Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Glossary

SABSA Framework: Enterprise Security Architecture

Learn all about the SABSA framework, a proven method for developing a robust, business-driven security architecture for companies of any size or industry.

Definition: SABSA (Sherwood Applied Business Security Architecture) is a proven framework. Companies use it to build their security architecture and security solutions. It was first developed in the 1990s. Its aim is to deliver security strategies, plans and solutions that tie straight back to what the business needs.

What is the SABSA framework?

SABSA has six layers. They reach from business strategy down to day-to-day security work. The six layers are:

  • Contextual security (business analysis)
  • Conceptual security (architecture design)
  • Logical security (design)
  • Physical security (implementation)
  • Component security (detailed design)
  • Operational security (management and operations)

Typical areas of application of the SABSA framework

SABSA is used in many sectors and for many kinds of security projects:

  • Security strategy: It helps you set security goals that support your business goals.
  • Security architecture: It gives you a clear structure to build security solutions that work together across technical silos.
  • Risk management: It finds and reduces business risks. It does this by linking security needs to business needs.
  • Compliance: It helps you meet the rules set by law. It makes sure your security practices and protocols match the standards that apply.

Why use SABSA?

SABSA has several strengths. That is why many companies choose it to structure their security work:

  • Driven by the business: Many security frameworks look only at technology. SABSA links security straight to business needs.
  • Flexible: You can fit it to any business model, no matter the industry or size.
  • Covers the whole picture: SABSA looks at technology. It also covers the way you organize security and the processes behind it.

Implementing the SABSA framework

To put SABSA in place, you first need a clear view of what your business and your IT need. Then you work through these steps:

  1. Analyze business needs: Set the key security goals of your company.
  2. Build the architecture: Work out security strategies and solutions that support these goals.
  3. Design security: Plan technical safeguards that fit the specific needs of your company.
  4. Implement: Put the physical and logical security measures in place.
  5. Operate: Run security day by day and keep to your own standards.

Protective measures with SABSA

Security measures are a core part of SABSA. They cover these key areas:

  • Review the security strategy often: Check that your policies and practices still fit and still work.
  • Watch risks all the time: If you keep checking the risk picture, you can react to threats when they come up.
  • Training and awareness: Make sure all staff understand the framework and can apply it.

Conclusion: Is SABSA right for your company?

SABSA gives companies a full framework to make their security programs leaner and clearer. It is built for practice. You fit it to the needs and risks of your own company.

SABSA works in any industry. It helps you build a security architecture that works and that fits your business goals. That helps you comply with the rules. It also helps protect your information and resources.

🔒 Have your security architecture evaluated against SABSA.

More terms in “Compliance & Regulation”

All terms in “Compliance & Regulation” →