ISC2 Information Systems Security Architecture

A design is only as defensible as the evidence it produces. You build risk treatment into the architecture, plan for audit and evidence collection, extend governance to third parties and suppliers, and place controls to handle AI-related risk.

• Risk treatment decisions expressed as architecture
• Control placement and compensating design
• Designing for audit evidence and traceability
• Third-party and supply chain architecture risk
• Governance of AI components in an architecture
• Residual risk and architectural exceptions

You build A governance and risk architecture view with an evidence plan for one enterprise system.

Architects share a language so that designs can be reviewed and reused. You work with enterprise and security architecture frameworks such as SABSA and TOGAF, document viewpoints for different stakeholders, and adapt reference architectures to real constraints.

• SABSA layers from business to operations
• TOGAF and where security fits in its method
• Reference architectures and when to adapt them
• Viewpoints for executives, engineers and auditors
• Security patterns and building blocks
• Architecture decision records

You build A security architecture document set for one business service, using a recognized framework.

Architects model threats at the scale of the whole system. You compare methods such as STRIDE, PASTA, attack trees and LINDDUN, model threats to AI and machine learning components, and feed what you find back into the design.

• Choosing a threat modeling method for the question asked
• STRIDE and attack trees at system scale
• PASTA and risk-centric modeling
• LINDDUN and privacy threat modeling
• Threats to AI and machine learning systems
• Tracking threats to mitigations in the design

You build An enterprise-scale threat model with traceable mitigations in the design.

Finding a flaw in a diagram costs far less than finding it in production. You review designs against requirements, test assumptions with prototypes and tabletop scenarios, and run architecture reviews that end in decisions.

• Verification compared with validation
• Design review against requirements and threats
• Architecture review boards and decision rights
• Proofs of concept and prototype testing
• Tabletop scenarios and failure analysis
• Handling findings and architecture exceptions

You build A design review report, with findings and decisions, for a proposed system.

Network design sets the limits of an intrusion. You design zones, boundaries and secure connectivity, apply zero trust principles as in NIST SP 800-207, and plan segmentation that still lets the business run.

• Zones, trust boundaries and segmentation strategy
• Zero trust architecture and policy enforcement points
• Software-defined and cloud-delivered network security
• Secure remote and partner connectivity
• Encrypted traffic, inspection and its trade-offs
• Resilience and denial-of-service design

You build A zero trust network architecture for an enterprise with offices, data centers and cloud, with a migration path.

Platforms are where most workloads live and fail. You design secure compute, endpoint and storage platforms, landing zones for single and multi-cloud estates, and the baselines that stop each new project reinventing them.

• Server, endpoint and virtualization architecture
• Container and orchestration platform design
• Cloud landing zones and account structure
• Multi-cloud and hybrid architecture decisions
• Secure AI and machine learning platform design
• Baselines, guardrails and golden patterns

You build A secure landing zone and platform architecture, with guardrails expressed as policy.

Cryptography at enterprise scale is an architecture problem. You design key hierarchies, public key infrastructure and key management services, decide where encryption sits, and plan the transition to algorithms that will outlast current ones.

• Where to encrypt: layers, trade-offs and gaps
• PKI design: roots, intermediates and revocation
• Key management services and hardware security modules
• Key hierarchy, rotation and recovery
• Cryptographic agility and post-quantum readiness
• Data protection architecture for structured and unstructured data

You build A cryptographic architecture with key hierarchy, PKI design and a crypto-agility plan.

Some systems cannot be patched or rebooted on demand. You design security for industrial control, embedded and legacy environments, using models such as the Purdue reference model and IEC 62443, and balance safety and availability against security.

• Industrial control system architecture and the Purdue model
• IEC 62443 zones and conduits
• Safety versus security trade-offs
• Securing legacy systems that cannot be changed
• Monitoring OT networks passively
• Connecting IT and OT without joining their risks

You build A zones-and-conduits design for a site that joins an industrial network to the enterprise.

Identity architecture decides who and what a system will believe. You design the lifecycle of human and machine identities, choose authentication strength by risk, and place identity providers so that trust crosses organizational boundaries safely.

• Identity sources, directories and the authoritative record
• Human, workload and device identity
• Authentication strength by risk: passwordless, multifactor, step-up
• Federation and trust across organizations
• Identity proofing and recovery flows
• Identity for AI agents and automated actors

You build An identity architecture for a company with partners and automated workloads, with trust diagrams.

Authentication says who; authorization and accounting say what they did. You design access decisions, policy engines and privileged access, and build the accounting trail that makes every decision reviewable.

• Authorization models and policy decision points
• Fine-grained and attribute-based access at scale
• Privileged access and just-in-time design
• Accounting: audit trails that stand up to scrutiny
• Access governance, reviews and entitlement management
• Monitoring identity behavior for misuse

You build An access decision and accounting architecture for one critical application, with policy examples.

Bring every domain into one design. You start from obligations and threats, choose frameworks and patterns, design infrastructure and identity, then verify the design in review and write the decisions down for those who will build it.

• Scoping the enterprise and its constraints
• Requirements, risk and threat inputs
• Infrastructure, cryptography and identity design
• Verification and validation plan
• Documenting decisions and exceptions
• Presenting the architecture to sponsors and builders

You build A complete enterprise security architecture package, from requirements to verification plan.