This is a question I get asked often. The answer matters because architecture is how security moves from reactive control selection to coherent design.
Define how Enterprise, Solutions and Operational Architects work together through SFIA 9-aligned roles, through-life accountabilities, customer-facing service catalogues and an outcome-led measurement framework.
Explore the operating modelDefine how Enterprise Security, Security Solutions and Operational Security Architects work together through SFIA 9-aligned roles, a security through-life value stream, customer-facing services and negotiated Protection Level Agreements.
Explore the security operating modelEnterprise Architecture is a strategic discipline that defines the structure and operation of an organisation’s technology landscape, aligning it with business goals and objectives. It provides a holistic view of business processes, data, applications, and infrastructure so that technology investment supports the organisation rather than adding unmanaged complexity.
Enterprise Security Architecture is the security-focused layer within Enterprise Architecture. It translates risk management strategy, regulatory obligations, security principles, controls, and processes into a coherent model for protecting information assets.
Its scope includes identity and access management, data protection, network security, application security, incident response, governance, risk, and compliance. The SABSA meta-framework, with the SABSA Method at its core, helps describe and manage this work.
Building architecture gives a useful analogy. A building needs a blueprint, foundations, utilities, usable spaces, maintenance, and safety measures. Enterprise Architecture does the same for the organisation’s systems and processes; Enterprise Security Architecture ensures that the blueprint is safe, resilient, and aligned with the risks the organisation actually faces.
| Aspect | Building Architecture | Enterprise Architecture | Enterprise Security Architecture |
|---|---|---|---|
| Planning and blueprints | Defines the building’s structure, materials, and style. | Creates blueprints for processes, data flows, and IT systems. | Defines security controls, policies, and technologies that protect the organisation. |
| Foundation and structure | Ensures the foundation can support the whole structure. | Ensures coherent infrastructure and data models. | Embeds security principles at every layer. |
| Utility and systems | Plans plumbing, electrical wiring, and HVAC. | Integrates applications, networks, and data management. | Implements encryption, firewalls, access management, and secure services. |
| Aesthetics and design | Makes the building functional and usable. | Designs IT environments for users, scalability, and agility. | Integrates security in ways that are effective and minimally disruptive. |
| Maintenance and evolution | Maintains and renovates the building over time. | Refines architecture as technology and strategy change. | Adapts controls to threats, regulations, and operating experience. |
Enterprise Architecture sets the strategic blueprint for how technology aligns with business goals. Enterprise Security Architecture provides the security-focused layer within that blueprint so the organisation is not only well-designed and efficient, but safe and resilient.