diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
index 28a4937b..28efbe46 100644
--- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
@@ -52,7 +52,7 @@
           }
         },
         "scope": {
-          "$ref": "#/$defs/scope"
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope"
         },
         "assets": {
           "type": "array",
@@ -342,62 +342,6 @@
         }
       }
     },
-    "scope": {
-      "type": "object",
-      "title": "Scope",
-      "description": "Specifies what is included and excluded from the blueprint model, establishing the boundaries within which the modelling and analysis is performed.",
-      "required": [
-        "name"
-      ],
-      "additionalProperties": false,
-      "properties": {
-        "bom-ref": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
-        },
-        "name": {
-          "type": "string",
-          "title": "Name",
-          "minLength": 1,
-          "description": "Name of the scope."
-        },
-        "description": {
-          "type": "string",
-          "title": "Description",
-          "description": "Description of what is included and excluded from the model."
-        },
-        "boundaries": {
-          "type": "array",
-          "title": "Boundaries",
-          "uniqueItems": true,
-          "items": {
-            "type": "string",
-            "minLength": 1
-          },
-          "description": "Explicit boundaries of the model."
-        },
-        "includedComponents": {
-          "type": "array",
-          "title": "Included Components",
-          "uniqueItems": true,
-          "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-          },
-          "description": "References using bom-link or bom-ref to components explicitly included."
-        },
-        "excludedComponents": {
-          "type": "array",
-          "title": "Excluded Components",
-          "uniqueItems": true,
-          "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-          },
-          "description": "References using bom-link or bom-ref to components explicitly excluded."
-        },
-        "properties": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
-        }
-      }
-    },
     "asset": {
       "type": "object",
       "title": "Asset",
diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json
index 88658a6a..305a4ad0 100644
--- a/schema/2.0/model/cyclonedx-common-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json
@@ -16,6 +16,62 @@
       "allOf": [{ "$ref": "#/$defs/refType" }],
       "$comment": "value-range is same as 'refType'"
     },
+    "modelScope": {
+      "type": "object",
+      "title": "Model Scope",
+      "description": "Specifies what is included and excluded from a model or analysis, establishing the boundaries within which it is performed.",
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "title": "Name",
+          "minLength": 1,
+          "description": "Name of the scope."
+        },
+        "description": {
+          "type": "string",
+          "title": "Description",
+          "description": "Description of what is included and excluded from the model."
+        },
+        "boundaries": {
+          "type": "array",
+          "title": "Boundaries",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "description": "Explicit boundaries of the model."
+        },
+        "includedComponents": {
+          "type": "array",
+          "title": "Included Components",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/refLinkType"
+          },
+          "description": "References using bom-link or bom-ref to components explicitly included."
+        },
+        "excludedComponents": {
+          "type": "array",
+          "title": "Excluded Components",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/refLinkType"
+          },
+          "description": "References using bom-link or bom-ref to components explicitly excluded."
+        },
+        "properties": {
+          "$ref": "#/$defs/properties"
+        }
+      }
+    },
     "bomLinkDocumentType": {
       "title": "BOM-Link Document",
       "description": "Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/",
diff --git a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json
index 5da76761..706b21b1 100644
--- a/schema/2.0/model/cyclonedx-metadata-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-metadata-2.0.schema.json
@@ -47,6 +47,14 @@
           "description": "The component that the BOM describes.",
           "$ref": "cyclonedx-component-2.0.schema.json#/$defs/component"
         },
+        "scope": {
+          "description": "The scope of the analysis represented by this BOM, including what is in and out of scope.",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope"
+        },
+        "modelLifecycle": {
+          "description": "Lifecycle metadata for the model represented by this BOM.",
+          "$ref": "#/$defs/modelLifecycle"
+        },
         "supplier": {
           "title": "Supplier",
           "description": " The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.",
@@ -65,6 +73,47 @@
         }
       }
     },
+    "modelLifecycle": {
+      "type": "object",
+      "title": "Model Lifecycle",
+      "description": "Version, release, review, and freeze information for the model represented by this BOM.",
+      "additionalProperties": false,
+      "properties": {
+        "version": {
+          "type": "string",
+          "pattern": "^\\d+(\\.\\d+)*$",
+          "description": "The structured version of the model."
+        },
+        "frozen": {
+          "type": "boolean",
+          "description": "Whether the model is frozen and must be versioned before modification."
