IT Security Architecture

IT Security Architecture translates business risk decisions into concrete, enforceable design. When done well, it ensures that security controls are proportionate, consistent, and traceable across every system in the estate. When absent or neglected, organisations accumulate invisible risk — controls are duplicated or missing, accountability is unclear, and breaches expose gaps that were never deliberately accepted.

The Building Blocks

IT Security Architecture combines two foundational concepts — one defines what to protect, the other how to describe it.

IT Security Architecture

The enterprise discipline that embodies security principles in the design of IT systems. It encompasses reusable artefacts, standards, and accountability structures that define:

  • What security controls are required and which threats and risks to the organisation they are designed to address
  • Where those controls are positioned within the IT architecture
  • How the resulting architecture reduces the organisation’s risk exposure to a level consistent with its risk appetite
  • Who is responsible for their design, implementation, and ongoing effectiveness

Types of Security Architecture

Security architecture is not one thing. Five distinct types form a hierarchy — from organisation-wide strategy down to specific system designs. Each serves a different audience and delivers a different kind of value.

Most organisations only produce Solution architectures (because projects demand them). Mature security programmes also maintain Enterprise and Governance layers. Reference architectures bridge the gap — reusable blueprints that connect strategy to implementation. That is what OSA patterns provide.

Enterprise Security Architecture

CISO, Board, Enterprise Architects
“What is our security posture across the organisation?”
Value

Strategic alignment — which investments, in what order, tied to business risk. Sets direction for the entire security programme.

Frameworks

OSA Capability Model, SABSA, TOGAF Security Extension

OSA Capability Model →

Reference Security Architecture

Security Architects, Solution Architects
“What does good look like for this type of system?”
Value

Design acceleration — proven blueprints so teams don’t start from scratch. Ensures consistency across projects and domains.

Frameworks

OSA Patterns, AWS Well-Architected, Azure Architecture Centre

OSA Patterns →

Solution Security Architecture

Solution Architects, Dev Teams, Security Engineers
“How do we secure this system?”
Value

Implementation guidance — concrete controls for a specific deployment, with threat model and compliance mapping.

Frameworks

OSA Pattern composition, project-specific designs derived from reference architectures

OSA Patterns →

Security Domain Architecture

Domain Specialists, Engineering Leads
“How do we implement this discipline everywhere?”
Value

Technical depth — standards and designs for one area (IAM, network, data protection, endpoint) applied consistently across the estate.

Frameworks

OSA domain patterns (e.g. SP-029 Zero Trust, SP-031 Cloud), NIST 800-63, NIST 800-207, CSA CCM

OSA Patterns →

Security Governance Architecture

GRC, Compliance Officers, Management
“Can we prove we are in control?”
Value

Compliance evidence — demonstrable alignment to frameworks, audit readiness, and policy enforcement across the organisation.

Frameworks

OSA Assessment, OSA Framework Mappings, ISO 27001, NIST CSF, COBIT

OSA Assessment →

How Leading Organisations Define It

There is no single definition of security architecture. Each framework emphasises a different dimension — some focus on policy enforcement, others on business alignment or composability. Together they reveal the full scope of the discipline.

NIST Security domains & policy enforcement

A set of physical and logical security-relevant representations of system architecture that conveys information about how the system is partitioned into security domains and makes use of security-relevant elements to enforce security policies within and between security domains based on a defined set of security design principles.

CNSSI 4009 / NIST SP 800-39
SABSA Business-driven & risk-focused

A proven methodology for developing business-driven, risk and opportunity focused Security Architectures at both enterprise and solutions level that traceably support business objectives. It is independent of any particular vendor, product, or pattern.

SABSA Institute
TOGAF Enterprise integration & policy

The architecture discipline that ensures enforcement of security policies across the enterprise. Security architecture has the tension of being separate from the remainder of enterprise architecture development and at the same time needing to be fully integrated in it.

The Open Group
Gartner Composable & mesh-based

A collaborative ecosystem of tools and controls to secure a modern, distributed enterprise. It builds on a strategy of integrating composable, distributed security tools by centralising the data and control plane to achieve more effective collaboration between tools.

Gartner CSMA, 2022
ISO/IEC Management system & risk treatment

The structured approach to preserving confidentiality, integrity and availability of information through the design and operation of an information security management system (ISMS), including the selection and implementation of controls assessed against a risk treatment plan.

ISO/IEC 27001:2022
OSA Enterprise discipline & accountability

The enterprise discipline that embodies security principles in the design of IT systems. It encompasses reusable artefacts, standards, and accountability structures that define what security controls are required, where they are positioned, how the resulting architecture reduces risk exposure, and who is responsible for their design, implementation, and ongoing effectiveness.

Open Security Architecture