  threat_analyst:
+    type: "string"
+    description: "Lead threat analyst name"
+    required: true
+  business_owner:
+    type: "string"
+    description: "Business system owner"
+    required: true
+  methodology:
+    type: "string"
+    description: "Threat modeling methodology used"
+    default: "STRIDE"
+    enum: ["STRIDE", "PASTA", "OCTAVE", "TRIKE", "VAST"]
+  system_criticality:
+    type: "string"
+    description: "Business criticality of the system"
+    default: "high"
+    enum: ["low", "medium", "high", "critical"]
+outputFormats: ["pdf", "html", "markdown", "docx"]
+includes: []
+---
+
+# Threat Assessment Report
+
+**System:** {{system_name}}  
+**Assessment Date:** {{assessment_date}}  
+**Threat Analyst:** {{threat_analyst}}  
+**Business Owner:** {{business_owner}}  
+**Methodology:** {{methodology}}  
+**System Criticality:** {{system_criticality}}  
+**Classification:** CONFIDENTIAL
+
+---
+
+## Executive Summary
+
+### System Overview
+{{#if system_overview}}
+{{system_overview}}
+{{else}}
+{{system_name}} is a {{system_criticality}} business system that {{system_description}}. This threat assessment evaluates potential security risks and provides recommendations for risk mitigation.
+
+**Key System Characteristics:**
+- Business Function: {{business_function}}
+- User Base: {{user_count}} users
+- Data Sensitivity: {{data_sensitivity}}
+- Regulatory Requirements: {{compliance_requirements}}
+- Technology Stack: {{tech_stack}}
+{{/if}}
+
+### Threat Landscape Summary
+{{#if threat_summary}}
+{{threat_summary}}
+{{else}}
+This assessment identified **{{total_threats}}** distinct threat scenarios across **{{threat_categories}}** categories. The analysis reveals **{{high_risk_threats}}** high-risk threats requiring immediate attention and **{{medium_risk_threats}}** medium-risk threats needing mitigation within the next quarter.
+
+**Most Critical Threats:**
+1. {{threat_1_name}} - Risk Score: {{threat_1_score}}
+2. {{threat_2_name}} - Risk Score: {{threat_2_score}}  
+3. {{threat_3_name}} - Risk Score: {{threat_3_score}}
+{{/if}}
+
+### Risk Assessment Overview
+| Risk Level | Threat Count | Business Impact | Recommended Timeline |
+|------------|--------------|-----------------|---------------------|
+{{#if risk_summary}}
+{{#each risk_summary}}
+| {{level}} | {{count}} | {{impact}} | {{timeline}} |
+{{/each}}
+{{else}}
+| Critical | X | Severe | Immediate (0-7 days) |
+| High | Y | Major | Urgent (7-30 days) |
+| Medium | Z | Moderate | Important (30-90 days) |
+| Low | W | Minor | Standard (90+ days) |
+{{/if}}
+
+### Key Recommendations
+{{#if key_recommendations}}
+{{#each key_recommendations}}
+{{@index+1}}. **{{category}}**: {{recommendation}}
+{{/each}}
+{{else}}
+1. **Identity & Access Management**: Implement multi-factor authentication and privileged access controls
+2. **Network Security**: Deploy network segmentation and intrusion detection systems
+3. **Data Protection**: Enhance encryption and data loss prevention capabilities
+4. **Monitoring & Response**: Establish security operations center and incident response procedures
+5. **Security Awareness**: Conduct comprehensive security training for all users
+{{/if}}
+
+---
+
+## Threat Modeling Methodology
+
+### Approach and Framework
+{{#if methodology_description}}
+{{methodology_description}}
+{{else}}
+This threat assessment follows the **{{methodology}}** methodology, providing a systematic approach to identify, analyze, and prioritize security threats.