+        },
+        "releasedAt": {
+          "$ref": "#/$defs/dateOrDateTime",
+          "description": "When the model was released."
+        },
+        "productReleaseDate": {
+          "$ref": "#/$defs/dateOrDateTime",
+          "description": "When the product release modeled by this BOM was released."
+        },
+        "reviewedAt": {
+          "$ref": "#/$defs/dateOrDateTime",
+          "description": "When the model was last reviewed."
+        }
+      }
+    },
+    "dateOrDateTime": {
+      "oneOf": [
+        {
+          "type": "string",
+          "format": "date"
+        },
+        {
+          "type": "string",
+          "format": "date-time"
+        }
+      ]
+    },
     "distributionConstraints": {
       "title": "Distribution Constraints",
       "description": "Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.",
diff --git a/schema/2.0/model/cyclonedx-risk-2.0.schema.json b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
index b32be1e6..58e63619 100644
--- a/schema/2.0/model/cyclonedx-risk-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-risk-2.0.schema.json
@@ -38,11 +38,130 @@
           },
           "description": "The risk appetites that apply to this collection. Multiple entries support a document covering more than one party."
         },
+        "qualitativeMatrices": {
+          "type": "array",
+          "title": "Qualitative Matrices",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/qualitativeMatrix"
+          },
+          "description": "Named qualitative risk matrices available to ratings in this collection."
+        },
         "properties": {
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
       }
     },
+    "qualitativeMatrix": {
+      "type": "object",
+      "title": "Qualitative Matrix",
+      "description": "A named risk matrix that defines likelihood and impact scales and the resulting score and level for each combination.",
+      "required": [
+        "bom-ref",
+        "name",
+        "likelihoodLevels",
+        "impactLevels",
+        "outcomes"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "bom-ref": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The name of the matrix."
+        },
+        "description": {
+          "type": "string",
+          "description": "A description of the matrix and its intended use."
+        },
+        "likelihoodLevels": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/qualitativeMatrixAxisLevel"
+          },
+          "description": "The ordered likelihood levels used by the matrix."
+        },
+        "impactLevels": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/qualitativeMatrixAxisLevel"
+          },
+          "description": "The ordered impact levels used by the matrix."
+        },
+        "outcomes": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/qualitativeMatrixOutcome"
+          },
+          "description": "The score and named result for each likelihood and impact combination."
+        }
+      }
+    },
+    "qualitativeMatrixAxisLevel": {
+      "type": "object",
+      "required": [
+        "name",
+        "value"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The stable name of this level."
+        },
+        "value": {
+          "type": "number",
+          "minimum": 0,
+          "description": "The ordinal or numeric value of this level."
+        },
+        "description": {
+          "type": "string",
+          "description": "The meaning of this level."
+        }
+      }
+    },
+    "qualitativeMatrixOutcome": {
+      "type": "object",
+      "required": [
+        "likelihood",
+        "impact",
+        "score",
+        "level"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "likelihood": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The name of a level from the matrix likelihood scale."
+        },
+        "impact": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The name of a level from the matrix impact scale."
+        },
+        "score": {
+          "type": "number",
+          "minimum": 0,
+          "description": "The numeric score assigned by this combination."
+        },
+        "level": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The matrix-specific qualitative result."
+        }
+      }
+    },
     "riskDomain": {
       "type": "object",
       "required": [
@@ -895,6 +1014,15 @@
           "type": "string",
           "description": "A textual representation of the metric values used to derive the score, in the format defined by the methodology."
         },
+        "qualitativeMatrix": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
+          "description": "Reference to the qualitative matrix used to derive this score."
+        },
+        "matrixLevel": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The matrix-specific qualitative result, such as very-low or very-high."
+        },
         "methodology": {
           "title": "Methodology",
           "description": "The risk rating methodology used to derive this score. Only methodologies that define a scoring calculation are listed; governance frameworks such as [ISO 31000](https://www.iso.org/iso-31000-risk-management.html) are recorded as standards rather than as a score methodology. Use the custom option for methodologies not listed.",
diff --git a/schema/2.0/model/cyclonedx-threat-2.0.schema.json b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
index edc8748c..e4641b91 100644
--- a/schema/2.0/model/cyclonedx-threat-2.0.schema.json
+++ b/schema/2.0/model/cyclonedx-threat-2.0.schema.json
@@ -166,6 +166,11 @@
           "title": "Description",
           "description": "A description of the threat."
         },
+        "event": {
+          "type": "string",
+          "title": "Event",
+          "description": "The event that realizes or triggers the threat."
