Communicating Security Architecture: Boards, Supervisors, Auditors and Engineers

All courses / The Transformed Security Architect / Module 4 / Chapter 19

Learning objectives

After the lesson the participant can:

• Match each of the five audiences to the question it asks, the form of the view and its cadence.
• Write a one-page architecture report that asks a management body for at most three decisions and states what it does not know.
• Define the five indicators and explain why the architect leaves out activity counts and summed scores.
• Compose a gate message with rule identifier, observed fact, reason and way forward.

Key concepts

One source, many projections

Every figure and diagram in a view carries the commit of the model, catalogue and evidence manifest it came from; a view that cannot name its sources is a draft. Views generated from the same commits cannot disagree.

Decisions, not information

A report asking for no decision is a briefing. The board page asks for at most three decisions, each with its cost, reversibility and what it affects, in risk language, and shows movement instead of state.

Standing pack

The supervisor view: a set of queries over the catalogue and evidence manifest that exists before anyone asks, opening with failed and declared controls, their owners and closure dates, and giving one answer for all supervisors.

Five indicators

Patch velocity, containment test results, recoverability, control status and review quality. Each describes a property someone can change, has an owner and a threshold, and is computed from evidence without opinion.

Provenance block

A disclosure produced by the generator, not typed, stating which sections an AI drafted, which agent or tool in which usage mode under which mandate manifest, what the verifier did and who verified. Disclosure does not share blame.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A page that is green only because the red is unmeasured is called the commonest cause of a bad surprise. What is unmeasured in your current reporting, and how would you say so on one page?
2. The chapter warns that a patch-velocity target can be met by reclassifying services as not internet-facing. Which of your indicators could be improved by changing the report instead of the estate?
3. Independence is preserved by access, not distance. What would your auditors need in order to draw their own sample and re-perform a test without your help?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How many decisions should the board page ask for, and why?

   1. At most three, because a board that receives seven requests decides none
   2. Exactly five, one for each indicator the architect reports
   3. None, because the page is a briefing and decisions belong to the CISO
   4. As many as there are failed controls, so that none is hidden
   Show the answer

   A. At most three, because a board that receives seven requests decides none
   A report asking for no decision is a briefing, and the board page should ask for at most three decisions, each with cost, reversibility and what it affects; a board that receives seven requests decides none, so the architect prioritises.

2. Where an AI agent collects the evidence, what does the auditor do according to the chapter?

   1. Repeats the agent's collection by hand for every control in the catalogue
   2. Relies on the agent's own account of what it collected and when
   3. Tests the agent: its links against the source system, its mandate against what it did
   4. Asks the architect to choose which of the agent's records should be shown
   Show the answer

   C. Tests the agent: its links against the source system, its mandate against what it did
   The auditor tests the agent instead of repeating its work, checking its links against the source system and its mandate manifest against what it did. The test of the collector is itself a catalogue control.

3. At what level is the review-quality indicator reported?

   1. By named reviewer, so that weak reviewers can be coached
   2. At team level only, agreed in advance with employee representatives
   3. By entity and reviewer, for the supervisor's standing pack
   4. It is not reported, because it could monitor individuals
   Show the answer

   B. At team level only, agreed in advance with employee representatives
   Review quality is always aggregated at team level, never by named person, and agreed in advance with employee representatives who have rights over measures that could monitor individuals.