Architecture / Security Architecture Operating Models / Services
03 · Offer
Security architecture service catalogues
Describe architecture in terms customers can request, understand and value.
23enterprise security services
18security solution services
18operational security services
Workbook source · ESA Service Catalogue
Enterprise Security Architecture services
For the CISO, CIO/CTO, risk and audit committees, and portfolio and investment boards.
Services of the Enterprise Security Architect: enterprise-scoped, setting security direction, reference architecture, standards and governance across every Through Life phase. Consumers: CISO, CIO/CTO, risk and audit committees, portfolio and investment boards.
| No. | Service Name | What We Do | What the Customer Gets | Customer Benefit | SABSA Supporting Tool/Method | Primary Through Life Phases | ODM Family | Notes |
|---|---|---|---|---|---|---|---|---|
| ESA-01 | Security Architecture and Solution Design | Provide architectural leadership and security design expertise across all technology initiatives, engaging from strategy through delivery and ongoing management. | Security is embedded from the outset, with expert involvement in shaping secure, resilient, and compliant solutions. | Reduces risk of vulnerabilities and compliance failures, avoids costly redesigns, and ensures secure delivery of business outcomes. | Architecture Layer Mapping, Business Attribute Profiling, SABSA Domain Modelling | 1. Strategy to 7. Operation | F1 | |
| ESA-02 | Enterprise Security Reference Architecture | Define and maintain security reference architectures, standards, and design patterns tailored to the organisation’s needs. | Access to consistent, reusable frameworks and blueprints for secure solution delivery. | Accelerates secure project delivery, ensures alignment with requirements, and reduces risk of security gaps. | SABSA Matrix (6 Perspectives - 6 Layers), Security Services-Oriented Architecture Framework, Logical/Physical/Component Layer Design | 1. Strategy, 3. Design | F1 | |
| ESA-03 | Security Requirements Definition and Engineering | Develop and validate security requirements for projects, change, and procurement, collaborating with stakeholders throughout the lifecycle. | Actionable, risk-based requirements that are traceable and support compliance. | Prevents vulnerabilities, supports audit needs, and reduces project delays or redesigns. | Business Attribute Profiling, Contextual Layer Analysis, Requirements Traceability Framework | 2. Planning, 3. Design | F2 | |
| ESA-04 | Security Risk and Capability Assessments | Conduct structured assessments of security risks and architectural maturity across systems and programmes. | Detailed reports highlighting risk posture, maturity gaps, and actionable recommendations. | Enables data-driven investment, prioritises remediation, and strengthens security resilience. | SABSA Risk Model, Threat Modelling (STRIDE/PASTA), Risk Taxonomy and Assessment Framework | 1. Strategy, 9. Optimisation | F4 | |
| ESA-05 | Security Strategy and Roadmap Development | Define security architecture strategy and develop a tailored capability roadmap aligned to business objectives. | A clear, actionable plan for security capability development and risk mitigation. | Prepares for emerging threats, supports business growth, and guides security investment. | Contextual Layer Definition, Business Requirements Analysis, SABSA Strategy & Planning Phase | 1. Strategy, 2. Planning | F4 | |
| ESA-06 | Supply Chain and Third-Party Security Assurance | Provide security assessment and assurance for suppliers and third parties, integrating security into procurement and supplier management. | Rigorous evaluation of supplier and third-party risk, with clear assurance reporting. | Protects from supply chain vulnerabilities and ensures compliance in third-party engagements. | SABSA Domain Modelling, Risk Assessment Framework, Governance Framework (RACI) | 2. Planning, 7. Operation | F2 | |
