Security Architecture and Technology Transformation
This domain tests architecture decisions and technology transformation: principles, reference architectures, zero trust, cloud and identity, secure by design, and architecture governance. Expect NIST SP 800-207 zero trust tenets, the CISA Zero Trust Maturity Model pillars, shared responsibility, SBOM and SLSA, and threat modeling.
Core rules
- Architecture work is organized in business, data, application, and technology domains. TOGAF's ADM gives the method; SABSA gives a risk-driven security architecture layer.
- Zero trust (SP 800-207): no implicit trust from network location; policy decisions are dynamic and enforced per request; least privilege; microsegmentation; continuous verification; assume breach. The CISA ZTMM assesses identity, devices, networks, applications and workloads, and data across traditional, initial, advanced, and optimal stages.
- Cloud: the provider secures the cloud; you secure what you put in it. Landing zones, IaC guardrails, CSPM, and workload protection replace perimeter assumptions.
- Secure by design means owning customer security outcomes, embracing transparency, and leading from the top. Build provenance uses SLSA levels and machine-readable SBOMs in SPDX or CycloneDX with NTIA minimum elements.
- Architecture review boards should challenge designs and record exceptions with expiry, not rubber-stamp.
Worked example
A firm replaces VPN with ZTNA for 4,000 staff. The design starts with the identity provider as policy plane, device posture from MDM, per-application access rather than network access, and session logging to the SIEM. Phase 1 covers contractors on unmanaged devices with browser isolation; phase 2 moves employees; legacy VPN stays for two OT applications under a documented exception with compensating segmentation. Success is measured by the percentage of apps behind the policy engine, authentication strength, and reduction in lateral reachable paths. Reasoning: identity and policy came first, the tool last.
Traps
Buying a zero trust product without a policy engine or identity hygiene; assuming the cloud provider covers customer misconfiguration; architecture review that approves everything; SBOMs generated but never ingested; threat modeling only at the end of design; treating segmentation as VLANs alone.