|
5.
|
Threat scenarios: at least three end-to-end threat scenarios for the threat profiles identified in accordance with point 4 who exhibit the highest threat severity scores. The threat scenarios shall describe the end-to-end attack path and shall include, at least:
|
(a)
|
one scenario that includes but is not limited to compromised service availability;
|
|
(b)
|
one scenario that includes but is not limited to compromised data integrity;
|
|
(c)
|
one scenario that includes but is not limited to compromised information confidentiality.
|
|