Architecture / Security Architecture Operating Models / Outcome model
04 · Accountability
Link architecture services to outcomes, owners, evidence, coverage and negotiated performance levels.
The core idea
Counts of diagrams, reviews and meetings show activity. They do not show that investment aligns, defects are found early, standards hold or releases are operable.
KPIs show performance, KRIs show exposure and KCIs show whether controls work.
Workbook source · ODM Overview
Purpose, rules, scope and operating rhythm.
Companion measurement framework for the ESA Service Catalogue and Service Through Life value stream. All targets are illustrative and subject to PLA negotiation.
| Purpose | Translate the Security Architecture capability into a small set of outcome-driven metrics (ODMs) that express the level of protection and value delivered, negotiated with service consumers as Protection Level Agreements (PLAs), rather than measuring activity or effort. |
|---|---|
| Design principle 1 - Anchor | ODMs are anchored to the ESA Service Catalogue (grouped into six service families), because catalogue services have identifiable customers who can negotiate a protection level against cost. Lifecycle phases do not have customers and therefore do not own ODMs. SSA and OSA catalogue services are mapped to the same six families (SSA-nn / OSA-nn references), so every role's services roll up to the ODMs without changing the metric set. |
| Design principle 2 - Two tiers | Tier 1: outcome metrics (this register) wrapped in PLAs, reported to executive and risk committee audiences. Tier 2: contributing indicators instrumented at Service Through Life phase gates, used by ESA/SSA/OSA leads as leading and diagnostic signals that explain ODM movement. |
| Design principle 3 - Indicator grammar | Each metric is typed using the Risk Ontology grammar: KRI (is exposure within appetite?), KPI (is the capability performing and protecting delivery velocity?), KCI (are the controls and traceability chains we specified healthy?). The ESA role split maps broadly to KRI ownership (ESA), KPI ownership (SSA) and KCI ownership (OSA). |
| Design principle 4 - Data first | Every ODM must be generatable from operational data (architecture repository, CMDB, exception register, delivery tooling, GRC platform). If a metric requires a manual quarterly trawl it will decay; see the ODM Data Lineage tab for the source-to-metric path. |
| Design principle 5 - Negotiated targets | Targets are protection levels bought by the consumer at a known cost, not aspirations set by the security function. Each PLA records the negotiating party, thresholds, and the cost delta of moving to a higher protection level. |
| Measurement plane | Catalogue service 17 (Security Metrics, Reporting and Decision Support) is the measurement plane. It carries no outcome ODMs of its own - self-referential metrics get gamed - only data-quality and decision-uptake indicators (MP-01, MP-02 in the register). |
| Tab guide | ODM Service Family Map: 23 ESA catalogue services, plus 36 SSA and OSA services, grouped into 6 families with measurable outcome statements. ODM Register: the metric set. ODM PLA Definitions: one PLA per family. ODM Contributing Indicators: phase-gate instrumentation mapped to the Through Life value stream. ODM Data Lineage: source systems and quality checks. ODM Dashboard: illustrative scorecard with RAG logic. |
| Standards alignment | Supports ISO/IEC 27001:2022 clause 9 (performance evaluation), NCSC CAF outcome-based assessment, and board reporting expectations under UK GDPR / NIS. ODM trendlines double as maturity evidence - no separate maturity survey required. |
| Operating cautions | Keep the set small (15–16 ODMs plus 2 measurement-plane indicators). Pair every coverage KPI with a conformance KCI so paper traceability is checked against the running estate. Review protection levels annually or on material change to threat landscape or business model. |
Workbook source · ODM Service Family Map
How all 59 services contribute to six outcome families and the measurement plane.
The 23 ESA Service Catalogue services rationalised into six measurable service families plus a measurement plane, with the SSA and OSA catalogue services mapped to the same families. Outcome statements rewrite the catalogue benefit claims into measurable form.
