Competences of the Transformed Security Architect: A Framework · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 5 / Chapter 21

Learning objectives

After the lesson the participant can:

Name the six domains of the framework and give one competence from each with the shift it most concerns.
Apply the rule that a person's level is the lower of the unaided and the AI-assisted demonstrated level.
Rank the kinds of evidence of competence and explain why certificates are never sufficient for Advanced or Expert.
Plan an assessment by practical demonstration with an unassisted scenario, a seeded review and a rationale interview.

Key concepts

Six domains: Design, code, AI, adversary, law and people, following the structure of the role in Parts II to IV. Design is the core; the AI domain exists because of Shift 4, which also changes how every domain is evidenced.
Rule of the lower level: Each level is defined twice, unaided and with AI the person verifies, and a person's level is the lower of the two demonstrated. An architect with excellent AI-assisted output who cannot produce a sound threat model unaided is Practitioner in that competence.
Unassisted demonstration: Work done without AI in a time-boxed exercise. It shows what the person can do when the assistant is wrong or stopped, and is the only evidence that answers the question of judgement directly.
Local extensions: Competences the mapping records as not covered by ENISA's Cybersecurity Architect profile, published in 2022: AI-02 on containment and identity for Mode 5 agents, AI-03 on autonomy levels and Level 3 playbooks, and ADV-02 on machine-speed defence.
Competence condition: A link from the record to decisions: each consequential decision right names the competences it requires and escalates when the record does not show them, and an autonomy ceiling in a mandate manifest depends on the supervising architects' evidenced level in AI-03.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Which level does this describe

Sort each description under the level it defines in the chapter's levels table, whether unaided or with AI.

Interactive exercise 2 · Put in order

Assessment by practical demonstration

Put the steps of the chapter's practical guide for assessing an architect in order.

Teaching plan

15 min	Lecture on why a framework and why as code, the six domains and the table of what has become less central than before.
10 min	Participants place three fictional architects on the levels table, applying the rule of the lower level, and defend their placements.
15 min	Read CMP-NR-01: purposes, readers, what the record is not used for, the levels and the development plan; discuss why working notes are deleted.
30 min	Exercise: participants plan an assessment for one architect, choosing competences, designing the unassisted scenario and the seeded review, and drafting the record schema.
5 min	Wrap-up on Hansa's condition of two holders of AI-03 at Advanced and what happened while only one was evidenced.

Discussion

The rule of the lower level can lower the recorded level of an architect whose repository looks excellent. How would you introduce the rule so that it is accepted as fair?
Expert is earned on designs that held under test, not on years in post. What would that change in how your organisation grades its senior architects?
A nightly check reads levels, never record content. Why does the chapter separate the record, the evidence and the working notes so strictly?

Written exercise

Exercise · 30 minutes

Plan an assessment by practical demonstration

Plan the yearly assessment of one security architect in your organisation, or of Nordvik Region's single post-holder. Select at most six competences from the framework: those due, those on which a decision right depends, and those the person wants to raise. Design a three-hour unassisted scenario on a sanitised or synthetic estate. Design an AI-assisted review of an AI-drafted artefact with three to five seeded errors, at least one a fluent omission, described as design flaws. Write four questions for the rationale interview. Name the lead assessor and the second assessor and say how levels are decided. Finally draft the record schema: purposes, what it is not used for, readers and validity.

Deliverable: A two-page assessment plan with scope, unassisted scenario, seeded review, interview questions, assessors and a competence record schema in the form of CMP-NR-01.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

An architect's AI-assisted threat models are excellent, but the architect cannot produce a sound threat model unaided. What level does the framework record in DES-02?
Show the answer
C. The lower of the two demonstrated levels, here the unaided one
A person's level is the lower of the unaided and AI-assisted demonstrated levels, however good the repository looks. The rule rests on the automation literature: operators who rarely do a task manually lose the skill to take over.
How does the framework treat certificates such as CISSP-ISSAP as evidence?
Show the answer
A. As supporting evidence at Foundation and Practitioner, never sufficient for Advanced or Expert
Certificates evidence knowledge, so the framework accepts them as supporting evidence at Foundation and Practitioner but never as sufficient for Advanced or Expert, where judgement must be demonstrated.
What happens to the evidence collector's Level 3 ceiling in MND-HM-01 if fewer than two architects hold AI-03 at Advanced?
Show the answer
B. The ceiling falls back to Level 2 Supervised
Hansa's conditions file requires two holders of AI-03 at Advanced for the Level 3 ceiling; if unmet, the ceiling falls to Level 2 Supervised. A lapse is managed like an expired certificate on a service, not as a disciplinary event.