| ESA-07 | Security Governance, Policy, and Compliance Enablement | Support the development, implementation, and improvement of security governance, policies, and compliance processes. | Robust, embedded controls and clear compliance processes. | Demonstrable compliance, reduced risk, and support for business operations. | Policy Architecture Framework, SABSA Governance Framework, Domain Modelling for Policy Scope | All phases | F3 | |
| ESA-08 | Stakeholder Engagement and Security Advocacy | Build relationships across business and technology teams, promoting security as a business enabler and translating complex concepts into business value. | Clear communication, advocacy, and alignment of security with business priorities. | Drives buy-in, shared accountability, and a culture of security awareness. | Business Attribute Profiling, Stakeholder Analysis, Communication and Traceability Framework | 1. Strategy, 2. Planning | F6 | |
| ESA-09 | Security Standards Development and Maintenance | Develop, review, and maintain technical security standards and guidelines to address evolving threats and technologies. | Up-to-date, practical standards underpinning consistent security practices. | Supports compliance, reduces technical debt, and ensures repeatable, auditable security. | Control Mapping and Layer-Mapping Technique, Standards Alignment Framework, Component Layer Design | 3. Design, 8. Maintenance | F3 | Technical Teams deliver systems and IT services including internal IT Teams and Suppliers |
| ESA-10 | Security Change and Transformation Integration | Ensure security is embedded in change and transformation programmes from inception through delivery. | Integrated security controls within programme governance and delivery. | Reduces risk during transformation, supporting secure and successful change. | SABSA Lifecycle Management (Strategy/Design/Implement/Manage), Architecture Layer Traceability | 2. Planning to 6. Transition | F1 | |
| ESA-11 | Security Requirements for Procurement and Outsourcing | Define, assure, and monitor security requirements for procurement and outsourcing activities. | Expert support for aligning external engagements with risk appetite and compliance. | Reduces risk of vulnerabilities from third parties and supports secure procurement. | Business Attribute Profiling, SABSA Domain Modelling, Risk and Compliance Framework | 2. Planning | F2 | |
| ESA-12 | Security Incident Response Architectural Support | Provide architectural expertise during major security incidents, ensuring response actions are aligned with architectural principles. | Rapid containment, eradication, and recovery support, with lessons learned for future designs. | Minimises impact of incidents and strengthens future resilience. | Operational Layer Analysis, Threat Modelling, SABSA Manage and Measure Phase | 7. Operation | F5 | |
| ESA-13 | Regulatory and Standards Alignment Advisory | Advise on alignment of security architecture with regulatory and industry standards, translating requirements into practical controls. | Practical guidance for audit readiness and compliance. | Reduces compliance risk and supports regulatory obligations. | Control Library Mapping, Layer-Mapping Technique, Standards Alignment Framework (ISO27001/NIST/GDPR) | 1. Strategy, 3. Design | F3 | |
| ESA-14 | Security Technical Debt Identification and Remediation Support | Identify and prioritise remediation of security technical debt, legacy risk and end-of-support exposure across the enterprise, directing technology refresh before it becomes unplanned risk. | Proactive management and prioritisation of technical debt remediation. | Prevents accumulation of vulnerabilities and supports secure architecture evolution. | Physical/Component Layer Analysis, Risk Model Assessment, Remediation Roadmapping | 8. Maintenance, 9. Optimisation | F4 | |
| ESA-15 | Security Innovation and Emerging Technology Advisory | Provide guidance on secure adoption and integration of emerging technologies (e.g., cloud, AI, IoT), governing capability pilots and enterprise adoption decisions. | Balanced, risk-aware advice for secure innovation. | Enables secure exploitation of new technologies while managing risk. | Threat Modelling, Architecture Layer Abstraction, Physical/Component Layer Design for Emerging Tech | 1. Strategy, 9. Optimisation | F1 | |
