How security services relate across the SABSA layers, from business context to procured product — a relationship-first model that ties services to drivers, risk and outcomes so the catalogue flexes with change instead of calcifying into a static diagram.
Interactive Security Services Domain Model
Choose a SABSA layer or select any concept to reveal its definition and relationships.
Use the layer filters to focus the model. Select a concept to spotlight its connections; select it again, click the background, or press Escape to reset.
Understanding The Model
A traceability chain, not a static catalogue: forward from business context to product for design, reverse from product to business context for assurance.
The Security Services Domain Model runs the five SABSA layers — contextual, conceptual, logical, physical, component — end to end. Business drivers are profiled into a Business Attribute Profile, the normalising lens that scopes domains and sub-domains. Domain policy translates compliance obligations and risk appetite into control objectives. Security services realise those objectives, decomposed into logical mechanisms and sub-mechanisms, which are in turn realised by physical systems and mechanisms, delivered by procured or built products. A sixth, cross-cutting set of concepts — obligations, threats, risk, business outcomes and measures — keeps the whole chain tied to why it exists, not just what it contains.
How To Use It
Start with the Business Driver and the Business Attribute Profile — the normalising lens everything downstream is traced back to.
Follow how compliance obligations and risk appetite shape domain policy, and how domain policy sets control objectives.
Trace how security services realise those objectives, and how logical mechanisms and sub-mechanisms define the workflows that implement them.
See how physical systems and mechanisms execute those workflows, and how products at the component layer deliver the physical estate.
Explore the drivers, risk and value layer — threats, risk, business outcomes and measures — that keeps the model relationship-first rather than a static catalogue.
Open the worked examples to see the same stack made concrete for identity and access management, payment services, AI governance, and firewall and network security.
How compliance obligations and threats drive risk, and how services prove business outcomes through measures.
Explore Each Layer
Each layer has its own guide covering who is involved, what it means, when it applies, where it sits, and why it matters — cross-referenced to equivalent concepts in TOGAF, ArchiMate, ITIL, COBIT and NIST where they exist.
Contextual Layer
Business drivers, the Business Attribute Profile, domains and sub-domains that scope everything downstream.
The same SABSA stack, made concrete. Each example instantiates every concept in the base model — compare it side by side to see how the abstract becomes specific.
Identity & Access Management
Securing workforce and privileged access: MFA, least privilege, and the identity provider stack behind them.
Tracing monitoring, encrypted-traffic inspection and segmentation into gateway, management and event systems — with the detailed A0 architecture available to download.
The interactive model above is the evolution of the original Security Services Ontology / ERD (SRM v1) and the COSAC 2025 workshop deck that introduced it, Moving Towards a Functional Security Services Catalogue (SSCW v2). The concepts are the same SABSA-aligned chain — domain, policy, control objective, service, mechanism, physical system, product — but the interactive model makes the relationships the primary artefact instead of a static class diagram, and adds the drivers, risk and value layer that keeps the catalogue tied to business outcomes as they change.
The original ERD and workshop materials remain available below for teams still working from them, or who prefer the class-diagram format for formal documentation.
Supporting Downloads
Static editions of the interactive model are available for reading, workshops, presentations, and adaptation.