+
+**{{methodology}} Categories:**
+{{#if methodology == "STRIDE"}}
+- **S**poofing: Identity and authentication threats
+- **T**ampering: Data and system integrity threats  
+- **R**epudiation: Non-repudiation and audit threats
+- **I**nformation Disclosure: Confidentiality and privacy threats
+- **D**enial of Service: Availability and performance threats
+- **E**levation of Privilege: Authorization and access control threats
+{{else if methodology == "PASTA"}}
+- Stage 1: Define Objectives
+- Stage 2: Define Technical Scope
+- Stage 3: Application Decomposition
+- Stage 4: Threat Analysis
+- Stage 5: Weakness Analysis
+- Stage 6: Attack Modeling
+- Stage 7: Risk Analysis
+{{/if}}
+{{/if}}
+
+### System Decomposition
+{{#if system_architecture}}
+{{system_architecture}}
+{{else}}
+#### Architecture Components
+```
+{{system_name}} Architecture:
+
+┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
+│   Web Clients   │────│  Load Balancer  │────│   Web Servers   │
+└─────────────────┘    └─────────────────┘    └─────────────────┘
+                                                       │
+                                               ┌─────────────────┐
+                                               │ Application     │
+                                               │ Servers         │
+                                               └─────────────────┘
+                                                       │
+                                               ┌─────────────────┐
+                                               │   Database      │
+                                               │   Cluster       │
+                                               └─────────────────┘
+```
+
+#### Trust Boundaries
+1. **Internet ↔ DMZ**: External users accessing public services
+2. **DMZ ↔ Internal Network**: Web tier accessing application services
+3. **Application ↔ Data Tier**: Application servers accessing databases
+4. **Internal ↔ Management**: Administrative access to system components
+
+#### Data Flow Analysis
+- **User Authentication**: Credentials flow from client to authentication service
+- **Business Logic**: Application processes user requests and business rules
+- **Data Storage**: Sensitive data stored and retrieved from database systems
+- **External Integrations**: API calls to third-party services and partners
+{{/if}}
+
+### Asset Inventory
+{{#if asset_inventory}}
+{{#each asset_inventory}}
+#### {{category}}
+{{#each assets}}
+- **{{name}}**: {{description}} (Criticality: {{criticality}})
+{{/each}}
+{{/each}}
+{{else}}
+#### Critical Assets
+- **Customer Database**: Contains PII and financial data (Criticality: Critical)
+- **Authentication Service**: Manages user access controls (Criticality: High)
+- **Payment Processor**: Handles financial transactions (Criticality: Critical)
+- **Web Application**: Primary user interface (Criticality: High)
+- **API Gateway**: External integration point (Criticality: Medium)
+
+#### Supporting Assets
+- **Load Balancers**: Traffic distribution (Criticality: Medium)
+- **Monitoring Systems**: Operational visibility (Criticality: Medium)
+- **Backup Systems**: Data recovery capability (Criticality: High)
+- **Network Infrastructure**: Connectivity foundation (Criticality: Medium)
+{{/if}}
+
+---
+
+## Threat Analysis
+
+{{#if detailed_threats}}
+{{#each detailed_threats}}
+### Threat {{@index+1}}: {{name}}
+
+**Threat ID:** {{id}}  
+**Category:** {{category}}  
+**Risk Score:** {{risk_score}}/10  
+**Priority:** {{priority}}
+
+#### Threat Description
+{{description}}
+
+#### Threat Actors
+{{#each threat_actors}}
+- **{{type}}**: {{capabilities}} (Motivation: {{motivation}})
+{{/each}}
+
+#### Attack Scenarios
+{{#each attack_scenarios}}
+{{@index+1}}. **{{scenario_name}}**
+   - **Prerequisites:** {{prerequisites}}
+   - **Attack Steps:** {{attack_steps}}
+   - **Success Criteria:** {{success_criteria}}
+   - **Detection Difficulty:** {{detection_difficulty}}
+{{/each}}
+
+#### Affected Assets