| ESA-16 | Security Architecture Governance Forums and Review Boards | Facilitate governance forums and architecture review boards for independent assurance and oversight. | Transparent oversight and continuous improvement of security architecture practices. | Ensures consistent application of controls and informed decision-making. | SABSA Governance Framework, Domain Modelling, RACI Framework | 3. Design to 6. Transition | F3 | |
| ESA-17 | Security Metrics, Reporting, and Decision Support | Deliver actionable metrics, benchmarking and reporting on security architecture effectiveness and risk posture, providing the evidence base for optimisation and investment decisions. | Clear, data-driven reporting for decision-making and regulatory support. | Enables informed decisions and continuous improvement. | Business Attribute Profiling (Performance Metrics), SABSA Manage and Measure Phase | All phases | MP | |
| ESA-18 | Security Architecture Knowledge Sharing and Training | Provide targeted training and knowledge sharing on secure architecture principles and practices. | Enhanced internal capability and security awareness. | Fosters professional development and a culture of security. | SABSA Matrix and Lifecycle Model, Layer-Mapping Technique, Governance and Traceability Frameworks | 9. Optimisation | F6 | |
| ESA-19 | Secure Architecture for Data Protection and Privacy | Embed data protection and privacy requirements in all architectural decisions and solutions. | Solutions that support data protection laws and safeguard sensitive information. | Ensures compliance with privacy regulations and protects organisational data. | Business Attribute Profiling, Threat Modelling, Logical/Physical Layer Design for Privacy Controls | 3. Design, 10. Retirement | F3 | |
| ESA-20 | Architecture Support for Business Continuity and Resilience | Ensure security architecture underpins business continuity and technical resilience. | Integration of resilience principles into technology and process design. | Enhances ability to withstand and recover from disruptive events. | Risk Model Framework, Domain Modelling, Physical/Operational Layer Resilience Design | 3. Design, 7. Operation | F5 | |
| ESA-21 | Security Architecture Community of Practice Leadership | Lead an internal community of practice to promote security architecture maturity and best practice. | Access to shared best practice, innovation, and professional development. | Drives consistency and continual improvement across the enterprise. | SABSA Governance Framework, Maturity Model Framework, Knowledge Management and Traceability | 9. Optimisation | F6 | |
| ESA-22 | Architecture Support for Safety-Critical or OT Environments | Provide specialist security architecture expertise for safety-critical and OT systems. | Tailored support addressing unique risks and regulatory requirements. | Ensures secure, reliable operation of critical systems and compliance in regulated environments. | Domain Modelling for OT/Safety Systems, Threat Modelling (OT-specific), Operational Layer Design | All phases | F1 | |
| ESA-23 | Security Optimisation and Posture Tuning | Continuously optimise the deployed security estate - tuning controls and detections, rationalising tooling and run-cost, automating recurring security processes, and directing technology refresh - using operational evidence and outcome metrics. | A measurably leaner, better-performing security estate: less alert noise and control friction, lower run-cost, and refreshed technology without coverage gaps. | Sustains agreed protection levels at falling cost and friction; prevents posture decay between projects; turns operational evidence into design improvement. | SABSA Manage and Measure Phase, Business Attribute Profiling (Performance Metrics), Operational Layer Analysis | 9. Optimisation | F4 |
Workbook source · SSA Service Catalogue
Security Solutions Architecture services
For project sponsors, product owners and delivery leaders.
Services of the Security Solutions Architect: project- and solution-scoped, from inception through delivery, optimisation and retirement. Consumers: project sponsors, delivery leads, product owners.
