Architecture / Security Architecture Operating Models / Lifecycle
02 · Intervention
The security through-life value stream
Security architecture starts with strategy and risk, shapes design and delivery, and continues through live operation and retirement.
10lifecycle stages
3architecture layers
30role-by-stage views
One lifecycle, three architectural lenses
Business architecture asks what value and capability must change; information systems architecture shapes applications and data; technology architecture shapes the platforms that sustain them.
flowchart LR TITLE["<b>Business architecture layer</b>"]:::title P1["<b>Strategy</b><br/><small>Define vision, drivers and goals</small>"] P2["<b>Planning</b><br/><small>Capture stakeholder needs</small>"] P3["<b>Design</b><br/><small>Model capabilities and value</small>"] P4["<b>Development</b><br/><small>Translate needs to specifications</small>"] P5["<b>Deployment</b><br/><small>Prepare business adoption</small>"] P6["<b>Transition</b><br/><small>Enable organisational change</small>"] P7["<b>Operation</b><br/><small>Monitor business services</small>"] P8["<b>Maintenance</b><br/><small>Maintain business processes</small>"] P9["<b>Optimisation</b><br/><small>Improve performance</small>"] P10["<b>Retirement</b><br/><small>Retire capabilities safely</small>"] TITLE -.-> P1 P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7 --> P8 --> P9 --> P10 classDef title fill:#122f3b,stroke:#122f3b,color:#fff classDef default fill:#f7f4ee,stroke:#204e5f,color:#172226
flowchart LR TITLE["<b>Information systems architecture layer</b>"]:::title P1["<b>Strategy</b><br/><small>Set application and data direction</small>"] P2["<b>Planning</b><br/><small>Capture system requirements</small>"] P3["<b>Design</b><br/><small>Design application and data models</small>"] P4["<b>Development</b><br/><small>Build systems and data</small>"] P5["<b>Deployment</b><br/><small>Introduce services to production</small>"] P6["<b>Transition</b><br/><small>Make systems operationally ready</small>"] P7["<b>Operation</b><br/><small>Run applications and data</small>"] P8["<b>Maintenance</b><br/><small>Update systems and data models</small>"] P9["<b>Optimisation</b><br/><small>Improve efficiency</small>"] P10["<b>Retirement</b><br/><small>Decommission and archive</small>"] TITLE -.-> P1 P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7 --> P8 --> P9 --> P10 classDef title fill:#122f3b,stroke:#122f3b,color:#fff classDef default fill:#f7f4ee,stroke:#204e5f,color:#172226
flowchart LR TITLE["<b>Technology architecture layer</b>"]:::title P1["<b>Strategy</b><br/><small>Set technology direction</small>"] P2["<b>Planning</b><br/><small>Capture infrastructure needs</small>"] P3["<b>Design</b><br/><small>Design target infrastructure</small>"] P4["<b>Development</b><br/><small>Build platforms</small>"] P5["<b>Deployment</b><br/><small>Deploy to production</small>"] P6["<b>Transition</b><br/><small>Complete technology handover</small>"] P7["<b>Operation</b><br/><small>Operate infrastructure</small>"] P8["<b>Maintenance</b><br/><small>Patch and upgrade</small>"] P9["<b>Optimisation</b><br/><small>Improve efficiency</small>"] P10["<b>Retirement</b><br/><small>Decommission components</small>"] TITLE -.-> P1 P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7 --> P8 --> P9 --> P10 classDef title fill:#122f3b,stroke:#122f3b,color:#fff classDef default fill:#f7f4ee,stroke:#204e5f,color:#172226
Completeness method
Process Lifecycle Completeness
A process map is not complete until the thing being governed has been examined across every lifecycle phase and architectural layer. Assess all 30 phase–layer intersections. A process need not exist in every cell, but every cell must have a decision; use N/A — rationale required only where non-applicability is evidenced.
BusinessDecisions, governance, roles, value and organisational workflow.
Information SystemsApplications, data, integration, information and automated workflow.
