Architecture / Security Architecture Operating Models / Roles
01 · Mandate
Security architecture roles and responsibilities
Separate roles by security decision altitude and scope, then connect them through shared risk, assurance and operational hand-offs.
ESAenterprise security direction
SSAsecure solution delivery
OSAlive-service posture
The three-role model
Enterprise Security ArchitectSets enterprise security principles, reference architectures, standards and governance.
Security Solutions ArchitectTurns risk and requirements into coherent, testable solution controls.
Operational Security ArchitectOwns security posture through operation, maintenance and retirement.
flowchart TB
subgraph EA[Enterprise Architecture]
direction TB
BA["Business Architecture<br/><small>Strategy · processes · capabilities</small>"]
subgraph ISA[Information Systems Architecture]
direction TB
IS["Applications · data · integration"]
subgraph TA[Technology Architecture]
T["Infrastructure · platforms"]
end
end
end
BA --> ISA
IS --> TA
classDef business fill:#dce9ff,stroke:#3569b7,color:#172226,stroke-width:2px
classDef systems fill:#d8f6e7,stroke:#22845b,color:#172226,stroke-width:2px
classDef technology fill:#ecebea,stroke:#6a6a6a,color:#172226,stroke-width:2px
class BA business
class IS systems
class T technologyWorkbook source · SFIA 9
SFIA 9 alignment
Responsibility levels, validated skill codes and level definitions.
Levels and skill codes validated against SFIA 9 (sfia-online.org, Sept 2026). Level names: 4 Enable; 5 Ensure, advise; 6 Initiate, influence; 7 Set strategy, inspire, mobilise.
| Role | SFIA Responsibility Level | Key Responsibilities | Relevant Skills | Level Notes |
|---|---|---|---|---|
| Enterprise Security Architect | Level 6 - Initiate, influence | Aligns security strategy with enterprise architecture and business objectives. Sets security principles, reference architectures, standards and governance across the enterprise. | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | Level 7 (Set strategy, inspire, mobilise) applies to a Head of Security Architecture / CISO-track role. GOVN is defined at Levels 6–7 only. |
| Security Solutions Architect | Level 5-6 - Ensure, advise / Initiate, influence | Translates security requirements into solution designs for one or more projects. Embeds security by design through delivery, testing and deployment. | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | Level 5 for single-project scope; Level 6 for programme or multi-solution scope. ARCH is defined at Levels 4–6. |
| Operational Security Architect | Level 5 - Ensure, advise | Owns the security posture of live services through operation, maintenance and retirement. Designs monitoring, response, hardening and recovery arrangements. | SCTY (Information security), SCAD (Security operations), BURM (Risk management), INAS (Information assurance) | Level 4 for single-platform scope; Level 5 for estate-wide operational security architecture. VUAS (Vulnerability assessment) tops out at Level 5. |
| Information Security Manager | Level 6 - Initiate, influence | Defines security policy, manages security risks, ensures compliance, and leads response. | SCTY (Information security), BURM (Risk management), GOVN (Governance) | |
| Security Architect | Level 6 - Initiate, influence | Designs secure architectures and ensures security by design in enterprise systems. | ARCH (Solution architecture), SCTY (Information security), COPL (Continuity management) | Generic role - see the ESA and SSA rows for the layered split. |
| Security Consultant | Level 5 - Ensure, advise | Provides expert advice on security design and risk mitigation across projects and systems. | SCTY (Information security), CNSL (Consultancy), INAS (Information assurance) | |
| Cybersecurity Specialist | Level 4 - Enable | Implements security controls, conducts security audits, and manages incident responses. | SCTY (Information security), INAS (Information assurance), SCAD (Security operations) | |
| Threat Intelligence Analyst | Level 5 - Ensure, advise | Collects and analyses threat data to provide actionable intelligence for risk management. | THIN (Threat intelligence), SCTY (Information security), BPRE (Business process improvement) | |
| Penetration Tester | Level 4 - Enable | Performs vulnerability assessments and penetration testing to identify security flaws. | PENT (Penetration testing), SCTY (Information security), INAS (Information assurance) | |
| Security Operations Analyst | Level 4 - Enable | Monitors security systems, analyses alerts, and supports incident management. | SCAD (Security operations), SCTY (Information security), USUP (Incident management) | |
| Incident Response Manager | Level 5 - Ensure, advise | Coordinates response to security incidents, ensuring mitigation and root cause analysis. | SCTY (Information security), USUP (Incident management), INAS (Information assurance) | |
| Risk and Compliance Manager | Level 6 - Initiate, influence | Manages risk, ensures regulatory compliance, and designs governance frameworks. | BURM (Risk management), AUDT (Audit), SCTY (Information security), GOVN (Governance) | "COMP (Compliance)" is not an SFIA code; AUDT is the nearest SFIA 9 skill. |
| Data Protection Officer | Level 6 - Initiate, influence | Ensures compliance with data privacy regulations (e.g., GDPR), manages data protection. | DATM (Data management), PEDP (Information and data compliance), GOVN (Governance), SCTY (Information security) | |
| SFIA Skill Code | Definition (SFIA 9) | Levels Defined | ||
| STPL (Enterprise and business architecture) | Aligning an organisation's technology strategy with its business mission, strategy and processes and documenting this using architectural models. | 5–7 | ||
| ARCH (Solution architecture) | Developing and communicating a multi-dimensional solution architecture to deliver agreed business outcomes. | 4–6 | ||
| SCTY (Information security) | Defining and operating a framework of security controls and security management strategies. | 2–7 | ||
| INAS (Information assurance) | Protecting against and managing risks related to the use, storage and transmission of data and information systems. | 2–7 | ||
| BURM (Risk management) | Planning and implementing processes for managing risk across the enterprise, aligned with organisational strategy and governance frameworks. | 2–7 | ||
| GOVN (Governance) | Defining and operating frameworks for decision-making, risk management, stakeholder relationships and compliance with organisational and regulatory obligations. | 6–7 | ||
| SCAD (Security operations) | Managing and administering security measures, using tools and intelligence to protect assets, ensuring compliance and operational integrity. | 1–6 | ||
| USUP (Incident management) | Coordinating responses to a diverse range of incidents to minimise negative impacts and quickly restore services. | 1–6 | ||
| THIN (Threat intelligence) | Developing and sharing actionable insights on current and potential security threats to the success or integrity of an organisation. | 2–6 | ||
| PENT (Penetration testing) | Testing the effectiveness of security controls by emulating the tools and techniques of likely attackers. | 2–6 | ||
| VUAS (Vulnerability assessment) | Identifying and classifying security vulnerabilities in networks, systems and applications and mitigating or eliminating their impact. | 2–5 | ||
| NFTS (Non-functional testing) | Evaluating performance, security, scalability and other non-functional qualities against requirements or expected standards. | 1–6 | ||
| COPL (Continuity management) | Developing, implementing and testing a business continuity framework. | 2–6 | ||
| CNSL (Consultancy) | Providing advice and recommendations, based on expertise and experience, to address client needs. | 4–7 | ||
| PEDP (Information and data compliance) | Implementing and promoting compliance with information and data management legislation. | 4–6 | ||
| DATM (Data management) | Developing and implementing plans, policies and practices that control, protect and optimise the value and governance of data assets. | 2–6 | ||
| AUDT (Audit) | Delivering independent, risk-based assessments of the effectiveness of processes, the controls and the compliance environment of an organisation. | 2–7 | ||
| BPRE (Business process improvement) | Creating new and potentially disruptive approaches to performing business activities. | 2–7 | ||
| METL (Methods and tools) | Leading the adoption, management and optimisation of methods and tools, ensuring effective use and alignment with organisational objectives. | 2–6 | ||
| EMRG (Emerging technology monitoring) | Identifying and assessing new and emerging technologies, products, services, methods and techniques. | 4–6 | ||
| RLMT (Stakeholder relationship management) | Systematically analysing, managing and influencing stakeholder relationships to achieve mutually beneficial outcomes through structured engagement. | 4–7 | ||
| CHMG (Change control) | Assessing risks associated with proposed changes and ensuring changes to products, services or systems are controlled and coordinated. | 2–6 | ||
| DESN (Systems design) | Designing systems to meet specified requirements and agreed systems architectures. | 2–6 | ||
| ITOP (Infrastructure operations) | Provisioning, deploying, configuring, operating and optimising technology infrastructure across physical, virtual and cloud-based environments. | 1–5 | ||
| KNOW (Knowledge management) | Systematically capturing, developing and leveraging vital knowledge to create value and enhance organisational performance. | 2–7 | ||
| ETDL (Learning delivery) | Transferring knowledge, developing skills and changing behaviours using a range of techniques, resources and media. | 2–5 | ||
| PRMG (Project management) | Delivering agreed project outcomes by aligning appropriate management techniques, collaboration, leadership and governance to specific project and organisational contexts. | 4–7 | ||
| CIPM (Organisational change management) | Planning, designing and implementing activities to transition the organisation and people to the required future state. | 2–6 | ||
| SFIA 9 Level | Essence (summary) | |||
| Level 4 - Enable | Performs diverse, complex activities; supports and guides others; works autonomously under general direction. | |||
| Level 5 - Ensure, advise | Provides authoritative guidance in their field; accountable for significant work outcomes. | |||
| Level 6 - Initiate, influence | Has significant organisational influence; shapes policy and strategy; demonstrates leadership. | |||
| Level 7 - Set strategy, inspire, mobilise | Operates at the highest organisational level; sets strategy and direction across the organisation. |
Workbook source · ESA
Enterprise Security Architect activity model
Enterprise-scoped responsibilities, activities, artefacts and collaborations.
Artefact columns show the information the ESA contributes or requires, scaled by project size. Risk overrides size: a small-value change touching critical assets, personal data or novel technology adopts the next band up. Artefacts may live inside existing governance documents rather than as standalone deliverables.
| Through Life Stage | Value Stream Activity | Role | Description | SFIA Responsibility Level | Relevant Skills | Activities | Example Artefacts - Small (<£250k, low risk) | Example Artefacts - Medium (£250k–£2m, moderate risk) | Example Artefacts - Large (>£2m, high risk or novel) |
|---|---|---|---|---|---|---|---|---|---|
| Planning | Service Strategy Development | Enterprise Security Architect | Sets up and enforces security as a core component of the organisation strategic direction for new services. This involves integrating security within the service’s strategic planning, aligning security goals with broader business objectives, and proactively identifying and planning for potential risks at the enterprise level. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Integrate security objectives into the service’s strategic plans. • Collaborate with business and IT leaders to ensure alignment of security with organisational goals. • Conduct risk assessments to identify enterprise-wide threats and vulnerabilities. • Develop strategies for risk mitigation and crisis management. • Evaluate and select secure technologies and suppliers. | • Strategy alignment confirmation at gate (pattern applies, no exceptions) | • Security strategy alignment assessment for the initiative | • Enterprise security strategy input paper • Target-state impact assessment • Board-level security briefing |
| Planning | Assessment | Enterprise Security Architect | Performs and facilitates a comprehensive security assessment of the current IT landscape to anticipate and plan for the security needs of new services. This includes evaluating existing security frameworks and their adequacy for supporting upcoming service transformations at an enterprise scale. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Perform thorough security audits of existing IT infrastructure, applications, and data. • Map out current security capabilities and identify areas requiring enhancement or upgrades. • Assess compatibility of existing security measures with new service requirements. • Project future security needs based on anticipated service expansions or changes. | • Domain risk context provided to project (existing assessment reused) | • Enterprise risk view for the affected domain with project implications | • Enterprise security assessment report • Domain risk posture analysis • Risk appetite mapping for the programme |
| Planning | Governance Planning | Enterprise Security Architect | Instrumental in crafting governance models that incorporate robust security measures. This stage focuses on developing enterprise-wide policies that standardise security practices across all services and ensuring compliance with both internal standards and external regulations. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop and refine enterprise-wide security governance frameworks. • Establish comprehensive security policies and compliance requirements. • Define clear security roles and responsibilities across all levels of the organisation. • Ensure alignment of security governance with global standards and regulations. • Create mechanisms for ongoing governance reviews and updates. | • Gate applicability decision recorded | • Governance route and assurance plan for the initiative | • Programme security governance framework • Design authority terms and schedule • Escalation and decision-rights map |
| Planning | Security and Compliance Planning | Enterprise Security Architect | Designs and defines an enterprise-wide security and compliance plan that outlines required security measures across the organisation. This strategic framework sets the standard for security practices in new and existing services, ensuring consistent application of security policies. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop detailed security and compliance plans covering all aspects of service and data protection. • Standardise security protocols across the enterprise to ensure uniform application. • Plan for continuous monitoring and auditing to ensure compliance and security standards are met. • Integrate compliance with international and industry-specific regulations. • Facilitate cross-departmental collaborations to align security and compliance efforts. | • Applicable policy and standards list issued to project | • Compliance obligations assessment for the initiative | • Enterprise compliance strategy mapping (UK GDPR, NIS, ISO 27001 SoA impacts) • Accreditation strategy |
| Planning | Architecture Design | Enterprise Security Architect | Direct and supervises that security principles are embedded at the foundation of service architecture planning. They guide the integration of security into architectural designs across the enterprise, ensuring scalability, data protection, and alignment with long-term strategic goals. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Guide the design of secure service architectures, ensuring robust protection mechanisms are in place. • Advocate for the incorporation of advanced security technologies • Collaborate with solution architects to embed security into all technology designs. • Ensure scalability and flexibility of security measures to adapt to changing threats. • Validate architectural designs against security best practices and standards. | • Approved pattern reference issued • Deviation decision if requested | • Target architecture guidance for the initiative • Pattern applicability assessment | • Enterprise security architecture blueprint for the programme • Domain model updates • Reference architecture extensions |
| Planning | Migration Planning | Enterprise Security Architect | Designs and defines strategies for the secure migration of data and systems within the enterprise framework, ensuring that transitions adhere to stringent security protocols and that all migration plans reflect the overarching security posture of the organisation. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Design comprehensive migration plans that prioritise security and minimise risk. • Establish protocols for secure data handling and system decommissioning. • Ensure compliance during migrations, including data protection laws and regulations. • Monitor and adjust security measures during the migration to respond to any issues. • Document all migration processes with a focus on security aspects. | • Migration standards reference issued | • Enterprise migration security guidance (sequencing, data protection principles) | • Enterprise migration security strategy • Cross-domain dependency and risk analysis |
| Planning | Cost Management Planning | Enterprise Security Architect | Direct and supervises the financial aspects of implementing security measures, ensuring investments in security are forecasted, justified, and aligned with the organisation’s strategic financial planning. This includes optimising spend on security technologies and services at the enterprise level. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Direct and supervise the budgeting for security initiatives, ensuring appropriate allocation of resources. • Conduct cost-benefit analysis of proposed security technologies and measures. • Align security spending with long-term strategic priorities and risk management frameworks. • Advocate for investments in security as essential to organisational resilience. • Monitor and report on the ROI of security expenditures to executive management. | • Benchmark security cost ratios provided | • Investment guidance with reuse opportunities identified | • Security investment strategy input • Portfolio-level cost-risk analysis • Protection-level options paper |
| Planning | Training and Change Management Planning | Enterprise Security Architect | Directs and coordinates the development of enterprise-wide security training programs and change management strategies. This stage is about embedding a culture of security awareness throughout the organisation and managing the impact of security changes on business processes and compliance requirements. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop comprehensive security training and awareness programs tailored to various organisational roles. • Create change management strategies that incorporate security from the outset. • Ensure effective communication of security policies and changes to all stakeholders. • Lead workshops and seminars to encourage a security-first mindset among employees. • Evaluate the effectiveness of training and change management efforts and adjust as necessary. | • Awareness materials pointer (existing enterprise content) | • Capability and awareness requirements input for the programme | • Enterprise security capability development plan input • Culture change strategy contribution |
| Design | Requirements Gathering | Enterprise Security Architect | Direct and supervises that security is deeply integrated into the service requirements from the very start. This involves collaborating with stakeholders to align security needs with business objectives, translating these into concrete security requirements that support both compliance and operational goals. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Collaborate with stakeholders to define security requirements based on business needs and objectives. • Ensure that all regulatory and compliance requirements are identified and integrated into the service requirements. • Advocate for security to be considered a primary requirement, not just an afterthought. | • Baseline security requirements issued from enterprise catalogue | • Tailored requirements set from enterprise catalogue with rationale | • Enterprise requirements catalogue extension • Regulatory traceability mapping for the programme |
| Design | Architecture Planning | Enterprise Security Architect | Influences the planning of service architecture to embed security as a fundamental component. The Enterprise Security Architect ensures that the selected service models and technologies are inherently secure, advocating for architectures that support both efficient service delivery and robust security. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Participate in selecting the service model (internal, single supplier, multi-supplier, hybrid) to ensure that chosen models align with security best practices. • Guide the choice and orchestration of technology services from a security perspective, ensuring secure integration and data handling across components. | • Pattern conformance confirmation | • Architecture option guidance with enterprise fit assessment | • Enterprise options appraisal with strategic alignment scoring • ADRs at enterprise level |
| Design | High and Detailed Design | Enterprise Security Architect | Provides direction for the development of high and detailed designs, ensuring they incorporate advanced security measures. This involves specifying encryption protocols, secure data handling practices, and access controls, setting the standard for security within the service architecture. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Ensure high and detailed designs incorporate strong security measures like data encryption, secure APIs, and robust access controls. • Review and approve all design documents for security efficacy and compliance with established security architecture standards. | • Design spot-check record at gate | • Design review with enterprise standards conformance findings | • Enterprise design assurance report • Cross-domain interface security review |
| Design | Security Design | Enterprise Security Architect | Directs and coordinates the security design process, ensuring that all aspects of the service are protected against potential threats. This includes designing comprehensive security frameworks that incorporate preventative, detective, and responsive measures, aligned with industry standards and regulatory requirements. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Design comprehensive security measures such as encryption standards, firewall configurations, and identity and access management (IAM) solutions and develop reusable patterns for project teams to implement. • Ensure designs comply with relevant security regulations and standards, providing a secure foundation for the entire service. | • Pattern instantiation approved (record) | • Security design review against reference architecture with findings | • Enterprise security architecture document for the programme • New/updated patterns published • Security case review |
| Design | Scalability and Reliability Design | Enterprise Security Architect | Direct and supervises that scalability and reliability designs include robust security measures to handle varying loads and potential threats effectively. This involves integrating security considerations into redundancy, load balancing, and autoscaling strategies to maintain service integrity under all conditions. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Advise on designing for scalability and reliability with a focus on maintaining security at scale. • Participate in defining strategies for load balancing, redundancy, and failover capabilities that do not compromise security measures. | • Scale guardrails reference provided | • Enterprise resilience requirements input for the design | • Enterprise resilience architecture review • Systemic failure-mode analysis across domains |
| Design | Cost Optimisation | Enterprise Security Architect | Optimises security investments by integrating cost-effective solutions that do not compromise on security. The Enterprise Security Architect evaluates and recommends technologies and practices that provide the best return on investment while maintaining strict security standards. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Assist in identifying cost-effective security solutions that maximise resource utilisation without sacrificing security. • Evaluate and recommend security technologies and practices that provide the best ROI while maintaining rigorous security standards. | • Reuse directive (use shared service X) | • Shared-capability options assessment for the project | • Enterprise cost-risk optimisation paper • Shared security services roadmap update |
| Design | Design Review and Validation | Enterprise Security Architect | Performs and facilitates thorough reviews and validations of the service design to ensure security measures meet all specified requirements. This critical oversight confirms that the service is not only compliant with security policies but also prepared to handle evolving threats effectively. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Lead security-specific design reviews and validation processes to ensure that the design meets all specified security requirements and best practices. • Coordinate with various stakeholders to ensure that security considerations are understood and implemented correctly. | • Gate decision record (approve/conditions) | • Design authority review minutes with conditions tracked | • Formal enterprise assurance report • Independent review commissioning and response oversight |
| Design | Documentation | Enterprise Security Architect | Direct and supervises the documentation of all security-related design decisions and architectures. The Security Architect ensures that these documents are comprehensive and maintained up-to-date, serving as essential references for troubleshooting, maintenance, and future audits. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Ensure that all security designs and decisions are thoroughly documented, providing a clear reference for future maintenance, troubleshooting, and audits. • Advocate for the creation of security documentation that is detailed, up-to-date, and accessible to all relevant parties for ongoing reference and training. | • Repository links verified at gate | • Architecture repository updates validated for the initiative | • Enterprise architecture documentation set updated (models, patterns, decisions) |
| Development | Idea Generation and Requirements | Enterprise Security Architect | Ensuring that security is foundational to new initiatives. They oversee the development of a centralised repository of security requirements and standards that projects must adhere to, ensuring alignment with regulatory and strategic goals. By conducting enterprise-wide risk assessments and providing targeted workshops, the ESA ensures that security considerations are seamlessly integrated into project charters and business cases. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop and maintain a centralised repository of security requirements and standards that all projects must adhere to, ensuring consistency and compliance from the outset. • Provide strategic oversight on the integration of security into business cases and project charters. • Organise workshops and training sessions to educate project teams on identifying and documenting security requirements aligned with enterprise-level strategies. • Lead security risk assessments at the enterprise level to prioritise security needs across multiple projects. | • Requirements repository reference issued | • Central requirements repository updates for the initiative | • Enterprise security requirements framework maintenance record • Standards gap analysis |
| Development | Design and Architecture | Enterprise Security Architect | Sets up and enforces and maintains a blueprint for enterprise-wide security architecture, serving as a guideline for all project designs. They lead cross-project review boards to ensure consistent application of security principles while promoting architectural innovation. Additionally, the ESA benchmarks and advocates for the integration of emerging technologies that enhance security resilience, ensuring these innovations align with long-term organisational objectives. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop and maintain a centralised repository of security requirements and standards that all projects must adhere to, ensuring consistency and compliance from the outset. • Provide strategic oversight on the integration of security into business cases and project charters. • Organise workshops and training sessions to educate project teams on identifying and documenting security requirements aligned with enterprise-level strategies. • Lead security risk assessments at the enterprise level to prioritise security needs across multiple projects. | • Blueprint conformance check note | • Blueprint alignment review with deviations managed | • Enterprise security blueprint updates • Cross-programme design consistency review |