| No. | Service Name | What We Do | What the Customer Gets | Customer Benefit | SABSA Supporting Tool/Method | Primary Through Life Phases | ODM Family |
|---|---|---|---|---|---|---|---|
| SSA-01 | Embedded Project Security Architecture | Provide a security solutions architect embedded within the delivery team from inception to handover, shaping secure design decisions as they are made rather than reviewing them afterwards. | Security expertise inside the team, at the point of decision, across the full delivery lifecycle. | Prevents late-stage security rework, keeps delivery velocity, and ensures security decisions reflect project reality. | Architecture Layer Mapping, Business Attribute Profiling, SABSA Lifecycle (Strategy/Design/Implement/Manage) | 2. Planning to 6. Transition | F6 |
| SSA-02 | Solution Security Design | Produce the security design for a solution - control allocation, layered protection, identity, cryptography, logging - integrated into the HLD and LLD rather than bolted on. | A security design proportionate to the solution’s risk, traceable from requirement to control to component. | Solutions ship with the right controls in the right places, evidenced for assurance and audit. | Logical/Physical/Component Layer Design, Control Allocation Mapping, SABSA Matrix | 3. Design | F1 |
| SSA-03 | Threat Modelling and Risk Assessment | Conduct proportionate threat modelling - from a threat table for small changes to full DFD/STRIDE models with attack paths for major or high-risk programmes - and turn findings into design decisions. | A clear view of what can go wrong, what matters most, and which controls address it - sized to the project. | Risk-based design effort: small projects move fast, large ones get the depth they warrant. | Threat Modelling (STRIDE/PASTA), SABSA Risk Model, Attack Path Analysis | 2. Planning, 3. Design | F1 |
| SSA-04 | Security Requirements Definition and Traceability | Define risk-based security requirements for the project with acceptance criteria, and maintain traceability from requirement through control to verification evidence at go-live. | Actionable, testable security requirements with an evidence chain that survives audit. | Prevents underspecified security needs becoming production vulnerabilities or compliance findings. | Business Attribute Profiling, Contextual Layer Analysis, Requirements Traceability Framework | 2. Planning to 5. Deployment | F2 |
| SSA-05 | Secure Design Review and Assurance | Review project designs against enterprise patterns, standards and the threat model at defined gates, providing findings, conditions and closure tracking for projects without an embedded architect. | Independent design assurance with concrete findings and a route to closure. | Catches design flaws at the cheapest point to fix them; gives sponsors confidence to proceed. | Layer-Mapping Technique, Standards Alignment Framework, Design Review Method | 3. Design, 4. Development | F1 |
| SSA-06 | Pattern Instantiation and Tailoring | Apply enterprise security reference patterns to the specific solution context, tailoring where justified and recording deviations for design authority decision. | Faster, consistent security design reusing proven patterns, with deviations managed rather than hidden. | Cuts design effort and review cycles; keeps the estate converging on approved architecture. | SABSA Domain Modelling, Pattern Catalogue Application, Architecture Layer Mapping | 3. Design | F1 |
| SSA-07 | Security in Agile Delivery | Work within agile cadences - security acceptance criteria on stories, definition-of-done security clauses, sprint-level design support and incremental threat model updates. | Security that moves at sprint speed, embedded in the backlog rather than gating it. | Security ceases to be a phase-end blocker; teams build it in as they go. | Incremental Threat Modelling, Business Attribute Profiling, SABSA Lifecycle Management | 3. Design, 4. Development | F6 |
| SSA-08 | DevSecOps Pipeline Security Design | Design the security of the delivery pipeline itself - SAST/SCA/secrets scanning gates, artefact signing, IaC scanning, environment promotion controls and exemption management. | A pipeline that enforces the security bar automatically, with evidence generated as a by-product. | Consistent, repeatable security without manual checkpoints; audit evidence for free. | Component Layer Design, Control Mapping, SABSA Manage and Measure Phase | 4. Development, 5. Deployment | F1 |
| SSA-09 | Cloud Solution Security Design | Design solution-level cloud security - landing zone conformance, service configuration, identity and network controls, and shared-responsibility clarity for the services actually used. | Cloud workloads that conform to the platform guardrails with service-level controls designed, not defaulted. | Avoids cloud misconfiguration risk - the dominant cause of cloud breaches - and rework against platform standards. | SABSA Domain Modelling, Logical/Physical Layer Design, Shared Responsibility Mapping | 3. Design, 5. Deployment | F1 |
