Deriving Zero Trust–Oriented Security Scenarios from Architectural Requirements

Zero Trust (ZT) has emerged as a prominent security paradigm for modern software systems. However, systematic support for deriving ZT-oriented architectural artifacts from high-level security requirements remains limited. This paper proposes a systematic method for deriving ZT–oriented security quality attribute scenarios (SQAs) from security architecturally significant requirements (ASRs). The method consists of three main steps: identify security quality attributes (QAs), decompose each QA into ZT principle–driven softgoal trees, and map ZT-oriented softgoals to SQAs. We applied the method in an academic case study, deriving ZT-oriented scenarios traceable to security ASRs and ZT principles. The results indicate that the method supports systematic, requirements-driven reasoning about ZT-compliant architectural decisions.