TechnologyInfrastructure, platforms, deployment, operation and technical automation.
Security is applied through the same three layers. At the Business layer assess risk, policy, accountability and security decision rights; at Information Systems assess security services, data, control workflows and evidence; at Technology assess mechanisms, secure configuration, platforms, telemetry and technical operation. Security is not a separate fourth layer.
Assessment sequence
- Identify the thing being governed and the outcome required.
- Examine all 30 phase–layer intersections.
- Identify the processes required at each applicable intersection.
- Define ownership, controls, evidence and hand-offs.
- Record missing or immature processes as gaps and assign actions.
- Validate implementation and measurement, then improve the process using evidence.
flowchart LR
A["1 · Identify the thing<br/>and required outcome"] --> B["2 · Examine all<br/><b>10 lifecycle phases</b>"]
B --> L1["Business<br/><small>decisions · governance · roles · value</small>"]
B --> L2["Information Systems<br/><small>applications · data · integration · workflow</small>"]
B --> L3["Technology<br/><small>platforms · deployment · operation · automation</small>"]
L1 --> C{"Process required<br/>at this intersection?"}
L2 --> C
L3 --> C
C -- Yes --> D["Define owner · outcome · inputs · outputs<br/>controls · evidence · hand-offs"]
C -- No --> E["Record evidenced N/A<br/>with rationale"]
D --> F["Record and remediate gaps"]
E --> G["Validate coverage,<br/>implementation and measures"]
F --> G
G -. improve .-> A
classDef start fill:#122f3b,stroke:#122f3b,color:#fff
classDef layer fill:#e7f0ed,stroke:#204e5f,color:#172226
classDef decision fill:#fff2cc,stroke:#b85f2e,color:#172226
classDef complete fill:#d8f6e7,stroke:#22845b,color:#172226
class A start
class L1,L2,L3 layer
class C decision
class G completeCompletion rule: an applicable process is not complete without an accountable owner, intended outcome, inputs, outputs, controls and evidence, and predecessor/successor hand-offs. The toolkit distinguishes an evidenced N/A from an unassessed gap and provides the register, definitions and remediation views needed to retain the decision.
Workbook source · Through Life Description
The ten stages
A common stage definition used throughout the model.
| Phase | Phase Name | Short Description | Comprehensive Description |
|---|---|---|---|
| 1 | Strategy | Define strategic direction and service portfolio aligned with business objectives | The Strategy phase establishes the foundational direction for service delivery by defining strategic objectives, assessing market opportunities, and determining which services to offer. This includes service portfolio management, demand analysis, financial planning, and business relationship management. Key activities involve understanding customer needs, conducting market assessments, developing service strategies that align with organisational goals, and establishing the business case for service investments. The phase ensures that all subsequent activities are strategically aligned and commercially viable. |
| 2 | Planning | Plan and coordinate resources, timelines, and deliverables for service implementation | The Planning phase translates strategic objectives into actionable plans with defined timelines, resource allocation, and success criteria. This involves detailed project planning, capacity planning, risk assessment, and stakeholder coordination. Key activities include developing comprehensive project plans, establishing governance structures, defining roles and responsibilities, creating communication plans, and setting up monitoring frameworks. The phase ensures proper preparation and coordination across all teams and stakeholders involved in service delivery. |
| 3 | Design | Design service architecture, processes, and governance frameworks | The Design phase creates detailed blueprints for service delivery, including technical architecture, process workflows, and governance frameworks. This encompasses service catalogue development, service level agreements definition, capacity management planning, availability design, security architecture, and supplier management frameworks. Key activities involve designing service components, establishing quality standards, creating documentation standards, and ensuring services are fit for purpose and use. The phase provides the foundation for successful service implementation. |
| 4 | Development | Build, develop, and configure service components and solutions | The Development phase involves building, configuring, and creating the actual service components and solutions. This includes application development, system configuration, infrastructure setup, process implementation, and documentation creation. Key activities encompass coding and development work, system integration, testing preparation, knowledge transfer preparation, and quality assurance processes. The phase transforms design specifications into tangible deliverables ready for deployment. |