| SSA-10 | Integration and API Security Design | Design the security of interfaces - authentication and authorisation models, API gateways, message integrity, third-party connectivity and data exchange agreements. | Interfaces that are explicitly designed trust boundaries rather than accidental ones. | Prevents the integration layer becoming the soft underbelly of otherwise secure solutions. | Trust Boundary Analysis, Logical Layer Design, Interface Control Specification | 3. Design, 4. Development | F1 |
| SSA-11 | Data Protection by Design | Embed data protection into the solution - classification-driven controls, minimisation, retention, and DPIA support - so privacy obligations are met through architecture, not paperwork. | Solutions that demonstrably meet UK GDPR obligations with privacy controls designed in. | Reduces regulatory exposure and privacy incidents; evidences accountability by design. | Business Attribute Profiling, Threat Modelling, Logical/Physical Layer Privacy Controls | 3. Design, 10. Retirement | F3 |
| SSA-12 | Security Testing Strategy and Oversight | Define what security testing the project needs - from pipeline scans to penetration tests - scope it, interpret results architecturally and design the remediation. | Testing proportionate to risk, with findings turned into design fixes rather than ticket noise. | Assurance spend lands where risk is; findings get fixed at cause, not symptom. | SABSA Risk Model, Assurance Mapping, Threat-Led Test Scoping | 4. Development, 5. Deployment | F1 |
| SSA-13 | Secure Migration and Cutover Design | Design the security of data and system migrations - sequencing, encryption in transit, integrity verification, rollback and the security of temporary coexistence states. | Migrations that protect data and service through every intermediate state, with tested rollback. | Prevents the migration window becoming the breach window; protects cutover confidence. | Migration Risk Assessment, Trust Boundary Analysis, Operational Layer Design | 5. Deployment, 6. Transition | F1 |
| SSA-14 | Third-Party Solution Security Assessment | Assess the security architecture of vendor solutions during selection and delivery - design review, integration risk, data handling and contractual security requirement verification. | A clear-eyed view of what a vendor product actually does with your data and how it fits your estate. | Prevents procurement surprises and third-party weaknesses inherited into the estate. | SABSA Domain Modelling, Risk Assessment Framework, Requirements Traceability | 2. Planning, 3. Design | F2 |
| SSA-15 | Security Operations Enablement | Design the operational security of the solution with the operational architects - monitoring use cases, alert routing, playbooks, runbooks and handover evidence - before go-live. | A solution that operations can actually defend from day one, with detection and response designed in. | Closes the classic gap between “built secure” and “operated secure”; smooth service acceptance. | Operational Layer Analysis, Detection Use-Case Design, SABSA Manage and Measure Phase | 5. Deployment, 6. Transition | F5 |
| SSA-16 | Solution Security Optimisation | Post-live, tune and improve the solution’s security - control effectiveness review, configuration tuning, cost and licence rationalisation, and automation of recurring security tasks. | A solution whose security gets leaner and sharper with operational evidence, not stale from day one. | Sustains protection while reducing noise, friction and run-cost; feeds lessons back to patterns. | SABSA Manage and Measure Phase, Business Attribute Profiling (Performance), Control Effectiveness Review | 8. Maintenance, 9. Optimisation | F4 |
| SSA-17 | Incident Support and Remediation Design | Provide solution-level architectural expertise during security incidents affecting delivered systems, and design the remediation so the class of failure is closed, not just the instance. | Faster, better-informed containment decisions and remediation that prevents recurrence. | Cuts incident impact and stops repeat incidents from the same design weakness. | Operational Layer Analysis, Threat Modelling, Root-Cause Remediation Design | 7. Operation | F5 |
| SSA-18 | Decommissioning Security Design | Design the secure retirement of solutions - data disposition, dependency unpicking, access and credential revocation, and the evidence trail for sanitisation and closure. | Retirement executed without data leakage, orphaned access or broken dependencies. | Closes the long tail of risk from half-retired systems and unmanaged data remnants. | Decommissioning Risk Assessment, Data Disposition Mapping, SABSA Domain Modelling | 10. Retirement | F4 |
Workbook source · OSA Service Catalogue
Operational Security Architecture services
For service owners, security operations leadership and the SOC.