| Family ID | Service Family | Catalogue Services (ID - Name) | Original Benefit Claim (Catalogue) | Measurable Outcome Statement | ODMs |
|---|---|---|---|---|---|
| F1 | Secure Design & Assurance | ESA-01 - Security Architecture and Solution Design; ESA-02 - Enterprise Security Reference Architecture; ESA-10 - Security Change and Transformation Integration; ESA-15 - Security Innovation and Emerging Technology Advisory; ESA-22 - Architecture Support for Safety-Critical or OT Environments; SSA-02 - Solution Security Design; SSA-03 - Threat Modelling and Risk Assessment; SSA-05 - Secure Design Review and Assurance; SSA-06 - Pattern Instantiation and Tailoring; SSA-08 - DevSecOps Pipeline Security Design; SSA-09 - Cloud Solution Security Design; SSA-10 - Integration and API Security Design; SSA-12 - Security Testing Strategy and Oversight; SSA-13 - Secure Migration and Cutover Design; OSA-06 - Secure Configuration and Hardening Management | "Avoids costly redesigns"; "accelerates secure project delivery"; "reduces risk during transformation" | Security defects are designed out, not remediated: the majority of security flaws are caught at or before the Design gate, post-build security rework is bounded, and the estate converges on approved reference patterns rather than drifting. | ODM-01, ODM-02, ODM-03 |
| F2 | Requirements & Third-Party Assurance | ESA-03 - Security Requirements Definition and Engineering; ESA-06 - Supply Chain and Third-Party Security Assurance; ESA-11 - Security Requirements for Procurement and Outsourcing; SSA-04 - Security Requirements Definition and Traceability; SSA-14 - Third-Party Solution Security Assessment | "Prevents vulnerabilities, supports audit needs"; "protects from supply chain vulnerabilities" | Every material change and external engagement carries traceable, risk-based security requirements that are verified as implemented at go-live, and critical suppliers hold current assurance within agreed thresholds - without slowing procurement. | ODM-04, ODM-05, ODM-06 |
| F3 | Governance, Compliance & Privacy | ESA-07 - Security Governance, Policy, and Compliance Enablement; ESA-09 - Security Standards Development and Maintenance; ESA-13 - Regulatory and Standards Alignment Advisory; ESA-16 - Security Architecture Governance Forums and Review Boards; ESA-19 - Secure Architecture for Data Protection and Privacy; SSA-11 - Data Protection by Design; OSA-07 - Operational Access and Privileged Account Architecture; OSA-11 - Operational Risk and Compliance Monitoring | "Demonstrable compliance, reduced risk"; "practical guidance for audit readiness" | The organisation is audit-ready by design: regulatory obligations trace to implemented controls through the architecture, audit findings attributable to design defects are rare, and standards remain current against the threat landscape. | ODM-07, ODM-08, ODM-09 |
| F4 | Risk, Strategy & Technical Debt | ESA-04 - Security Risk and Capability Assessments; ESA-05 - Security Strategy and Roadmap Development; ESA-14 - Security Technical Debt Identification and Remediation Support; ESA-23 - Security Optimisation and Posture Tuning; SSA-16 - Solution Security Optimisation; SSA-18 - Decommissioning Security Design; OSA-01 - Operational Security Posture Ownership; OSA-05 - Vulnerability and Patch Management Architecture; OSA-08 - Security Tooling Estate Management; OSA-09 - Detection Tuning and Optimisation; OSA-12 - Security Operations Automation; OSA-15 - Legacy and End-of-Life Risk Management; OSA-16 - Secure Decommissioning Execution; OSA-17 - Operational Security Process Improvement | "Enables data-driven investment"; "guides security investment"; "prevents accumulation of vulnerabilities" | Control-objective coverage on critical domains is complete and evidenced, accumulated risk debt is bounded and reducing, and the security capability roadmap is delivered to plan so investment tracks appetite. | ODM-10, ODM-11, ODM-12 |
| F5 | Resilience & Incident Architecture | ESA-12 - Security Incident Response Architectural Support; ESA-20 - Architecture Support for Business Continuity and Resilience; SSA-15 - Security Operations Enablement; SSA-17 - Incident Support and Remediation Design; OSA-02 - Security Monitoring and Detection Architecture; OSA-03 - Incident Response Architecture and Playbooks; OSA-04 - Operational Acceptance and Handover Assurance; OSA-10 - Backup, Recovery and Resilience Operations; OSA-13 - Threat-Informed Defence; OSA-18 - Major Incident Architectural Support | "Minimises impact of incidents"; "enhances ability to withstand and recover from disruptive events" | Major incidents produce architectural learning that lands as pattern and standard change within a fixed window, and the recovery architecture of critical services is verified against RTO/RPO on a rolling basis. | ODM-13, ODM-14 |
| F6 | Capability & Culture | ESA-08 - Stakeholder Engagement and Security Advocacy; ESA-18 - Security Architecture Knowledge Sharing and Training; ESA-21 - Security Architecture Community of Practice Leadership; SSA-01 - Embedded Project Security Architecture; SSA-07 - Security in Agile Delivery | "Drives buy-in, shared accountability"; "fosters professional development and a culture of security" | Delivery teams engage security architecture early by default rather than under compulsion, and internal capability grows so that routine secure design is self-served through patterns and accredited practitioners. | ODM-15, ODM-16 |
| MP | Measurement Plane (not a family) | ESA-17 - Security Metrics, Reporting, and Decision Support; OSA-14 - Operational Metrics and Posture Reporting | "Enables informed decisions and continuous improvement" | The measurement system itself is trustworthy and used: ODMs are generated automatically from operational data, and governance decisions demonstrably cite ODM evidence. No outcome ODMs - measurement-plane indicators only. | MP-01, MP-02 |
Workbook source · ODM Register
Definitions, formulae, owners, consumers, cadence and thresholds.
