Information Security Program · Topic 6 of 6
Enterprise Architecture and Information Security Architecture
Enterprise and information security architecture in the CISM outline effective November 2026: frameworks, principles, patterns and architecture review.
- 3 min
- Includes a diagram
- EA spans business, information, applications and technology, current and target states.
- TOGAF and Zachman for EA; SABSA for security architecture.
- Defense in depth, least privilege, zero trust, secure by design, segmentation, resilience.
What it is
Enterprise architecture (EA) describes how the organization's business processes, information, applications and technology fit together now and how they should evolve. Information security architecture is the security view of that architecture: how security principles, controls and services are designed into it consistently. ISACA has announced these two areas as additions to the CISM outline that takes effect on 3 November 2026.
How it works
Enterprise architecture
EA usually documents a current state, a target state and a road map between them, across layers:
| Layer | Describes |
|---|---|
| Business | Capabilities, processes, organization |
| Information and data | Data entities, flows, ownership |
| Applications | Systems and how they interact |
| Technology | Infrastructure, networks, platforms, cloud |
Common frameworks include TOGAF (with its Architecture Development Method) and the Zachman Framework (a matrix of perspectives against questions such as what, how, where, who, when and why).
Information security architecture
Security architecture is not a separate drawing beside the EA; it is a view across every layer. SABSA is a widely used framework that derives security architecture from business requirements, layer by layer.
Core design principles:
| Principle | Meaning |
|---|---|
| Defense in depth | Multiple layers of control |
| Least privilege | Only the access needed |
| Zero trust | No implicit trust based on network location; verify each request |
| Secure by design and by default | Security built in from the start, with safe default settings |
| Segmentation | Separate zones limit the spread of an attack |
| Resilience | Systems continue or recover when components fail |
Why it matters to the security manager
- Architecture decisions last for years; security is cheapest and strongest when designed in.
- Reusable security patterns (for example a standard way to expose an API through a gateway with authentication and monitoring) let delivery teams build securely without starting from scratch.
- Consistent architecture reduces duplicated tools and unmanaged interfaces.
- Legacy systems that cannot meet current principles can often be protected by architecture, such as wrapping them behind a controlled gateway, until they are replaced.
Architecture governance
The security manager works with the enterprise architects so that security requirements are part of architecture standards and architecture review before major projects proceed. Deviations from approved patterns go through an exception process with risk acceptance. Adoption can be measured, for example by the share of new projects using approved patterns or approved exceptions.
When a question asks how to make security consistent across many projects, look for security requirements built into the enterprise architecture and its review process, rather than separate reviews of each project after design.
How the exam asks about this
- "What is the relationship between EA and security architecture?" Security architecture is a view of, and integrated into, the enterprise architecture.
- "A legacy system cannot support modern authentication." Protect it through architecture, such as a gateway with authentication and monitoring, until replacement.
- "How can the manager tell whether teams follow the security architecture?" Measure use of approved patterns and exceptions in new projects.
What to remember for the exam
- EA spans business, information, applications and technology, current and target states.
- TOGAF and Zachman for EA; SABSA for security architecture.
- Defense in depth, least privilege, zero trust, secure by design, segmentation, resilience.
- Security patterns make secure delivery repeatable.
- Architecture review and exceptions keep projects aligned.
A security architecture designed apart from the enterprise architecture ends up as a set of tools bolted on afterwards, with gaps where they do not connect.
Common mistakes
Treating security architecture as network diagrams only.
Reviewing security after design is finished.
Rejecting legacy integration outright when an architectural control could manage the risk.
Check yourself
What does an enterprise architecture document besides the current state?
The target state and the road map between them.
Which framework derives security architecture from business requirements?
SABSA.
What is a security pattern?
A reusable, approved design for a common need, such as exposing an API securely, that teams can apply consistently.
Topic 6 of 6 in Information Security Program
Test yourself on Information Security Program
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.