| Development | Development and Coding | Enterprise Security Architect | Executes and applies a unified secure software development lifecycle framework across the organisation. They work closely with development teams to integrate secure coding practices within modern methodologies such as Agile and DevOps. By organising code review sessions and security hackathons, the ESA cultivates a proactive security culture and ensures that development teams have access to a curated library of secure coding resources, thereby accelerating the adoption of secure practices. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Advise on the selection of operational technologies and infrastructure that enhance security and resilience. • Participate in defining operational security architecture that includes robust recovery and backup solutions. • Evaluate and recommend secure configurations for operational environments, focusing on long-term sustainability and ease of management. • Ensure architectural plans include provisions for security patches and updates. | • Secure SDLC standard reference issued | • Secure SDLC conformance assessment for the delivery | • Enterprise secure SDLC framework updates • Toolchain security standards |
| Development | Testing and Quality Assurance | Enterprise Security Architect | Standardises security testing protocols, including automation frameworks that integrate into continuous testing environments. They provide strategic oversight on the prioritisation and remediation of security defects, ensuring that all projects adhere to rigorous security benchmarks. The ESA also oversees the maintenance of a dynamic threat model, which evolves in response to emerging threats and project developments, ensuring continuous protection. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Standardise advanced security testing techniques, such as fuzzing and ethical hacking, across organisation. • Develop security test automation frameworks that can be integrated into continuous testing environments. • Provide guidance on handling and prioritising the remediation of security defects found during testing. • Direct and supervise the creation and maintenance of a dynamic threat model that adapts as new threats emerge and projects evolve. | • Testing standards reference issued | • Security testing standards conformance review | • Enterprise security testing framework • Assurance scheme definition (what depth for what risk) |
| Development | Deployment and Release Management | Enterprise Security Architect | Direct and supervises that secure release management protocols are standardised across projects, including comprehensive guidelines for containerisation and cloud deployments. They conduct post-deployment audits to confirm adherence to security designs and establish performance benchmarks to assess the impact of security measures on system operations, thereby ensuring that deployments enhance, rather than inhibit, system functionality. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Standardise secure release management protocols, including rollback procedures and emergency response strategies, across all projects. • Develop security guidelines for containerisation and cloud deployments that all projects should follow. • Conduct post-deployment security audits to ensure compliance with the designed security architecture. • Establish security performance benchmarks for new deployments to measure the impact of security on overall system performance. | • Release standards reference issued | • Release management security review for the programme | • Enterprise release security protocols • Pipeline security reference architecture |
| Development | Monitoring and Performance Optimisation | Enterprise Security Architect | Development of security-specific performance management tools, defining key security performance indicators that align with overarching business objectives. They spearhead the implementation of adaptive security measures based on real-time data, optimising security responsiveness and system resilience. Regular security performance reviews enable the ESA to anticipate potential issues and strategically plan for enhancements. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Lead the development of security-specific performance management tools and dashboards for real-time monitoring across the enterprise. • Define key security performance indicators (KPIs) that align with business objectives for all projects. • Coordinate the implementation of adaptive security measures based on monitoring insights to enhance system resilience. • Facilitate regular security performance reviews to identify trends, anticipate potential issues, and plan strategic enhancements. | • KPI set reference provided | • Security KPI definitions for the service aligned to enterprise metrics | • Enterprise security metrics framework (KPI/KRI/KCI definitions) • Executive dashboard specification |
| Development | Feedback and Continuous Improvement | Enterprise Security Architect | Sets up and enforces a centralised feedback mechanism to capture and analyse security-specific insights from across the project lifecycle. This feedback informs continuous updates to the enterprise security strategy, ensuring it remains relevant and effective in addressing real-world challenges. By championing initiatives that drive security improvements and encourage innovation, the ESA ensures that organisation security practices are continuously refined and advanced. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Implement a centralised feedback mechanism to gather security feedback from across all stages of project lifecycles. • Analyse feedback data to derive actionable insights that inform enterprise security policy updates and project guidelines. • Regularly update the enterprise security strategy based on real-world application and feedback to maintain relevance and effectiveness. • Champion continuous improvement initiatives that drive better security practices and encourage innovation in addressing security challenges. | • Feedback routed to pattern backlog | • Feedback analysis with pattern/standard update proposals | • Enterprise improvement programme reporting • Lessons-learned integration into standards |
| Testing | Test Planning and Strategy | Enterprise Security Architect | Orchestrates the development of a unified testing strategy, embedding security across all project phases. This strategy standardises security testing protocols across organisation and ensures each project adheres to the same high standards and methodologies. By incorporating regulatory and compliance requirements, the ESA ensures security measures are consistent and compliant across various sectors. This strategic oversight aligns security practices with evolving business objectives effectively. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop an enterprise-wide testing strategy that integrates security at every phase, ensuring consistency across all projects. • Establish security testing standards, methodologies, and frameworks that all projects must adhere to, creating a uniform approach. • Identify and incorporate regulatory and compliance requirements into the testing strategy. • Facilitate cross-departmental collaborations to align security testing strategies with business objectives and technology advancements. | • Test strategy standards reference | • Test strategy review against enterprise assurance requirements | • Enterprise testing strategy • Assurance depth matrix by risk tier |
| Testing | Test Environment Setup | Enterprise Security Architect | Sets up and enforces baseline security configurations to maintain integrity and security controls across all environments. They implement stringent access controls and continuous monitoring to safeguard these environments from unauthorised access and potential breaches. Regular security audits ensure that any vulnerabilities or misconfigurations are promptly identified and corrected, maintaining the integrity of the testing processes. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Define baseline security configurations for all test environments across organisation to maintain control over data integrity and security. • Ensure the proper segregation of test environments from production networks to safeguard operational data. • Implement robust access controls and monitoring protocols for test environments to prevent unauthorized access and potential data leaks. • Regularly audit the security of test environments to detect and rectify vulnerabilities or misconfigurations promptly. | • Baseline configuration standards reference | • Environment baseline conformance confirmation | • Enterprise environment security baselines published and maintained |
| Testing | Test Case Design and Improvement | Enterprise Security Architect | Provides direction for the development of security test cases, ensuring coverage of anticipated security scenarios. They promote the creation of a centralised repository of reusable test cases, enhancing efficiency and consistency in security testing across projects. Periodic reviews and updates of test cases keep organisation abreast of emerging threats and technological changes, ensuring that testing remains robust and relevant. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Guide the development and standardisation of security test cases that comprehensively cover expected threats and vulnerabilities. • Introduce a repository of reusable security test cases to facilitate efficient test planning and execution across multiple projects. • Periodically review and update security test cases in response to new threat intelligence and technological changes. • Encourage the use of advanced simulation tools and techniques to create realistic security scenarios for testing. | • Threat scenario library reference | • Test coverage review against enterprise threat scenarios | • Enterprise threat scenario and abuse-case library maintenance |
| Testing | Test Execution | Enterprise Security Architect | Monitors the adherence to predefined security protocols and timelines. They provide expert analysis of complex test results, particularly in simulations that involve sophisticated security scenarios. The ESA also coordinates realistic incident response simulations to rigorously evaluate the effectiveness of organisation security measures, ensuring that test documentation is meticulous and thorough. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Monitor the execution of security tests to ensure they are carried out as per the defined protocols and within the set timelines. • Provide expertise in interpreting test results, particularly in complex security testing scenarios. • Coordinate incident response simulations during testing to evaluate the effectiveness of existing security measures. • Ensure comprehensive documentation of test activities and outcomes for future reference and audits. | • Escalation point for significant findings | • Oversight review of significant security findings | • Portfolio test outcome analysis • Systemic findings report to risk committee |
| Testing | Test Data Management | Enterprise Security Architect | Direct and supervises the management of sensitive test data, implementing policies that enforce data protection standards such as encryption and anonymisation. They ensure that data handling practices comply with legal and regulatory requirements and that all personnel involved in testing are trained in these practices. Regular audits of test data management procedures ensure ongoing compliance and security. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Direct and supervise the development and enforcement of policies for handling sensitive test data, including encryption, anonymisation, and secure storage. • Establish protocols for the secure disposal of test data that is no longer required. • Audit test data management practices regularly to ensure compliance with security policies and data protection laws. • Train testing teams on best practices for handling and protecting test data to prevent data breaches. | • Test data policy reference issued | • Test data policy conformance confirmation | • Enterprise test data protection policy and standards maintenance |
| Testing | Test Automation | Enterprise Security Architect | Advocates for the integration of scalable automated security testing tools within the CI/CD pipelines. They ensure that these tools are properly evaluated and updated to meet the dynamic needs of the organisation. This automation not only improves the efficiency of testing activities but also ensures that security testing evolves in line with technological advancements and new security challenges. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Promote the integration of automated security testing tools that are scalable and adaptable to different project needs. • Direct and supervise the implementation of continuous integration and continuous deployment (CI/CD) pipelines that include automated security scans. • Evaluate and approve new automation tools and technologies that can enhance the effectiveness of security testing. • Ensure that automated tests are regularly reviewed and updated to adapt to new security challenges and business requirements. | • Approved tooling list reference | • Automation approach review against enterprise toolchain | • Enterprise security test automation standards • Tool rationalisation decisions |
| Testing | Performance Testing | Enterprise Security Architect | Direct and supervises that security implementations do not adversely affect system performance. They work closely with performance teams to include security stress tests, analysing how security features perform under extreme conditions. This collaborative effort helps identify any security vulnerabilities that emerge under stress, providing critical insights for strengthening system defences. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Integrate security considerations into performance testing to ensure that security features do not adversely affect system performance. • Collaborate with performance testing teams to incorporate security stress tests under peak load conditions. • Analyse performance test results to identify potential security weaknesses exposed under stress and provide recommendations for reinforcement. | • Performance-security guardrails reference | • Review of security overhead findings with tuning direction | • Enterprise analysis of control performance impacts informing standards |
| Testing | Defect Tracking and Management | Enterprise Security Architect | Standardises the process of tracking and managing security defects across the organisation. They ensure that defects are prioritised based on their severity and impact, facilitating rapid and effective resolutions. Regular reviews of outstanding defects help refine response strategies and prevent similar issues in future projects. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Standardise defect tracking systems and ensure that security defects are classified, tracked, and managed with high priority. • Develop protocols for rapid response and resolution of critical security defects discovered during testing. • Encourage a feedback loop between project teams and security architects to enhance the defect resolution process based on past incidents and challenges. • Facilitate regular reviews of unresolved security defects to assess risk and determine necessary actions. | • Severity classification standard reference | • Defect classification and escalation conformance check | • Portfolio defect trend analysis • Systemic remediation direction |
| Testing | Continuous Improvement | Enterprise Security Architect | Analyses security testing outcomes and post-deployment performance to identify areas for enhancement. They organise regular review sessions to discuss testing successes and areas needing improvement, encourageing a culture of continuous learning and adaptation. The ESA ensures that security testing practices are not static but evolve to meet the changing landscape of threats and business needs. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Lead the analysis of testing and post-deployment data to drive continuous improvement in security testing practices. • Organise regular review sessions with project teams to discuss successes and areas of improvement in security testing. • Stay updated with the latest security testing methodologies and tools to ensure the organisation testing practices remain state-of-the-art. • Advocate for ongoing training and development opportunities for testing teams to enhance their security knowledge and skills. | • Lessons routed to standards backlog | • Testing improvement review with standards updates | • Enterprise assurance effectiveness review and framework updates |
| Deployment | Provisioning and Configuration | Enterprise Security Architect | Direct and supervises that all systems are provisioned and configured to meet the security standards set by organisation. The ESA develops and enforces configuration management policies to provide uniformity and efficiency across different environments. They oversee the deployment of servers, storage, and network capabilities, making sure that each component is configured to optimise security and operational performance from the outset. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop configuration management policies that ensure all deployed systems meet security requirements from the outset. • Direct and supervise the provisioning process of servers, storage, and networking equipment to ensure they are aligned with security best practices. • Implement robust security configurations, including firewall settings, encryption standards, and secure network protocols. • Establish guidelines for configuration changes to maintain security integrity across the system lifecycle. | • Configuration baseline standard reference | • Baseline conformance oversight record | • Enterprise configuration management policy • Platform security baselines published |
| Deployment | Monitoring and Incident Management | Enterprise Security Architect | Responsible for implementing monitoring systems across organisation to oversee the performance, availability, and security of services. They establish key performance indicators (KPIs) for security monitoring and proactive incident management. The ESA ensures that monitoring systems are capable of detecting and responding to security incidents swiftly, thereby minimising potential disruptions and enhancing the overall security posture. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Design monitoring systems to detect, alert, and respond to security incidents in real time. • Develop incident response procedures and KPIs to evaluate the effectiveness and timeliness of responses to security threats. • Train operational teams in incident detection and response techniques, ensuring rapid and effective handling of potential breaches. • Continuously review and enhance monitoring tools and practices to adapt to new security challenges and technological advancements. | • Monitoring standards reference | • Monitoring design conformance review | • Enterprise monitoring reference architecture • Incident response framework updates |
| Deployment | Performance Optimisation | Enterprise Security Architect | Uses monitoring data to optimise the performance of services across organisation. They adjust resource allocation, refine configurations, and employ advanced caching technologies to enhance service responsiveness and scalability. The ESA ensures that performance optimisation efforts do not compromise security, balancing efficiency with robust security measures. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Analyse performance data to identify bottlenecks and areas where security measures might impact system efficiency. • Optimise resource allocation and system configurations to balance security with performance and scalability. • Implement advanced caching techniques and load balancing strategies to improve service response times without compromising security. | • Optimisation guardrails reference | • Review of optimisation decisions affecting control coverage | • Enterprise performance-security policy guidance • Cross-service optimisation analysis |
| Deployment | Backup and Disaster Recovery | Enterprise Security Architect | Defines and oversees the implementation of backup and recovery procedures to ensure data integrity and availability across all services. They ensure that backup strategies are in alignment with business continuity requirements and are capable of restoring services quickly in the event of a disaster. The ESA regularly reviews and updates these strategies to adapt to new business needs and technological advancements. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Create and maintain a comprehensive disaster recovery plan that includes regular backups, failover procedures, and recovery tests. • Automate backup processes to ensure data integrity and minimise the risk of data loss in any disaster scenario. • Conduct regular disaster recovery drills to ensure all teams are prepared and recovery processes are effective and timely. • Update and refine backup and disaster recovery protocols to reflect changes in technology and business requirements. | • DR standards reference issued | • DR plan conformance review for the service | • Enterprise DR/resilience strategy contribution • Recovery architecture standards |
| Deployment | Security Management | Enterprise Security Architect | Enforces strict security measures across all deployment phases. They assure access control policies, encryption standards, and regularly updates security procedures to protect against new threats. The ESA conducts frequent security audits to ensure compliance with both internal security policies and external regulations. By continuously monitoring for threats and vulnerabilities, the ESA maintains a secure deployment environment. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Regularly update security policies and procedures to incorporate the latest security trends, technologies, and regulatory requirements. • Enforce rigorous access control measures to safeguard sensitive data and systems from unauthorized access. • Schedule and conduct regular security audits and vulnerability assessments to identify and address potential security gaps. • Collaborate with compliance teams to ensure all deployments meet industry standards and regulatory requirements. | • Policy set reference issued | • Security management conformance review | • Enterprise security policy updates • Access control architecture standards |
| Deployment | Patch and Configuration Management | Enterprise Security Architect | Direct and supervises that all services are maintained with the latest security patches and configurations. They oversee regular updates to enhance service reliability and security, ensuring that these updates are implemented without disrupting service continuity. The ESA’s management of patching processes is important for maintaining high security and operational standards. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Direct and supervise a scheduled patch management program that ensures all systems are protected against known vulnerabilities. • Implement change management processes that ensure all configuration changes are reviewed for security implications before implementation. • Maintain an audit trail of all patches and configuration changes to provide accountability and facilitate post-implementation reviews. | • Patch policy reference issued | • Patch programme conformance oversight | • Enterprise vulnerability management policy and SLA framework maintenance |
| Deployment | Capacity Planning and Scaling | Enterprise Security Architect | Monitor service demand and analyse usage trends to forecast future resource needs, planning capacity adjustments to handle growth efficiently. The ESA ensures that scalability measures are secure and cost-effective, optimizing resource utilisation without exposing organisation to increased security risks. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Systematically analyse current and projected service demand to plan resource scaling that accommodates growth without sacrificing security. • Develop scalable security architectures that ensure security measures expand effectively with system growth. • Collaborate with finance and business units to budget for scaling resources in a cost-effective manner that adheres to security requirements. | • Scaling guardrails reference | • Capacity approach review for security implications | • Enterprise capacity-security analysis informing platform strategy |
| Deployment | Continuous Improvement | Enterprise Security Architect | Commit to the ongoing refinement gather feedback from monitoring systems, incident reports, and user interactions to refine deployment strategies and enhance security measures. The ESA leads initiatives to resolve issues, optimise performance, and adapt deployment practices to meet evolving needs, ensuring organisation deployments remain state-of-the-art and securely aligned with business objectives. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Encourage a culture that values continuous improvement in security practices through regular feedback loops and performance reviews. • Lead cross-functional teams in identifying, implementing, and evaluating improvements in the security deployment process. • Utilise insights from monitoring, incidents, and operational feedback to drive strategic changes that enhance security measures and deployment efficiency. | • Lessons routed to enterprise backlog | • Deployment lessons review with standards implications | • Enterprise improvement portfolio reporting with pattern updates |
| Transition | Knowledge Transfer and Training | Enterprise Security Architect | Direct and supervises comprehensive security training and knowledge transfer during the transition to ensure operational teams are prepared to manage the security architecture. This includes ensuring that systems adhere to enterprise-level security requirements. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), RLMT (Stakeholder relationship management), ETDL (Learning delivery) | • Ensure that all security-related tools and procedures are understood by operational staff. • Lead workshops for operational teams to cover incident response protocols, monitoring systems, and new security controls. • Ensure the alignment of training with the enterprise security architecture. | • Handover standards reference | • Handover completeness oversight record | • Enterprise transition standards • Operational readiness framework maintenance |
| Transition | Incident Response Preparation | Enterprise Security Architect | Prepares incident response frameworks at an enterprise level, ensuring that all services and systems transitioned into operation have robust incident detection and management protocols integrated. This is done with a focus on enterprise-wide threats. | Level 6 - Initiate, influence | SCTY (Information security), BURM (Risk management), SCAD (Security operations), USUP (Incident management) | • Review incident response plans for enterprise services. • Ensure SIEM systems are properly configured for new services. • Conduct risk assessments to anticipate incident scenarios that may arise post-transition. | • Enterprise IR plan linkage confirmed | • IR readiness review for the service against enterprise plan | • Enterprise IR framework updates • Cross-service escalation architecture |
| Transition | Monitoring Enablement | Enterprise Security Architect | Direct and supervises that security monitoring systems are activated and integrated within the broader enterprise monitoring environment, with a focus on scalability and alignment with overarching enterprise security goals. | Level 6 - Initiate, influence | SCTY (Information security), METL (Methods and tools), EMRG (Emerging technology monitoring) | • Enable enterprise-wide visibility of systems during the transition. • Configure advanced detection capabilities and thresholds in the SIEM. • Align monitoring systems with long-term enterprise objectives, focusing on adaptability to new and evolving threats. | • SIEM onboarding standard reference | • Monitoring enablement conformance confirmation | • Enterprise detection strategy updates • Visibility requirements by domain |
| Transition | Operational Handover | Enterprise Security Architect | Direct and supervises the secure handover of services from the project team to the operational team. This includes verifying that all security configurations, documentation, and tools are transferred without any gaps, ensuring continued enterprise-level security alignment. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), CHMG (Change control), SCAD (Security operations) | • Review the handover of security responsibilities to ensure completeness. • Conduct a final enterprise-level audit of security policies and procedures. • Ensure that operational teams have the resources and documentation needed to maintain security at the enterprise level. | • Gate sign-off record | • Enterprise-level security audit of handover completeness | • Formal acceptance oversight with enterprise risk position statement |
| Transition | Post-Deployment Security Testing | Enterprise Security Architect | Validates the security of newly deployed services by conducting final security tests to ensure no new vulnerabilities have been introduced. Emphasis is on adherence to enterprise-wide security standards. | Level 6 - Initiate, influence | SCTY (Information security), NFTS (Non-functional testing), COPL (Continuity management) | • Coordinate and conduct enterprise-level security tests post-deployment. • Validate that the security controls in place meet enterprise security architecture requirements. • Ensure that the system functions securely under operational conditions. | • Validation results reviewed at gate | • Post-deployment assurance review record | • Enterprise validation report with residual risk acceptance routing |