+{{#each affected_assets}}
+- **{{asset_name}}**: {{impact_description}} (Impact Level: {{impact_level}})
+{{/each}}
+
+#### Risk Assessment
+**Likelihood Assessment:** {{likelihood}}/5
+- Threat Actor Capability: {{actor_capability}}/5
+- Attack Complexity: {{complexity}}/5  
+- Required Access: {{access_required}}/5
+- Detection Probability: {{detection_prob}}/5
+
+**Impact Assessment:** {{impact}}/5
+- Confidentiality Impact: {{confidentiality}}/5
+- Integrity Impact: {{integrity}}/5
+- Availability Impact: {{availability}}/5
+- Business Impact: {{business_impact}}/5
+
+**Risk Calculation:** 
+```
+Risk Score = (Likelihood × Impact × Vulnerability) / Controls
+Risk Score = ({{likelihood}} × {{impact}} × {{vulnerability}}) / {{controls}} = {{risk_score}}
+```
+
+#### Existing Controls
+{{#each existing_controls}}
+- **{{control_name}}**: {{effectiveness}} effectiveness ({{description}})
+{{/each}}
+
+#### Recommended Mitigations
+{{#each mitigations}}
+{{@index+1}}. **{{control_type}}**: {{description}}
+   - **Implementation Cost:** {{cost}}
+   - **Timeline:** {{timeline}}
+   - **Risk Reduction:** {{risk_reduction}}%
+   - **Responsible Party:** {{owner}}
+{{/each}}
+
+#### Residual Risk
+After implementing recommended mitigations:
+- **Residual Risk Score:** {{residual_risk}}/10
+- **Acceptance Criteria:** {{acceptance_criteria}}
+- **Monitoring Requirements:** {{monitoring_requirements}}
+
+---
+
+{{/each}}
+{{else}}
+### Example Threat: SQL Injection Attack
+
+**Threat ID:** THR-001  
+**Category:** Tampering (STRIDE)  
+**Risk Score:** 8.5/10  
+**Priority:** Critical
+
+#### Threat Description
+Attackers exploit insufficient input validation in web application forms to inject malicious SQL commands, potentially gaining unauthorized access to the database and sensitive customer information.
+
+#### Threat Actors
+- **External Attackers**: Script kiddies to advanced persistent threat groups (Motivation: Data theft, financial gain)
+- **Malicious Insiders**: Employees with database access (Motivation: Financial gain, revenge)
+
+#### Attack Scenarios
+1. **Unauthenticated SQL Injection**
+   - **Prerequisites:** Web application accessible, input validation missing
+   - **Attack Steps:** Submit malicious SQL in form fields, extract database contents
+   - **Success Criteria:** Access to user accounts or sensitive data
+   - **Detection Difficulty:** Medium (depends on logging)
+
+2. **Authenticated SQL Injection** 
+   - **Prerequisites:** Valid user account, application access
+   - **Attack Steps:** Escalate privileges through SQL injection in authenticated features
+   - **Success Criteria:** Administrative access to database
+   - **Detection Difficulty:** High (legitimate user activity)
+
+#### Affected Assets
+- **Customer Database**: Complete data exposure (Impact Level: Critical)
+- **User Authentication**: Account takeover possible (Impact Level: High)
+- **Payment Data**: Financial information at risk (Impact Level: Critical)
+
+#### Risk Assessment
+**Likelihood Assessment:** 4/5
+- Threat Actor Capability: 3/5 (Moderate skill required)
+- Attack Complexity: 2/5 (Automated tools available)
+- Required Access: 1/5 (No special access needed)
+- Detection Probability: 3/5 (May avoid detection)
+
+**Impact Assessment:** 5/5
+- Confidentiality Impact: 5/5 (Complete data exposure)
+- Integrity Impact: 4/5 (Data modification possible)
+- Availability Impact: 3/5 (Database could be corrupted)
+- Business Impact: 5/5 (Regulatory violations, customer loss)
+
+**Risk Calculation:**
+```
+Risk Score = (4 × 5 × 4) / 2 = 40/2 = 8.5/10
+```
+
+#### Existing Controls
+- **Input Validation**: Low effectiveness (Basic client-side only)
+- **Database Permissions**: Medium effectiveness (Some access restrictions)
+- **Web Application Firewall**: Not implemented
+
+#### Recommended Mitigations
+1. **Parameterized Queries**: Implement prepared statements for all database queries
+   - **Implementation Cost:** $15,000
+   - **Timeline:** 4-6 weeks
+   - **Risk Reduction:** 80%
