What it means
Security control placement determines where a preventive, detective, responsive, or recovery mechanism must sit in the architecture to see, decide, and act on the intended behavior.
Why it matters
Architecture decisions determine where trust is granted, where controls can observe and act, and how failures propagate across systems and organizations.
Practical focus
- Identify assets, data flows, trust boundaries, and required outcomes
- Place controls where they can enforce or observe the intended behavior
- Document assumptions, dependencies, and failure modes
- Validate the design against realistic threats and operating constraints
Common mistakes
- Selecting products before defining requirements
- Assuming a diagram proves enforcement
- Ignoring inherited, legacy, or third-party dependencies
- Failing to test how the design behaves during degradation or attack
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: