There is tool from Microsoft which is used also internally. It has predefined questions for actions over boundaries.

https://www.microsoft.com/en-us/securityengineering/sdl/thre...