+   - **Responsible Party:** Development Team
+
+2. **Input Validation Framework**: Deploy comprehensive server-side validation
+   - **Implementation Cost:** $25,000
+   - **Timeline:** 6-8 weeks
+   - **Risk Reduction:** 70%
+   - **Responsible Party:** Security Team
+
+3. **Database Activity Monitoring**: Implement real-time SQL injection detection
+   - **Implementation Cost:** $40,000
+   - **Timeline:** 2-3 weeks
+   - **Risk Reduction:** 60%
+   - **Responsible Party:** Operations Team
+
+#### Residual Risk
+After implementing recommended mitigations:
+- **Residual Risk Score:** 2.5/10
+- **Acceptance Criteria:** Acceptable with continuous monitoring
+- **Monitoring Requirements:** Daily review of database access logs
+
+---
+{{/if}}
+
+## Attack Tree Analysis
+
+### High-Priority Attack Trees
+
+{{#if attack_trees}}
+{{#each attack_trees}}
+#### {{goal}}
+
+```
+{{tree_structure}}
+```
+
+**Key Insights:**
+{{#each insights}}
+- {{insight}}
+{{/each}}
+
+**Mitigation Focus Areas:**
+{{#each mitigation_areas}}
+- {{area}}: {{description}}
+{{/each}}
+
+{{/each}}
+{{else}}
+#### Goal: Gain Unauthorized Access to Customer Data
+
+```
+Steal Customer Data
+│
+├─ OR ─ Database Direct Access
+│       │
+│       ├─ AND ─ SQL Injection
+│       │        ├─ Unvalidated Input
+│       │        ├─ Dynamic Query Construction
+│       │        └─ Database Errors Exposed
+│       │
+│       └─ AND ─ Privilege Escalation
+│                ├─ Initial Database Access
+│                ├─ Weak Database Permissions
+│                └─ Inadequate Monitoring
+│
+├─ OR ─ Application Compromise  
+│       │
+│       ├─ AND ─ Authentication Bypass
+│       │        ├─ Weak Password Policy
+│       │        ├─ No Multi-Factor Auth
+│       │        └─ Session Management Flaws
+│       │
+│       └─ AND ─ Authorization Bypass
+│                ├─ Insecure Direct Object Refs
+│                ├─ Missing Function Level Checks
+│                └─ Privilege Escalation Bugs
+│
+└─ OR ─ Infrastructure Attack
+        │
+        ├─ AND ─ Network Intrusion
+        │        ├─ Vulnerable Network Services
+        │        ├─ Weak Network Segmentation
+        │        └─ Insufficient Monitoring
+        │
+        └─ AND ─ System Compromise
+                 ├─ Operating System Vulnerabilities
+                 ├─ Misconfigurations
+                 └─ Backdoor Installation
+```
+
+**Key Insights:**
+- Multiple attack paths exist to achieve the same goal
+- Authentication and input validation are critical control points
+- Network segmentation could limit attack impact
+- Monitoring and detection capabilities need improvement
+
+**Mitigation Focus Areas:**
+- **Input Validation**: Implement comprehensive validation framework
+- **Authentication**: Deploy multi-factor authentication
+- **Network Security**: Enhance segmentation and monitoring
+- **Database Security**: Implement least privilege access controls
+{{/if}}
+
+---
+
+## Risk Prioritization Matrix
+
+### Risk Scoring Methodology
+```
+Risk Score = (Threat Likelihood × Business Impact × Technical Impact) / Control Effectiveness
+
+Where each factor is scored 1-5:
+- Threat Likelihood: Probability of successful attack
+- Business Impact: Consequence to business operations  
+- Technical Impact: Severity of technical compromise
+- Control Effectiveness: Current mitigation strength
+```
+
+### Prioritized Risk Register
+{{#if risk_register}}
+| Rank | Threat | Risk Score | Likelihood | Impact | Controls | Priority |
+|------|--------|------------|------------|--------|----------|----------|
+{{#each risk_register}}
+| {{rank}} | {{threat_name}} | {{risk_score}} | {{likelihood}} | {{impact}} | {{controls}} | {{priority}} |
+{{/each}}
+{{else}}
+| Rank | Threat | Risk Score | Likelihood | Impact | Controls | Priority |
+|------|--------|------------|------------|--------|----------|----------|
+| 1 | SQL Injection | 8.5 | High | Critical | Weak | Critical |
+| 2 | Authentication Bypass | 7.8 | Medium | High | Medium | High |