| Operation | Environment Provisioning | Enterprise Security Architect | Direct and supervises the creation and configuration of virtual and physical environments to ensure they comply with enterprise-wide security standards. They play a crucial role in defining security protocols for the provisioning of resources, such as machines, devices, and storage, ensuring these protocols enhance security and reduce potential vulnerabilities from the outset. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop and enforce security standards for the provisioning of all operational environments, ensuring alignment with enterprise-wide security policies. • Direct and supervise the secure setup of infrastructure, including virtual machines, devices, and network configurations, to mitigate potential security risks. • Establish procedures for secure resource allocation that ensure all environments are consistent and compliant with requirements. | • Provisioning standards reference | • Provisioning standards conformance oversight | • Enterprise provisioning security standards maintenance with compliance reporting |
| Operation | Release Packaging | Enterprise Security Architect | Direct and supervises that deployment artifacts are created with security in mind, including rigorous version control and traceability of all components. They define the standards for bundling code and configurations that ensure secure and traceable releases, facilitating efficient and secure deployment processes. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Direct and supervise the creation of deployment artifacts, ensuring that all release packages adhere to strict security and version control guidelines. • Implement traceability measures for all configurations and code changes to facilitate security audits and compliance checks. • Ensure that release packages are securely stored and managed to prevent unauthorized access. | • Artefact signing policy reference | • Release integrity standards conformance review | • Enterprise software supply-chain security policy (signing, SBOM, provenance) |
| Operation | Configuration Management | Enterprise Security Architect | Managing and overseeing the configuration of environments and integration across the organisation. They establish and maintain security guidelines for configuration management that all operational projects must follow, ensuring consistency and compliance with security best practices across all deployments. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Define and maintain security policies for managing configurations, environment-specific settings, and external integrations across all operational platforms. • Ensure that configuration changes follow a controlled and documented process to maintain security integrity. • Regularly audit configuration management practices to ensure they meet security standards and address new threats. | • Configuration policy reference | • Configuration compliance oversight reporting | • Enterprise configuration security policy • Estate compliance analytics review |
| Operation | Deployment Automation | Enterprise Security Architect | Designs and implements automation strategies for deployments to ensure consistent, repeatable, and error-free deployment pipelines. They incorporate security measures into the automation tools and processes, enhancing the integrity and reliability of automated deployments across different environments. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Design and implement secure deployment automation processes that enhance consistency, repeatability, and efficiency across deployments. • Integrate security assessments into the automation pipelines to detect vulnerabilities before they impact production environments. • Monitor automated deployment processes to ensure they operate under the defined security parameters. | • Automation security standards reference | • Automation security design review | • Enterprise deployment automation security standards • Break-glass policy |
| Operation | Deployment Verification | Enterprise Security Architect | Direct and supervises that both functional and non-functional testing includes comprehensive security checks. They set predefined acceptance criteria that include stringent security validation to ensure that new deployments perform securely as intended before going live. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Establish security testing protocols as part of deployment verification to ensure all new systems meet organisation security standards. • Direct and supervise the execution of security validation tests to confirm that deployments are secure and compliant with predefined acceptance criteria. • Analyse results from deployment tests to identify and address security vulnerabilities promptly. | • Verification protocol reference | • Verification protocol conformance review | • Enterprise verification standards with attestation requirements |
| Operation | Rollback and Recovery | Enterprise Security Architect | Plans and tests rollback and recovery procedures to ensure they are effective and minimise downtime. They oversee the implementation of disaster recovery plans that allow quick restoration of services to a known good state, ensuring business continuity and data integrity. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Plan and test rollback procedures and disaster recovery plans to ensure they can be executed swiftly and effectively in the event of a security breach or deployment failure. • Ensure that recovery strategies are capable of restoring services to their last known secure state, minimising downtime and preserving data integrity. • Regularly review and update disaster recovery and rollback protocols to adapt to new business needs and technology changes. | • Recovery standards reference | • Recovery capability review for the service | • Enterprise recovery architecture standards including compromise recovery |
| Operation | Monitoring and Performance Optimisation | Enterprise Security Architect | Sets up and enforces monitoring procedures that not only track the performance and functionality of services but also oversee their security posture continuously. They utilize data from these monitoring activities to optimise performance without compromising security, ensuring organisation operations adapt to varying conditions efficiently. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Set up comprehensive security monitoring systems that continuously evaluate the security posture of operational services. • Utilise monitoring data to optimise service performance without compromising on security measures. • Develop strategies for performance tuning that enhance service responsiveness and scalability while maintaining security integrity. | • Metrics feed into enterprise dashboard confirmed | • Service posture review within enterprise reporting | • Enterprise security posture reporting • Portfolio detection coverage analysis |
| Operation | Defect Tracking and Management | Enterprise Security Architect | Designs and defines systems for tracking and managing defects throughout operational processes. They ensure that all security-related defects are prioritised based on their impact, coordinated efficiently with development teams, and resolved swiftly to maintain high service quality and security standards. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Implement a centralised defect tracking system that prioritizes security issues and coordinates their resolution efficiently. • Direct and supervise the defect management process, ensuring timely updates and patches are applied to mitigate risks associated with identified vulnerabilities. • Facilitate communication between operational teams and development teams to ensure seamless resolution of security defects. | • Severity standards reference | • Defect escalation oversight for security-significant issues | • Portfolio defect analytics • Architectural root-cause directives |
| Maintenance | Monitoring and Alerting | Enterprise Security Architect | Orchestrates the establishment of unified monitoring protocols that are applied across all operational environments within organisation. They integrate state-of-the-art detection tools and data analytics to proactively identify security threats, ensuring real-time alerting and swift mitigation. By automating responses to common security events, the ESA enhances the speed and accuracy of the organisation security operations, providing stakeholders with real-time security dashboards for immediate visibility and action. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Design and implement uniform monitoring processes across all operational environments to detect, analyse, and alert on security threats consistently. • Utilise cutting-edge detection technologies and data analytics to proactively identify and address potential security issues before they become critical. • Automate responses to common security events to reduce human error and response time, ensuring swift action is taken to mitigate risks. • Maintain real-time security dashboards that provide up-to-date visibility of security statuses across organisation to relevant stakeholders. | • Monitoring standards reference | • Monitoring effectiveness oversight review | • Enterprise detection strategy refresh • Cross-domain coverage gap analysis |
| Maintenance | Incident and Problem Management | Enterprise Security Architect | Centralises the incident reporting mechanisms, ensuring that all security incidents are managed consistently and efficiently across departments. They continuously enhance organisation incident response processes by integrating lessons learned from recent security incidents. Comprehensive recovery plans are developed and maintained, detailing actionable steps for effective recovery and ensuring business continuity in the face of security challenges. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Establish a centralised platform for reporting and managing security incidents to ensure consistency in handling and response strategies across various departments. • Regularly review and enhance incident response processes to incorporate lessons learned from recent incidents, improving both speed and effectiveness. • Create and maintain comprehensive recovery plans that detail actions to be taken during and after a security incident, ensuring business continuity. | • Escalation framework reference | • Significant incident review participation record | • Enterprise incident trend analysis • Architectural lessons directives • IR framework updates |
| Maintenance | Patch and Update Management | Enterprise Security Architect | Manages a coordinated patching schedule to ensure all systems across organisation are updated timely, minimising potential security vulnerabilities and operational disruptions. Post-update, they conduct thorough vulnerability assessments to confirm the security integrity of the systems. Additionally, the ESA leads educational initiatives on the importance of patch compliance, emphasising its critical role in maintaining organisation security and operational integrity. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Manage a coordinated patching schedule across organisation to ensure timely updates and minimise disruptions. • Perform vulnerability assessments after updates to verify that new or unforeseen vulnerabilities have not been introduced. • Educate and inform all operational teams about the importance of patch compliance to security and operational integrity. | • Patch policy reference | • Patch posture oversight for the domain | • Enterprise vulnerability posture reporting to risk committee • Policy threshold reviews |
| Maintenance | Performance Optimisation | Enterprise Security Architect | Direct and supervises that security measures align with system performance objectives, identifying any negative impacts and addressing them proactively. They regularly optimise security configurations to boost system efficiency without compromising security and facilitate cross-functional reviews with IT, operations, and security teams to maintain a balanced approach to performance optimisation and security. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Ensure that security measures are aligned with system performance goals, identifying and addressing any negative impacts. • Periodically optimise security configurations to enhance system efficiency without compromising security. • Facilitate regular performance reviews with IT, operations, and security teams to ensure a balanced approach to performance and security. | • Guardrails reference for tuning | • Performance-security review oversight | • Enterprise standards updates from performance findings |
| Maintenance | Capacity Planning and Scaling | Enterprise Security Architect | Embeds security risk assessments into the capacity planning processes, ensuring that increases in system capacity do not inadvertently introduce security risks. They provide expert guidance on secure infrastructure expansion and resource allocation, continuously monitoring the impact of scaling activities on organisation security posture to make necessary adjustments. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Embed security risk assessments into the capacity planning process to ensure new capacity additions do not introduce vulnerabilities. • Provide expert advice on secure infrastructure expansion and resource allocation, keeping security as a primary consideration. • Continuously monitor how changes in system capacity impact the overall security posture, adjusting security strategies accordingly. | • Capacity risk note if flagged | • Capacity risk review for security implications | • Enterprise capacity risk assessment integrated into planning standards |
| Maintenance | User Feedback and Enhancements | Enterprise Security Architect | Obtains and analyses user feedback focused specifically on security, using this input to drive improvements in security practices. They prioritise the implementation of security enhancements based on this feedback, enhancing user trust and satisfaction. They encourage user participation in security testing processes to ensure that security measures are both effective and aligned with user needs. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Actively solicit and analyse user feedback focused on security aspects, using this data to drive improvements in security practices. • Prioritise the implementation of security enhancements based on direct insights and requests from users to enhance user trust and satisfaction. • Encourage user participation in security testing and validation processes to gather feedback and enhance security measures. | • Feedback routed to policy/pattern backlog | • Feedback trend review with standards implications | • Enterprise usability-security analysis informing policy and design principles |
| Maintenance | Continual Improvement and Innovation | Enterprise Security Architect | Directs and coordinates initiatives to explore and integrate new security technologies and methodologies. They organise interdepartmental workshops and seminars to encourage a culture of knowledge sharing and continuous learning in security best practices. Staying abreast of industry trends, the ESA ensures that organisation security practices are not only current but also forward-thinking, keeping organisation agile and well-prepared for future security challenges | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Spearhead initiatives to explore new security technologies and methodologies that could enhance organisational security capabilities. • Organise workshops and roadshows to share knowledge and best practices in security across different departments. • Stay abreast of and implement industry-wide security trends and innovations to keep organisation security practices up-to-date and effective. | • Improvement items routed to enterprise backlog | • Domain improvement plan review | • Enterprise security improvement programme with innovation adoption decisions |
| Optimisation | Performance Analysis and Benchmarking | Enterprise Security Architect | Analyses security performance across the portfolio - control effectiveness, pattern adoption, incident and defect trends - benchmarking domains against protection-level targets and directing systemic improvement. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Aggregate control effectiveness and outcome metrics across domains and services into a portfolio view. • Benchmark domains against agreed protection levels, peer organisations and recognised frameworks (e.g. NCSC CAF). • Identify systemic weaknesses that individual projects cannot see and commission targeted improvement. • Report posture and trends to risk committees using outcome-driven metrics. | • Domain metrics reviewed in portfolio dashboard | • Domain benchmarking review with improvement directives | • Portfolio posture and benchmarking report • Protection-level review with risk committee • CAF/framework re-assessment |
| Optimisation | Cost and Value Optimisation | Enterprise Security Architect | Optimises enterprise security investment - rationalising duplicated capability across domains, renegotiating enterprise agreements, and redirecting spend to the controls that demonstrably reduce risk. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Maintain a portfolio view of security spend mapped to capability and risk reduction. • Identify duplicated or overlapping security capability across business units and direct consolidation. • Shape enterprise licensing and sourcing strategy for security technology. • Present costed protection-level options to investment boards for explicit trade-off decisions. | • Duplication flag raised for shared-service reuse | • Capability overlap assessment across business units | • Security investment optimisation strategy • Enterprise licensing case • Protection-level cost options paper |
| Optimisation | Process Improvement and Automation | Enterprise Security Architect | Improves enterprise security processes - architecture review, exception handling, assurance reporting - and sets the direction for security automation so that improvements compound across the organisation. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Streamline enterprise security governance processes (reviews, exceptions, assurance) using throughput and cycle-time evidence. • Define the enterprise approach and standards for security process automation, including policy-as-code. • Direct removal of duplicated effort between first- and second-line security activities. • Measure governance friction (review turnaround, exception ageing) and act on trends. | • Governance friction metrics reviewed | • Governance process improvement plan (review cycle times, exception ageing) | • Enterprise process automation strategy • Policy-as-code standards • Governance redesign proposal |
| Optimisation | Technology Refresh and Rationalisation | Enterprise Security Architect | Owns the strategic health of the security technology estate - the capability roadmap, end-of-life exposure across domains, and the rationalisation of overlapping products onto strategic platforms. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Maintain the enterprise security technology roadmap with lifecycle and end-of-support exposure by domain. • Direct rationalisation of overlapping security products onto strategic platforms. • Set refresh priorities based on risk exposure, cost and capability gain. • Update reference architectures and patterns to reflect the strategic technology set. | • Roadmap lifecycle entries updated | • Domain refresh priorities with risk-based sequencing | • Enterprise security technology roadmap refresh • Rationalisation business case • Updated reference architectures |
| Optimisation | Control and Configuration Tuning | Enterprise Security Architect | Sets enterprise policy and guardrails for control tuning - ensuring local tuning across domains stays within risk appetite, and harvesting tuning insight back into standards and patterns. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Define enterprise guardrails for control and detection tuning, including what requires design-authority approval. • Review aggregated tuning activity for patterns indicating design weaknesses in standards or patterns. • Ensure tuning practice is validated against threat models and does not silently erode coverage. • Fold recurring tuning lessons into updated patterns, baselines and standards. | • Tuning guardrails reference issued | • Aggregated tuning review with standards implications | • Enterprise tuning policy • Pattern and baseline updates from tuning insight • Coverage assurance review |
| Optimisation | Capability Enhancement and Innovation | Enterprise Security Architect | Directs the enterprise security innovation agenda - scanning emerging technology and threat developments, governing pilots, and deciding which proven capabilities become enterprise standards. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Maintain a security technology radar aligned to business strategy and threat evolution. • Govern the pipeline of capability pilots across domains, avoiding duplicated experiments. • Evaluate pilot outcomes and decide enterprise adoption, updating patterns and the capability roadmap. • Brief leadership on capability implications of emerging technology (e.g. AI, post-quantum cryptography). | • Technology radar entry updates | • Pilot governance record with evaluation criteria | • Security technology radar publication • Pilot portfolio review • Enterprise adoption decisions with pattern updates |
| Retirement | Identification and Assessment | Enterprise Security Architect | The ESA begins the retirement process by conducting thorough assessments of systems, applications, or resources that are candidates for decommissioning. This evaluation focuses on identifying obsolescence, security risks, or interoperability issues that may affect the broader enterprise environment. The ESA takes into account factors such as underutilisation, elevated maintenance costs, and the potential security vulnerabilities of outdated technologies. The goal is to ensure that retiring these assets does not expose organisation to undue risk. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Conduct thorough assessments of existing systems, applications, and resources to identify those that are obsolete, underutilised, or pose elevated security risks. • Analyse the impact of potential decommissioning on interconnected systems, data flows, and overall enterprise security architecture. • Evaluate the financial implications, including maintenance costs and potential savings, associated with retiring specific systems. • Identify legal and compliance implications of decommissioning, especially related to data retention and privacy requirements. | • Portfolio rationalisation candidate list entry | • Retirement assessment review with enterprise dependency check | • Portfolio rationalisation analysis • Enterprise dependency and risk assessment |
| Retirement | Planning and Strategy | Enterprise Security Architect | Once potential retirement candidates are identified, the ESA develops a strategic plan for the decommissioning process. This plan includes a detailed risk assessment, outlining potential security challenges and mitigation strategies to ensure that the transition is managed securely and efficiently. The ESA works closely with IT, compliance, and business units to create a roadmap that aligns with enterprise security policies and operational needs, scheduling the decommissioning to minimise disruption to ongoing services. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop decommissioning plans that detail risk assessments, mitigation strategies, and contingency plans. • Collaborate with stakeholders across IT, compliance, legal, and business units to ensure alignment with organisational goals and compliance requirements. • Establish clear schedules and timelines for decommissioning processes, including migration and data destruction phases, to minimise operational disruption. • Define security protocols for each phase of the decommissioning process to maintain data integrity and security. | • Decommissioning standards reference | • Decommissioning plan review against enterprise standards | • Enterprise decommissioning strategy • Regulatory and records obligations mapping |
| Retirement | Data Migration and Archiving | Enterprise Security Architect | The ESA oversees the migration and archiving of data from systems slated for decommissioning. They ensure that the data transfer process adheres to strict data integrity and security processes. The ESA implements data sanitisation standards to prevent any possibility of data leakage and ensures compliance with legal standards for data handling and storage. Their focus is on maintaining the confidentiality and integrity of data throughout its transition to new systems or archival solutions. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Supervise the migration of data from outdated systems to more secure, modern environments, ensuring that data integrity and security are preserved. • Implement rigorous data sanitisation processes for all decommissioned hardware to prevent unauthorised data retrieval. • Coordinate with data storage and compliance teams to ensure all data archiving methods meet current legal standards and organisational policies. • Conduct thorough validations post-migration to ensure all data has been accurately transferred and securely archived. | • Data disposition policy reference | • Data disposition plan conformance review | • Enterprise data disposition standards • Retention and archive architecture guidance |
| Retirement | Decommissioning and Resource Cleanup | Enterprise Security Architect | As systems are physically decommissioned, the ESA ensures that all components are securely shut down and that storage devices are either thoroughly wiped or securely destroyed, according to data destruction policies. They oversee the revocation of all associated permissions and ensure that the entire process is documented in detail, confirming that no residual data remains accessible. The ESA also manages the recycling or disposal of hardware in an environmentally responsible and secure manner. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Direct and supervise the physical and secure decommissioning of hardware, ensuring that all data is irretrievably destroyed if not migrated. • Manage the detailed inventory of all decommissioned assets, maintaining records of asset disposal or repurposing. • Ensure that environmental standards for electronic waste disposal are strictly followed. • Terminate all associated services, contracts, and agreements related to decommissioned systems, ensuring that no residual operational ties remain. | • Sanitisation standards reference | • Decommissioning evidence oversight review | • Enterprise sanitisation and disposal standards with assurance sampling |
| Retirement | Communication and User Transition | Enterprise Security Architect | Effective communication is vital during the decommissioning process. The ESA coordinates with communications teams to ensure all stakeholders are well-informed about the changes. They provide comprehensive guidance and support to users transitioning to new systems, facilitating workshops and training sessions to address security procedures and operational changes. The ESA's communication strategy aims to minimise confusion and disruption, ensuring a seamless transition for all involved. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Develop communication strategies to keep all affected stakeholders informed throughout the decommissioning process. • Provide guidance and support for users transitioning to new systems, including security training and documentation on new procedures. • Collect and address feedback from users throughout the transition, making adjustments to improve the process and resolve any issues promptly. | • Comms template reference | • Stakeholder communication review for security content | • Enterprise transition communication standards including regulatory notifications |
| Retirement | Review and Documentation | Enterprise Security Architect | Following the decommissioning, the ESA conducts a detailed review to evaluate the effectiveness of the entire process. This review helps identify any areas for improvement in handling future decommissioning. They update all relevant documentation to reflect the changes made, including security policies and operational guidelines. This documentation serves as a crucial record of the transition, detailing the rationale for decommissioning decisions and the methods used to secure and archive data. | Level 6 - Initiate, influence | STPL (Enterprise and business architecture), SCTY (Information security), BURM (Risk management), GOVN (Governance) | • Conduct detailed reviews after each decommissioning phase to evaluate its success and the effectiveness of the implemented security measures. • Document every aspect of the decommissioning process, from initial assessment to final cleanup, ensuring a thorough record for compliance and auditing purposes. • Update the organisation security policies, system documentation, and operational guidelines to reflect the changes made through the decommissioning. | • Lessons routed to enterprise repository | • Decommissioning review with repository updates confirmed | • Enterprise closure assurance report • Architecture repository and model updates |
Workbook source · SSA
Security Solutions Architect activity model
Solution-scoped responsibilities from options through transition.