| 5 | Deployment | Deploy services into production environment with controlled rollout | The Deployment phase manages the controlled rollout of services into the production environment. This involves deployment planning, environment preparation, data migration, system configuration, and go-live activities. Key activities include coordinating deployment activities, managing deployment risks, ensuring system readiness, conducting final testing, and executing cutover procedures. The phase ensures services are successfully moved from development to live operational status. |
| 6 | Transition | Manage transition of services from development to operational state | The Transition phase manages the handover from development teams to operational teams, ensuring knowledge transfer and operational readiness. This includes change management, service validation, knowledge management, and operational readiness assessment. Key activities involve conducting operational readiness reviews, transferring documentation and knowledge, establishing support procedures, training operational staff, and ensuring smooth transition to operational state. The phase bridges the gap between deployment and full operational capability. |
| 7 | Operation | Execute day-to-day service delivery and support operations | The Operation phase encompasses the day-to-day delivery and management of live services to end users. This includes incident management, service request fulfilment, problem management, access management, and service monitoring. Key activities involve managing service desk operations, resolving incidents and problems, fulfilling service requests, monitoring service performance, and ensuring agreed service levels are maintained. The phase focuses on maintaining service availability, performance, and user satisfaction. |
| 8 | Maintenance | Perform ongoing maintenance, updates, and corrective actions | The Maintenance phase ensures ongoing service health through regular updates, patches, preventive maintenance, and corrective actions. This includes scheduled maintenance activities, security updates, performance tuning, capacity monitoring, and proactive maintenance. Key activities involve conducting regular health checks, applying updates and patches, performing preventive maintenance, monitoring system performance, and addressing maintenance requirements. The phase ensures services remain secure, stable, and performant over time. |
| 9 | Optimisation | Continuously improve service performance and efficiency | The Optimisation phase continuously improves service performance, efficiency, and value delivery through systematic analysis and enhancement. This includes performance monitoring, process improvement, cost optimisation, and service enhancement initiatives. Key activities involve measuring service metrics, identifying improvement opportunities, implementing process enhancements, optimising resource utilisation, and driving continuous improvement initiatives. The phase ensures services evolve to meet changing requirements and deliver maximum value. |
| 10 | Retirement | Decommission services at end-of-life whilst ensuring smooth transition | The Retirement phase manages the controlled decommissioning of services at their end-of-life, ensuring minimal disruption and proper transition arrangements. This includes retirement planning, data migration or archival, system decommissioning, and transition to alternative services. Key activities involve developing retirement plans, communicating with stakeholders, migrating or archiving data, decommissioning infrastructure, and ensuring continuity through alternative arrangements. The phase ensures orderly service cessation whilst protecting business continuity and data integrity. |
Workbook source · Through Life
Role accountabilities by layer and stage
The full ESA, SSA and OSA responsibility matrix.
Business Architecture
The Business Architecture layer focuses on defining the business strategy, governance, organisation, and key business processes. It serves as the foundation for aligning business goals with IT strategies, ensuring that all technology investments support business objectives. Within this layer, several core components are typically addressed. These include business capabilities, which outline what the organisation needs to do to achieve its strategic goals, and value streams, which map out the end-to-end activities that deliver value to stakeholders. Additionally, the Business Architecture layer defines the organisation's structure and relationships between various business units, providing a clear roadmap for implementing change and achieving business transformation.