+| 3 | Data Exfiltration | 7.2 | Medium | Critical | Medium | High |
+| 4 | Privilege Escalation | 6.9 | High | Medium | Medium | High |
+| 5 | Denial of Service | 6.1 | High | Medium | Strong | Medium |
+| 6 | Session Hijacking | 5.8 | Medium | Medium | Weak | Medium |
+| 7 | Cross-Site Scripting | 5.2 | High | Low | Medium | Medium |
+| 8 | Information Disclosure | 4.9 | Medium | Medium | Medium | Low |
+{{/if}}
+
+### Risk Heat Map
+{{#if risk_heatmap}}
+{{risk_heatmap}}
+{{else}}
+```
+Impact →     Low    Medium    High    Critical
+Likelihood ↓
+Very High    |  6   |   7   |   1   |    2    |
+High         |  8   |   5   |   4   |    -    |
+Medium       |  -   |   6   |   3   |    -    |
+Low          |  -   |   -   |   -   |    -    |
+Very Low     |  -   |   -   |   -   |    -    |
+
+Legend: Numbers represent threat IDs from risk register
+```
+{{/if}}
+
+---
+
+## Mitigation Strategy
+
+### Defense-in-Depth Approach
+{{#if defense_strategy}}
+{{defense_strategy}}
+{{else}}
+#### Layer 1: Perimeter Security
+- **Network Firewalls**: Control traffic between network segments
+- **Web Application Firewall**: Filter malicious web traffic
+- **DDoS Protection**: Mitigate distributed denial of service attacks
+- **VPN Gateways**: Secure remote access connections
+
+#### Layer 2: Network Security
+- **Network Segmentation**: Isolate critical systems and data
+- **Intrusion Detection/Prevention**: Monitor for malicious activity
+- **Network Access Control**: Authenticate and authorize device access
+- **Traffic Analysis**: Monitor for anomalous network behavior
+
+#### Layer 3: Host Security
+- **Endpoint Protection**: Anti-malware and behavioral analysis
+- **System Hardening**: Secure configuration management
+- **Patch management**: Timely security update deployment
+- **Host-based Monitoring**: Local security event collection
+
+#### Layer 4: Application Security
+- **Secure Development**: Security built into SDLC processes
+- **Input Validation**: Comprehensive data sanitization
+- **Authentication**: Multi-factor authentication implementation
+- **Authorization**: Role-based access controls
+
+#### Layer 5: Data Security
+- **Encryption**: Data protection in transit and at rest
+- **Data Classification**: Sensitivity-based handling procedures
+- **Data Loss Prevention**: Monitor and prevent data exfiltration
+- **Backup Security**: Secure and tested backup procedures
+{{/if}}
+
+### Recommended Security Controls
+{{#if security_controls}}
+{{#each security_controls}}
+#### {{category}}
+{{#each controls}}
+- **{{name}}**: {{description}}
+  - Priority: {{priority}}
+  - Cost: {{cost}}
+  - Timeline: {{timeline}}
+  - Risk Reduction: {{risk_reduction}}%
+{{/each}}
+{{/each}}
+{{else}}
+#### Critical Priority (0-30 days)
+- **Multi-Factor Authentication**: Deploy MFA for all user accounts
+  - Priority: Critical
+  - Cost: $50,000
+  - Timeline: 2-3 weeks
+  - Risk Reduction: 70%
+
+- **Input Validation Framework**: Implement comprehensive validation
+  - Priority: Critical  
+  - Cost: $75,000
+  - Timeline: 4-6 weeks
+  - Risk Reduction: 80%
+
+#### High Priority (1-3 months)
+- **Network Segmentation**: Isolate critical systems
+  - Priority: High
+  - Cost: $150,000
+  - Timeline: 8-12 weeks
+  - Risk Reduction: 60%
+
+- **Security Monitoring**: Deploy SIEM and SOC capabilities
+  - Priority: High
+  - Cost: $200,000
+  - Timeline: 10-14 weeks
+  - Risk Reduction: 50%
+
+#### Medium Priority (3-6 months)
+- **Endpoint Protection**: Advanced threat protection
+  - Priority: Medium
+  - Cost: $100,000
+  - Timeline: 6-8 weeks
+  - Risk Reduction: 40%
+
+- **Security Training**: Comprehensive awareness program
+  - Priority: Medium
+  - Cost: $25,000
+  - Timeline: 3-4 weeks
+  - Risk Reduction: 30%
+{{/if}}
+
+---
+
+## Implementation Roadmap
+
+### Phase 1: Critical Risk Mitigation (0-3 months)
+{{#if phase1_plan}}
+{{phase1_plan}}
+{{else}}
+**Objectives:** Address critical and high-risk threats that could result in significant business impact.