Artefact columns show the information a project should produce, scaled by project size. Risk overrides size: a small-value change touching critical assets, personal data or novel technology adopts the next band up. Artefacts may live inside existing project documents rather than as standalone deliverables.
| Through Life Stage | Value Stream Activity | Role | Description | SFIA Responsibility Level | Relevant Skills | Activities | Example Artefacts - Small (<£250k, low risk) | Example Artefacts - Medium (£250k–£2m, moderate risk) | Example Artefacts - Large (>£2m, high risk or novel) |
|---|---|---|---|---|---|---|---|---|---|
| Planning | Service Strategy Development | Security Solutions Architect | Translates overarching enterprise security goals into specific project deliverables, ensuring each project aligns with the strategic security framework. The Project Security Architect collaborates with stakeholders to integrate security into the service's strategic planning from inception, ensuring robust defences are a foundational aspect of the project's design. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Translate overarching enterprise security strategies into detailed project-specific security requirements and benchmarks. • Incorporate enterprise-level security goals into project scope and objectives. • Engage with enterprise architects to ensure the alignment of project technologies and methodologies with strategic security directives. • Advocate for the inclusion of security considerations in project feasibility studies and service design sessions. | • Security objectives noted in project brief • Reference to enterprise security strategy | • Security alignment statement in PID • Initial security risk themes in RAID log | • Project security strategy paper • Security outcomes and NFR baseline agreed with ESA • Steering board security briefing |
| Planning | Assessment | Security Solutions Architect | Conducts thorough security assessments tailored to the project's scope and technological landscape, ensuring all security risks are identified early. This proactive evaluation helps shape the project's security posture by aligning it with enterprise-level benchmarks and preparing for potential threats. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Execute detailed security risk assessments for projects in alignment with enterprise-wide risk management frameworks. • Review and adapt enterprise security assessments to address project-specific contexts and challenges. • Collaborate with enterprise security teams to update and refine security assessments based on project developments. • Prepare comprehensive reports that evaluate the security posture of the project against enterprise standards. | • Threat table (top 5–10 threats vs assets) in project brief • Reuse of existing platform/domain risk assessment | • Scoped risk assessment (context DFD + STRIDE pass) • Risk log entries with owners and treatments | • Full security risk assessment report • Threat model workbook (DFDs, trust boundaries, attack paths) • Populated risk register with treatment plans |
| Planning | Governance Planning | Security Solutions Architect | Develops and enforces a security governance model that complies with enterprise standards but is customised for project-specific needs. This role ensures that security responsibilities are clearly defined within the project, enhancing accountability and ensuring consistent adherence to security policies. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Implement and monitor security governance as per the frameworks set by the enterprise security architecture. • Ensure strict adherence to enterprise security policies throughout the project lifecycle. • Develop project-specific security governance documentation in consultation with enterprise security architects. • Establish clear communication channels for reporting security issues that align with enterprise governance structures. | • Governance-by-inheritance note (which enterprise gates apply) | • Project security governance plan (gates, roles, RACI) • Design authority engagement schedule | • Security governance section in PMP • ToR for project security working group • Compliance obligations map |
| Planning | Security and Compliance Planning | Security Solutions Architect | Designs a detailed security and compliance plan for the project, aligning with enterprise security policies and regulatory demands. The Project Security Architect ensures that these plans are practical, executable, and embedded throughout the project lifecycle, from initial design through final delivery. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Design and refine project-level security plans to ensure they are fully compliant with enterprise-wide security policies. • Integrate compliance requirements from external and internal standards into the project execution plans. • Schedule, coordinate, and lead regular security audits, ensuring continuous adherence to compliance standards. • Develop and maintain an incident response strategy that aligns with enterprise standards. | • Compliance checklist of applicable policies and standards • Control selection note from reference pattern | • Lightweight security management plan • Regulatory applicability assessment (UK GDPR / NIS scope) | • Full security and compliance plan • DPIA where personal data is processed • Assurance strategy (e.g. CAF / ISO 27001 mapping) |
| Planning | Architecture Design | Security Solutions Architect | Leads the integration of security into the project's architecture, ensuring all technical designs incorporate necessary security controls and mechanisms. This involves close collaboration with technical architects to build security into the fabric of the project, from data handling to software deployment. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Create detailed security designs that integrate enterprise security requirements with project needs. • Collaborate with enterprise architects to ensure project architectures are scalable, secure, and compliant. • Perform technical design reviews to ensure that security is embedded in system architecture. | • Pattern selection record • Security paragraph in solution outline | • Security architecture section in HLD • Control allocation table (requirement → control) | • Standalone security architecture document • Conceptual and logical security models • Control traceability matrix |
| Planning | Migration Planning | Security Solutions Architect | Oversees the secure migration of data and systems, ensuring alignment with security best practices defined at the enterprise level. The Project Security Architect plans and monitors these transitions to mitigate risks and ensure continuity of security standards throughout the migration process. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Coordinate with enterprise architects to ensure secure migration strategies are robust and comply with standards. • Oversee the secure integration of new systems and data migrations, ensuring minimal risk and disruption. • Develop security protocols for data handling and system decommissioning during project transitions. • Monitor migration activities to enforce security measures and adjust plans as needed based on real-time findings. | • Data handling note in migration plan (classification, transfer method) | • Secure migration approach (sequencing, encryption, rollback) • Data classification register for migrated sets | • Secure migration strategy and runbook • Migration risk assessment • Data reconciliation and destruction evidence plan |
| Planning | Cost Management Planning | Security Solutions Architect | Carefully plans and manages the project's security budget, aligning expenditures with enterprise financial strategies and security priorities. This involves justifying security investments by demonstrating their importance in mitigating risks and enhancing the project's value. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop detailed budget proposals for security measures within projects, ensuring alignment with enterprise financial guidelines. • Manage project-level security expenditures, providing regular financial reports to enterprise architects and stakeholders. • Assess the financial impact of security decisions, optimising resource allocation to maximise security ROI. • Advocate for necessary security funding based on project-specific risks and requirements. | • Security line items in project budget | • Security cost estimate with build-vs-reuse options • Licence and tooling cost note | • Security investment case with cost-risk trade-offs • Whole-life security cost model including operations |
| Planning | Training and Change Management Planning | Security Solutions Architect | Develops and implements security training and change management strategies tailored to the project's needs. The Project Security Architect ensures all team members understand their security roles and responsibilities, promoting a culture of security awareness and compliance throughout the project lifecycle. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Design and implement comprehensive security training programs for project teams based on enterprise standards. • Coordinate with enterprise security teams to ensure consistent security messaging and training across projects. • Manage change processes related to security, ensuring that all project stakeholders understand and adhere to updated security practices. • Evaluate and respond to the effectiveness of security training and change initiatives, adapting strategies to meet project needs. | • Security awareness note in change communications | • Role-based security training outline for project teams • Change impact note covering security behaviours | • Security training and change management plan • Training needs analysis by role • Adoption metrics definition |
| Design | Requirements Gathering | Security Solutions Architect | Actively engages in the initial stages of project design to ensure that security requirements are accurately captured and integrated. The Security Solutions Architect collaborates with stakeholders to identify specific security needs, aligning them with the project objectives and ensuring these requirements are clearly documented and actionable. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Work closely with business analysts and project stakeholders to identify and document detailed security requirements specific to the project. • Analyse business objectives and security needs to ensure all relevant considerations are captured within project scope. • Analyse regulatory requirements and industry standards to integrate compliance into the project from the outset. • Develop security use cases and threat models that guide the security design process. | • Security requirements list (10–20 items) in requirements log | • Security requirements catalogue with MoSCoW priorities and acceptance criteria | • Security requirements specification • Traceability matrix (business need → security requirement) • Abuse and misuse cases |
| Design | Architecture Planning | Security Solutions Architect | Participates in the architecture planning process, injecting security expertise to guide the selection of secure service models and technologies. This role ensures that security is considered in every architectural decision, facilitating the design of a robust service infrastructure that prioritises security without compromising on functionality. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Participate in architectural decisions, ensuring security considerations are integrated into service models and technological choices. • Provide expertise on secure network architectures, data protection methods, and application security standards. • Assist in the selection of technologies and platforms that meet both performance and security requirements. • Advocate for security-by-design principles, ensuring they are foundational to the architectural planning process. | • Option note (pattern A vs B) with security pros and cons | • Architecture options paper with security evaluation criteria | • Formal options appraisal with weighted security scoring • Architecture decision records for security-significant choices |
| Design | High and Detailed Design | Security Solutions Architect | Works closely with the design team to embed comprehensive security measures throughout the high level and detailed design phases. By specifying essential security controls like encryption, secure channels, and robust authentication mechanisms, the Security Solutions Architect establishes a secure foundation for the entire project lifecycle. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop and implement detailed security design elements that incorporate best practices like encryption, firewalls, and intrusion detection. • Collaborate with the design team to embed security at every layer of the infrastructure, from the network to the application level. • Conduct peer reviews of security designs to validate robustness and adherence to technical specifications. • Document all security design configurations, providing a clear guide for developers and engineers. | • Security annotations in HLD/LLD (authentication, crypto, logging) | • Security design section in HLD and LLD • Interface security specifications | • Detailed security design document • Cryptography and key management design • Network zoning and segmentation diagrams |
| Design | Security Design | Security Solutions Architect | Leads the development of the project security architecture, designing layers of protection that safeguard against a broad spectrum of risks. This includes the integration of advanced security technologies and adherence to best practice security protocols to create a resilient and compliant service environment. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Lead the creation of a comprehensive security architecture, ensuring it encompasses all aspects of the project‚Äö√Ñ√¥s technical and operational scope. • Design and specify security controls, authentication protocols, and access management systems to protect data and applications. • Integrate security monitoring tools and incident response mechanisms into the project design. • Validate security models against established benchmarks and project requirements. | • Control implementation table (control → component) • Threat table carried through from planning | • Lightweight threat model (DFD + STRIDE) informing the design • Instantiated security patterns recorded in repository | • Full threat model (per-element STRIDE, attack trees) • Layered security architecture document • Security case (claims–argument–evidence) |
| Design | Scalability and Reliability Design | Security Solutions Architect | Ensures that designs for scalability and reliability incorporate strong security measures that adapt to changing load conditions and potential threats. The Security Solutions Architect advises on implementing scalable security solutions that maintain protection and performance even under peak demands. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Ensure that security designs incorporate flexible scaling options that do not compromise security as system demand increases. • Advise on the implementation of failover mechanisms and redundancy to maintain security during potential system failures. • Plan for security capacity management to handle increases in usage or data flow securely. • Review scalability plans to ensure they meet security standards across all potential operational scenarios. | • Note on security behaviour under scale (rate limits, session handling) | • Security NFRs for scale and failover with test hooks | • Resilience-security analysis (failure modes vs controls) • DoS and abuse mitigation design |
| Design | Cost Optimisation | Security Solutions Architect | Identifies and implements cost-effective security solutions during the design phase, ensuring that the project maximises security ROI. This involves balancing budget constraints with the need for effective security, advocating for investments in technologies that provide long-term security benefits. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Evaluate the cost implications of security choices, aiming to optimise the balance between expense and effective protection. • Recommend security solutions that offer the best value for money without compromising on critical security needs. • Participate in budget discussions to justify security expenditures based on risk assessments and potential impact. • Monitor and report on the efficiency of security investments throughout the design phase. | • Reuse decision note (shared security services vs new build) | • Control cost comparison with residual-risk statement | • Cost-risk optimisation paper agreed at design authority |
| Design | Design Review and Validation | Security Solutions Architect | Conducts rigorous security reviews and validations of the project design to ensure it meets all specified security requirements and aligns with broader compliance standards. This critical evaluation helps to refine the security posture of the project before moving into deployment. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Conduct comprehensive security validations to ensure that all design elements meet required security standards before project implementation. • Organise and lead security review sessions with project stakeholders to discuss and address potential security issues. • Adjust security strategies based on feedback from design reviews to enhance project resilience and compliance. • Ensure that final designs incorporate all necessary security modifications and approvals before moving forward. | • Peer review comments and closure log | • Design review record with findings and actions • Standards conformance checklist | • Formal design assurance report • Independent (second-line) review findings and response |
| Design | Documentation | Security Solutions Architect | Manages the meticulous documentation of security design decisions and the architectural rationale. The Security Solutions Architect ensures that all security aspects of the project are well-documented, facilitating future reference, compliance audits, and ongoing project governance. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Oversee the documentation process for all security-related designs and decisions, ensuring clarity and accessibility for future reference. • Maintain detailed records of security configurations, standards, and guidelines used in the project. • Prepare and update security documentation to reflect changes and updates during the project lifecycle. • Provide training materials based on the security documentation to educate the project team and relevant stakeholders on security protocols and procedures. | • Updated HLD/LLD security sections • Decision log entries | • Security design rationale document • Updated artefacts in architecture repository | • Complete security design pack in repository • As-designed baseline for downstream assurance |
| Development | Idea Generation and Requirements | Security Solutions Architect | Engages from the initial phases of project conception, ensuring that security considerations are integrated from the beginning. They work closely with project managers and stakeholders to accurately identify and document detailed security requirements tailored to the project's specific needs. The SSA ensures that these security specifications align with broader organisations standards while addressing the unique aspects of the project. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Collaborate with project managers to identify and integrate security requirements early in the project lifecycle. • Conduct initial risk assessments to inform security needs and document specific security requirements. • Ensure that security requirements are clearly defined, documented, and aligned with both project goals and organisations security policies. | • Security acceptance criteria on user stories | • Security requirements refinement log • Definition-of-done security criteria | • Security requirements baseline under change control • Epic-level assessment against threat model |
| Development | Design and Architecture | Security Solutions Architect | Embedding security into the technical designs of the project. They collaborate with project architects to ensure that all designs reflect best security practices, from data encryption to secure network configurations. The SSA reviews architectural proposals, ensuring they provide robust defence mechanisms against potential threats and comply with relevant regulations. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Work closely with architects to incorporate security measures into the project's design, ensuring architectures are robust against potential threats. • Review and approve security aspects of architectural designs, ensuring compliance with security best practices and regulatory requirements. • Advocate for the inclusion of advanced security technologies and solutions during architectural planning. | • Secure design checklist for developers | • Component security design notes • Approved deviations log | • Per-increment security design updates under governance • Threat model maintained per release |
| Development | Development and Coding | Security Solutions Architect | Implements security measures within the coding practices. They ensure the adoption of secure coding standards, oversee code reviews, and integrate security testing tools directly into the development process. The SSA conducts regular security audits to identify and rectify vulnerabilities early, ensuring the codebase remains secure throughout the project lifecycle. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Implement and enforce secure coding guidelines across development teams. • Oversee the integration of security testing tools within the development process, such as static and dynamic code analysis. • Conduct regular security code reviews and audits to identify and mitigate vulnerabilities. • Facilitate security-focused training sessions for developers to enhance security awareness and skills. | • Secure coding checklist adopted • SAST/linter configuration | • Secure coding standard tailored to the stack • Code review security checklist • SAST triage log | • Secure SDLC evidence pack (SAST, SCA, secrets scanning policies) • Security exemption register with expiry dates |
| Development | Testing and Quality Assurance | Security Solutions Architect | Oversees the integration of comprehensive security testing within the project's QA processes. They ensure that penetration tests, security audits, and vulnerability assessments are conducted rigorously. The SSA works closely with QA teams to prioritise the remediation of security issues, verifying that all security defects are addressed before the software is deployed. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop and oversee a comprehensive security testing strategy, incorporating penetration testing, vulnerability assessments, and security audits. • Collaborate with QA teams to ensure that security testing is thorough and integrated into all stages of QA. • Prioritise and manage the remediation of security issues discovered during testing. • Validate security measures and controls before final project sign-off. | • Security test cases covering top risks in test plan | • Security test plan • DAST scan reports with triaged findings | • Security test strategy • Penetration test scope and report • Remediation tracker with SLAs |
| Development | Deployment and Release Management | Security Solutions Architect | Ensures that secure deployment practices are meticulously followed during the release management process. They oversee the secure configuration of environments and manage the deployment pipelines to safeguard against security breaches. The SSA actively participates in the release process, validating security implementations and ensuring that the deployment meets all predefined security criteria. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Monitor and manage the secure configuration of project deployments. • Ensure that CI/CD pipelines incorporate appropriate security checks and balances. • Supervise and validate security implementations during deployment to ensure compliance with defined security standards. • Coordinate with operations teams to ensure smooth and secure release processes. | • Secure deployment checklist in release notes | • Pipeline security gate definitions • Signed artefact policy | • Release security assurance report per major release • Pipeline security architecture description |
| Development | Monitoring and Performance Optimisation | Security Solutions Architect | Post-deployment, the SSA sets up and manages security monitoring tools to continuously oversee the performance and integrity of the application. They track security metrics to identify any operational issues and swiftly implement optimisations to enhance security and system performance. The SSA ensures that the application responds effectively to both user demands and potential security threats. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Set up and manage security monitoring tools to continuously track the application's performance and security posture. • Analyse security and performance data to identify and address operational security issues. • Recommend and implement security enhancements and performance optimisations based on real-time monitoring insights. • Ensure that monitoring systems are calibrated and maintained to detect emerging threats and vulnerabilities effectively. | • Log and event list - what the solution must record | • Monitoring requirements specification (events, alerts, retention) | • Security monitoring design with use cases mapped to MITRE ATT&CK • SIEM onboarding pack |
| Development | Feedback and Continuous Improvement | Security Solutions Architect | Utilises feedback from users, IT support, and monitoring systems to drive the continuous improvement of security practices within the project. They analyse this feedback to identify trends and areas for enhancement, incorporating these insights into the ongoing development and refinement of the project. The SSA promotes an iterative development process, ensuring that the project adapts to evolving security needs and user requirements. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Establish a feedback loop with users, IT support, and other stakeholders to gather security-related feedback. • Analyse feedback to identify common security issues and trends, using this data to drive improvements in the project. • Lead iterative development cycles to incorporate new security features and enhancements based on user and operational feedback. • Regularly update security practices and protocols to adapt to new threats and changes in the project environment. | • Security lessons captured in retrospective actions | • Security improvement backlog with owners | • Continuous improvement report with metric trends feeding design updates |
| Testing | Test Planning and Strategy | Security Solutions Architect | Developing and refining the testing strategy for specific projects. They ensure that the security aspects of the testing strategy align with both the project's objectives and organisations broader security policies. By collaborating closely with project managers, the SSA identifies critical security tests needed to validate the project's resilience against threats, ensuring a thorough understanding and planning of security testing requirements. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Collaborate with project stakeholders to define security objectives and requirements for testing. • Develop a detailed security testing strategy that aligns with the overall project delivery timeline. • Identify key security risks and vulnerabilities to be addressed during testing. • Ensure integration of security testing with other test planning activities. | • Security test scope note in project test plan | • Security test plan (scope, methods, environments, exit criteria) | • Security test strategy including penetration test and assurance mapping to requirements |
| Testing | Test Environment Setup | Security Solutions Architect | Ensures that environments are securely configured and isolated from production networks. They oversee the implementation of security controls within these environments to prevent data leaks and unauthorised access. The SSA also works to maintain the integrity of the test environments, ensuring that they accurately emulate the production environment for reliable security testing. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Design and oversee the setup of secure test environments that mimic production settings. • Implement and maintain robust access controls and security measures in all test environments. • Ensure proper segregation of test environments from production and other environments. • Regularly audit and update security configurations to prevent unauthorized access and data leaks. | • Environment hardening checklist • Test data handling note | • Environment security configuration baseline • Isolation confirmation from production | • Environment security design and attestation • Production-parity risk assessment |
| Testing | Test Case Design and Improvement | Security Solutions Architect | Designing and improving test cases that specifically address the security needs of the project. They ensure that each test case comprehensively covers potential security vulnerabilities and exploits. The SSA regularly reviews and updates test cases to include new and emerging threats, ensuring the project remains protected against the latest security challenges. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop comprehensive security test cases that cover all identified risks and regulatory compliance requirements. • Continuously review and update test cases to incorporate new threats and vulnerabilities. • Collaborate with software developers and QA teams to ensure that security test cases are integrated into the overall test plan. • Utilise security scenarios and use cases to enhance the realism and effectiveness of test cases. | • Security test cases for top 5–10 risks | • Test case library mapped to requirements and threats | • Full traceability chain: threat → requirement → test case → result • Abuse case test suite |
| Testing | Test Execution | Security Solutions Architect | Oversees the running of security-specific tests, ensuring they are executed as planned and within specified parameters. They closely monitor the execution process to identify any deviations or unexpected results. The SSA analyses the outcomes of security tests to verify that security measures within the project are effective and to identify areas needing enhancement. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Supervise the execution of security tests to ensure they are performed as per the strategy and timelines. • Monitor test executions for security incidents and ensure immediate response to detected issues. • Analyse test results for security implications and document all findings for review. • Coordinate with QA and development teams to address any security issues identified during testing. | • Test results with security defects raised in tracker | • Security test execution report with evidence | • Formal security test report with residual-risk statement signed by the risk owner |
| Testing | Test Data Management | Security Solutions Architect | Manages the security aspects of test data within the scope of the project to ensure its integrity and confidentiality. They establish protocols for the creation, use, and disposal of test data, especially when handling sensitive or personal data. The SSA ensures compliance with data protection laws and regulations, thereby safeguarding the test data from potential security breaches. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Establish protocols for handling, storage, and disposal of sensitive test data. • Ensure encryption and proper security measures are applied to test data to prevent breaches. • Manage test data lifecycle to comply with data protection laws and best practices. • Audit test data usage and security periodically to ensure compliance and identify any lapses. | • Test data rule recorded (no live personal data / masking applied) | • Test data management plan (masking, synthetic data, disposal) | • Test data risk assessment • DPIA update where applicable • Disposal evidence |
