All courses / The Transformed Security Architect / Module 1 / Chapter 2
Learning objectives
After the lesson the participant can:
- Describe the five inherited methods of the security architect and the conditions each assumed.
- Explain the three legitimate purposes of the review board and why each survives the transformation.
- Identify the five developments that strained the inherited practice, separating what is observable from what is expected.
- Classify the practices of a security architecture function as keep, codify, delegate or retire, naming what covers each retired purpose.
Key concepts
- Attested evidence
- Evidence in which someone states in a spreadsheet that a control operated. The chapter calls attestation cheap to collect and expensive to trust, and notes that it ages from the day it is signed.
- Three purposes of the review board
- Scarce expertise concentrated and spread, a gate proportionate to the cost of reversing a design mistake, and an accountable record of who reviewed and who accepted the residual risk. Each survives at a different scale.
- Function and implementation of the gate
- The function is independent challenge before an irreversible commitment; the implementation was a meeting that a project must pass. The transformed role keeps the function and changes the implementation.
- Keep, codify, delegate, retire
- The four dispositions of the practice audit: keep when purpose and conditions hold, codify when a check could carry the form, delegate routine decisions to a named forum, pipeline or supplier with written decision rights, retire when the purpose is covered elsewhere or absent.
- What the transformed role inherits
- Four parts of the inherited content: traceability to business risk, the principles of secure design, independent challenge built into pipeline and record, and accountable sign-off by a named person with a decision right.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
Nordvik's 2024 reference architecture, section by section
Nordvik's architect audited the 2024 security reference architecture against the AI estate. Sort each section under the disposition recorded in assessment RAA-NR-2026-01.
Interactive exercise 2 · Scenario
The board that everyone wants to abolish
Apply the chapter's distinction between the function of a gate and its implementation.
Teaching plan
| 15 min | Lecture on where the role came from and its methods, using Figure 2.1; for each method the teacher asks what condition of its time made it rational. |
| 10 min | Discussion of the department of no: timing, asymmetry and culture, and what the evidence on external change approval does and does not show. |
| 10 min | Walk through Nordvik's assessment RAA-NR-2026-01 section by section; participants predict each disposition before it is revealed. |
| 20 min | Exercise: participants audit five recurring practices of their own function with the chapter's guide and record a disposition for each. |
| 5 min | Wrap-up: pairs challenge one retirement each, asking which control, record or forum now covers its purpose. |
Discussion
- Which of the three mechanisms behind the department of no, timing, asymmetry or culture, weighs most in your organisation, and what would change the incentive?
- The chapter says a stale layer is worse than an absent one, because readers trust it. Which document in your practice still carries authority that the estate no longer matches?
- Nordvik has to build what Hansa already has, and Hansa has to remove what Nordvik never built. What does that contrast suggest about where your own transformation should begin?
Written exercise
Exercise · 20 minutes
Audit an inherited security architecture practice
Choose five recurring activities of your security architecture function, for example a review meeting, a reference architecture document, a supplier questionnaire, a hardening appendix and an exception letter. For each, state its purpose in one sentence using the gate's purposes (expertise, irreversibility, accountability) or the risk frame's (traceability, ownership, evidence). State the conditions it assumed, namely release frequency, number of systems, acting identity and adversary speed, and mark each as holding, partly holding or no longer holding. Classify each practice as keep, codify, delegate or retire. For every retirement, name the control, record or forum that now covers its purpose.
Deliverable: A practice audit table of five rows in the form of the chapter's practice-audit example, with purpose, conditions, disposition, what covers the purpose and a review date.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
What did Forsgren, Humble and Kim find about approval of changes by an external body, as the chapter reports it?
Show the answer
A. It was associated with slower delivery and no better stability than peer review and automated checks
The chapter reports that external change approval was associated with slower delivery and no better stability than peer review and automated checks, and adds that the finding concerns external, periodic review, not review as such.In Nordvik's assessment of its 2024 security reference architecture, what happened to section 6, logging and monitoring?
Show the answer
C. It was delegated to the managed security service provider under NR-2025-044
The gap was that no detections existed for AI gateway events, and the disposition was to delegate the section to the managed security service provider under NR-2025-044. It is the one section that changes owner.Which assumption of the inherited methods does a Mode 5 Autonomous production agent break?
Show the answer
B. That every action traces to a person or a person-owned service account
Review, logging, segregation of duties and sign-off all depended on every action tracing to a person or a person-owned service account. A Mode 5 agent acts with its own identity and permissions at a pace no person's account matches.