All applications/systems/platforms/services that process, store or transmit Red Hat Restricted (+PII) data must perform Threat Modeling for every significant release and document the following:

Identify Potential Threats as per STRIDE Threat Classification

Indicate which Threats are already mitigated and how/when remaining Threats (if, any) would be mitigated

https://source.redhat.com/departments/it/it-information-security/wiki/threat_modeling

Shipwright Threat Model