| Testing | Test Automation | Security Solutions Architect | Promotes the use of automated security testing tools to enhance the efficiency and coverage of tests. They ensure that automated tools are properly integrated into the testing process, providing consistency across tests and reducing the potential for human error. The SSA regularly evaluates the effectiveness of automated testing tools and updates them to adapt to new security requirements. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Implement and manage automated security testing tools and frameworks. • Ensure test automation includes a variety of security tests, such as static code analysis and dynamic scanning. • Regularly review and calibrate automated testing tools to maintain their effectiveness and accuracy. • Advocate for the integration of security automation in the CI/CD pipeline. | • Automated security scan jobs configured in pipeline | • Automation coverage matrix for security tests | • Security test automation framework description • Coverage and drift reports |
| Testing | Performance Testing | Security Solutions Architect | Integrates security considerations into performance testing, assessing how security measures impact the performance of the system under various loads. They ensure that performance tests do not compromise security protocols and that the system remains stable and secure even under stress conditions. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Integrate security assessments into performance testing to evaluate the impact of security measures on system performance. • Plan and execute stress tests to assess system resilience and security under high load. • Analyse performance test results to identify security performance issues and bottlenecks. • Collaborate with performance engineers to ensure that security optimisations do not adversely affect performance. | • Note on security control behaviour under load in performance report | • Performance scenarios including security overhead measurements | • Security-performance analysis with control tuning recommendations |
| Testing | Defect Tracking and Management | Security Solutions Architect | Manages the tracking and resolution of security defects discovered during testing. They prioritise defects based on their potential impact on project security and coordinate with development teams to ensure timely and effective fixes. The SSA maintains detailed records of security defects to facilitate analysis and prevent recurrence in future projects. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Track and prioritise security defects based on their severity and impact on the project. • Manage the lifecycle of security defects from detection to resolution. • Facilitate communication between developers, testers, and security teams to ensure effective defect resolution. • Review closed security defects to ensure thorough remediation and prevent recurrence. | • Security defects tagged with severity in tracker | • Security defect triage log with SLA tracking | • Defect trend and root-cause analysis • Escape analysis (defects missed at design) |
| Testing | Continuous Improvement | Security Solutions Architect | Uses feedback from the testing phase to continuously improve security measures within the project. They analyse testing results to identify trends and patterns in security vulnerabilities, using this information to refine security strategies. The SSA encourage s a culture of continuous security improvement, ensuring that security practices are constantly evolving to meet the project's needs and external threats. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Analyse feedback from security testing phases to identify trends and areas for improvement. • Lead post-project reviews focusing on security outcomes to derive lessons learned. • Update security testing strategies and practices based on project experiences and industry developments. • Promote a culture of continuous security enhancement across project teams. | • Retrospective actions on security testing | • Testing improvement plan updates | • Assurance effectiveness review feeding the test strategy |
| Deployment | Provisioning and Configuration | Security Solutions Architect | Oversees the provisioning and secure configuration of new systems as part of the project's deployment phase. They collaborate closely with IT operations to ensure that servers, storage, and network resources are set up according to the specific security standards developed during the design phase. The SSA ensures each component is securely configured before the system goes live, establishing a strong security foundation from the outset. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Work closely with IT operations to ensure that all new deployments are provisioned according to the project-specific security requirements and design specifications. • Oversee the secure configuration of servers, storage, and network resources, ensuring they adhere to the security architecture defined during the project design phase. • Validate security settings and configurations before the system goes live to prevent potential security vulnerabilities from the start. | • Hardened build checklist • Reference to platform configuration baseline | • Configuration baseline document (CIS-aligned) • IaC security scan results | • Secure build standard per platform • Compliance scan attestation pack |
| Deployment | Monitoring and Incident Management | Security Solutions Architect | Designs and implements tailored monitoring strategies that are specifically aligned with the security needs of the project. They develop detailed incident response plans that define the procedures and roles for handling security incidents. Additionally, the SSA conducts training sessions for the operational teams, equipping them with the necessary skills and knowledge to manage and respond to security alerts effectively. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Design and implement monitoring strategies that align with the specific security needs of the new service or application, ensuring all critical components are monitored for security threats. • Establish incident response plans specific to the new deployment, detailing roles, responsibilities, and procedures for addressing potential security incidents. • Train project-specific operational staff on how to respond to security alerts and incidents according to the predefined incident management process. | • Alert routing note - who is notified of what | • Monitoring and alerting design for the service • Incident escalation matrix | • Security operations handover pack (detection use cases, playbook links, tuning guidance) |
| Deployment | Performance Optimisation | Security Solutions Architect | Monitors the impact of security measures on the performance of new deployments, ensuring that these do not detract from the user experience or system efficiency. They work collaboratively with system administrators to fine-tune security configurations, optimising the balance between security and performance to ensure that the new service operates optimally. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Monitor the performance impacts of security measures post-deployment to ensure they do not adversely affect the user experience or system efficiency. • Collaborate with system administrators to tune security settings, optimising configurations to balance security with performance. • Adjust security practices based on real-world performance data to ensure optimal operation of the new service. | • Post-go-live check note (controls vs performance) | • Performance impact assessment of security controls | • Optimisation report with tuning decisions and risk sign-off |
| Deployment | Backup and Disaster Recovery | Security Solutions Architect | Ensures that robust backup and disaster recovery plans are in place and thoroughly tested before any new service is launched. They work with IT operations to establish offsite backups and automated recovery processes that comply with the project's risk management strategies. By conducting pre-launch recovery drills, the SSA verifies the effectiveness of these plans, making necessary adjustments to guarantee rapid recovery and continuity. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Ensure that backup and disaster recovery plans are in place and tested before deployment, aligning them with the project's risk management strategy. • Coordinate with the IT operations team to set up offsite storage solutions and automated backup schedules that meet the project's business continuity requirements. • Conduct pre-launch disaster recovery drills to verify the effectiveness of recovery procedures and adjust as necessary. | • Backup schedule and restore test note | • Backup/DR plan covering security of backups (encryption, access) | • DR runbook with restore test evidence • Immutable backup design |
| Deployment | Security Management | Security Solutions Architect | Implements and oversees the security controls and measures designed during the project phase. This includes managing access controls, applying encryption protocols, and deploying security monitoring tools. The SSA regularly reviews and adjusts these measures based on initial monitoring data and feedback to ensure the deployment remains secure and compliant with organisations and regulatory standards. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Implement security controls and measures designed during the project phase, including access controls, encryption, and security monitoring tools. • Regularly review and adjust security configurations and policies based on findings from initial monitoring and feedback from early users. • Coordinate with the enterprise security team to ensure that the project's security management practices align with organisations standards and compliance requirements. | • Access control matrix for the service | • Security management plan for the live service • JML process linkage | • Security management framework for the service • Privileged access design • Attestation schedule |
| Deployment | Patch and Configuration Management | Security Solutions Architect | Manages the initial rollout of patches and system updates, ensuring they are implemented securely and effectively. They oversee the integration of these updates into regular maintenance schedules, maintaining continuous protection against new vulnerabilities. All changes and updates are meticulously documented to support audit processes and ongoing configuration management. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Manage the initial rollout of patches and updates for the new deployment, ensuring they are applied in a controlled and secure manner. • Oversee the integration of patch management processes into the service's regular maintenance routines, ensuring continuous protection against vulnerabilities. • Document all changes and updates for audit purposes and ongoing configuration management. | • Patch responsibility note - who patches what, by when | • Patch and vulnerability management plan for solution components | • Vulnerability management integration description • Severity-based SLA matrix and exception process |
| Deployment | Capacity Planning and Scaling | Security Solutions Architect | Monitors usage to verify that the capacity meets actual demand and plans for future scaling. They ensure that scalability considerations include maintaining robust security as the service grows, providing strategic guidance on resource allocation to handle increased loads securely. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Monitor the initial usage patterns of the new service to assess if the capacity planning done during the project phase meets the actual demand. • Plan for future scaling based on early usage data and predicted growth, ensuring that security scalability is maintained as the service expands. • Provide input on adjusting resource allocation to handle increased load without compromising security. | • Scaling note including security components | • Capacity plan covering security tooling (SIEM throughput, licence headroom) | • Capacity and scaling analysis with security control scaling design |
| Deployment | Continuous Improvement | Security Solutions Architect | Gathers and analyses feedback from the deployment phase to identify any security issues or areas for improvement. They lead post-deployment reviews to refine security strategies based on real-world performance and operational feedback. This continuous improvement process helps the SSA enhance security practices for future deployments, ensuring lessons learned are integrated into subsequent project delivery cycles. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Collect and analyse feedback from the deployment phase to identify any security-related issues or potential improvements. • Initiate post-deployment security reviews to refine deployment strategies and enhance security measures based on real-world observations and operational feedback. • Drive continuous improvement in security practices by incorporating lessons learned into future project delivery phases. | • Post-deployment review actions | • Deployment lessons report • Improvement backlog entries | • Formal post-implementation review with security findings • Pattern and standard update proposals |
| Transition | Knowledge Transfer and Training | Security Solutions Architect | Ensures that project-specific security knowledge, tools, and processes are transferred effectively to the operational teams, with a focus on how security controls support the system’s business requirements. | Level 5 - Ensure, advise | PRMG (Project management), SCTY (Information security), CIPM (Organisational change management) | • Conduct training sessions on security controls designed during the project. • Facilitate knowledge transfer on how security mechanisms map to the project’s functional requirements. • Provide documentation detailing security implementation and its integration within the system. | • Handover walkthrough session record | • Security handover pack (controls, configurations, contacts) • Training session records | • Knowledge transfer plan with completion evidence • Operational security training curriculum |
| Transition | Incident Response Preparation | Security Solutions Architect | Prepares incident response documentation tailored to the specific solution being delivered, ensuring operational teams can respond effectively to security incidents related to the project. | Level 5 - Ensure, advise | SCTY (Information security), SCAD (Security operations), USUP (Incident management) | • Document incident response protocols relevant to the project. • Ensure project-specific monitoring rules are created and tested in line with expected system behaviours. • Collaborate with operational security teams to prepare for potential incident scenarios. | • Escalation contact card • Known-risk list for the service desk | • Service-specific incident response playbook (draft) • Monitoring rule list | • IR playbooks exercised via tabletop • Documented integration with enterprise IR plan |
| Transition | Monitoring Enablement | Security Solutions Architect | Configures monitoring tools specific to the project, ensuring that security controls and events are properly logged and aligned with the overall security design. Focus is on ensuring coverage of all critical components designed during project delivery. | Level 5 - Ensure, advise | SCTY (Information security), SCAD (Security operations), METL (Methods and tools) | • Work with operational teams to configure project-specific monitoring. • Ensure critical security events and log sources are integrated into the monitoring platform. • Validate that all security controls within the solution are monitored and alerting as designed. | • Log source onboarding request and confirmation | • Monitoring enablement checklist completed • Alert test evidence | • Detection use-case pack mapped to the threat model • Tuning baseline report |
| Transition | Operational Handover | Security Solutions Architect | Facilitates the secure handover of the project to the operational team, ensuring that all security configurations and controls are documented, and that operational teams understand how to manage the security features. | Level 5 - Ensure, advise | PRMG (Project management), SCTY (Information security), CHMG (Change control) | • Create a detailed security handover document, covering all configurations and controls. • Ensure operational teams understand the security architecture implemented within the project. • Conduct final checks to confirm that all security elements are functioning as intended. | • Signed handover checklist | • Security handover document (controls, exceptions, residual risks) | • Formal acceptance into service with security acceptance criteria and sign-offs |
| Transition | Post-Deployment Security Testing | Security Solutions Architect | Oversees post-deployment security testing specific to the project, ensuring that all security controls are functioning as designed. Focus is on validating that no security regressions or gaps exist after deployment. | Level 5 - Ensure, advise | SCTY (Information security), NFTS (Non-functional testing), COPL (Continuity management) | • Conduct security validation tests based on the project’s security architecture. • Ensure that post-deployment tests cover all implemented security features. • Collaborate with operational security teams to address any issues found during testing. | • Post-go-live scan results with closure notes | • Post-deployment validation report against the design | • Independent post-implementation security assessment • Residual risk statement |
| Operation | Environment Provisioning | Security Solutions Architect | Ensures that all environments created for new deployments are configured securely according to the specific security designs formulated during the project's planning stages. The SSA collaborates with IT operations to set up these environments, applying project-specific security controls and measures to safeguard resources, devices, and dependencies crucial to the project's success. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Ensure that all environments provisioned for project deployments comply with the specific security requirements defined during the project's design phase. • Collaborate closely with IT operations to establish secure and isolated environments that are optimised for the project's needs without impacting existing services. • Implement project-specific security controls that are tailored to the resources, devices, and dependencies required for the project. | • Provisioning checklist against baseline | • Environment compliance report against the security baseline | • Continuous compliance monitoring configuration • Deviation register |
| Operation | Release Packaging | Security Solutions Architect | Responsible for the security of deployment artifacts, ensuring that all code bundles and configurations are securely packaged and verified. They enforce strict version control and security checks throughout the packaging process, guaranteeing that all release artifacts meet the established security criteria before they are deployed. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Manage the security aspects of creating deployment artifacts for the project, ensuring robust version control and adherence to security protocols. • Ensure the integrity and security of code bundles and configurations throughout the release packaging process. • Validate that all deployment artifacts are compliant with security requirements before they are approved for release. | • Signed artefact and checksum records | • Release integrity process description • SBOM for the release | • Supply-chain evidence pack (SBOM, provenance attestations, signing policy) |
| Operation | Configuration Management | Security Solutions Architect | Oversees the secure setup and integration of system settings, software configurations, and network parameters that align with the project's security requirements. They maintain meticulous documentation and version control for all configuration changes to ensure traceability and adherence to security standards. This includes managing external integrations and ensuring that any third-party services or APIs comply with the project's security processes. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Oversee the configuration of systems, software, and network settings specific to the project, ensuring that all settings meet stringent security specifications. • Document all configuration changes and maintain version control to ensure traceability and compliance with project security standards. • Work with the development and operations teams to manage external integrations securely, ensuring that all third-party connections are vetted and secure. | • Configuration baseline entries in CMDB | • Configuration drift report and remediation log | • Configuration management plan with security baselines • Drift trend analytics |
| Operation | Deployment Automation | Security Solutions Architect | Designs secure automation processes for deploying new systems, integrating rigorous security validations into the automation pipelines. This ensures that deployments are not only efficient but also free from security vulnerabilities. They monitor these automated deployments closely, addressing any security concerns immediately to maintain the integrity of the deployment process. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Design and implement secure automation strategies for project deployment to minimise manual errors and ensure consistent execution of security practices. • Integrate security checks and validations into automated deployment processes, ensuring deployments are both efficient and secure. • Monitor automated deployments for security issues and ensure any anomalies are addressed immediately. | • Pipeline security checks configuration | • Automation security review record • Secrets management configuration | • Deployment automation security design • Break-glass procedure documentation |
| Operation | Deployment Verification | Security Solutions Architect | Conducts comprehensive security testing during the deployment verification stage to validate that new systems meet both functional and security specifications set forth by the project requirements. They ensure all deployments pass these security assessments before going live, overseeing any necessary modifications to meet predefined security acceptance criteria. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Conduct thorough security assessments as part of the deployment verification to ensure that new deployments adhere to project-specific and organisations security standards. • Validate the security and functionality of new systems against predetermined acceptance criteria and project requirements. • Oversee the resolution of any security issues discovered during deployment verification before the final release. | • Smoke test record including security checks | • Verification report against security acceptance criteria | • Formal verification and validation report with control attestation |
| Operation | Rollback and Recovery | Security Solutions Architect | Develops and tests specific rollback and recovery procedures for each project, ensuring that these mechanisms can quickly restore services to a secure state in case of deployment failures. They regularly update and refine these recovery strategies based on new insights and operational feedback to enhance disaster recovery capabilities. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop and test rollback procedures specifically for the project, ensuring quick recovery capabilities in case of deployment failures. • Establish project-specific disaster recovery plans that include security considerations to protect data and maintain service continuity. • Continuously update and refine recovery strategies based on lessons learned from testing and actual incident responses. | • Rollback steps documented in runbook | • Tested rollback procedure with security considerations | • Recovery playbook including compromise-recovery variant • Test evidence |
| Operation | Monitoring and Performance Optimisation | Security Solutions Architect | Sets up tailored monitoring tools to continually assess the performance and security of the services. They analyse performance data to understand the impact of security measures on system operations and collaborate with operational teams to fine-tune systems for optimal performance without compromising security. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Set up and customise monitoring tools to track the performance and security of newly deployed services, ensuring they align with the project's objectives. • Analyse performance data to identify any impact of security measures on service performance and user experience. • Work with the operational teams to optimise system performance without compromising the security integrity of the project. | • Alert review notes • Threshold change log | • Monitoring effectiveness review • Tuning change records | • Detection coverage assessment (ATT&CK heatmap) • Optimisation roadmap |
| Operation | Defect Tracking and Management | Security Solutions Architect | Identifying, prioritising, and resolving security defects found during operations. They work closely with development and operations teams to ensure swift and effective resolution of issues, maintaining a log of all defects and their resolutions for future reference and continuous security improvement. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Track and manage defects identified during project operations, prioritising security-related issues for immediate resolution. • Coordinate with developers and operational teams to ensure rapid and secure defect resolution. • Maintain documentation of all defects and resolutions to facilitate ongoing security assessments and audits. | • Security defects prioritised in operations backlog | • Security defect management report with SLAs | • Trend and root-cause analysis • Systemic fix proposals to the design authority |
| Maintenance | Monitoring and Alerting | Security Solutions Architect | Responsible for ensuring that the monitoring systems implemented during the project phase are specifically tuned to detect vulnerabilities and threats that could affect the newly delivered systems. They collaborate with operational teams to fine-tune these systems, ensuring that alerts are both actionable and accurate, minimising false positives while swiftly identifying true security threats. The SSA also ensures that the monitoring tools are up to date with the latest detection capabilities to handle evolving security challenges. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Tailor monitoring systems to specifically watch for security issues related to new systems or technologies introduced during project delivery. • Improve alert mechanisms to accurately identify and respond to real security threats, reducing false positives and ensuring that true threats are addressed promptly. • Regularly update security monitoring tools with the latest threat detection capabilities to handle new and evolving security challenges. | • Alert tuning notes for delivered systems | • Monitoring review report • Updated alert catalogue | • Detection engineering backlog • Coverage gap analysis against current threats |
| Maintenance | Incident and Problem Management | Security Solutions Architect | Works closely with the incident response teams to ensure that any security incidents related to the newly implemented systems are managed according to the project-specific security processes. They provide expert advice on resolving incidents that involve complex system interactions or new technologies introduced during the project. The SSA also reviews and updates the incident management protocols to incorporate learnings from recent incidents, continuously refining response strategies. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Provide leadership in managing security incidents that involve newly implemented systems, ensuring responses are swift and effective. • Regularly review and refine incident management protocols to integrate lessons learned from recent security incidents. • Work closely with operational and security teams to ensure a coordinated response to incidents, leveraging project-specific knowledge to address issues effectively. | • Incident notes and fixes for the solution | • Post-incident reviews with security actions | • Problem records identifying architectural root causes • Threat model updates driven by incidents |
| Maintenance | Patch and Update Management | Security Solutions Architect | Oversees the application of patches and updates specifically for the systems and components introduced during the project delivery. They ensure that these updates do not compromise the custom configurations and security measures put in place. The SSA works closely with vendors and internal teams to test patches in controlled environments before deployment to avoid introducing new vulnerabilities. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Manage the application of patches and updates for new systems, ensuring compatibility with existing configurations and maintaining security integrity. • Test patches in controlled environments to validate their effectiveness and ensure they do not introduce new vulnerabilities. • Work with software and hardware vendors to understand the impact of patches and coordinate their deployment across project-delivered systems. | • Patch log for solution components | • Patch compliance report • Risk-based deferral records | • Vulnerability posture report • Compensating control decisions with sign-off |
| Maintenance | Performance Optimisation | Security Solutions Architect | Monitors the performance impact of security measures implemented during the project phase, ensuring they do not adversely affect the system's efficiency. They are involved in tuning and optimising these measures to maintain an optimal balance between security and performance. The SSA also assesses the system's load handling capabilities to recommend performance improvements without compromising security. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Monitor and assess how security configurations impact the performance of new systems and adjust settings to optimise both security and system efficiency. • Suggest and implement changes to improve the performance of security measures without compromising security. • Conduct load testing to evaluate the impact of security measures on system performance under various conditions and scale solutions as needed. | • Control tuning change records | • Performance/security balance review | • Optimisation study with re-baselined NFRs |
| Maintenance | Capacity Planning and Scaling | Security Solutions Architect | Evaluates how well the security architecture scales with increased system demands. They ensure that any expansions or upgrades maintain the integrity of the security measures implemented during the project phase. The SSA also advises on potential security implications of scaling operations and integrates additional security controls if needed. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Ensure that security measures scale adequately with the system's growth, maintaining robust security during capacity expansions. • Provide expertise on how to scale security architectures safely and effectively, incorporating new security technologies if necessary. • Continuously monitor and adjust the scalability of security controls to ensure they remain effective as operational demands increase. | • Capacity check note including security tooling | • Capacity forecast including security licence and throughput headroom | • Scaling design update • Security control scaling validation |
| Maintenance | User Feedback and Enhancements | Security Solutions Architect | Incorporates security-related user feedback into the maintenance cycle, using insights from end-users to identify areas where security can be enhanced. They prioritise security enhancements that address specific issues reported by users and collaborate with development teams to ensure these enhancements are implemented effectively. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Actively gather and integrate user feedback related to security into the maintenance cycle, identifying areas for enhancement. • Focus on implementing security improvements that directly address user-reported issues, enhancing user trust and satisfaction. • Work with development teams to ensure user-requested security enhancements are implemented accurately and effectively. | • Log of user-reported security friction | • Enhancement proposals balancing usability and security | • Usability-security analysis • Enhancement business case |