The outcome-driven metric set. Type: KRI = exposure vs appetite; KPI = capability performance and delivery velocity; KCI = control and traceability health. Targets are illustrative pending PLA negotiation.
| ODM ID | Family | ODM Name | Outcome Claim | Metric Definition | Type | Unit | Direction | Target (Green) | Amber ≥ | Red < | Owner Role | Negotiating Consumer | Cadence | Contributing Indicators | Primary Data Sources | Catalogue Services |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ODM-01 | F1 | Design-stage defect capture | Security flaws are found where they are cheapest to fix - at design, not in production. | Security design defects identified at or before the Design gate as a percentage of all security design defects found in the period (including post-deployment escapes). | KPI | % | Higher | 80 | 65 | 65 | SSA | CIO / Portfolio Board | Quarterly | CI-03, CI-05, CI-07 | Design review tooling; defect tracker; incident RCA records | ESA-01, ESA-02, ESA-10, SSA-02, SSA-03, SSA-05, SSA-12 |
| ODM-02 | F1 | Security rework cost | Redesign cost avoided - the catalogue claim made measurable. | Effort/cost of post-build change attributable to security design decisions, as a percentage of total delivery spend on in-scope initiatives. | KRI | % | Lower | 2 | 4 | 4 | ESA | CFO / Portfolio Board | Quarterly | CI-04, CI-05 | Delivery tooling (change records); financial system cost codes | ESA-01, ESA-10, SSA-01, SSA-05 |
| ODM-03 | F1 | Pattern adoption & conformance | The estate converges on approved patterns; drift is caught quickly. | Percentage of new deployments conformant with the approved reference pattern that specifies them; drift detected within 30 days via configuration compliance scanning. | KCI | % | Higher | 85 | 70 | 70 | OSA | Domain / Platform Owners | Monthly | CI-06, CI-08 | Architecture repository; configuration compliance scanning; CMDB | ESA-02, ESA-15, ESA-22, ESA-23, SSA-06, OSA-06 |
| ODM-04 | F2 | Requirements traceability integrity | What we required is what was built and verified. | Percentage of Tier-1 changes whose security requirements trace to implemented and verified controls at go-live (requirement → control → verification evidence). | KCI | % | Higher | 95 | 85 | 85 | SSA | Change / Programme Boards | Quarterly | CI-02, CI-07 | Requirements repository; test evidence; architecture repository | ESA-03, SSA-04 |
| ODM-05 | F2 | Third-party assurance coverage | Supply chain exposure is within appetite. | Percentage of critical suppliers holding current security assurance within agreed threshold (assessment age, score, remediation status); high-tier suppliers reported alongside. | KRI | % | Higher | 100 | 90 | 90 | ESA | CPO / Supplier Board | Quarterly | CI-01, CI-09 | Supplier assurance platform; contract register | ESA-06, ESA-11, SSA-14 |
| ODM-06 | F2 | Procurement security cycle time | Security does not slow the buying process. | Median working days from procurement engagement to issue of security requirements for RFP/contract. | KPI | days | Lower | 10 | 15 | 15 | SSA | CPO / Procurement | Quarterly | CI-01 | Procurement workflow tooling | ESA-11, SSA-14 |
| ODM-07 | F3 | Regulatory trace completeness | Audit-ready by design, with an evidence chain. | Percentage of in-scope regulatory obligations (UK GDPR, NIS, ISO/IEC 27001 SoA) with a demonstrable obligation → control → architecture evidence chain. | KRI | % | Higher | 95 | 85 | 85 | ESA | CISO / Risk Committee | Quarterly | CI-02, CI-10 | GRC platform; control library; architecture repository | ESA-07, ESA-13, ESA-19, SSA-11, OSA-11 |
| ODM-08 | F3 | Audit findings attributable to design | Design quality shows up as clean audits. | Count of internal/external audit findings in the period whose root cause is an architecture or design defect (target: none critical). | KRI | count | Lower | 2 | 4 | 4 | ESA | CISO / Audit Committee | Annual | CI-10 | Audit findings register; RCA records | ESA-07, ESA-13, ESA-16, OSA-11 |
