CSA (Other exams): Post-Merger Architecture Governance at NorthBridge Retail

Recommendation: federated governance with a central Architecture Review Board (ARB) and delegated exception authority.

• Decision rights: The ARB owns cross-domain standards (encryption, network zones, identity) and the target architecture. Each CISO keeps domain-level design authority for their legacy estate but cannot unilaterally create new exceptions. A joint Risk & Exception Committee (one delegate per CISO, plus enterprise risk) approves exceptions longer than 30 days; the ARB approves only standards changes. This avoids a pure central model (too slow for 14 BUs) and a pure federated model (which caused the conflicting HSM/KMS mandates).
• Escalation: Unresolved conflicts go to the CIO and board risk committee within 10 business days, with a written risk position.
• Encryption conflict: Resolve by data classification, not vendor preference: HSM-backed keys for PCI/regulated data; cloud KMS with customer-managed keys (BYOK) for tier-2 data. Publish the decision as policy-as-code so teams get instant feedback.
• Why: The 18-month deadline is a governance problem, not a technical one. Clear decision rights and a tiered exception path let both CISO offices keep accountability while preventing shadow IT.

Evaluate the exception on residual risk and data sensitivity, not on revenue alone.

1. Classify the product's data: If it touches cardholder data, PHI, or GDPR special categories, the exception should be denied or limited to a 30-day bridge with compensating controls (tokenization, field-level encryption, enhanced logging). If it is internal/low-sensitivity, a 120-day exception is reasonable.
2. Require a compensating control plan: The business unit must document the control gap, the temporary control (e.g., WAF, network isolation, key rotation), and a dated remediation milestone. No open-ended exceptions.
3. Assign residual risk acceptance: The business owner signs acceptance; the CISO has veto only for crown-jewel systems. Record in the risk register with a risk score and board visibility if above appetite.
4. Set an expiry and review: 120 days max, with a 30-day checkpoint. If remediation slips, escalate to the ARB.

Reasoning: A blanket denial slows revenue and encourages shadow IT; a blanket approval erodes the standard. The board's role is to make the trade-off explicit and time-bound.

Triage by exploitability and blast radius, then burn down in waves.

• First 14 days: Patch or isolate the 8 critical internet-facing vulnerabilities. If patching is blocked, apply virtual patching (WAF/IPS) and restrict source IPs. These carry the highest likelihood of external exploitation.
• Firewall exceptions: Classify the 23 exceptions by whether they enable east-west access to crown jewels. Revoke any exception with any/any or broad CIDR first; replace with service-specific rules. For the rest, set a 90-day burn-down with weekly review.
• Ownership: Assign each exception to a named application owner, not the network team alone. Integrate exception detection into CI/CD so new ones do not appear during merger integration.
• Report: Provide the board a one-page heat map: open criticals, average exception age, and remediation velocity.

Reasoning: You cannot fix all 31 items at once without stopping integration. Risk-rank by exposure and business criticality, and use compensating controls to buy time.