What are the best practices for applying the SABSA framework to information assurance?

1 Understand the SABSA model

The SABSA model consists of six layers, each representing a different aspect of security architecture. The layers are: context, concept, logic, physical, component, and operational. Each layer has a corresponding domain, such as business, information, or technology. The model also defines six attributes for each layer and domain, such as risk, control, or service. The SABSA model helps you to identify and prioritize the security requirements and objectives for each layer and domain, and to map them to the appropriate solutions and processes.

2 Apply the SABSA matrix

The SABSA matrix is a tool that helps you to organize and document the security architecture across the six layers and domains. The matrix consists of 36 cells, each representing a specific combination of layer and domain. For example, the cell at the intersection of the context layer and the business domain contains the business drivers and objectives for security. The matrix helps you to ensure that the security architecture is consistent, comprehensive, and traceable throughout the lifecycle of the information system.

3 Use the SABSA lifecycle

The SABSA lifecycle is a process that guides you through the stages of security architecture development, implementation, and management. The lifecycle consists of five phases: discover, define, design, deliver, and monitor. Each phase has a set of activities and deliverables that correspond to the SABSA model and matrix. For example, in the discover phase, you perform a stakeholder analysis and a business attribute profiling to identify the security needs and expectations of the business. The lifecycle helps you to align the security architecture with the business strategy and to measure its effectiveness and value.

4 Adopt the SABSA principles

The SABSA principles are a set of guidelines that help you to apply the SABSA framework in a consistent and effective way. Some of the key principles are: start with the business view, focus on outcomes and benefits, use a top-down approach, integrate with other frameworks and standards, and adapt to the context and environment. The principles help you to ensure that the security architecture is relevant, feasible, and sustainable for the organization and its stakeholders.

5 Learn from the SABSA community

The SABSA community is a network of security professionals who use and promote the SABSA framework. The community offers various resources and opportunities for learning and sharing, such as the SABSA Institute, the SABSA World events, the SABSA certification program, and the SABSA LinkedIn group. The community helps you to stay updated on the latest developments and best practices of the SABSA framework, and to connect with other security architects who can offer advice and feedback.