| ODM-09 | F3 | Standards currency | Standards keep pace with threat and technology change. | Percentage of technical security standards reviewed and reissued within their defined review cycle (12 or 24 months by class). | KCI | % | Higher | 90 | 75 | 75 | OSA | Design Authority | Quarterly | CI-08 | Standards register (architecture repository) | ESA-09 |
| ODM-10 | F4 | Control-objective coverage | Critical domains are demonstrably protected end-to-end. | Percentage of Tier-1 domain control objectives realised by at least one implemented, operating control/mechanism (SRM Conceptual → Logical → Physical trace), with gaps formally risk-accepted by the domain owner. | KRI | % | Higher | 95 | 85 | 85 | ESA | Domain Owners / Risk Committee | Quarterly | CI-02, CI-06 | Architecture repository; CMDB; control assurance results | ESA-04, ESA-05, OSA-01, OSA-07 |
| ODM-11 | F4 | Security debt exposure | Risk debt is bounded, visible and reducing. | Weighted index of open security technical-debt items and design exceptions on critical domains (severity × age); no exception older than 12 months without owner re-authorisation. | KRI | index | Lower | 100 | 130 | 130 | ESA | Risk Committee | Quarterly | CI-04, CI-11 | Exception register; technical debt inventory | ESA-14, ESA-23, SSA-16, OSA-05, OSA-15 |
| ODM-12 | F4 | Roadmap delivery | Security investment lands as planned capability. | Percentage of security capability roadmap milestones delivered within one quarter of plan. | KPI | % | Higher | 80 | 65 | 65 | SSA | CISO / Investment Board | Quarterly | CI-12 | Portfolio/programme tooling | ESA-05 |
| ODM-13 | F5 | Architectural lessons closed | Incidents make the architecture stronger. | Percentage of P1/P2 security incidents whose architectural lessons produce a published pattern or standard change within 90 days of incident closure. | KPI | % | Higher | 100 | 80 | 80 | SSA | CISO / Resilience Board | Quarterly | CI-13 | Incident records; standards/pattern register | ESA-12, SSA-17, OSA-18 |
| ODM-14 | F5 | Resilience design verification | Recovery works on paper and in practice. | Percentage of critical services whose recovery architecture has been exercised within 12 months and met agreed RTO/RPO. | KCI | % | Higher | 95 | 85 | 85 | OSA | Service Owners / Resilience Board | Quarterly | CI-14 | BC/DR test records; service catalogue | ESA-20, OSA-10 |
| ODM-15 | F6 | Early engagement rate | Teams come to security architecture by default, before build. | Percentage of in-scope (Tier-1) initiatives with security architecture engagement completed before build commences. | KPI | % | Higher | 90 | 75 | 75 | SSA | CIO / Delivery Leadership | Quarterly | CI-03, CI-15 | Delivery pipeline gates; engagement log | ESA-01, ESA-08, SSA-01, SSA-07 |
| ODM-16 | F6 | Capability uplift | Routine secure design becomes self-service. | Number of accredited secure-design practitioners in delivery teams and percentage of routine designs completed via self-served patterns without ESA escalation (composite, trend-based). | KPI | trend | Higher | 10 | 5 | 5 | ESA | CIO / HR (capability) | Annual | CI-15, CI-16 | Training records; pattern usage telemetry | ESA-18, ESA-21 |
| MP-01 | MP | Metric automation & data quality | The measurement system is trustworthy. | Percentage of ODMs generated automatically from operational data without manual adjustment; data-quality exceptions logged per cycle. | KCI | % | Higher | 80 | 60 | 60 | OSA | Design Authority | Quarterly | - | Metrics pipeline; data-quality checks | ESA-17, OSA-14 |
| MP-02 | MP | Decision uptake | Metrics change decisions, not just slides. | Percentage of architecture governance decisions (review boards, investment gates) whose records cite ODM evidence. | KPI | % | Higher | 70 | 50 | 50 | ESA | Design Authority | Quarterly | - | Governance minutes / decision log | ESA-16, ESA-17 |
Workbook source · ODM PLA Definitions
Negotiated protection commitments, trade-offs and investment implications.
