PASTA Stage 7: Risk & Impact Analysis

Produce business-weighted risk scores by combining Stage 6 exploitability with Stage 1 business impact. Deliver a prioritized remediation roadmap balancing risk reduction against effort. This is the final PASTA stage.

Supported Flags

Read ../../shared/schemas/flags.md for the full flag specification. Key behaviors:

Flag Stage 7 Behavior

--scope

Inherits from prior stages. Synthesizes all prior outputs.

--depth quick

Top 5 risk-ranked findings with one-line mitigations only.

--depth standard

Full risk scoring, mitigation roadmap, and compliance mapping.

--depth deep

Standard + residual risk assessment, systemic issues, cost-benefit per mitigation.

--depth expert

Deep + executive summary, quantified risk, formal compliance gap report.

--severity

Filter final output to findings at or above the threshold.

--format md

Standalone markdown report for stakeholder distribution.

--fix

Chain into fix mode for highest-priority findings.

Framework Context

Read ../../shared/frameworks/pasta.md , Stage 7 section. PASTA is SEQUENTIAL. Stage 7 consumes all prior stage outputs to produce the final deliverable.

Prerequisites

Required: Stage 6 output -- attack scenarios, DREAD scores, detection gaps. Also needs: business assets and compliance (Stage 1), entry points (Stage 2), components (Stage 3), threats (Stage 4), vulnerabilities (Stage 5). If unavailable, warn and assume.

Workflow

Step 1: Calculate Business-Weighted Risk

Risk Score = Exploitability (DREAD, 1-10) x Business Impact (1-10).

Impact Level Score Criteria

Critical 9-10 Regulatory breach, massive financial loss, existential threat

High 7-8 Significant data breach, major outage, legal liability

Medium 4-6 Limited exposure, partial degradation, reputational harm

Low 1-3 Minor disclosure, negligible business effect

Step 2: Rank Findings

Order by composite risk score (descending). Break ties by: compliance implications, attack complexity (simpler ranks higher), detection coverage (undetectable ranks higher).

Step 3: Propose Mitigations

Effort Definition Timeline

Quick win Single file change, config update, dependency bump Same day

Short-term Targeted code changes, new middleware or control 1-2 sprints

Long-term Architectural change, new service, framework migration Quarterly

Prioritize by risk-reduction-per-effort. Identify mitigations resolving multiple findings.

Step 4: Map to Compliance

Cross-reference with Stage 1 compliance requirements: which findings violate regulatory controls, which would be flagged in audit, mandated timelines, documentation needed.

Step 5: Assess Residual Risk

After proposed mitigations: what risk remains, what needs formal acceptance, what compensating controls exist, what monitoring is needed.

Step 6: Executive Summary

Non-technical summary: overall posture, top 3 immediate actions, phased effort estimate, compliance status and regulatory exposure.

Analysis Checklist

• Which findings, if exploited, would cause the greatest business harm?

• Which mitigations give the highest risk reduction for lowest effort?

• Are there findings violating regulatory requirements needing immediate remediation?

• What residual risk remains after all proposed mitigations?

• Are there systemic issues that, if fixed, resolve multiple findings?

• What is the total estimated effort for all recommended mitigations?

• Should any findings be formally accepted rather than fixed?

• What ongoing monitoring is needed after remediation?

Output Format

Stage 7 produces the Final PASTA Report. ID prefix: PASTA (e.g., PASTA-001 ).

PASTA Stage 7: Risk & Impact Analysis

Executive Summary

Risk Posture: [Critical / High / Moderate / Low] [2-3 sentence summary] Immediate Actions: [N] | Total Findings: [N] (X critical, Y high, Z medium) Effort: [quick wins: N, short-term: N, long-term: N]

Risk-Ranked Findings

Remediation Roadmap

Quick Wins (Immediate)

Short-Term (1-2 Sprints)

Long-Term (Quarterly)

Compliance Gaps

Residual Risk

Findings follow ../../shared/schemas/findings.md with:

• dread : DREAD scoring from Stage 6

• references.cwe : from Stage 5, references.owasp : OWASP mapping, references.mitre_attck : from Stage 4

• metadata.tool : "pasta-risk" , metadata.framework : "pasta" , metadata.category : "Stage-7"

Completion

This is the final PASTA stage. The output is the complete threat model deliverable: actionable, prioritized, and tied to business value. Track remediation progress and schedule periodic reassessment as the application evolves.