Security reference architectures and SABSA overview
In short: A security reference architecture is a reusable template of patterns, components and principles for a type of system. SABSA is a business-driven method that traces security from business goals through six layers down to components and operations, so every control can be justified by a business need.
What a reference architecture is
A security reference architecture is a proven blueprint that shows the components, zones, data flows and controls usually needed for a type of system, such as a cloud landing zone, a remote-access service or an industrial site. It saves time, encourages consistency across projects and acts as a checklist so important controls are not forgotten.
Examples include NIST SP 800-207 for zero trust, cloud providers' security reference architectures and well-architected frameworks (see well-architected frameworks), IEC 62443 and the Purdue model for industrial systems, and vendor-neutral patterns published by industry groups.
Use them as a starting point, not a final answer. Tailor each one to your risks, regulations, budget and existing technology, and record why you departed from it.
SABSA in brief
SABSA (Sherwood Applied Business Security Architecture) is an open framework and method for enterprise security architecture. Its key idea is that security exists to enable the business, so every control must trace back to a business requirement. It is organised as a matrix of six layers against six questions: what, why, how, who, where and when.
| Layer | Focus | Example output |
|---|---|---|
| Contextual | Business goals, assets, risks | "Customers must trust our online payments" |
| Conceptual | Security attributes and strategy | Attributes such as confidential, available, auditable |
| Logical | Security services and policies | Authentication, audit and key management services |
| Physical | Mechanisms and technology choices | Identity provider, HSM, SIEM |
| Component | Specific products and standards | Product versions, protocols, configurations |
| Operational | Running and assuring security | Monitoring, incident response, change control |
Business attributes and traceability
A central SABSA tool is the business attributes profile: a list of qualities the business needs, such as "available", "compliant" or "user-friendly", each with a clear definition and a way to measure it. Architects then trace links in both directions. Going down shows that every business need has controls; going up shows that every control has a reason. Controls with no upward link are candidates for removal, and needs with no downward link are gaps.
SABSA also stresses risk as opportunity as well as threat: security should help the business do new things safely, not only block them.
Using frameworks together
- TOGAF gives the overall enterprise architecture method; SABSA is often used alongside it to add the security view (see TOGAF).
- Control frameworks such as ISO/IEC 27001:2022 and the NIST Cybersecurity Framework 2.0 supply controls and outcomes; SABSA explains why each is selected.
- Reference architectures provide ready patterns at the logical and physical layers.
- Capture business goals and risks with stakeholders.
- Build a short attributes profile with measures.
- Pick a suitable reference architecture and map it to the attributes.
- Tailor, document gaps and decisions, and get them approved.
- Review the architecture as the business and threats change.
Tip: in dissertations and design reports, a short traceability table from business requirement to control to evidence is a clear way to show a structured, SABSA-style approach.
Practice
What is the main idea behind SABSA?
Which SABSA layer deals with specific products and configurations?
Why not simply copy a reference architecture as it is?
Key takeaways
- Reference architectures are reusable security blueprints; tailor them.
- SABSA is a business-driven security architecture method.
- Its six layers run from contextual down to component, plus operational.
- Business attributes profiles and two-way traceability justify every control.
- SABSA works alongside TOGAF, ISO/IEC 27001 and NIST CSF.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.