| Security through life | Security architecture concentrates on requirements, threat modelling and design assurance before go-live. | Accountability continues from Strategy to Retirement, including posture, detection, vulnerability, recovery, optimisation and secure decommissioning. |
| Live-service ownership | The project hands residual risk and controls to the SOC, GRC, service management or platform teams. | The OSA owns the architectural integrity of live protection and connects operational evidence back to ESA and SSA. |
| Role model | Enterprise security, project security and security operations are separate functions with hand-off gaps. | ESA → SSA → OSA is one protection value chain: enterprise intent becomes implemented controls whose health is continuously evidenced. |
| Assurance | A design review, risk acceptance or compliance gate provides point-in-time approval. | Continuous assurance asks whether controls were implemented, remain effective and still address the changing threat and business context. |
| Measurement | Reporting counts assessments, findings, policies, exceptions and review completion. | ODMs measure protection outcomes such as early defect capture, rework, traceability, pattern conformance, posture and response effectiveness. |
| Evidence | Assurance evidence is assembled for gates or audits, often through manual exercises. | Contributing indicators and data lineage connect executive outcomes to operational telemetry, repositories, GRC, delivery and incident data. |
| Risk and controls | Requirements and controls can become static once approved. | Threat intelligence, incidents, vulnerabilities, drift and control-health evidence continuously reshape requirements, patterns and priorities. |
| Protection economics | Security investment is justified broadly through risk reduction or compliance need. | Protection Level Agreements expose the risk, coverage, capacity and cost implications of choosing one protection level over another. |
| Operational acceptance | Security readiness is checked late or absorbed into a general service-transition gate. | Monitoring, playbooks, access, hardening, recovery and residual risk are architectural acceptance concerns before ownership transfers. |
| Scale | More demand is answered with more security architects and more reviews. | Reusable patterns, guardrails and practitioner capability make routine secure design self-service while escalation focuses on material risk. |