One PLA per service family. The PLA is the negotiated contract: the consumer buys a stated protection level at a known cost; thresholds define when escalation and renegotiation occur. Cost deltas are placeholders for the negotiation.
| PLA ID | Service Family | Negotiating Parties | Protection Level Statement (negotiated) | ODMs in Scope | Threshold Logic | Appetite Linkage | Review Cadence | Cost Delta Note |
|---|---|---|---|---|---|---|---|---|
| PLA-F1 | Secure Design & Assurance | ESA lead ↔ CIO / Portfolio Board | At least 80% of security design defects are captured at or before the Design gate; security-attributable rework is held below 2% of delivery spend; 85% of new deployments conform to approved patterns with drift detected inside 30 days. | ODM-01, 02, 03 | Green: all three ODMs at target. Amber: any one ODM in amber band for one quarter - remediation plan required. Red: any ODM in red band or two consecutive amber quarters - escalate to Risk Committee. | Aligned to enterprise appetite for change-introduced risk; the accepted 20% design-escape allowance is a conscious cost/velocity trade-off. | Annual | Raising defect capture to 90% requires additional embedded architect capacity (est. +2 FTE) - priced for the consumer to accept or decline. |
| PLA-F2 | Requirements & Third-Party Assurance | ESA lead ↔ CPO, Change/Programme Boards | 95% of Tier-1 changes have verified requirement-to-control traceability at go-live; 100% of critical suppliers hold current assurance; security requirements for procurement issued within 10 working days (median). | ODM-04, 05, 06 | Green: coverage ODMs at target and cycle time within bound. Amber: coverage 85–95% or cycle time 10–15 days. Red: any critical supplier without current assurance for >30 days. | Supplier assurance thresholds derive from supply-chain risk appetite; cycle-time bound protects procurement velocity as an explicit business value. | Annual | Extending 100% assurance to high-tier (not just critical) suppliers adds assessment cost (est. +£120k p.a. tooling and effort). |
| PLA-F3 | Governance, Compliance & Privacy | ESA lead ↔ CISO, Risk & Audit Committees | 95% of in-scope regulatory obligations carry a demonstrable control-to-architecture evidence chain; no more than two audit findings per year root-caused to design, none critical; 90% of standards within review cycle. | ODM-07, 08, 09 | Green: all at target. Amber: trace completeness 85–95% or standards currency 75–90%. Red: any critical design-attributable audit finding - immediate escalation. | Directly expresses compliance risk appetite for UK GDPR, NIS and ISO/IEC 27001 certification maintenance. | Annual | Closing the final 5% trace gap requires GRC-to-repository integration (est. one-off £80k) - consciously deferred or funded. |
| PLA-F4 | Risk, Strategy & Technical Debt | ESA lead ↔ Domain Owners, Risk Committee | 95% of Tier-1 control objectives are realised by implemented controls with residual gaps risk-accepted; the security debt index trends downward with no exception older than 12 months unre-authorised; 80% of roadmap milestones land within a quarter of plan. | ODM-10, 11, 12 | Green: coverage at target, debt index ≤ baseline 100 and falling. Amber: coverage 85–95% or debt index 100–130. Red: coverage <85% or debt index >130 or any orphaned exception >12 months. | The debt index baseline and 12-month exception ceiling are the quantified expression of accumulated-risk appetite. | Annual | Accelerating debt burn-down beyond plan is priced per remediation tranche in the technical debt roadmap. |
| PLA-F5 | Resilience & Incident Architecture | ESA lead ↔ Service Owners, Resilience Board | Every P1/P2 incident yields a published architectural change within 90 days; 95% of critical services have recovery architecture exercised within 12 months meeting RTO/RPO. | ODM-13, 14 | Green: both at target. Amber: lessons-closed 80–100% or verification 85–95%. Red: any critical service unverified >18 months. | Maps to operational resilience appetite and, where applicable, CAF/NIS resilience outcomes. | Annual | Increasing exercise frequency to 6-monthly for the top-10 services carries stated test and downtime cost. |
| PLA-F6 | Capability & Culture | ESA lead ↔ CIO / Delivery Leadership | 90% of Tier-1 initiatives engage security architecture before build; accredited practitioner count and self-served pattern usage grow year on year. | ODM-15, 16 | Green: engagement at target, capability trend positive. Amber: engagement 75–90%. Red: engagement <75% - indicates the operating model, not the teams, needs attention. | Early engagement is the leading indicator for the whole framework; a red here predicts F1/F2 degradation within two quarters. | Annual | Uplift investment (training, CoP time) is priced per cohort; declining it lowers the negotiable engagement target. |