| Maintenance | Continual Improvement and Innovation | Security Solutions Architect | Drives continuous improvement initiatives for security within the scope of the delivered projects. They keep abreast of the latest security technologies and practices that could benefit the project's security stance. The SSA leads efforts to pilot new security technologies within the project's framework, ensuring that the project stays at the forefront of security innovations. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Drive initiatives for continuous improvement of security practices within the project scope, ensuring alignment with the latest security trends and innovations. • Explore and test new security technologies and methods that could enhance the project's security framework, ensuring the project remains at the cutting edge. • Develop an environment where continuous security improvement is prioritised, encouraging innovation and adaptation to emerging security challenges. | • Improvement actions in service review | • Security improvement plan for the solution | • Innovation assessment of new controls or technology with pilot results |
| Optimisation | Performance Analysis and Benchmarking | Security Solutions Architect | Reviews how the security controls delivered with the solution perform in live operation, comparing observed effectiveness against the design intent and agreed NFRs. The SSA turns operational evidence into concrete design adjustments. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Review operational security metrics for the delivered solution against design intent and agreed NFRs. • Benchmark control performance (detection rates, false positives, authentication latency) against the baseline set at design. • Identify under- or over-performing controls and propose proportionate design adjustments. • Share benchmarking insights with the Enterprise Security Architect to inform patterns and standards. | • Control performance summary in service review | • Control effectiveness review against NFRs • Improvement backlog entries | • Control effectiveness report • Re-baselined NFRs • Design change proposals |
| Optimisation | Cost and Value Optimisation | Security Solutions Architect | Identifies over-engineered, duplicated or under-used security controls and tooling within the solution, proposing consolidation that reduces cost without materially increasing risk. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Review security tooling and control overlap across the solution, identifying candidates for consolidation or retirement. • Assess licence utilisation and right-size subscriptions for security products. • Model the risk impact of proposed savings and present cost-risk trade-offs to the service owner. • Feed rationalisation opportunities into technical debt and investment planning. | • Tooling overlap note • Licence utilisation check | • Control rationalisation proposal with risk impact | • Security investment optimisation case • Control consolidation design |
| Optimisation | Process Improvement and Automation | Security Solutions Architect | Streamlines recurring security processes attached to the solution - access recertification, certificate renewal, secrets rotation - replacing manual effort with automation that is itself securely designed. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Identify recurring manual security tasks suitable for automation and quantify the effort they consume. • Design secure automation for tasks such as certificate renewal, secrets rotation and access reviews. • Validate that automation identities and workflows follow least-privilege principles. • Measure and report toil reduction and error-rate improvement. | • Automation quick-wins list (certificate renewal, access reviews) | • Automation design for recurring security tasks • Toil reduction metrics | • Security process automation roadmap • Workflow designs • Benefits tracking |
| Optimisation | Technology Refresh and Rationalisation | Security Solutions Architect | Monitors solution components for end-of-support exposure and rationalisation opportunities, planning secure upgrades and consolidations before they become unplanned risk. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Track end-of-support and end-of-life dates for solution components and security tooling. • Assess refresh options, including consolidation onto strategic platforms endorsed by the enterprise architecture. • Design upgrade paths that maintain control coverage throughout the transition. • Update solution documentation and reference patterns to reflect refreshed technology. | • End-of-support register entries for solution components | • Refresh options assessment with security implications | • Technology refresh business case • Secure upgrade design and migration plan |
| Optimisation | Control and Configuration Tuning | Security Solutions Architect | Tunes security control configurations - detection rules, alert thresholds, policy settings - based on operational experience, reducing noise and user friction without weakening the security posture. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Analyse alert and event data to identify noisy or ineffective rules attached to the solution. • Tune thresholds, rulesets and policies, recording the rationale and expected effect of each change. • Verify tuning changes against the threat model to confirm no loss of detection or control coverage. • Baseline tuned configurations under change control. | • Tuning change log (thresholds, rules) with rationale | • Tuning review report with false-positive/negative analysis | • Control tuning study • Updated detection and control baselines under change control |
| Optimisation | Capability Enhancement and Innovation | Security Solutions Architect | Builds on operational lessons to enhance the solution’s security capability - adopting improved services such as managed identity, runtime protection or policy-as-code - piloting before committing. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Identify capability gaps and enhancement opportunities from operational evidence and emerging technology. • Propose and design pilots for enhanced security capabilities within the solution. • Evaluate pilot results against agreed success criteria and residual risk. • Recommend adoption, adaptation or rejection, feeding outcomes back to enterprise patterns. | • Enhancement suggestions in service review | • Capability pilot proposal (e.g. managed identity adoption) | • Capability enhancement design with pilot evaluation • Pattern feedback to enterprise architecture |
| Retirement | Identification and Assessment | Security Solutions Architect | The Security Solutions Architect begins the retirement process by conducting a thorough evaluation of the systems, applications, or resources identified for decommissioning. This evaluation focuses on assessing the security architectures in place to determine their adequacy against current standards. The SSA identifies any security risks associated with the retirement, such as potential data leakage or vulnerabilities that might be exposed during the decommissioning process. They also ensure that all actions comply with regulatory and compliance requirements, particularly concerning data protection and privacy. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Review and evaluate the security configurations, access controls, and data protection mechanisms of systems identified for retirement to ensure no vulnerabilities are overlooked. • Map out all system dependencies to understand the broader impact of decommissioning on the network and other interconnected systems. • Conduct a full compliance audit to identify all regulatory and legal obligations associated with the retirement of each system, including UK GDPR, or other relevant standards. • Perform a detailed security risk analysis to identify potential threats and vulnerabilities that could arise during the retirement process. | • Retirement candidate note (data, dependencies, risks) | • Retirement security assessment (data, access, integrations) | • Decommissioning risk assessment • Dependency map • Data inventory |
| Retirement | Planning and Strategy | Security Solutions Architect | In the planning and strategy phase, the SSA develops detailed and secure decommissioning plans, incorporating robust risk assessments and mitigation strategies. These plans outline how to handle data migration, sanitisation, and the secure disposal of hardware, ensuring that security considerations are integrated throughout the process. Coordination with the Enterprise Security Architect and Operational Security Architect is crucial to align the decommissioning strategy with broader organisational security policies and operational impacts. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Craft a detailed plan covering all phases of the decommissioning process, incorporating necessary security controls. • Create and implement a stakeholder engagement plan to ensure all relevant parties are informed and involved throughout the retirement process. • Plan and allocate resources to ensure sufficient security oversight and technical support during decommissioning. • Establish a clear timeline with specific milestones for each phase of the retirement process to ensure timely execution. | • Decommissioning checklist | • Decommissioning plan with security milestones | • Decommissioning strategy covering contractual, regulatory and records obligations |
| Retirement | Data Migration and Archiving | Security Solutions Architect | The SSA oversees the secure migration of data from systems slated for decommissioning. They ensure the integrity and confidentiality of the data throughout the migration process, implementing stringent controls and checks. The SSA also manages the secure erasure of data remaining on decommissioned systems, applying data sanitisation protocols to prevent unauthorised data retrieval. Additionally, they coordinate with data management teams to establish compliant archiving solutions for any data that must be retained according to organisational policies or legal mandates. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Develop a secure data migration strategy that ensures data integrity and confidentiality during transfers. • Execute data cleansing and sanitization processes to securely erase data from decommissioned systems. • Ensure that data archival processes comply with all relevant data retention policies and are secure from unauthorised access. • Conduct thorough validation and verification of data migration and sanitisation to ensure completeness and accuracy. | • Data disposition note (retain / migrate / destroy) | • Data migration and archiving plan (encryption, integrity checks) | • Data disposition register • Retention schedule mapping • Destruction certificate plan |
| Retirement | Decommissioning and Resource Cleanup | Security Solutions Architect | During the actual decommissioning phase, the SSA ensures the process is executed securely. They oversee the physical and digital dismantling of systems, focusing on the thorough deletion or destruction of sensitive information stored on hardware being decommissioned. The SSA manages the termination of security services and configurations associated with the retired systems, ensuring that no residual security risks remain. They also document all security measures and actions taken during this phase to provide a clear audit trail for compliance and review. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Oversee the physical decommissioning of hardware, ensuring proper shutdown and secure wiping or destruction of devices. • Systematically revoke access rights and credentials associated with decommissioned systems. • Manage compliant disposal or repurposing of hardware, adhering to environmental standards and data security requirements. • Clean up security configurations to remove any residuals that could be exploited in the future. | • Access revocation and asset disposal confirmations | • Cleanup evidence pack (accounts, keys, certificates, DNS, firewall rules) | • Full decommissioning evidence including sanitisation certificates and CMDB closure |
| Retirement | Communication and User Transition | Security Solutions Architect | The SSA plays a role in communicating changes during the decommissioning process. They inform all relevant stakeholders of security changes and new risks introduced by the transition to new systems. The SSA provides guidance and support to users adapting to new systems, including conducting security training sessions. They gather feedback from users on the security impact of the transition, using this data to refine future security strategies and ensure a seamless transition for all users. | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Implement a comprehensive communication strategy to keep all stakeholders informed about decommissioning processes and security implications. • Provide training and support for users transitioning to new systems, focusing on new security protocols. • Establish mechanisms to gather and address feedback throughout the transition process to refine the decommissioning strategy. | • Stakeholder communication note | • Transition communications plan with security guidance for users | • Programme-level transition communications • Contractual and regulatory notifications where required |
| Retirement | Review and Documentation | Security Solutions Architect | Following the completion of the decommissioning, the SSA conducts a comprehensive review of the process to evaluate the effectiveness of the security measures implemented. They update project security documentation to reflect the processes undertaken and the outcomes achieved, ensuring that all lessons learned are captured. This documentation is vital for ongoing security assessments and helps refine future decommissioning strategies, contributing to the continuous improvement of project delivery and security practices within organisations . | Level 6 - Initiate, influence | ARCH (Solution architecture), SCTY (Information security), BURM (Risk management), INAS (Information assurance) | • Conduct a thorough security review after the retirement process to evaluate the effectiveness of implemented security measures. • Document all security procedures and actions taken during the retirement in detailed reports for future reference and compliance audits. • Capture and analyse lessons learned to provide insights for improving future decommissioning projects, focusing on security enhancements. | • Closure note with lessons learned | • Decommissioning review report • Risk register closure entries | • Formal closure report with assurance sign-off • Archived security artefact set |
Workbook source · OSA
Operational Security Architect activity model
Operational readiness, resilience, supportability and estate health.
Artefact columns show the information a project should produce or hand over, scaled by project size. Risk overrides size: a small-value change touching critical assets, personal data or novel technology adopts the next band up. Artefacts may live inside existing operational documents rather than as standalone deliverables.
| Through Life Stage | Value Stream Activity | Role | Description | SFIA Responsibility Level | Relevant Skills | Activities | Example Artefacts - Small (<£250k, low risk) | Example Artefacts - Medium (£250k–£2m, moderate risk) | Example Artefacts - Large (>£2m, high risk or novel) |
|---|---|---|---|---|---|---|---|---|---|
| Planning | Service Strategy Development | Operational Security Architect | Ensures operational security considerations are integrated from the start, influencing the service strategy to include proactive monitoring and continuous risk assessment. The Operational Security Architect advocates for resilient designs that accommodate easy updates and maintenance without compromising security. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Collaborate with enterprise architects and business leaders to integrate robust operational security measures into the initial service design. • Advocate for scalable security solutions that can evolve with the service, ensuring long-term protection and adaptability. • Participate in strategic planning sessions to ensure security considerations are prioritised and integrated from the outset. | • Operational security constraints note for the project brief | • Operability and supportability requirements statement • Known estate risk summary for planners | • Operational security strategy input paper • Estate posture assessment informing service strategy |
| Planning | Assessment | Operational Security Architect | Regularly assesses the operational environment to identify security vulnerabilities and compliance deviations. This continuous evaluation helps in maintaining the integrity of the security framework and ensures the service remains robust against emerging threats. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Conduct comprehensive security audits and detailed risk assessments of operational systems on a regular basis to identify and mitigate vulnerabilities. • Analyse security logs and monitoring data to proactively detect anomalies and potential threats, initiating preventive measures. • Evaluate the performance of existing security controls and initiate upgrades or adjustments based on findings to enhance overall security. | • Known-vulnerability and legacy-constraint note for the project | • Operational risk assessment of affected services • Current control coverage summary | • Estate security posture report for impacted domains • Operational risk register extract with treatments |
| Planning | Governance Planning | Operational Security Architect | Implements and monitors security governance practices in operational activities, ensuring compliance with organisational security policies and regulations. The Operational Security Architect is essential in enforcing these governance structures daily to maintain service reliability and security. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Develop, implement, and maintain robust operational security policies and compliance protocols, ensuring they are up-to-date with the latest security standards and regulations. • Organise and lead security governance meetings to review policies and discuss improvements with key stakeholders. • Implement mechanisms for rapid response and crisis management, ensuring they are well-integrated into the operational governance structures. | • Operational acceptance criteria note (what ops will require) | • Operational security governance inputs (gates, acceptance checkpoints) | • Operational governance framework section • Service acceptance criteria catalogue with security thresholds |
| Planning | Security and Compliance Planning | Operational Security Architect | Updates and refines the operational security and compliance plans to address new security challenges and regulatory changes. This ongoing planning ensures that the operational practices remain effective and that security protocols adapt to the evolving threat landscape. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Regularly update operational security plans to incorporate new technologies, tactics, and threat intelligence, ensuring proactive defence mechanisms are in place. • Plan and oversee regular compliance checks and security audits to ensure ongoing adherence to both internal and external standards. • Develop and maintain incident response plans, ensuring they are effective and can be activated immediately to handle potential security breaches. | • Operational compliance checklist (patching, logging, access reviews) | • Operational security plan updates for the affected services • Compliance monitoring requirements | • Operational compliance framework mapping (CAF/ISO controls in operation) • Continuous compliance monitoring design |
| Planning | Architecture Design | Operational Security Architect | Provides ongoing input to refine the security architecture of operational systems, ensuring it supports both current and future security needs. The Operational Security Architect collaborates with system architects to enhance security measures and safeguard service operations. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Provide ongoing consultation to IT architecture teams to integrate robust security features into network and system designs. • Review and advise on the security aspects of operational infrastructure, ensuring that all elements are protected against potential threats. • Collaborate with technology providers to ensure that security enhancements are seamlessly integrated into existing and new systems. | • Operability review comments on proposed design | • Operational security requirements for the design (monitoring, patching, access) | • Operational architecture input paper • Supportability and monitoring reference requirements |
| Planning | Migration Planning | Operational Security Architect | Plays a crucial role in planning and executing the secure migration of operational data and systems, ensuring minimal downtime and maintaining security standards. The Operational Security Architect oversees these activities to ensure seamless transitions and operational continuity. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Strategically plan the secure migration of operational systems and data, ensuring all actions comply with security best practices and minimise risks. • Supervise the implementation of security measures during migrations to safeguard data integrity and service continuity. • Monitor migration processes in real-time to quickly address any security issues and adjust plans as necessary to ensure safety and compliance. | • Migration window and rollback constraints note | • Operational migration risk assessment • Service continuity plan for migration | • Migration operations runbook (security tasks, checkpoints, abort criteria) • Downtime and exposure analysis |
| Planning | Cost Management Planning | Operational Security Architect | Manages and optimises security-related expenditures in the operational phase, ensuring cost-effective security practices that do not compromise the service‚Äôs security posture. This involves regular reviews of security investments against operational performance. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Monitor and control budget allocations for security operations, ensuring optimal use of resources for maximum security impact. • Evaluate the financial efficiency of implemented security measures, proposing budget adjustments to better address emerging threats and opportunities. • Prepare detailed financial reports for security operations, highlighting ROI and justifying future investments in security technologies and practices. | • Operational security cost note (run-cost implications) | • Run-cost estimate for security operations (monitoring, licences, effort) | • Whole-life operational security cost model • Cost-to-serve baseline for the new service |
| Planning | Training and Change Management Planning | Operational Security Architect | Leads the development and implementation of ongoing security training programs for operational staff to address new threats and changes in technology. The Operational Security Architect ensures that all operational personnel are aware of and comply with the latest security procedures and practices. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Lead the design and delivery of comprehensive security training programs for operational teams, focusing on real-world threats and practical defence strategies. • Develop and implement ongoing security awareness campaigns to keep security at the forefront of operational practices. • Manage the security aspects of organisational change, ensuring that updates to security policies and technologies are effectively communicated and adopted across all operational teams. | • Ops team briefing note on upcoming change | • Operational security training plan for affected teams | • Capability uplift plan for security operations • Training needs analysis for new technology |
| Design | Requirements Gathering | Operational Security Architect | Actively participates in the requirements gathering phase to ensure operational security needs are accurately captured and integrated into the project design. The Operational Security Architect collaborates with project teams to define practical security requirements that support both day-to-day operations and long-term maintenance, preparing the system for real-world security challenges post-deployment. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Collaborate with design and project teams to ensure operational security requirements are integrated from the outset. • Assess and define security needs that maintain ongoing operations and support. • Identify operational challenges that impact security post-deployment, such as maintenance windows and access management. • Gather requirements for security monitoring tools and operational support systems needed for the live environment. | • Operational security requirements list (logging, alerts, access) | • Operational requirements catalogue (monitoring, backup, patching, IR hooks) | • Operational security requirements specification with acceptance criteria and traceability |
| Design | Architecture Planning | Operational Security Architect | Contributes expert advice on selecting secure operational technologies and architectures that enhance overall system resilience and security. The Operational Security Architect ensures that the architecture includes robust disaster recovery solutions and scalable security configurations to support ongoing operations and system updates efficiently. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Advise on the selection of operational technologies and infrastructure that enhance security and resilience. • Participate in defining operational security architecture that includes robust recovery and backup solutions. • Evaluate and recommend security configurations for operational environments, focusing on long-term sustainability and ease of management. • Ensure architectural plans include provisions for security patches and updates. | • Operability comments on options | • Operational assessment of architecture options (supportability, monitoring fit) | • Operational impact appraisal for each option • Estate integration analysis |
| Design | High and Detailed Design | Operational Security Architect | Reviews high and detailed designs to integrate operational security measures effectively, such as secure logging and incident response mechanisms. This role is crucial in ensuring that designs reflect operational security needs, providing detailed input to enhance system monitoring, network segmentation, and proactive security defences. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Review high and detailed designs to ensure they include operational security measures such as logging, monitoring, and incident response. • Provide detailed enhancements to network segmentation, access management, and monitoring mechanisms and tools. • Validate security measures within the designs to confirm they meet operational standards and practices. • Document operational security requirements and ensure they are integrated into technical specifications. | • Ops review comments on HLD/LLD security aspects | • Operational security review record for designs • Monitoring and logging design inputs | • Operational integration design (SIEM, IAM, vulnerability management, backup) • Runbook skeletons per control |
| Design | Security Design | Operational Security Architect | Leads the design of operational security controls, ensuring that all aspects of security are robustly integrated into the project infrastructure. The Operational Security Architect designs systems with features that support continuous monitoring, threat detection, and efficient security management, focusing on sustainability and ease of operation. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Lead the integration of operational security controls within the project‚Äö√Ñ√¥s security design, ensuring all aspects are covered from an operational standpoint. • Design systems with operational security features such as automated threat detection systems and integrated security management tools. • Develop designs for security operations centres (SOCs) if applicable, detailing processes, tools, and procedures needed. • Specify requirements for operational security software, including SIEM (Security Information and Event Management) systems. | • Confirmation that designed controls are operable (review note) | • Operational validation of security design (alerting, response hooks) • Control operating procedures outline | • Control operating model for the solution • Detection and response design aligned to SOC capability |
| Design | Scalability and Reliability Design | Operational Security Architect | Ensures that scalability and reliability designs incorporate security measures that adapt to changing operational loads while maintaining strict security controls. This includes planning for secure auto-scaling, load balancing, and failover capabilities, thus guaranteeing system integrity and continuous protection under all operational scenarios. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Ensure scalability and reliability designs include considerations for scaling security measures and maintaining service continuity under various operational conditions. • Provide input on designing systems that remain secure during scaling operations, such as during load balancing and auto-scaling events. • Advise on fail-safe security operations that ensure system integrity and data protection during failover procedures. • Review and recommend improvements to enhance security in scalable and reliable system designs. | • Note on monitoring behaviour under scale | • Operational scaling requirements for security tooling | • Resilience-operations analysis (control behaviour in failure and surge conditions) |
| Design | Cost Optimisation | Operational Security Architect | Identifies and implements cost-effective security operational practices that optimise resource utilisation without compromising security integrity. The Operational Security Architect assesses the long-term cost benefits of security decisions, aiming to reduce operational expenses while enhancing security effectiveness. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Identify cost-effective security operational practices that optimise resource use without compromising security. • Assess the long-term cost implications of operational security decisions, focusing on total cost of ownership including maintenance and updates. • Recommend security technologies and practices that reduce operational overheads while maximising security effectiveness. • Help budget for operational security needs, ensuring adequate funding for ongoing security operations. | • Run-cost comment on design choices | • Operational cost comparison of control options | • Run-cost optimisation paper with risk trade-offs |
| Design | Design Review and Validation | Operational Security Architect | Engages in security design reviews to validate the operational viability and effectiveness of security implementations. This includes ensuring that security measures are practical, manageable, and align with operational realities, making necessary adjustments based on feedback to optimise the security posture for everyday operations. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Participate in security design reviews to validate the operational feasibility of security implementations. • Ensure security designs adequately support operational needs and can be effectively maintained and managed post-deployment. • Adjust operational security strategies based on outcomes from design reviews to ensure practical and effective security measures. • Confirm that security designs are validated against operational scenarios to prevent potential security issues in live environments. | • Operational readiness comments in design review | • Operational review record with findings and actions | • Operational assurance report on the design • Acceptance criteria validation plan |
| Design | Documentation | Operational Security Architect | Manages the comprehensive documentation of all operational security procedures and systems. The Operational Security Architect ensures that this documentation is thorough, up-to-date, and accessible, providing a critical resource for training, troubleshooting, and maintaining security standards across operational teams. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the creation of comprehensive operational security documentation that guides maintenance and management of security systems. • Ensure documentation includes detailed operational procedures, standards, and guidelines for security. • Update security documentation to reflect operational insights and lessons learned during the design phase. • Provide operational security training materials based on the security documentation to ensure proper understanding and implementation of security practices. | • Updated operational notes for affected services | • Operational security documentation set (procedures, contacts, escalations) | • Complete operations documentation pack (runbooks, SOPs, monitoring guides) |
