TRUST, RISK AND RESILIENCE
An EA capability serves as a force multiplier for the CISO's objectives, embedding security, compliance, and resilience into the core design of the business and technology landscape.RISK / RESILIENCE THEMES AND CONTROLS
Security protects the business from threats. A threat is defined as anything that could reduce business output. The security architecture will define a blueprint to protect the business from threats. One cannot eliminate threats they are always present however we can preempt them and predict where threats may occur. Preventions can be put in place to reduce weakness and vulnerabilities. A mechanism is required to detect and expose security incidents otherwise they might go unnoticed. Prompt containment will restrict any impact caused by the incident then a recovery process can restore the business capability to the agreed level.
Preemption Predict Threats
Threats are always present however we can preempt them and predict where they may occur.
Prevention Reduces Weakness
Preventions can be put in place to reduce weakness and vulnerabilities.
Detection Exposes Incidents
A mechanism is required to detect and expose security incidents otherwise they might go unnoticed.
Containment Restricts Impact
Prompt containment will restrict any impact caused by the incident.
Recovery Restores Capability
A recovery process will restore the business capability to the agreed level.
Try our new AI questionnaire: Answer 12 quick questions about how you are currently tracking and in return you'll receive an executive one‑pager with a maturity score, an action plan, and the top 3 actions to move fastest.
Rate the following statements (1–5)
Strategy & Motivation Domains
Business Domain
Application Domain
Data Domain
Technology Domain
Implementation & Migration Domains
COMPLIMENTARY EVIDENCE AND INFORMATION
ERP Transformation (State Gov)
Creating an environment for success
FAQs
CISO Briefing: Enterprise Architecture (EA) - Trust, Risk, and Resilience
These key questions address how the EA capability serves as a force multiplier for the CISO's objectives, embedding security, compliance, and resilience into the core design of the business and technology landscape.
How does EA prevent new projects from inheriting old security vulnerabilities?
EA formalises the Security by Design methodology. Before any project is funded or launched, it must pass through the Architecture Review Board (ARB). The ARB mandates the use of approved, resilient Target State Architecture patterns (e.g., zero-trust network models, standardised encryption methods) rather than allowing project teams to invent their own, often flawed, solutions.
How does EA help us manage regulatory compliance across multiple jurisdictions (e.g., GDPR, AU standards)?
EA maps compliance requirements directly onto the Data Architecture and the Business Capabilities that handle sensitive data. This allows us to identify where specific data types (e.g., PII) reside, who accesses them, and how they move. This evidence-based mapping significantly simplifies audits and ensures controls are applied only where they are legally required, improving compliance efficiency.
How does EA improve our threat modelling and risk prioritisation efforts?
By creating a unified view of the enterprise, EA accurately maps the relationship between critical Business Value Chains and the supporting Application and Technology assets. This dependency mapping allows us to identify the "crown jewels" (assets whose failure causes maximum business impact), allowing the security team to focus risk mitigation funding on the areas of highest strategic and financial criticality.
How does EA reduce our overall attack surface and simplify security operations?
EA actively drives Application Rationalisation and Technology Standardisation. Every redundant, obsolete, or non-standard system is a vulnerability waiting to be exploited. By providing the roadmap to decommission these systems, EA reduces the number of components the security team needs to patch, monitor, and defend, achieving better security coverage with fewer resources.
What role does EA play in shifting our organisation from reactive defence to proactive resilience?
EA shifts the focus from fixing security findings to building resilience into the foundation. We enforce non-functional requirements (NFRs) for availability, recovery time objectives (RTO), and recovery point objectives (RPO) at the design phase. This ensures the architecture is inherently resilient, not just hardened, improving business continuity.
How does EA enable the implementation of a consistent Zero Trust Architecture (ZTA) across the organisation?
ZTA requires control point standardisation. EA enforces the use of common identity providers, API gateways, and micro-segmentation patterns across all new and integrated applications. This stops departmental teams from deploying isolated security models and ensures continuous verification is applied uniformly across the entire Application and Technology landscape.
How can the EA repository be leveraged as a rapid response tool during a security incident?
During a critical incident, speed is vital. The EA repository's dependency maps instantly identify: the business functions affected by a compromised system, the data streams involved, the owners of the affected applications, and the immediate upstream/downstream connections. This cuts down investigative time from days to hours, accelerating containment and recovery.
How does EA help us enforce security policies and standards globally across diverse teams?
EA translates static security policies (e.g., "All data must be encrypted in transit") into mandatory, reusable Architectural Patterns. Project teams are given a certified 'Secure API Pattern' to implement, making compliance a simple choice rather than a complex design exercise. This drastically improves consistency and reduces policy interpretation errors.
Will EA slow down security innovation or the adoption of new protective measures?
No, EA controls integration, not innovation. We maintain a clear Future State Architecture that anticipates new security technologies (e.g., quantum-resistant crypto). This allows security teams to test new tools in a controlled environment and define their place within the target architecture, ensuring seamless and governed rollout across the enterprise when ready.
How does EA address the supply chain risk posed by third-party applications and open-source tools?
EA manages the risk profile of the Application and Technology catalogue. We explicitly track third-party software usage, including adherence to open-source licences (a contractual compliance point). Furthermore, EA governance ensures that interfaces to third-party services are secure, controlled via APIs, and isolated from core systems, mitigating external exposure.
What specific security-focused KPIs should the CISO’s office monitor alongside EA?
Beyond traditional metrics, focus on architectural outcomes:
- Security Debt Reduction Rate: The rate at which high-risk, obsolete assets are decommissioned per the EA Roadmap.
- Compliance Failure Rate: Percentage of projects flagged by the ARB for failing to meet mandated security NFRs.
- Zero-Trust Adoption Score: A metric tracking the percentage of the application portfolio operating within the approved ZTA framework.
What commitment is required from the CISO's office to ensure EA is successful in driving security?
The EA team requires the CISO's mandate to make security non-negotiable at the design stage. This means empowering the EA to stop any non-compliant project, ensuring security reviews happen early (Shift Left), and providing the EA team with critical threat intelligence to inform and design robust architectural standards.