The TLCTC framework defines a generic risk management methodology — a Bow-Tie structure with cause-based classification, Data Risk Events, and NIST CSF function verbs — that is not limited to adversarial threats.
Cyber Risk Event
TLCTC Threat Clusters #1–#10. Attacker intent drives the causal chain exploiting generic vulnerabilities.
IT Risk Event
Software Failure (INT + 3PC). No attacker—the inherent imperfection of software is the cause.
The Bow-Tie — Software Failure
Internal Software Failure
- • Code defects & logic errors
- • Misconfigurations
- • Resource leaks
Third-Party Software Failure
- • COTS product defects
- • SaaS provider outage
- • Library / OSS regressions
- → Revenue loss
- → SLA breach penalties
- → Trust erosion
NIST CSF Mapping
Verbs describing what controls do. Click a function to analyze the control architecture (examples only).
Adversarial · TLCTC #10
Supply Chain Attack
An adversary intentionally compromises a trusted third-party component. The generic vulnerability is the organizational dependency on that trust.
Non-Adversarial · SW Failure
Third-Party Software Failure
No adversary. The trusted component fails due to its own latent defects. The structural problem is identical: you accepted code you cannot fix.
The Generic Risk Management Method
The TLCTC framework establishes a generic risk management methodology whose structural components — the Bow-Tie model, cause-based classification, and Data Risk Events — are domain-independent.
When applying this method to "Software Failure", the sub-type differentiation (INT vs. 3PC) becomes the critical innovation. A single control objective demands structurally different strategies depending on whether you own the code or accepted it through trust.