| Development | Idea Generation and Requirements | Operational Security Architect | Provides input during the initial phases of project planning, ensuring that operational security considerations are embedded from the start. They assess and critique proposed projects for potential security implications, advising on necessary adjustments to align with production-level security standards. The OSA helps define operational security metrics and objectives, ensuring new developments are equipped to meet these criteria once deployed. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Provide insights on operational security requirements and best practices to ensure new projects are designed with long-term security management in mind. • Assess proposed projects for operational security implications, suggesting adjustments to meet production-level security standards. • Participate in defining operational security metrics and objectives that new developments should achieve. | • Operational lessons input to requirements (known pain points) | • Operational requirements input log with supportability criteria | • Operational insight report shaping requirements (incident trends, toil hotspots) |
| Development | Design and Architecture | Operational Security Architect | Reviews project designs to ensure they are not only secure but also optimised for long-term maintenance and scalability. They advocate for the inclusion of features that support efficient incident management and recovery, such as advanced monitoring capabilities and automated security controls, ensuring the architecture supports robust operational security practices. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Review and provide feedback on project designs from an operational security perspective, ensuring designs are scalable, maintainable, and secure. • Advise on incorporating features that facilitate secure operations, such as monitoring capabilities and automated security controls. • Ensure that the architecture supports efficient incident response and recovery strategies. | • Operability feedback on component designs | • Operational review notes per design increment | • Operational architecture review records with tracked actions |
| Development | Development and Coding | Operational Security Architect | Collaborates with development teams to integrate operational security measures into the codebase. This includes recommending security tools and practices that simplify future maintenance and enhance security, such as standardised logging protocols and comprehensive error handling. They ensure that all security features are adequate to protect the application against threats in a live environment. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Recommend security tools and practices that should be integrated during development to ease transition into production and simplify ongoing maintenance. • Engage with development teams to embed operational security considerations, such as logging standards and error handling protocols, into the codebase. • Validate that security features coded into applications are adequate for threat mitigation in a live environment. | • Recommended security tooling note for the pipeline | • Operational tooling integration guidance (agents, logging libraries) | • Production-readiness engineering standards input • Telemetry and instrumentation specification |
| Development | Testing and Quality Assurance | Operational Security Architect | Oversees the integration of operational security tests, ensuring these tests mimic real-world operational conditions to validate the application‚Äôs resilience. They work closely with QA teams to implement scenarios that test the system‚Äôs response to security incidents under stress, reviewing and approving test outcomes to confirm that operational security requirements are met. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the inclusion of operational security tests within the QA process, ensuring tests reflect real-world usage and abuse cases. • Coordinate with QA to simulate operational conditions in security testing scenarios to verify system resilience and data integrity under stress. • Review and approve test results, focusing on the security aspects crucial for maintaining system stability and performance. | • Operational abuse-case suggestions for tests | • Operational test scenarios (real-world usage and failure cases) | • Operational acceptance test suite definition with security scenarios |
| Development | Deployment and Release Management | Operational Security Architect | Guides the security aspects of deployment strategies to maintain and enhance the security posture during rollouts. They monitor deployments closely, responding swiftly to any security incidents and ensuring that new releases do not compromise the operational environment. Additionally, they assist in developing secure rollback procedures and detailed disaster recovery plans. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Guide the security aspects of deployment strategies to ensure that new releases maintain or enhance the security posture of operational environments. • Monitor the initial deployment phases for security issues, coordinating quick responses to any incidents. • Assist in the development of secure rollback procedures and disaster recovery plans. | • Release window and rollback constraints note | • Operational release checklist (security steps, verification points) | • Release operations security framework (gates, verification, rollback triggers) |
| Development | Monitoring and Performance Optimisation | Operational Security Architect | Designs and implements comprehensive security monitoring systems that provide real-time insights into threats and performance. They continuously assess the effectiveness of current security measures, recommending updates or enhancements based on their findings. This ongoing analysis helps to identify potential security vulnerabilities and optimise system performance to handle evolving security challenges. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design and implement security monitoring solutions that provide real-time analysis of threats and system performance. • Continuously evaluate the effectiveness of existing security monitoring tools and strategies, recommending improvements or upgrades as needed. • Analyse performance and security data to identify patterns that may indicate potential security vulnerabilities or the need for system enhancements. | • Log source and alert wishlist for the new service | • Monitoring solution design (collection, correlation, dashboards) | • Full monitoring architecture (use cases, data flows, retention, tuning approach) |
| Development | Feedback and Continuous Improvement | Operational Security Architect | Actively collects and analyses feedback from system users and automated monitoring tools to drive continuous improvements in security protocols. They lead initiatives to refine and update security measures, ensuring that the organisations security practices adapt to new threats and operational feedback. This iterative process helps maintain system integrity and enhances user trust over time. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Collect and analyse operational security feedback from system users, IT support, and automated monitoring tools to identify areas for improvement. • Lead the ongoing refinement of security protocols and measures based on operational feedback and emerging threats. • Initiate security enhancement projects that improve resilience, reduce complexity, and streamline operations. | • Operational feedback notes to the delivery team | • Operational feedback report with prioritised improvements | • Structured feedback loop definition with metrics and review cadence |
| Testing | Test Planning and Strategy | Operational Security Architect | Orchestrates the development of a unified testing strategy, embedding security across all project phases. This strategy standardises security testing protocols across organisations and ensures each project adheres to the same high standards and methodologies. By incorporating regulatory and compliance requirements, the ESA ensures security measures are consistent and compliant across various sectors. This strategic oversight aligns security practices with evolving business objectives effectively. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Develop comprehensive operational security testing strategies that align with the organisations risk management and security policies. • Coordinate testing schedules with IT operations to minimise impact on production environments while ensuring thorough coverage. • Assess and update security testing procedures to incorporate emerging threats and changes in compliance requirements. • Establish key performance indicators (KPIs) and objectives for security testing to measure effectiveness and guide improvements. | • Operational test considerations note (live-service protection) | • Operational security testing plan (non-disruption, environment rules) | • Operational test strategy including production-safeguard controls and rollback |
| Testing | Test Environment Setup | Operational Security Architect | Establishes baseline security configurations to maintain integrity and security controls across all environments. They implement stringent access controls and continuous monitoring to safeguard these environments from unauthorised access and potential breaches. Regular security audits ensure that any vulnerabilities or misconfigurations are promptly identified and corrected, maintaining the integrity of the testing processes. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Ensure operational test environments are robustly secured and accurately replicate production settings for effective testing. • Implement strict controls over the creation and management of virtual environments to prevent data leakage and ensure environment integrity. • Regularly review and refresh security configurations in test environments to adapt to new security threats and vulnerabilities. • Conduct periodic security audits of test environments to ensure compliance with internal and external security standards. | • Environment isolation confirmation | • Secured test environment baseline replicating production controls | • Environment security attestation • Production-parity gap assessment |
| Testing | Test Case Design and Improvement | Operational Security Architect | Guides the development of security test cases, ensuring coverage of anticipated security scenarios. They promote the creation of a centralised repository of reusable test cases, enhancing efficiency and consistency in security testing across projects. Periodic reviews and updates of test cases keep organisations abreast of emerging threats and technological changes, ensuring that testing remains robust and relevant. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design detailed security test cases for operational systems that cover a broad spectrum of risk scenarios and potential attacks. • Collaborate with cybersecurity teams to incorporate real-time threat intelligence into test case scenarios. • Regularly review and enhance test cases based on outcomes from recent security incidents and operational changes. • Develop test cases that not only check for vulnerabilities but also assess the resilience of security controls and incident response procedures. | • Operational scenarios added to test cases | • Operational security test cases (monitoring, response, recovery) | • Operational test case library mapped to detection and response capability |
| Testing | Test Execution | Operational Security Architect | Monitors the adherence to predefined security protocols and timelines. They provide expert analysis of complex test results, particularly in simulations that involve sophisticated security scenarios. The ESA also coordinates realistic incident response simulations to rigorously evaluate the effectiveness of organisations security measures, ensuring that test documentation is meticulous and thorough. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the rigorous execution of security tests, ensuring they are conducted without disrupting operational services. • Analyse test results to quickly identify security weaknesses and coordinate with respective teams for immediate mitigation. • Implement continuous testing practices that allow for ongoing assessments of the security posture without manual intervention. • Document all testing activities and outcomes in a central repository for accountability and future reference. | • Test observation notes (operational impact) | • Operational test execution report (service impact, control behaviour) | • Formal operational test report with detection/response validation evidence |
| Testing | Test Data Management | Operational Security Architect | Oversees the management of sensitive test data, implementing policies that enforce data protection standards such as encryption and anonymisation. They ensure that data handling practices comply with legal and regulatory requirements and that all personnel involved in testing are trained in these practices. Regular audits of test data management procedures ensure ongoing compliance and security. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Manage the lifecycle of test data to ensure its security from creation to disposal, including strict access controls and encryption measures. • Ensure that test data reflects the complexity of real-world data but without using actual sensitive information to prevent risks. • Implement automated tools for test data generation and management to reduce errors and improve efficiency. • Audit and review test data handling practices regularly to ensure they meet the latest security and compliance requirements. | • Test data handling confirmation (masking applied) | • Test data lifecycle controls record (access, encryption, disposal) | • Test data governance evidence pack with disposal certificates |
| Testing | Test Automation | Operational Security Architect | Enhances the efficiency and frequency of security testing across operational systems. They ensure tools are regularly updated and maintained to keep pace with system changes and emerging threats. This automation not only streamlines the testing process but also ensures consistent and reliable testing outcomes, for maintaining robust security defences. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Leverage advanced test automation tools to streamline security testing processes, increasing frequency and consistency. • Integrate automated security scans within regular operational procedures to continuously evaluate the security landscape. • Update and maintain automation scripts to adapt to new system configurations and emerging security threats. • Evaluate the effectiveness of automated tools regularly, ensuring they provide accurate and relevant results. | • Scheduled scan configuration for ongoing checks | • Automated operational security test suite (control validation jobs) | • Continuous control validation framework (BAS/detection validation) description |
| Testing | Performance Testing | Operational Security Architect | Conducts performance testing to assess the impact of security measures on system performance under various load conditions. They work collaboratively with technical teams to optimise security settings that might affect system performance, ensuring that security implementations enhance rather than hinder user experience and system efficiency. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Conduct performance testing to evaluate how security measures affect system efficiency and user experience under normal and peak loads. • Identify any performance bottlenecks caused by security configurations and work on optimising them without compromising security. • Collaborate with network and systems engineers to ensure that security enhancements do not adversely impact system performance. | • Note on monitoring/control behaviour under load | • Security tooling performance report under load (EPS, agent overhead) | • Security-performance engineering analysis with tuning recommendations |
| Testing | Defect Tracking and Management | Operational Security Architect | Ensures that all security issues identified during testing are meticulously documented, prioritised based on their impact, and resolved swiftly. This process involves close coordination with development and operational teams to ensure effective and timely resolutions, maintaining the integrity and security of operational systems. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Utilise sophisticated defect tracking systems to document, prioritise, and track the resolution of security issues discovered during testing. • Establish clear communication channels between operational teams and developers to ensure quick and effective defect resolutions. • Monitor the resolution process to ensure security fixes are implemented properly and verify through re-testing. | • Operational security defects logged with severity | • Defect triage record with operational impact assessment | • Defect trend analysis with systemic operational fixes proposed |
| Testing | Continuous Improvement | Operational Security Architect | Uses insights gathered from security testing to drive enhancements in security procedures. Regular review sessions with stakeholders help disseminate lessons learned and encourage a culture of continuous security improvement, ensuring that the organisations security measures evolve in response to new challenges and operational requirements. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Use data and feedback from operational security testing to drive continuous improvement initiatives in security practices. • Organise regular review meetings with stakeholders to discuss testing outcomes, share best practices, and plan future testing strategies. • Stay updated with the latest security testing methodologies and tools to enhance the organisations security testing capabilities. | • Testing lessons noted for operations | • Operational testing improvement actions with owners | • Detection and response improvement plan informed by test outcomes |
| Deployment | Provisioning and Configuration | Operational Security Architect | Ensures that all systems are continuously monitored and adjusted post-deployment to maintain security standards. After initial configurations set by the Security Solutions Architect, the OSA takes over to manage ongoing security configurations, ensuring that any changes due to operational requirements maintain the integrity of the system and comply with security policies. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Continuously audit and update security configurations to adapt to evolving technology and threat landscapes. • Implement strict access controls, ensuring only authorised personnel can make changes to critical systems. • Collaborate with network architects to design secure network configurations that minimise vulnerabilities. • Develop scripts or automation tools to consistently apply security settings across deployments without manual intervention. | • Configuration compliance check result | • Configuration audit report against baseline • Hardening verification record | • Continuous configuration compliance design • Baseline exception register with expiry |
| Deployment | Monitoring and Incident Management | Operational Security Architect | Responsible for the continuous monitoring of all operational systems. They implement advanced monitoring tools that detect, alert, and report on security incidents in real time. The OSA swiftly coordinates incident response strategies to mitigate risks, working closely with incident response teams to manage and resolve issues as they arise, ensuring minimal impact on service continuity. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design and deploy comprehensive monitoring systems that detect, alert, and log security incidents in real time. • Develop and maintain incident response protocols, including escalation paths and communication strategies for swift action. • Train operational teams on incident response techniques, enhancing their ability to detect and respond to security incidents. • Perform regular scenario-based drills to test and refine incident response effectiveness. | • Alert routing configured and confirmed | • Monitoring implementation record (log sources, alerts, dashboards) • IR escalation matrix | • Detection use-case deployment pack • Incident response integration evidence (tested escalations) |
| Deployment | Performance Optimisation | Operational Security Architect | Monitors the performance impact of security measures to ensure they do not adversely affect the operational efficiency of services. They work to optimise configurations that balance security with system performance, ensuring that security measures enhance rather than hinder service delivery. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Analyse system performance logs to identify any impact from security tools and configurations. • Collaborate with system administrators to fine-tune security settings that optimise operational efficiency and system stability. • Develop strategies to mitigate any negative impacts of security measures on system performance. • Implement adaptive security measures that can dynamically adjust based on system performance metrics. | • Post-deployment performance check note | • Security tooling performance assessment with tuning actions | • Performance optimisation report with re-baselined thresholds |
| Deployment | Backup and Disaster Recovery | Operational Security Architect | Oversees the operational aspects of backup and disaster recovery plans. They ensure these plans are regularly updated, tested, and capable of quick execution in response to any disaster scenario. The OSA's oversight guarantees that backup systems are functional, secure, and capable of restoring data and services quickly to mitigate downtime and data loss. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design and implement redundant backup systems to ensure data integrity across multiple storage locations. • Schedule and oversee regular backup tests to ensure they are functional and meet recovery time objectives (RTOs) and recovery point objectives (RPOs). • Update disaster recovery plans in response to new business requirements or after significant system updates or changes. • Collaborate with business continuity planners to ensure that security aspects are fully integrated into organisations overall continuity strategy. | • Backup job configuration and first restore test record | • Backup/DR operational validation report (schedules, restore evidence) | • DR operations runbook • Restore and failover test evidence pack • Immutable/offline backup verification |
| Deployment | Security Management | Operational Security Architect | Enforces security policies that protect against internal and external threats. They continually update and refine security measures, such as access controls and encryption protocols, to adapt to new threats. The OSA conducts regular security audits to ensure compliance with the latest security standards and to assess the effectiveness of current security measures. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Continually review and enhance security policies and procedures to cover all aspects of the operational environment. • Implement regular updates of security systems, including firewalls, intrusion detection systems, and malware protection tools. • Conduct comprehensive audits of existing security measures to identify vulnerabilities and implement corrections. • Stay abreast of the latest security standards and compliance requirements, integrating them into the operational security framework. | • Access model applied and verified (matrix) | • Operational security management record (access, policies, exceptions) | • Operational security management plan • Privileged access operating procedures • Attestation schedule |
| Deployment | Patch and Configuration Management | Operational Security Architect | Manages the regular application of patches and updates to ensure systems are protected against vulnerabilities. They oversee the patch management process, ensuring patches are tested, deployed securely, and integrated without disrupting existing operations. The OSA also maintains configuration management logs to track changes and ensure all modifications meet security requirements. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the deployment of patches, ensuring they are tested, approved, and documented before application. • Regularly review and adjust the configuration management database (CMDB) to ensure accuracy and completeness. • Develop and enforce policies for change management that include security review and approval processes. • Monitor the effectiveness of patches and configuration changes to ensure they do not introduce new vulnerabilities into the system. | • Patch schedule entry for new components | • Patch and vulnerability management onboarding record for the service | • Vulnerability management integration pack (scanning scope, SLAs, reporting) |
| Deployment | Capacity Planning and Scaling | Operational Security Architect | As services evolve, the OSA plays a crucial role in capacity planning and resource scaling to handle increased operational loads. They monitor system performance and user demand to guide resource allocation, ensuring that scaling efforts are secure and align with the overall security architecture. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Forecast future system demands based on trend analysis and business growth projections. • Ensure security scalability by integrating flexible security solutions that can grow with the system. • Work with IT procurement to ensure that new hardware and software purchases meet the security needs of organisations. • Advise on virtualisation and cloud strategies that meet security requirements while providing scalable resources. | • Capacity check note including security tooling | • Capacity forecast for security infrastructure (ingestion, storage, licences) | • Capacity and scaling plan with security tooling headroom analysis |
| Deployment | Continuous Improvement | Operational Security Architect | Collects feedback from monitoring systems, user reports, and security incidents to continuously refine and enhance security practices. They lead efforts to implement lessons learned into current operations, encourage ing a proactive approach to security and operational efficiency. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Implement a feedback loop with IT operations and business units to gather insights on security practices and potential improvements. • Analyse incident reports and audit findings to drive continuous security enhancements. • Lead cross-functional teams in projects to refine and enhance security infrastructure and practices. • Promote a culture of security awareness and continuous improvement across the service. | • Deployment observations for the improvement log | • Deployment review report with security improvement actions | • Post-implementation review contribution with operational metrics baseline |
| Transition | Knowledge Transfer and Training | Operational Security Architect | Maintains system-specific security knowledge, tools, and processes to support ongoing operations. Ensures that security control objectives continue to align with evolving business requirements and provides onboarding or upskilling support for operational teams. | Level 5 - Ensure, advise | SCTY (Information security), KNOW (Knowledge management), ETDL (Learning delivery), SCAD (Security operations) | • Assimilate project-delivered security artefacts and validate their applicability for ongoing operational management. • Maintain and enhance system-specific security documentation, including operational runbooks, control catalogues, and escalation processes. • Deliver tailored security onboarding and refresher training for platform teams and support staff responsible for day-to-day operations. • Establish clear lines of communication between operational teams and security functions to support effective knowledge retention and issue escalation. • Periodically review system documentation and operational procedures to ensure they reflect current architecture and control implementations. | • Handover session attendance and notes • Quick-reference card for service desk | • Validated security handover pack (accepted by operations) • Team training records | • Knowledge base articles for the service • Operational capability assessment post-training |
| Transition | Incident Response Preparation | Operational Security Architect | Develops and maintains incident response playbooks for the system, ensuring alignment with the system’s architecture and threat profile. Coordinates with SOC and IR teams to ensure playbooks are actionable and regularly tested against known threats or past incidents. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), USUP (Incident management) | • Develop and maintain system-specific incident response playbooks aligned with enterprise IR strategy and threat intelligence sources. • Conduct tabletop exercises and simulated incident walkthroughs to validate team readiness and response effectiveness. • Ensure appropriate log sources and telemetry feeds are integrated with SIEM and EDR platforms to support rapid triage and forensic analysis. • Define incident severity levels and containment protocols relevant to the operational context of the system. • Collaborate with SOC and Threat Intelligence functions to tune alerting thresholds and detection rules specific to system behaviours. | • Escalation contacts loaded to on-call tooling | • System-specific IR playbook (validated) • Alert-to-playbook mapping | • Exercised IR playbooks with tabletop report • Integration evidence with enterprise IR plan |
| Transition | Monitoring Enablement | Operational Security Architect | Owns the operational security monitoring strategy for the system, ensuring continuous visibility into security events and anomalies. Maintains log source integrity, adjusts alerting thresholds, and validates that monitoring remains aligned to current risk. | Level 5 - Ensure, advise | SCAD (Security operations), SCTY (Information security), ITOP (Infrastructure operations), METL (Methods and tools) | • Maintain oversight of all security monitoring controls, ensuring that log sources remain active, synchronised, and tamper-resistant. • Regularly review and tune monitoring rules, detection use cases, and alerting thresholds based on changes in system behaviour or threat landscape. • Coordinate with observability and infrastructure teams to address telemetry gaps, ensuring complete coverage of critical components. • Implement automated monitoring health checks and alert suppression rules to reduce false positives and alert fatigue. • Ensure monitoring capabilities are aligned with security SLAs, risk appetite, and incident response expectations. | • Log sources confirmed active and parsing | • Monitoring acceptance record (sources, alerts tested, dashboards live) | • Detection coverage confirmation against use-case pack • Tuning baseline and review schedule |
| Transition | Operational Handover | Operational Security Architect | Accepts responsibility for the security posture of the live system, ensuring all security controls are operating effectively and integrated with broader operational processes. Maintains artefacts such as control matrices and technical runbooks to support change and incident response. | Level 5 - Ensure, advise | SCTY (Information security), CHMG (Change control), SCAD (Security operations), DESN (Systems design) | • Assume ownership of the system’s security posture post-deployment, ensuring continuity of security controls as part of the operational lifecycle. • Establish and maintain a comprehensive security configuration baseline, integrating it into change control and assurance processes. • Validate that operational teams have the necessary access, guidance, and tooling to manage security controls effectively. • Review and approve post-handover changes that could impact the system’s security posture, working closely with Change and Risk Management. • Maintain artefacts such as system security profiles, audit logs, and configuration inventories as part of operational governance. | • Acceptance checklist signed by operations | • Operational acceptance record with conditions and residual risks | • Formal service acceptance report including security acceptance evidence |
