I'm working on a threat modeling/architectural risk analysis (ARA) methodology for the organization I work for. Our business consists of one major product (developed by ~500 developers over a decade). The product contains hundreds of features, most of which are far from the attack surface and work with data of little consequence.

In order to optimize our ARA I wish to implement a feature risk rating method which will allow software architects (which are not security-savvy) to easily assess the impact of the feature they are producing. Based on their score they will either do a lightweight version of ARA, a more detailed version or even consult with the security team (if it is a high impact feature).

Can you recommend any such methodology? The only thing that comes to my mind is a questionnaire where the architect will fill information about the assets with which his/her feature interacts (based on our asset inventory) and, based on the asset impact and a simple formula, the architect calculates the feature impact.

Do you guys have any better ideas?