Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Information Security Architecture: Principles and SABSA
What security architecture is
Information security architecture is the blueprint for how security controls and services fit together across the organisation: identity, network zones, encryption, logging and monitoring. It turns the strategy’s goals into a coherent design, so projects don’t each invent their own security. It’s one of the two architecture content areas added in the 2026 CISM outline, and it aligns with the enterprise architecture.
SABSA, from business to components
SABSA (Sherwood Applied Business Security Architecture) is a business-driven framework. It works top-down, so every mechanism traces back to a business requirement:
| Layer | View | Question |
|---|---|---|
| Contextual | Business | What does the business need? Assets, risks, goals |
| Conceptual | Architect | Which security attributes and principles does it need? |
| Logical | Designer | Which security services and policies deliver them? |
| Physical | Builder | Which mechanisms (encryption, directories, firewalls)? |
| Component | Tradesperson | Which specific products and tools? |
| Operational | Service manager | How is it run, monitored and maintained? (spans all layers) |
Starting from products and working up is backwards. Start from the business.
Design principles
| Principle | Meaning |
|---|---|
| Least privilege | Only the access needed for the task |
| Default deny | Anything not explicitly allowed is blocked |
| Defence in depth | Several independent layers of control |
| Secure by default | Systems ship and deploy in a secure configuration |
| Fail secure | On failure, default to a safe state, such as denying access |
| Complete mediation | Every access is checked, every time |
| Economy of mechanism | Simple designs are easier to secure and verify |
| Segregation of duties | No single person controls a whole sensitive process |
Principles let architects make consistent decisions without asking security about every detail.
Reference architectures and patterns
- A reference architecture is the approved target design: zones, identity, logging, encryption.
- Standard patterns are reusable designs, such as “SaaS integration with SSO and central logging”.
- Security requirements are the baseline every project must meet.
- Exceptions to the architecture are risk-assessed and approved, like policy exceptions.
Governing the architecture
- Security reviews at project initiation and design.
- Security represented on the architecture review board.
- Exceptions recorded with an owner and an expiry date.
- The architecture updated as threats and technology change.
Example. A new mobile banking app is reviewed against the bank’s reference architecture. It uses the standard pattern for customer identity (MFA, device binding) and API gateway logging, so the security review takes days instead of weeks.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Business-driven security architecture framework | SABSA |
| Top layer of SABSA | Contextual: business requirements |
| Main benefit of a security architecture | Consistent controls aligned with business needs |
| What should happen when a system fails? | Fail secure: default to a safe state |
| A project deviates from the architecture | Risk-assess and approve an exception |
In short
- Information security architecture describes how security controls and services are structured across the enterprise to meet business requirements.
- It's a new content area in the 2026 CISM outline, alongside enterprise architecture.
- SABSA is a business-driven security architecture framework with six layers: contextual, conceptual, logical, physical, component and operational.
- Design principles (least privilege, defence in depth, secure by default, fail secure, complete mediation, simplicity) guide consistent decisions.
- Reference architectures and standard patterns let projects reuse approved secure designs.
- Architecture is governed: projects are reviewed against it, and exceptions are risk-assessed.
Exam traps
- Starting from products (component layer) rather than business requirements (contextual) is backwards.
- Security architecture must align with enterprise architecture, not compete with it.
- Fail secure means failing to a safe state (e.g. deny access), not staying open.
- A reference architecture nobody is required to follow doesn't change anything.
Slides
Click the slide and use the arrow keys. F toggles full screen.
SABSA, from business to components
Design principles
1 / 9