| Phase | Description | Enterprise Security Architect Role | Security Solutions Architect Role | Operational Security Architect Role |
|---|---|---|---|---|
| 1. Strategy | Define business vision, drivers, and goals. Establish strategic intent and value proposition. Align with enterprise mission and long-term business direction. | Ensure strategic alignment of business objectives with security vision. Influence early shaping of business capabilities to embed security thinking. | Provide insights into how business initiatives may impact security posture and ensure business-driven security requirements are captured. | Advise on operational security constraints that may affect strategic business planning or require mitigation in the business roadmap. |
| 2. Planning | Capture stakeholder needs and business requirements. Conduct business capability assessment, gap analysis, and prioritise initiatives based on feasibility and value. | Align enterprise security capabilities with business capability planning. Influence business risk decisions and support investment prioritisation. | Contribute to business requirement definitions with a focus on security risks and controls. Support gap analysis from a delivery perspective. | Highlight existing operational risks or legacy issues that should inform future business capability planning. |
| 3. Design | Develop conceptual models for business capabilities, processes, value streams, and organisation structure. Define target business architecture and assess impacts. | Ensure the target business architecture embeds necessary security capabilities and aligns with enterprise risk tolerance. | Work with business analysts to define secure business process flows and ensure security is considered in business impact assessments. | Validate that new business processes are compatible with existing operational security capabilities or highlight required changes. |
| 4. Development | Translate business requirements into functional specifications. Support development of business services and validate alignment with business capability models. | Maintain alignment between evolving business capabilities and strategic security goals during design elaboration. | Support the development of business-aligned security services and validate that the implementation meets business-driven security requirements. | Ensure that operational considerations for business processes (e.g. monitoring, escalation) are accounted for in development. |
| 5. Deployment | Oversee readiness for business adoption. Validate organisational preparedness, user enablement, and alignment with business processes and outcomes. | Review deployment against strategic business-security alignment. Ensure change management supports secure adoption. | Support security-related business readiness activities, including training and process validation. | Ensure that operational procedures for secure business process support are in place and tested. |
| 6. Transition | Enable organisational change. Support communication, training, and adoption of new business processes. Ensure business continuity and governance alignment. | Ensure security governance is integrated into new organisational structures or business models. | Facilitate handover of security-relevant business knowledge and responsibilities to operational teams. | Support secure onboarding of business processes into operations and update business continuity measures as needed. |
| 7. Operation | Monitor performance of business services and processes. Evaluate business value delivery, customer satisfaction, and alignment with KPIs. | Review ongoing business performance through a security lens. Feed insights into future strategic planning. | Limited role unless business change or optimisation is required. Support lessons learned analysis. | Ensure security controls continue to support business process KPIs, and handle incidents affecting business operations. |
| 8. Maintenance | Manage business process updates, refine capabilities in response to change, and maintain alignment with business goals and market demands. | Guide strategic realignment of security services in response to changes in business process or capability. | Assess the impact of business process changes on previously delivered security capabilities and adjust as required. | Maintain alignment between evolving business needs and day-to-day security operations. |
| 9. Optimisation | Identify performance improvements, process inefficiencies, and opportunities for innovation. Support continuous improvement and evolution of business models. | Champion continuous improvement in security posture aligned to business efficiency and innovation objectives. | Evaluate how improvements in business architecture can introduce new security challenges or opportunities. | Contribute operational metrics and incident trends to inform business-led optimisation efforts. |
| 10. Retirement | Manage controlled retirement of business capabilities or services. Ensure transition strategies and lessons learned support future planning. | Ensure business offboarding is aligned with data protection, compliance, and security governance requirements. | Support transition planning for business capability retirement, especially where security dependencies exist. | Execute decommissioning of operational controls tied to retired business processes and manage residual risks. |
Information Systems Architecture
The Information Systems Architecture layer defines the structure and interactions of the core systems that support business functions. It consists of two key domains: Application Architecture and Data Architecture. The Application Architecture outlines the individual applications required to support business processes, detailing how they interact and align with business capabilities. It ensures that the organisation’s software ecosystem is efficient, interoperable, and scalable. This includes considerations around integration (e.g., APIs, messaging), lifecycle management, and system dependencies. The Data Architecture focuses on structuring the organisation’s data assets to support operational and analytical needs. It defines key data entities, their relationships, and how data flows across the enterprise. This includes governance aspects such as data ownership, classification, quality, and compliance - especially important under regulations like GDPR. Together, these architectures create a cohesive view of how applications and data enable the business, ensuring IT solutions are strategically aligned and technically robust.