| Transition | Post-Deployment Security Testing | Operational Security Architect | Oversees post-deployment security testing specific to the project, ensuring that all security controls are functioning as designed. Focus is on validating that no security regressions or gaps exist after deployment. | Level 5 - Ensure, advise | SCTY (Information security), NFTS (Non-functional testing), VUAS (Vulnerability assessment), INAS (Information assurance), COPL (Continuity management) | • Conduct scheduled and ad hoc validation of security controls in the production environment, ensuring they remain effective post-change. • Collaborate with testing and resilience teams to run scenario-based tests (e.g., failover, credential misuse, lateral movement) reflecting realistic threats. • Perform periodic regression testing following updates, patches, or architectural changes to identify and address emerging control gaps. • Review findings from vulnerability scans, penetration tests, and red team exercises, coordinating remediation and lessons learned activities. • Maintain a security test plan for the system that evolves based on threat intelligence, incident trends, and audit findings. | • Post-go-live scan reviewed and actions logged | • Production control validation report | • Ongoing control validation schedule established • First-cycle validation evidence |
| Operation | Environment Provisioning | Operational Security Architect | Ensures that the provisioning of operational environments is consistent with real-time security requirements and ongoing risk assessments. The OSA works closely with the IT operations teams to implement robust security measures that align with the specific needs of live services. They continuously monitor and adjust the security configurations to adapt to changing threat landscapes, ensuring that environments remain secure and resilient. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Define and implement security policies and controls tailored specifically for each type of operational environment, whether cloud-based, on-premise, or hybrid. • Coordinate with infrastructure teams to ensure all provisioning processes incorporate necessary security checks and meet compliance standards. • Conduct risk assessments for new or modified environments to identify potential security gaps and ensure appropriate measures are in place. • Establish protocols for securely integrating new technologies and platforms into existing environments. | • Provisioning compliance check record | • Environment compliance reporting (scheduled scans vs baseline) | • Continuous compliance dashboard for environments • Deviation and exception register |
| Operation | Release Packaging | Operational Security Architect | Oversees the security aspects of release packaging for operational updates and patches. They ensure that all deployment artifacts are verified for security integrity and comply with the organisations established procedures. The OSA collaborates with development and project delivery teams to secure the release process, maintaining traceability and accountability for every change made to the operational systems. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Ensure the security of all release packages by implementing encryption and digital signing to maintain integrity and authenticity. • Conduct pre-deployment reviews of all packages to validate compliance with security policies and architectural standards. • Coordinate with project delivery teams to integrate security considerations into the build and release process, ensuring seamless transitions from development to operations. | • Release integrity verification note (signatures checked) | • Release verification procedure and execution records | • Supply-chain verification process (signature, SBOM checks) with evidence |
| Operation | Configuration Management | Operational Security Architect | Responsible for ensuring that all operational settings and integrations adhere to strict security standards. They oversee the application of configuration changes, maintaining compliance with security policies, and preventing unauthorised modifications. The OSA also conducts regular audits to validate configuration integrity and to identify and remediate any security discrepancies. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the management of security configurations for operating systems, applications, and network devices across operational environments. • Develop and enforce policies for managing changes to system configurations to avoid unauthorised alterations and ensure consistency across platforms. • Regularly review and update configuration settings based on new security findings and compliance requirements. • Automate configuration monitoring to detect and respond to unauthorised changes in real-time. | • CMDB security attributes updated | • Configuration drift reports with remediation records | • Secure configuration management framework in operation • Drift analytics and trends |
| Operation | Deployment Automation | Operational Security Architect | Ensures that all automated processes incorporate comprehensive security checks. They monitor automated deployment scripts to detect and rectify potential security issues swiftly. The OSA's role is crucial in certifying that automation tools enhance operational efficiency without compromising the security of the deployed services. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design secure deployment automation workflows that include comprehensive pre-deployment checks and post-deployment validations. • Integrate advanced security testing and scanning tools within deployment pipelines to identify vulnerabilities before they affect production environments. • Monitor automated deployment activities for adherence to security protocols, intervening manually when necessary to correct issues. | • Automation run logs with security checks passing | • Automation security review record • Secrets handling verification | • Automation assurance pack (pipeline controls, break-glass, audit trails) |
| Operation | Deployment Verification | Operational Security Architect | Actively involved in the deployment verification process, ensuring that all new or updated services meet rigorous security standards before they go live. They coordinate with testing teams to conduct thorough security assessments and validate compliance with the security criteria defined during the project delivery phase. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee the deployment verification process, ensuring all aspects, from functional performance to security compliance, are thoroughly validated. • Implement automated security testing frameworks to perform intensive security audits during deployment verification. • Coordinate with cybersecurity teams to resolve any security issues discovered during verification promptly and efficiently. | • Post-deployment verification checklist completed | • Verification reports against operational acceptance criteria | • Verification and validation framework with control attestation records |
| Operation | Rollback and Recovery | Operational Security Architect | Plans and tests rollback procedures and disaster recovery plans tailored to operational services. They ensure these plans are robust, secure, and capable of quickly restoring services to a secure state after an incident. Regular testing of these procedures ensures they are always ready to execute and effectively minimise downtime and data loss. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design and test robust rollback procedures that can be quickly implemented in case of a deployment failure or security breach. • Regularly update and practice disaster recovery plans to ensure minimal downtime and maintain operational continuity under all circumstances. • Review and refine recovery strategies following real-world incidents or changes in the operational landscape to improve resilience and reduce recovery times. | • Rollback procedure tested and recorded | • Rollback and recovery test reports | • Recovery assurance pack including compromise-recovery procedures and exercises |
| Operation | Monitoring and Performance Optimisation | Operational Security Architect | Establishes and manages sophisticated monitoring systems that track the security and performance of services continuously. They use this data to optimise system performance while ensuring robust security measures are effective. The OSA adjusts security controls in response to observed threats or performance bottlenecks, ensuring optimal service delivery. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Develop and maintain advanced security monitoring solutions that provide continuous surveillance of all operational systems. • Analyse security monitoring data to identify trends and potential threats, enabling proactive adjustments to security strategies. • Optimise system performance and security by regularly tuning monitoring tools and updating security response protocols. | • Alert review and tuning log | • Monitoring effectiveness reviews • Tuning records with rationale | • Detection coverage assessment (ATT&CK heatmap) • Continuous tuning programme records |
| Operation | Defect Tracking and Management | Operational Security Architect | Manages the tracking and resolution of defects discovered during the operation of services. They prioritise security-related defects, coordinating with the relevant teams to ensure timely and effective remediation. The OSA maintains detailed records of all security issues and their resolutions to improve future response strategies and enhance overall security. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Lead the defect tracking process for operational security issues, ensuring comprehensive documentation and prioritisation based on severity and impact. • Develop workflows for rapid defect resolution that involve key stakeholders across security, IT operations, and development teams. • Maintain a lessons-learned repository from past security incidents and defect resolutions to guide future operations and prevent recurrence. | • Operational security defects tracked with priority | • Defect management reporting with SLA performance | • Root-cause and trend analysis • Systemic remediation proposals to architecture |
| Maintenance | Monitoring and Alerting | Operational Security Architect | Establishes comprehensive monitoring frameworks that are specifically tailored to the unique requirements of organisations live services. By implementing advanced detection technologies and configuring real-time alert systems, the OSA ensures that potential security threats are identified swiftly and addressed promptly. This proactive monitoring setup allows for the continuous surveillance of operational systems, ensuring security breaches are minimised and operational continuity is maintained. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Design, implement, and maintain comprehensive monitoring solutions tailored to specific operational needs of live services. • Configure real-time alert systems to promptly detect and respond to security threats, minimising impact on operational continuity. • Continuously update and upgrade monitoring tools with the latest threat detection technologies and methodologies. • Analyse monitoring data to identify trends and potential security vulnerabilities, ensuring proactive management of risks. • Collaborate with IT operations to ensure monitoring systems are integrated seamlessly across all platforms and services. | • Alert tuning notes and rule updates | • Monitoring review reports • Updated alert catalogue with ownership | • Detection engineering backlog and coverage gap analysis against current threat intelligence |
| Maintenance | Incident and Problem Management | Operational Security Architect | Takes a leadership role in coordinating the response to security incidents. They develop and continuously refine incident response processes to incorporate best practices and lessons learned from recent security events. Regular training sessions are conducted for the incident response teams to ensure preparedness and efficiency in handling security breaches. The OSA also facilitates a collaborative environment across various departments, ensuring that all stakeholders are engaged and informed during the resolution of security incidents. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Lead the coordination and management of incidents, ensuring swift and effective resolution to maintain service integrity. • Regularly update incident response processes, incorporating best practices and lessons learned from recent security events. • Conduct regular training for incident response teams to ensure readiness and efficiency. • Facilitate cross-functional collaboration among IT operations, network security, and external stakeholders to address and mitigate incidents. • Review and analyse past incidents to improve response strategies and minimise future risks. | • Incident records with resolution notes | • Post-incident review reports with actions tracked | • Problem records with root-cause analysis • IR playbook and threat model updates from incidents |
| Maintenance | Patch and Update Management | Operational Security Architect | Oversees the patch and update management process, ensuring that all operational systems receive timely updates to mitigate known vulnerabilities. They manage a schedule for updates and maintain a controlled environment for testing patches before deployment. This careful management helps avoid disruptions to ongoing operations and ensures that updates enhance system security without introducing new issues. The OSA also works closely with software vendors to understand the implications of patches and to coordinate their effective rollout. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Oversee and coordinate the timely application of patches and updates across all operational systems to address security vulnerabilities. • Develop strategies for efficient patch management that minimise disruptions to ongoing operations and service delivery. • Conduct pre-deployment testing of patches to ensure compatibility and non-disruption to existing systems. • Maintain a rigorous schedule for regular updates, ensuring all systems are defended against the latest security threats. • Collaborate with software vendors and security teams to understand implications of patches and manage the rollout process effectively. | • Patch compliance status for the estate | • Patch compliance reports • Risk-based deferral decisions with expiry | • Vulnerability posture reporting • Compensating control records with risk-owner sign-off |
| Maintenance | Performance Optimisation | Operational Security Architect | Focused on optimising the performance of security systems to ensure they do not negatively impact the overall system performance. They regularly assess and resolve any performance bottlenecks caused by security configurations, implementing strategic enhancements to improve system efficiency. By balancing security needs with system performance requirements, the OSA ensures that operational systems are both secure and highly efficient, providing a seamless user experience. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Regularly assess and optimise the performance of security systems to ensure they do not adversely affect the overall system performance. • Identify and resolve any performance bottlenecks caused by security configurations or updates. • Implement strategic enhancements to improve both security and system efficiency, ensuring optimal operational performance. • Work closely with network and systems engineers to ensure that security enhancements are implemented without degrading service quality or user experience. | • Security tooling performance check notes | • Performance review of security systems with tuning actions | • Optimisation study of the security stack with re-baselined thresholds |
| Maintenance | Capacity Planning and Scaling | Operational Security Architect | Leads efforts to ensure that organisations infrastructure is prepared to handle both expected and unexpected increases in demand. They conduct detailed analyses of performance metrics and usage patterns to accurately forecast future resource needs. The OSA ensures that security architectures are scalable and robust, providing strategic guidance on infrastructure investments that support growth while maintaining security standards. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Lead capacity planning efforts to ensure infrastructure is prepared to handle expected and unexpected increases in load, with a keen focus on maintaining security standards. • Analyse performance metrics and usage patterns to accurately predict scaling needs and prepare for resource allocation. • Assess the scalability of security architectures and ensure they are robust enough to handle increased operational demands. • Provide strategic recommendations on infrastructure investments that enhance scalability while strengthening security measures. | • Capacity utilisation check (ingestion, storage, licences) | • Capacity forecast for security infrastructure | • Capacity plan with scaling design validated for security tooling |
| Maintenance | User Feedback and Enhancements | Operational Security Architect | Engages with end-users to gather feedback on the security and operational aspects of services. This feedback is valuable in driving improvements and ensuring that security measures align with user expectations and needs. The OSA prioritises security enhancements based on this user feedback, facilitating regular review sessions to discuss concerns and potential improvements, enhancing user trust and satisfaction with the services. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Actively engage with end-users to gather feedback on security and operational aspects of services, using insights to drive improvements. • Incorporate user feedback into security enhancement initiatives, ensuring that updates and changes meet user needs and enhance overall security. • Facilitate regular review sessions with users to discuss security concerns and potential improvements, enhancing user trust and service satisfaction. | • User-reported security friction log entries | • Feedback analysis with proposed enhancements | • Usability-security review with prioritised enhancement plan |
| Maintenance | Continual Improvement and Innovation | Operational Security Architect | Drives initiatives focused on the continuous improvement of security measures. They explore and integrate innovative security technologies and practices to stay ahead of potential threats and adapt to evolving security challenges. By encourage ing a culture of continuous learning and adaptation within the security team, the OSA ensures that organisations security practices remain cutting-edge, effectively protecting against both current and future security risks. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Champion continuous improvement initiatives focused on enhancing security measures and practices across live services. • Explore and integrate innovative security technologies and methodologies to stay ahead of emerging threats and challenges. • Develop a culture of continuous learning and adaptation within the team, encouraging ongoing professional development and knowledge sharing. • Lead projects to pilot new security solutions, evaluating their effectiveness and suitability for wider deployment across organisations. | • Improvement actions in operational review | • Operational security improvement plan | • Innovation pilot evaluations with adoption recommendations |
| Optimisation | Performance Analysis and Benchmarking | Operational Security Architect | Benchmarks the operational performance of security controls and services across the live estate - detection and response times, control availability, alert quality - against agreed targets, and turns the evidence into tuning and investment recommendations. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Track operational security metrics (MTTD, MTTR, control uptime, alert fidelity) against agreed service targets. • Benchmark security operations performance against prior periods and comparable services. • Identify controls and processes that consistently miss targets and diagnose root causes. • Report findings to service owners and feed systemic issues to the solution and enterprise architects. | • Ops metrics summary (MTTD/MTTR, alert quality) in service review | • Security operations performance review against targets • Improvement actions with owners | • Benchmarking report across services • Re-baselined operational targets • Investment recommendations |
| Optimisation | Cost and Value Optimisation | Operational Security Architect | Optimises the running cost of operational security - tooling estate, licence consumption, alert-handling effort - while protecting the level of assurance the business has agreed to. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Review operational security tooling for overlap, low utilisation and redundant agents on the estate. • Analyse cost-to-serve for security operations (alert triage effort, incident handling time) and identify reduction opportunities. • Right-size licences, log ingestion and retention against actual operational need and compliance obligations. • Present consolidation options with explicit residual-risk impact for decision. | • Licence and ingestion utilisation check | • Tooling consolidation proposal with risk impact • Cost-to-serve analysis | • Operational security cost optimisation case • Consolidation design with coverage validation |
| Optimisation | Process Improvement and Automation | Operational Security Architect | Improves and automates recurring operational security processes - triage, enrichment, access recertification, evidence collection - reducing toil and response times while keeping automation itself securely governed. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Identify high-toil operational security processes and quantify effort consumed. • Design and implement automation and orchestration (e.g. SOAR playbooks, automated enrichment, scheduled recertification). • Ensure automation identities, credentials and actions follow least privilege and are auditable. • Measure improvements in response time, consistency and analyst workload. | • Toil hotspot list with quick wins | • SOAR/automation playbook designs • Toil reduction metrics | • Operations automation roadmap • Playbook library under governance • Benefits realisation tracking |
| Optimisation | Technology Refresh and Rationalisation | Operational Security Architect | Maintains the health of the operational security tooling estate - planning refreshes before end-of-support, consolidating overlapping capabilities, and ensuring upgrades preserve monitoring and control coverage. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Maintain a lifecycle register for operational security tooling, including end-of-support exposure. • Plan and sequence refresh and upgrade activity to avoid monitoring blind spots during transition. • Rationalise overlapping tools and agents, validating replacement coverage before retirement. • Update operational runbooks and integrations to reflect the refreshed estate. | • Tooling lifecycle register entries (end-of-support dates) | • Refresh plan with coverage-preservation approach | • Tooling estate rationalisation case • Migration design with blind-spot analysis |
| Optimisation | Control and Configuration Tuning | Operational Security Architect | Continuously tunes detections, alert thresholds and control configurations across live services using operational evidence - cutting noise and false positives without eroding coverage. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Analyse alert volumes, false-positive rates and missed detections across the estate. • Tune detection rules, thresholds and control policies, documenting rationale and expected effect. • Validate tuning against threat models and purple-team or detection-validation exercises. • Maintain tuned baselines under change control and monitor for drift. | • Tuning change log with rationale | • Tuning review report (false-positive/negative trends) • Detection validation results | • Estate-wide tuning programme records • Validated baselines under change control • Purple-team validation evidence |
| Optimisation | Capability Enhancement and Innovation | Operational Security Architect | Advances operational security capability on the basis of operational evidence - piloting improvements such as behavioural analytics, automated response or exposure management - and embedding what proves its value. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Identify operational capability gaps from incident trends, coverage assessments and analyst feedback. • Propose and run controlled pilots for enhanced operational capabilities (e.g. UEBA, automated containment). • Evaluate pilots against agreed success criteria, including operational overhead and residual risk. • Embed successful capabilities into standard operations and share outcomes with the architecture community. | • Capability gap notes from incident trends | • Capability pilot proposal and evaluation (e.g. automated containment) | • Capability uplift design with pilot evidence • Adoption plan and maturity re-assessment |
| Retirement | Identification and Assessment | Operational Security Architect | The OSA evaluates operational systems marked for retirement to assess their current functional status and security posture. This involves analysing usage patterns to identify underutilised or redundant systems and determining any potential security risks associated with their continued operation or shutdown. The OSA works closely with the ESA to ensure that the findings align with enterprise-wide security strategies, ensuring no gaps in compliance or protection arise during the transition process. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Analyse operational systems to determine which are candidates for retirement based on utilisation, performance, security vulnerabilities, and ongoing support costs. • Perform detailed security assessments for each system identified for retirement to uncover any potential risks associated with decommissioning. • Collaborate with enterprise security architects to ensure alignment between the retirement candidates and broader security strategies. • Document and report on the potential impacts of system decommissioning, including effects on related systems and business operations. | • Retirement candidate assessment note (usage, vulnerabilities) | • Operational retirement assessment (dependencies, monitoring, access) | • Estate analysis for retirement (dependency map, data flows, risk exposure) |
| Retirement | Planning and Strategy | Operational Security Architect | Once systems are identified for retirement, the OSA develops a plan focusing on maintaining security throughout the decommissioning process. This planning includes detailed risk assessments, outlining potential vulnerabilities during system shutdown or data migration phases. The OSA collaborates with project teams to ensure that the transition strategy minimises operational disruptions and maintains security integrity, creating contingency plans for any identified risks. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Develop security-focused decommissioning plans that include timelines, required resources, and detailed procedures for safely winding down systems. • Create risk mitigation strategies for identified security risks to ensure that the retirement process does not expose organisations to threats. • Coordinate with IT and business units to develop a phased decommissioning approach that minimises operational disruptions. • Plan for the secure handling and disposal of hardware, ensuring that all data is irreversibly destroyed or securely migrated. | • Decommissioning checklist for operations | • Operational decommissioning plan (monitoring wind-down, access removal sequence) | • Decommissioning operations strategy with continuity safeguards and contingency |
| Retirement | Data Migration and Archiving | Operational Security Architect | The OSA oversees the secure migration and archiving of data from retiring systems, ensuring that data integrity and confidentiality are preserved. They implement data security controls and coordinate with IT teams to employ encryption and other protective measures during data transfer processes. The OSA also ensures that all data retention policies are adhered to and that any data deletion aligns with compliance mandates, safeguarding against potential data breaches. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Manage the secure migration of data from systems being retired to new systems, ensuring data integrity and security during the transfer. • Implement encryption and secure transfer protocols to protect data during migration. • Coordinate the archiving of critical data in compliance with legal and regulatory requirements, ensuring that data retention policies are adhered to. • Oversee the secure deletion of data that is not migrated or archived, using industry-standard data sanitisation methods. | • Data disposition actions recorded | • Migration execution records with integrity verification | • Data disposition evidence pack (transfer logs, integrity checks, archive access controls) |
| Retirement | Decommissioning and Resource Cleanup | Operational Security Architect | During the physical decommissioning of systems, the OSA ensures that all operational security measures are strictly followed. This includes overseeing the secure erasure of data, the proper disposal of hardware, and the revocation of access rights associated with decommissioned systems. The OSA monitors and verifies each step of the resource cleanup to prevent security lapses, ensuring that all components are appropriately sanitised or destroyed. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Supervise the physical decommissioning process, ensuring that all components are appropriately dismantled and disposed of securely. • Manage the deactivation and de-registration of software licenses and the revocation of system access to ensure that security vulnerabilities are closed. • Oversee the secure wiping or destruction of storage devices to prevent data leakage. • Ensure compliance with environmental standards for the disposal of electronic waste and hardware. | • Access revoked and confirmed; assets marked disposed | • Cleanup execution records (accounts, keys, certificates, rules, agents) | • Decommissioning evidence pack with sanitisation certificates and CMDB closure |
| Retirement | Communication and User Transition | Operational Security Architect | The OSA is actively involved in communicating with users affected by the retirement of systems, ensuring they are fully informed about the changes and understand the security implications. They provide support and guidance during the transition to new systems, focusing on security training and updating users on new operational protocols. The OSA gathers feedback from users to continually refine the transition process and address any security concerns promptly. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Communicate decommissioning plans and schedules to all stakeholders, providing updates and alerts throughout the process. • Provide guidance and support to users affected by the retirement, ensuring they are transitioned to new systems with appropriate security training. • Collect and address feedback from users throughout the decommissioning process to ensure issues are resolved promptly and to improve future retirement processes. | • Ops and user notification records | • Transition communications with security guidance issued | • Stakeholder transition record including external/contractual notifications |
| Retirement | Review and Documentation | Operational Security Architect | Post-retirement, the OSA conducts a comprehensive review of the entire decommissioning process to evaluate the security measures implemented and identify any areas for improvement. They document all aspects of the retirement process, including security protocols used, challenges faced, and how they were mitigated. This documentation serves as a vital resource for future retirement projects, providing a detailed record that helps refine and enhance security practices. | Level 5 - Ensure, advise | SCTY (Information security), BURM (Risk management), SCAD (Security operations), INAS (Information assurance) | • Conduct post-decommissioning reviews to evaluate the security effectiveness of the retirement process and identify any remaining risks. • Document all aspects of the decommissioning process, including actions taken, decisions made, and lessons learned, to inform future retirement strategies. • Update security policies and practices based on insights gained from the retirement process to enhance organisations security postures. | • Closure note with lessons for operations | • Decommissioning review with monitoring/alert catalogue updates | • Formal closure report • Residual risk closure evidence • Archived operational artefact set |