+        },
         "source": {
           "type": "string",
           "title": "Source",
@@ -514,6 +519,23 @@
             "persistent": "The actor pursues the target persistently over time."
           }
         },
+        "maliciousIntent": {
+          "type": "boolean",
+          "title": "Malicious Intent",
+          "description": "Whether the actor intends to cause harm in this scenario."
+        },
+        "applicability": {
+          "type": "string",
+          "title": "Applicability",
+          "description": "The applicability of this scenario to the organization.",
+          "enum": [
+            "minimal",
+            "low",
+            "moderate",
+            "high",
+            "maximal"
+          ]
+        },
         "accessLevel": {
           "type": "string",
           "title": "Access Level",
diff --git a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json
index 01bb1fb2..5bc3d29e 100644
--- a/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json
+++ b/tools/src/test/resources/2.0/valid-risk-ai-bias-2.0.json
@@ -4,6 +4,30 @@
   "serialNumber": "urn:uuid:7c9e6679-7425-40de-944b-e07fc1f90ae7",
   "version": 1,
   "risks": {
+    "qualitativeMatrices": [
+      {
+        "bom-ref": "matrix-owasp-tml-5x5",
+        "name": "OWASP Threat Model Library 5x5",
+        "description": "The qualitative matrix used by the OWASP Threat Model Library.",
+        "likelihoodLevels": [
+          { "name": "rare", "value": 1 },
+          { "name": "unlikely", "value": 2 },
+          { "name": "possible", "value": 3 },
+          { "name": "likely", "value": 4 },
+          { "name": "certain", "value": 5 }
+        ],
+        "impactLevels": [
+          { "name": "negligible", "value": 1 },
+          { "name": "minor", "value": 2 },
+          { "name": "moderate", "value": 3 },
+          { "name": "major", "value": 4 },
+          { "name": "severe", "value": 5 }
+        ],
+        "outcomes": [
+          { "likelihood": "likely", "impact": "major", "score": 16, "level": "very-high" }
+        ]
+      }
+    ],
     "risks": [
       {
         "bom-ref": "risk-model-bias",
@@ -48,7 +72,7 @@
             },
             "description": "Potential regulatory action and harm to affected applicants."
           },
-          "score": { "level": "high", "score": 8, "methodology": "owasp-risk-rating" },
+          "score": { "level": "high", "score": 16, "methodology": "qualitative-matrix", "qualitativeMatrix": "matrix-owasp-tml-5x5", "matrixLevel": "very-high" },
           "detectability": { "score": 6, "description": "Bias surfaces only in aggregate metrics, so individual decisions are hard to flag." },
           "confidence": 0.6,
           "rationale": "Based on offline fairness metrics."
diff --git a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
index d8d14f03..2a55ba86 100644
--- a/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
+++ b/tools/src/test/resources/2.0/valid-threatmodel-simple-2.0.json
@@ -3,6 +3,34 @@
   "specVersion": "2.0",
   "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
   "version": 1,
+  "metadata": {
+    "component": {
+      "type": "application",
+      "name": "Operator console",
+      "version": "1.0"
+    },
+    "scope": {
+      "name": "Operator console and customer data store",
+      "description": "The operator console, its authentication controls, and the customer data store are in scope. Corporate identity-provider infrastructure is out of scope."
+    },
+    "modelLifecycle": {
+      "version": "1.0",
+      "frozen": false,
+      "releasedAt": "2026-08-20",
+      "productReleaseDate": "2026-08-15",
+      "reviewedAt": "2026-08-19"
+    }
+  },
+  "externalReferences": [
+    {
+      "type": "documentation",
+      "url": "https://example.com/operator-console/release-notes"
+    },
+    {
+      "type": "vcs",
+      "url": "https://example.com/operator-console/source"
+    }
+  ],
   "profiles": {
     "threatProfiles": [
       {
@@ -24,6 +52,7 @@
         "bom-ref": "threat-credential-theft",
         "name": "Credential theft",
         "description": "An adversary steals operator credentials to reach protected data.",
+        "event": "An actor obtains and uses an operator credential.",
         "source": "Internal threat-modelling workshop",
         "categories": [
           {
@@ -81,6 +110,8 @@
           "espionage"
         ],
         "intent": "targeted",
+        "maliciousIntent": true,
+        "applicability": "high",
         "accessLevel": "external",
         "attackVector": {
           "type": "network",