| Phase | Information Systems Architecture Focus (TOGAF) | Enterprise Security Architect Role | Security Solutions Architect Role | Operational Security Architect Role |
|---|---|---|---|---|
| 1. Strategy | Define strategic direction for applications and data. Identify key systems needed to support business goals. Align technology with business value and regulatory context. | Ensure strategic alignment of data and application security with enterprise architecture. Define security principles for data lifecycle and system integration. | Contribute to defining security-relevant capabilities of future information systems. Identify potential system-level risks. | Provide input on current systems' constraints and known vulnerabilities to guide strategic planning. |
| 2. Planning | Capture information system requirements. Conduct data flow and application capability gap analysis. Identify dependencies and integration points. | Ensure secure data flows and application interdependencies are assessed. Influence architectural roadmap for secure integration. | Define security requirements for applications and data, including data classification, access, and protection needs. | Validate planned systems against operational monitoring, logging, and access management capabilities. |
| 3. Design | Develop logical data and application models. Define system interfaces, data entities, and application services. Align with architecture principles. | Validate logical models for secure data flow and application interaction. Align with enterprise data governance and security architecture. | Define detailed application security patterns, secure data models, and ensure integration points are properly secured. | Assess whether the design supports incident detection, data integrity monitoring, and secure operational behaviour. |
| 4. Development | Construct applications and implement data models. Validate systems against functional and data integrity requirements. | Ensure development aligns with enterprise architecture and security standards. Support exception handling processes. | Conduct security testing (e.g. SAST/DAST), validate implementation of data and application security controls. | Ensure instrumentation for monitoring and operational security is built into applications and data stores. |
| 5. Deployment | Introduce applications and data services into the production environment. Validate integration and data exchange with live systems. | Confirm deployment aligns with system-level risk appetite and supports secure interoperability. | Conduct go-live security assessments, validate secure configuration, and support cutover planning. | Prepare operational tools for application and data service monitoring, including logging, alerts, and incident response readiness. |
| 6. Transition | Ensure systems are operationally ready. Support knowledge transfer and data handover. Confirm governance and lifecycle controls. | Review governance alignment and lifecycle security considerations, including data retention and auditability. | Support documentation and handover of security aspects related to applications and data handling. | Accept operational responsibility for system security monitoring, logging, and incident management. |
| 7. Operation | Applications and data systems are in full use. Support ongoing performance, data accuracy, and integration with enterprise systems. | Monitor trends to inform enterprise data and application security evolution. | Support root cause analysis where architectural design impacts operational security outcomes. | Operate and maintain secure system states, perform audits, and manage day-to-day application and data threats. |
| 8. Maintenance | Update applications and data models to reflect changes in requirements or performance insights. Patch and optimise systems. | Ensure updates do not compromise strategic security posture or architectural integrity. | Assess changes for security design implications and test impacts on controls. | Implement patches and system changes securely, monitor for new vulnerabilities, and maintain control baselines. |
| 9. Optimisation | Evaluate performance and improve system efficiency. Rationalise application landscape and optimise data usage. | Advocate secure rationalisation strategies, ensuring consolidation or replacement does not weaken security posture. | Support redesign or reengineering of systems for better control integration and performance. | Feed operational data into optimisation decisions and support secure configuration management. |
| 10. Retirement | Decommission systems and archive or migrate data. Ensure compliance with retention and disposal policies. | Oversee secure decommissioning strategies, ensuring data is sanitised and dependencies removed. | Support decommissioning execution and documentation of impacts on dependent systems. | Execute secure system shutdowns, remove credentials, revoke access, and ensure all logs and audit trails are archived appropriately. |
Technology Architecture
The Technology Architecture layer focuses on the infrastructure necessary to support the deployment of applications and data. It defines the hardware, software, networks, and other foundational components that form the IT environment. This layer ensures that the infrastructure is reliable, scalable, and secure, providing a stable foundation for business operations. Key components include servers, storage systems, networking equipment, and virtualisation technologies. Moreover, the Technology Architecture layer addresses standards and protocols to ensure interoperability and future-proofing. It also considers performance, availability, and security requirements, aligning them with business needs. This ensures that the technology environment not only supports current operations but can also adapt to future demands.