+
+**Key Activities:**
+- Deploy multi-factor authentication across all systems
+- Implement comprehensive input validation framework
+- Establish security monitoring and incident response capabilities
+- Conduct emergency security awareness training
+- Perform immediate vulnerability remediation
+
+**Success Metrics:**
+- 90% reduction in critical risk threats
+- MFA deployment to 100% of users
+- 24/7 security monitoring operational
+- Zero tolerance for critical vulnerabilities
+
+**Budget:** $400,000
+**Timeline:** 12 weeks
+**Responsible:** Security Team, Development Team
+{{/if}}
+
+### Phase 2: Comprehensive Security Enhancement (3-6 months)
+{{#if phase2_plan}}
+{{phase2_plan}}
+{{else}}
+**Objectives:** Implement defense-in-depth strategy and strengthen overall security posture.
+
+**Key Activities:**
+- Deploy network segmentation and micro-segmentation
+- Implement advanced threat protection and endpoint security
+- Establish security operations center (SOC)
+- Conduct comprehensive penetration testing
+- Develop incident response and business continuity plans
+
+**Success Metrics:**
+- 70% reduction in high-risk threats
+- Network segmentation 95% complete
+- Mean time to detect (MTTD) < 1 hour
+- Mean time to respond (MTTR) < 4 hours
+
+**Budget:** $600,000
+**Timeline:** 12 weeks
+**Responsible:** Security Team, Infrastructure Team
+{{/if}}
+
+### Phase 3: Security Maturity and Optimization (6-12 months)
+{{#if phase3_plan}}
+{{phase3_plan}}
+{{else}}
+**Objectives:** Achieve security maturity and establish continuous improvement processes.
+
+**Key Activities:**
+- Implement advanced threat intelligence and analytics
+- Deploy automated security testing and DevSecOps
+- Establish security metrics and KPI tracking
+- Conduct regular security assessments and audits
+- Develop security community of practice
+
+**Success Metrics:**
+- 50% reduction in medium-risk threats
+- 99.9% security tool availability
+- Zero security incidents with major business impact
+- Security maturity level 4 (Optimized)
+
+**Budget:** $300,000
+**Timeline:** 24 weeks
+**Responsible:** All Teams
+{{/if}}
+
+---
+
+## Monitoring and Measurement
+
+### Key Risk Indicators (KRIs)
+{{#if risk_indicators}}
+{{#each risk_indicators}}
+- **{{name}}**: {{description}}
+  - Threshold: {{threshold}}
+  - Measurement: {{measurement}}
+  - Reporting: {{frequency}}
+{{/each}}
+{{else}}
+- **Critical Vulnerability Count**: Number of unpatched critical vulnerabilities
+  - Threshold: 0 vulnerabilities > 7 days old
+  - Measurement: Weekly vulnerability scans
+  - Reporting: Weekly executive dashboard
+
+- **Failed Authentication Attempts**: Anomalous login attempt patterns
+  - Threshold: >50 failed attempts per user per hour
+  - Measurement: Real-time authentication logs
+  - Reporting: Immediate alerting
+
+- **Privileged Access Usage**: Administrative account activity monitoring
+  - Threshold: >5 simultaneous admin sessions
+  - Measurement: Continuous privileged access monitoring
+  - Reporting: Daily review and monthly reporting
+{{/if}}
+
+### Security Metrics Dashboard
+{{#if security_metrics}}
+{{security_metrics}}
+{{else}}
+**Risk Posture Metrics:**
+- Overall Risk Score: [Current score vs target]
+- Critical Threats Remaining: [Count and trend]
+- Control Implementation Progress: [Percentage complete]
+- Residual Risk Acceptance: [Approved vs total]
+
+**Operational Security Metrics:**
