Map Threats to Mitigation Controls

Defines a control taxonomy of three types - preventive (stops attacks before they occur, such as firewalls or input validation), detective (identifies attacks in progress, such as IDS or log monitoring), and corrective (responds and recovers, such as incident response or backup restore) - across five layers (network, application, data, endpoint, process, plus a physical layer in the data model), and frames defense-in-depth as nested perimeter, network, host, application, and data rings each covered by a different control set. Ships a Python data model: a SecurityControl dataclass with ControlType, ControlLayer, ImplementationStatus, and Effectiveness enums, a coverage_score method weighting effectiveness by implementation status, a Threat dataclass carrying a STRIDE category and risk score, and a MitigationMapping linking a threat to its controls with calculate_coverage, has_defense_in_depth checking whether at least two layers are covered, and has_control_diversity checking whether at least two control types are present, plus a MitigationPlan aggregating threats. Ships a control library template, a mitigation-analysis report template (Executive Summary, Defense in Depth Coverage, Critical Gaps Requiring Immediate Action, Recommendations, Implementation Roadmap), and a control-effectiveness testing report template (Summary, Results by Control) for verifying that implemented controls actually work as intended rather than assuming coverage from a checklist.

Use it when mapping identified threats to concrete mitigating controls, assessing defense-in-depth coverage, scoring control effectiveness, or producing a threat-mitigation report. Skip it for anything unrelated to threat mitigation mapping or outside this scope.

Input is a set of identified threats, typically STRIDE-categorized, and the organization's control inventory; output is a MitigationMapping per threat with a coverage score and defense-in-depth and control-diversity flags, rolled up into an executive-level gap report with prioritized recommendations and an implementation roadmap, plus a control-effectiveness test report.

A standalone Python data model built on dataclasses and enums with no external dependency; designed to consume threat data from a separate threat-modeling process such as STRIDE analysis, and control inventories maintained elsewhere.

Security teams mapping identified threats to the controls meant to mitigate them who need a structured coverage-scoring model and report templates rather than an informal spreadsheet of threats and countermeasures. has_defense_in_depth and has_control_diversity flag a threat covered by only one control in one layer. It also covers prioritizing security investment, building a remediation roadmap from the coverage-scoring output, and validating overall control coverage during a security architecture review.