| Phase | Technology Architecture Focus (TOGAF) | Enterprise Security Architect Role | Security Solutions Architect Role | Operational Security Architect Role |
|---|---|---|---|---|
| 1. Strategy | Define strategic technology direction. Identify key platforms, infrastructure trends, and target environments to support business objectives. | Shape the strategic vision for secure infrastructure platforms and cloud services. Ensure alignment with risk appetite and regulatory expectations. | Advise on emerging technologies' security implications and how they may impact delivery plans. | Share legacy constraints and current infrastructure capabilities to inform future secure platform strategies. |
| 2. Planning | Capture infrastructure requirements. Conduct capability assessments and determine infrastructure services needed for future-state operations. | Define secure technology standards and architectural guardrails. Guide selection of infrastructure components aligned to security posture. | Translate business and application needs into secure infrastructure requirements. | Validate planned architecture against operational security tooling, SLAs, and support models. |
| 3. Design | Design the target infrastructure architecture, including networks, compute, storage, and hosting environments. Ensure scalability, security, and resilience. | Ensure security-by-design is applied to all technology components. Validate network zoning, segmentation, and trusted boundaries. | Develop secure configuration patterns, infrastructure access models, and network security controls. | Ensure operational feasibility of security monitoring, patching, and backup/restore strategies. |
| 4. Development | Build infrastructure platforms, configure services, and conduct component-level testing. Establish secure environments. | Validate adherence to platform security baselines and technology blueprints. | Implement secure configurations, test platform hardening, and validate infrastructure security services (e.g. IAM, logging). | Test and prepare operational tooling for infrastructure monitoring, alerting, and response. |
| 5. Deployment | Deploy infrastructure into production environments. Ensure compatibility, resilience, and secure integration. | Confirm deployment conforms to architectural standards and supports secure operations at scale. | Validate security controls (e.g. firewalls, IAM, encryption) are operational and integrated. | Ensure monitoring, response plans, and privileged access controls are fully operational and tested. |
| 6. Transition | Finalise technology handover. Validate resilience, failover, backup strategies, and support readiness. | Ensure transition maintains architectural integrity and continuity of security posture. | Support documentation and knowledge transfer of secure infrastructure operations. | Take ownership of infrastructure operations, including vulnerability management and logging services. |
| 7. Operation | Manage day-to-day infrastructure operations. Monitor performance, reliability, and maintain service availability. | Monitor infrastructure trends and risk posture, feeding into technology lifecycle planning. | Provide support for architectural queries and post-implementation reviews when needed. | Maintain secure operation of platforms, apply patches, manage threats, and support audit readiness. |
| 8. Maintenance | Apply patches, upgrade infrastructure, and support evolving requirements. Ensure availability and resilience. | Guide secure evolution of infrastructure platforms in line with strategic direction. | Assess security impacts of infrastructure changes and recommend updates to security patterns. | Apply updates securely, monitor changes, and maintain visibility over infrastructure risks. |
| 9. Optimisation | Enhance infrastructure efficiency, rationalise platforms, and adopt emerging technologies where beneficial. | Ensure optimisation activities support improvements in security efficiency, scalability, and resilience. | Support secure rationalisation of platforms, validate that optimised configurations meet control requirements. | Inform optimisation through metrics and incidents. Support secure consolidation of infrastructure. |
| 10. Retirement | Decommission infrastructure components. Remove dependencies and ensure secure disposal of technology assets. | Define secure decommissioning standards and ensure compliance with data and system sanitisation requirements. | Support infrastructure decommissioning and update architecture artefacts accordingly. | Securely dismantle services, remove access, and confirm full audit trails and data disposal. |