What it means
It connects enterprise objectives and risk decisions to reusable security structures so individual projects do not solve the same problems independently or create incompatible trust models.
Why it matters
Without an enterprise view, local optimizations accumulate into fragmented identity, inconsistent controls, duplicate tools, and architecture drift.
Practical focus
- Anchor architecture to business capabilities and important services
- Maintain reusable patterns and reference architectures
- Define decision rights, exceptions, and review points
- Measure adoption, technical debt, and risk reduction
Common mistakes
- Producing diagrams without enforceable decisions
- Designing only for the current organizational chart
- Mandating one technology for every context
- Allowing exceptions to become undocumented permanent designs
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: