SABSA

What is SABSA?

SABSA is a method for designing enterprise security architecture: the overall shape of an organisation’s security, from its goals down to the individual technologies. Its defining idea is that every security decision should trace back to a business requirement. The SABSA Institute describes it as a business-driven, risk- and opportunity-focused method, and the name originally stood for Sherwood Applied Business Security Architecture, after its creator, John Sherwood.

It is maintained by The SABSA Institute, a community interest company. SABSA is copyright protected but open use: anyone may use it free of charge, and the Institute says its intellectual property can never be sold.

How does it work?

The central tool is the SABSA matrix. It asks six questions, what, why, how, who, where and when, at each of six layers:

• Contextual: the business view, covering what the business does, its goals and its risks;
• Conceptual: the architect’s view, covering the security concepts and objectives needed to support the business;
• Logical: the designer’s view, covering policies, services and information flows;
• Physical: the builder’s view, covering mechanisms, rules and procedures;
• Component: the tradesperson’s view, covering specific products, tools and standards;
• Service management: running and measuring it all day to day.

Working down the matrix turns business needs into technical choices. Working back up shows why each control exists, which is what makes a design defensible to auditors and the board.

What is Business Attributes Profiling?

SABSA describes business requirements as attributes: qualities the business needs from its systems, such as available, confidential, compliant, auditable or user-friendly. Each attribute is defined, measured and linked to the controls that support it. This attributes profile becomes the requirements specification for the architecture and the basis for measuring whether it is working.

Is it a one-off design exercise?

No. SABSA calls itself a “through-life” method. It covers the whole lifecycle, from engineering the requirements to managing the delivered solution, so the architecture is revisited as the business, its risks and its technology change.

How does it relate to other frameworks?

SABSA is a method, not a control set. It doesn’t tell you which controls to implement; it tells you how to choose and justify them. That makes it a natural partner to:

• TOGAF, the enterprise architecture framework, into which SABSA can integrate security;
• ISO/IEC 27001, NIST CSF or the CIS Controls, which supply the control catalogues;
• COBIT and ITIL, for governance and service management.

Who uses it?

Security architects, especially in large and regulated organisations, and teams building a security architecture practice. The Institute offers competency-based certification for individuals at several levels. There is no certification for an organisation.