TOGAF 10: Embedding Security Architecture Across Every ADM Phase

In the TOGAF standard, security architecture is a cross‑cutting concern that spans the entire enterprise architecture. It can be described as a consistent set of views, viewpoints, and artifacts covering security, privacy, and operational risk perspectives, along with related themes such as security objectives and security services.

The TOGAF 10 Series Guide introduces a design method for enterprise security architecture. The following diagram illustrates how enterprise architecture and enterprise security architecture interrelate, highlighting the foundational concepts from ISM (Information Security Management) and ERM (Enterprise Risk Management) that supplement the TOGAF framework; underlined concepts are those introduced by ISM or ERM.

A direct translation of the method is shown below:

Security Activities by ADM Phase

Preliminary Phase : Define security policies and standards that serve as the foundation for the entire architecture development process. Establish the scope and objectives of the security architecture.

Phase A – Architecture Vision : Incorporate security requirements into the architecture vision and treat them as key stakeholder concerns.

Phase B – Business Architecture : Identify security requirements and risks associated with business goals, ensuring they are considered in subsequent architecture work.

Phase C – Information Systems Architectures (Data & Application) : Identify and define the security controls needed to protect information assets.

Phase D – Technology Architecture : Select technology solutions that support the required security controls and verify compatibility with the overall architecture.

Phase E – Opportunities and Solutions : Evaluate solution options to confirm the chosen approach satisfies security requirements.

Phase F – Migration Planning : Develop implementation plans for security controls and ensure security is addressed during migration.

Phase G – Implementation Governance : Oversee the implementation of security controls to verify they are executed according to defined standards.

Phase H – Architecture Change Management : Continuously monitor and assess the security architecture to respond to new threats and changes.

Requirements Management : Throughout the ADM cycle, continuously identify and manage security requirements, ensuring appropriate prioritization and resource allocation.

Reference: TOGAF Series Guide, G184 – Establishing EA Leaders and Developing EA Capability .