Skip to content
WorkspaceTemplates
The first pages of the Threat Model template

Threat Model

Document template for Google Docs and Word

Make a copy in Google Docs
Type
Document
Price
Free
Pages
8 · US Letter
Style
Corporate
Difficulty
Beginner
Updated
October 30, 2026

Every page (8)

Overview

A threat model without a data flow diagram floats free of the system, and a list of scanner findings says little about business impact. This template anchors the review in the architecture: the system and its layers, the data flows that cross trust boundaries, STRIDE threats ranked by likelihood and impact, mitigations with owners and dates, and residual risk with a named approver.

The sample reviews the customer billing portal of Lowmoor Digital, a fictional software company: 4 data flows, 3 trust boundaries, 5 ranked threats and 5 accepted residual risks. Replace the diagram with your components first, then the threats for each boundary, the severity ratings and the owners and due dates.

Useful for

  • An application security engineer reviewing a new service before it is approved for release
  • An engineering lead tracking mitigations, owners and due dates for open security findings
  • A CISO recording which residual risks were accepted, by whom, and when they are reviewed

What's included

  • Cover and a layered system diagram with a request flow and the data stores it touches
  • Data flow page with flows across boundaries, protections and an example request
  • Scope page comparing what is in and out, with definitions and an exclusions callout
  • Likelihood and impact heat map with a STRIDE threat register, owners and responses
  • Mitigation status page with scorecard, top risks and a dated checklist
  • Residual risk register with approvers and review dates, plus a make-it-yours page

How to use it

  1. 1

    Click Make a copy in Google Docs, then confirm on the Google page. The copy is saved to your own Google Drive.

  2. 2

    Redraw the system and data flow pages with your components, data stores and trust boundaries.

  3. 3

    Replace the threats with those you identified using STRIDE on each boundary, and re-rate each finding on your own severity scale with evidence.

  4. 4

    Assign an owner and an SLA date to every high and critical finding, and fill in the residual risk page with the approver and risks formally accepted.

  5. 5

    Delete the Make it yours page, then share the model with your review board or present it.

What you need

Requirements

  • A Google account with access to Google Drive

Works with

  • Google Docs
  • Microsoft Word (download the .docx)

Questions

Why use STRIDE?

STRIDE gives you six threat types to check against each data flow: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. It keeps a review systematic rather than ad hoc.

How often should a threat model be refreshed?

Whenever the architecture changes, and at least once a year. A model that describes last year's system hides risk. Update the diagram first, then the threats it affects.

Is the Lowmoor Digital system real?

No. Lowmoor Digital, the billing portal, the people named and every figure are fictional sample data. Replace them with your own system and findings before you share the model.

  • #threat-model
  • #stride
  • #security-review
  • #application-security
  • #data-flow-diagram
  • #risk-register
  • #google-docs

Related templates

More Google Docs templatesMore developer workflows templates

More security review templates

See all 3

Also in Developer workflows

All developer workflows templates
Get this template

    What you get

      Use this templateSee full details

      Preparing your template…