Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Enterprise Architecture for Security Managers
Why architecture matters to security
Enterprise architecture (EA) is the organisation’s blueprint: how business processes, data, applications and technology fit together today, how they should look in the future, and the route between. Decisions made at this level, such as going cloud-first, replacing the ERP or sharing one identity platform, shape security for years.
The 2026 CISM exam content outline adds enterprise architecture and information security architecture as new content areas, reflecting that security managers are expected to work within the architecture, not around it.
Four architecture domains
| Domain | Describes | Security’s role |
|---|---|---|
| Business | Strategy, processes, organisation | Risk appetite, process controls, roles |
| Data | What data exists and how it flows | Classification, data protection, privacy |
| Application | Systems and how they connect | Secure design, integration points, APIs |
| Technology | Infrastructure, network, cloud | Segmentation, hardening, identity, logging |
Security isn’t a fifth layer added on top; it runs through all four.
Current state to target state
EA maps the current state, defines a target state that supports the business strategy, analyses the gap and sets a roadmap. Architecture governance then checks every project against the target. That’s the same logic as the security strategy, which is why the two should be developed together.
TOGAF and Zachman
- TOGAF provides a method, the Architecture Development Method (ADM), a repeating cycle for developing and governing architecture across the business, data, application and technology domains.
- Zachman is a classification grid (what, how, where, who, when, why against stakeholder viewpoints) that checks an architecture description is complete. It isn’t a method.
How the security manager uses EA
- A seat at the table: security is represented on the architecture review board.
- Standard secure patterns: approved designs for identity, logging, encryption and integration that projects reuse.
- Accurate asset and data maps: data flows and dependencies feed risk assessments and incident response.
- Architecture governance: projects are checked against security requirements before approval.
Example. Three departments each choose a different identity provider for new SaaS tools. Through the architecture board, the security manager agrees a single SSO pattern: one place to enforce MFA, joiners and leavers, saving cost and closing gaps.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main benefit of involving security in enterprise architecture | Security built in at design, consistently across the enterprise |
| Architecture framework with a development method | TOGAF (the ADM) |
| A classification grid for architecture | Zachman |
| Best evidence that EA is actually used | Projects are reviewed against it before approval |
| How security architecture relates to EA | It aligns with and supports it |
In short
- Enterprise architecture (EA) describes how an organisation's business processes, data, applications and technology fit together, now and in the target state.
- The 2026 CISM outline adds enterprise architecture as a new content area: security managers are expected to work within it, not around it.
- TOGAF provides a method (the Architecture Development Method) across business, data, application and technology domains; Zachman is a classification grid.
- Security should be built into each architecture domain and into architecture governance, so every project is checked against security requirements.
- EA helps security by giving an accurate picture of assets, data flows and dependencies, and a place to set standard secure patterns.
- Security architecture (next article) is the security-specific view that aligns with the enterprise architecture.
Exam traps
- Security added after the architecture is decided is costlier and weaker.
- Zachman is a grid for classifying descriptions, not a method; TOGAF's ADM is the method.
- An architecture nobody checks projects against has little value.
- Security architecture must align with enterprise architecture, not run as a separate parallel design.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Four architecture domains
Current state to target state
TOGAF and Zachman