Services of the Operational Security Architect: live-service and estate-scoped, from acceptance into service through continuous operation, optimisation and decommissioning. Consumers: service owners, operations leadership, SOC.
| No. | Service Name | What We Do | What the Customer Gets | Customer Benefit | SABSA Supporting Tool/Method | Primary Through Life Phases | ODM Family |
|---|---|---|---|---|---|---|---|
| OSA-01 | Operational Security Posture Ownership | Own the security posture of live services - maintaining the operational security architecture, tracking control health, and acting as the accountable design authority for in-service security change. | A named owner for “is this service still secure?” with the evidence to answer it. | Prevents posture decay between projects; keeps accountability unambiguous. | Operational Layer Analysis, SABSA Manage and Measure Phase, Control Health Monitoring | 7. Operation, 8. Maintenance | F4 |
| OSA-02 | Security Monitoring and Detection Architecture | Design and maintain the monitoring architecture - log source coverage, SIEM integration, detection use cases mapped to threats - so security events are seen, not just generated. | Detection coverage that maps to your actual threat model, with gaps known and prioritised. | Attacks are detected early; monitoring spend targets real risk rather than log volume. | Detection Use-Case Design, MITRE ATT&CK Coverage Mapping, Operational Layer Design | 5. Deployment, 7. Operation | F5 |
| OSA-03 | Incident Response Architecture and Playbooks | Build and maintain service-specific incident response playbooks aligned to the enterprise IR framework, and exercise them so response is practised, not improvised. | Playbooks that reflect how systems actually work, tested before they are needed. | Faster containment, less improvisation and cleaner recovery when incidents occur. | Incident Response Framework Alignment, Tabletop Exercise Design, Operational Layer Analysis | 6. Transition, 7. Operation | F5 |
| OSA-04 | Operational Acceptance and Handover Assurance | Gate the transition of new solutions into service - validating monitoring, runbooks, access models and residual risks against security acceptance criteria before operations takes ownership. | Nothing enters service that operations cannot see, support and defend. | Stops projects transferring hidden risk into the operational estate. | Service Acceptance Criteria Framework, Operational Readiness Assessment, SABSA Manage Phase | 5. Deployment, 6. Transition | F5 |
| OSA-05 | Vulnerability and Patch Management Architecture | Design the vulnerability management operating approach - risk-based prioritisation, severity SLAs, deferral and compensating-control decisions, and posture reporting. | A defensible, risk-based patching regime instead of an unwinnable patch-everything race. | Exposure windows shrink where they matter; deferrals are conscious decisions with owners. | SABSA Risk Model, Risk-Based Prioritisation Framework, Compensating Control Design | 8. Maintenance | F4 |
| OSA-06 | Secure Configuration and Hardening Management | Define and maintain secure configuration baselines for operational platforms, with drift detection and remediation so the estate stays as hardened as it was built. | An estate that provably matches its baselines, with drift caught in days not audits. | Closes the gap between designed and actual configuration - a top breach contributor. | Configuration Baseline Framework (CIS-aligned), Drift Detection Design, Component Layer Analysis | 7. Operation, 8. Maintenance | F1 |
| OSA-07 | Operational Access and Privileged Account Architecture | Design the operational identity and access arrangements - joiner/mover/leaver flows, privileged access operations, recertification cycles and break-glass procedures. | Access that tracks people and roles accurately, with privilege visible, time-bound and reviewed. | Cuts the standing-privilege attack surface and the audit findings that follow it. | Identity Architecture Mapping, Privileged Access Operating Model, Recertification Design | 7. Operation | F3 |
| OSA-08 | Security Tooling Estate Management | Manage the operational security tooling estate - lifecycle, integration health, agent sprawl and rationalisation - keeping capability current without accumulating shelfware. | A tooling estate that is current, integrated and justified by the capability it delivers. | Lower run-cost, fewer blind spots from broken integrations, no zombie agents. | Tooling Lifecycle Register, Capability Mapping, Component Layer Design | 7. Operation, 9. Optimisation | F4 |
