What is a Security Architecture Program?

A security architecture program is associated with the management and effectivity of the suite of preventive and detective safeguards as a whole within an environment.

The goal of this program is to ensure that all of the security technologies implemented within the environment work together to meet organizational goals.

This also often includes understanding the assets and associated data that live within an environment, and then measurement and management of the safeguards that protect those elements.

Common Security Architecture Program Elements:

Data Map – This diagram illustrates where all of the information and assets are located within an organization.

Security Architecture Diagram – Illustrates where preventive and detective safeguards are located within an environment.

Security Architecture Program Charter- Illustrates the mission and mandate, roles and responsibilities and objectives of the security architecture program.

Process Documentation- Every process area associated with security architecture management should have defined roles and responsibilities, business rules and associated tools for each process.

Associated Role- The Security Architecture Program is often managed by the security architect.

Security Architecture Program Management is Generally Comprised of the Following Functions:

Management Of Data & Asset Map – It is hard to have an effective security architecture if you do not understand what the architecture is protecting. This function understands categories and documents where information and assets are located within the environment.

Documentation of Security Architecture – This is the visual presentation of the preventive and detective security safeguards within the environment.

Global Safeguards Responsibilities – It is common for the security architecture to have either operational or oversight responsibilities over safeguards that are global in nature. Some examples would be associated with Identity Management, Application Development, or logging and monitoring, though there can be others with varying levels of responsibility and accountability for the security architecture program.

Measurement of Security Architecture Effectiveness- These are processes for managing the effectiveness and susceptibility of implemented safeguards within the environment.

Security Architecture Communication & Consulting- Since an effective security architecture includes safeguards implemented across an entire business, this function is designed to support communication and interaction with all areas of the business.

Development & Management of Security Architecture Roadmap- As an organization changes, so will the requirements for an effective security architecture to protect it.

As always, please provide your feedback to CISO Handbook team or Mike.Gentile@cisoshare.com or follow me on Twitter; I always read them.