+- Security Incident Count: [Monthly incidents by severity]
+- Mean Time to Detect: [Average detection time]
+- Mean Time to Respond: [Average response time]
+- Control Effectiveness: [Pass/fail rates for security controls]
+
+**Business Impact Metrics:**
+- Security Investment ROI: [Risk reduction per dollar spent]
+- Compliance Status: [Percentage of requirements met]
+- Security Awareness: [Training completion and phishing click rates]
+- Customer Trust Index: [Security-related satisfaction scores]
+{{/if}}
+
+---
+
+## Conclusion and Next Steps
+
+### Assessment Summary
+{{#if assessment_conclusion}}
+{{assessment_conclusion}}
+{{else}}
+This comprehensive threat assessment of {{system_name}} identified significant security risks that require immediate attention. While the system provides critical business functionality, the current security posture presents unacceptable risks to the organization.
+
+**Key Findings:**
+- {{total_critical_threats}} critical threats require immediate remediation
+- Current security controls are insufficient for the system's risk profile
+- Implementation of recommended mitigations will reduce overall risk by 75%
+- Estimated investment of $1.3M over 12 months to achieve target security posture
+{{/if}}
+
+### Immediate Actions Required
+{{#if immediate_next_steps}}
+{{#each immediate_next_steps}}
+{{@index+1}}. **{{action}}** (Due: {{due_date}}, Owner: {{owner}})
+{{/each}}
+{{else}}
+1. **Executive Approval** (Due: Within 48 hours, Owner: {{business_owner}})
+   - Approve security investment and implementation roadmap
+   - Assign dedicated resources for critical risk mitigation
+
+2. **Critical Vulnerability Remediation** (Due: Within 7 days, Owner: Development Team)
+   - Address all critical findings identified in this assessment
+   - Implement temporary compensating controls where necessary
+
+3. **Incident Response Activation** (Due: Immediate, Owner: Security Team)
+   - Activate enhanced monitoring for identified threat scenarios
+   - Prepare incident response team for potential security events
+{{/if}}
+
+### Long-term Strategic Recommendations
+{{#if strategic_next_steps}}
+{{strategic_next_steps}}
+{{else}}
+1. **Security Program Maturity**: Establish comprehensive information security program
+2. **Regular Assessments**: Conduct quarterly threat modeling and annual penetration testing
+3. **Security Culture**: Develop security-conscious organizational culture
+4. **Threat Intelligence**: Implement proactive threat intelligence program
+5. **Continuous Improvement**: Establish security metrics and continuous improvement processes
+{{/if}}
+
+### Review and Update Schedule
+{{#if review_schedule}}
+{{review_schedule}}
+{{else}}
+- **Quarterly Reviews**: Update threat landscape and risk assessments
+- **Annual Assessment**: Complete threat model refresh and validation
+- **Triggered Reviews**: Major system changes, security incidents, or regulatory updates
+- **Next Scheduled Review**: {{next_review_date}}
+{{/if}}
+
+---
+
+**Report prepared by:** {{threat_analyst}}  
+**Technical reviewers:** {{#if technical_reviewers}}{{technical_reviewers}}{{else}}[Senior security architects]{{/if}}  
+**Business approval:** {{business_owner}}  
+**Document classification:** CONFIDENTIAL  
+**Retention period:** 3 years from assessment date  
+
+*This threat assessment contains sensitive security information and should be handled according to organizational data classification policies.*