| OSA-09 | Detection Tuning and Optimisation | Continuously tune detections and alerting using operational evidence - false-positive analysis, coverage validation against ATT&CK, purple-team feedback - without eroding coverage. | Fewer, better alerts: analysts investigate signal rather than triage noise. | Faster response, lower analyst burnout, and validated confidence that tuning has not opened gaps. | MITRE ATT&CK Coverage Mapping, Detection Validation, SABSA Manage and Measure Phase | 9. Optimisation | F4 |
| OSA-10 | Backup, Recovery and Resilience Operations | Design and assure the operational recovery capability - backup integrity and immutability, restore testing, failover exercising and compromise-recovery variants. | Recovery that is demonstrated on a schedule, including from ransomware-class events. | When the worst happens, recovery is a rehearsed procedure rather than a hopeful theory. | Recovery Architecture Design, Exercise Programme Framework, Resilience Layer Analysis | 3. Design, 7. Operation | F5 |
| OSA-11 | Operational Risk and Compliance Monitoring | Run continuous compliance monitoring for operational obligations - control attestation, audit evidence generation and exception management - so audit readiness is a state, not a project. | Compliance evidence generated continuously by operations, not assembled in a panic before audits. | Audit cost and disruption fall; exceptions carry owners and expiry dates. | Continuous Compliance Design, Control Attestation Framework, Standards Alignment (ISO 27001/CAF) | 7. Operation | F3 |
| OSA-12 | Security Operations Automation | Design and govern automation of security operations - SOAR playbooks, alert enrichment, automated containment and scheduled hygiene tasks - with automation itself securely controlled. | Routine response and hygiene executed in seconds by machines, audited and reversible. | Response times drop, toil falls, and scarce analysts work on what machines cannot do. | SOAR Playbook Design, Automation Governance Framework, Least-Privilege Automation Model | 7. Operation, 9. Optimisation | F4 |
| OSA-13 | Threat-Informed Defence | Integrate threat intelligence into operational decisions - mapping active threats to your attack surface, steering detection priorities, hunting and control emphasis. | Operations that anticipate the threats targeting organisations like yours, not last year’s generic list. | Defensive effort concentrates where attack likelihood actually is. | Threat Intelligence Integration, Attack Surface Mapping, MITRE ATT&CK Alignment | 7. Operation | F5 |
| OSA-14 | Operational Metrics and Posture Reporting | Produce the operational security evidence base - MTTD/MTTR, control health, coverage, compliance posture - feeding service reviews, ODMs and executive reporting. | Trustworthy numbers on how well security operations actually perform, trended over time. | Decisions and investment cases rest on evidence; the ODM framework gets its data. | Business Attribute Profiling (Performance Metrics), SABSA Manage and Measure Phase, KPI/KRI/KCI Framework | 7. Operation | MP |
| OSA-15 | Legacy and End-of-Life Risk Management | Manage the risk of unsupported and legacy systems in operation - compensating controls, isolation design, monitoring emphasis and pressure into the refresh roadmap. | Legacy risk that is contained, visible and priced, rather than silently accumulating. | Keeps unavoidable legacy defensible and gives refresh decisions an honest risk basis. | Compensating Control Design, Isolation and Segmentation Patterns, Risk Model Assessment | 8. Maintenance, 9. Optimisation | F4 |
| OSA-16 | Secure Decommissioning Execution | Execute the operational side of system retirement - access and credential revocation, monitoring wind-down, data sanitisation evidence and CMDB closure. | Retirement completed with an evidence trail: nothing left listening, nothing left readable. | Eliminates orphaned access and data remnants - favourite footholds for attackers. | Decommissioning Runbook Design, Sanitisation Evidence Framework, Operational Layer Analysis | 10. Retirement | F4 |
| OSA-17 | Operational Security Process Improvement | Continuously improve operational security processes - toil analysis, workflow redesign, automation candidates and measurable reduction in effort and error rates. | Security operations that get cheaper and faster each quarter without losing rigour. | Frees capacity for higher-value work; improvement is measured, not asserted. | Process Analysis, Toil Measurement Framework, SABSA Manage and Measure Phase | 9. Optimisation | F4 |
| OSA-18 | Major Incident Architectural Support | Provide architectural expertise during major security incidents - estate knowledge for containment decisions, recovery sequencing and post-incident architectural remediation. | Containment and recovery decisions informed by how the estate actually fits together. | Less collateral damage during response; incidents leave the architecture stronger. | Operational Layer Analysis, Dependency Mapping, Post-Incident Architecture Review | 7. Operation | F5 |