Learn

Security architecture, risk and compliance, explained properly.

Each guide defines one term, shows how it works step by step with a worked example, names the standards behind it, and ends with how Alvor helps. Written by practitioners for anyone who has to do the work.

Security architecture

What is a security architecture framework?

A security architecture framework is a published structure for describing an organisation's security as it is today, deciding what it should become, and planning the move, with each control traced to a business need. Frameworks do different jobs: SABSA and NIST SP 800-160 are methods, TOGAF hosts security inside enterprise architecture, Zachman classifies artefacts, and NIST SP 800-207 is a reference architecture for zero trust.

Read the guide · 23 min read

What is enterprise security architecture?

Enterprise security architecture is security architecture practised across a whole organisation rather than one system. It sets what individual designs inherit: the business attributes security has to protect, the domains and the trust relationships between them, the patterns and standards teams build to, and the governance that checks a design before it ships. Its test is traceability, from a business objective down to a control and back.

Read the guide · 21 min read

What is security architecture?

Security architecture is the practice of deciding how a system will resist attack and keep working, and recording those decisions so they can be reviewed, built to and audited. It is structural work: security domains and the trust relationships between them, where data flows and crosses a boundary, which controls sit at each crossing, and who is accountable. NIST calls the result security-relevant views of a system's architecture.

Read the guide · 23 min read

Secure by Design and threat modeling

What is a data flow diagram in threat modeling?

A data flow diagram is a map of how data moves through a system, drawn so a team can ask what could go wrong. It uses five element types: external entities, processes, data stores, data flows and trust boundaries. Every flow that crosses a trust boundary is a place where trust changes, so that is where attacks land and where controls belong.

Read the guide · 20 min read

Risk and compliance

What is a business impact analysis (BIA)?

A business impact analysis (BIA) works out how the harm from a disruption grows over time, for each business process an organisation runs. For every process it records the longest outage the organisation can tolerate, the recovery time and data-loss limits that keep it inside that line, and the people, systems and suppliers the process needs. It measures consequences, whatever the cause.

Read the guide · 20 min read

What is a cyber risk assessment?

A cyber risk assessment is the process of identifying how an organisation's systems and information could be harmed, estimating how likely each harm is and how severe it would be, and ranking the results against criteria agreed before the scoring began. Its output is a prioritised list of risk scenarios, each with a stated rationale, that tells the organisation where to act first and feeds the risk register.

Read the guide · 21 min read

What is a risk register?

A risk register is the record of the risks an organisation has identified, what it decided about each one, and who decided. Each entry carries a description, an owner, an assessment of likelihood and impact, the response chosen, and a status. NIST's published template adds a priority and an exposure rating. Its value is the decisions it holds, not the list.

Read the guide · 22 min read

What is a statement of applicability (SoA)?

A statement of applicability (SoA) is the document ISO/IEC 27001 requires an organisation to produce from its risk treatment: every control it has decided is necessary, the reason for each, whether each is implemented, and the reason for leaving out any of the 93 reference controls in Annex A. Certification auditors test what it claims, and published certificates cite it by version and date.

Read the guide · 20 min read

What is GRC (governance, risk and compliance)?

GRC stands for governance, risk and compliance: the way an organisation sets its own rules, decides what could stop it keeping them, and proves to outsiders that it does. OCEG defines it as the integrated collection of capabilities that let an organisation reliably achieve objectives, address uncertainty and act with integrity. In practice it names four records: controls, risks, policies and evidence.

Read the guide · 20 min read

What is third-party risk management (TPRM)?

Third-party risk management (TPRM) is how an organisation identifies, assesses, contracts for and monitors the risks of relying on outside parties: vendors, suppliers, service providers and the subcontractors behind them. It covers the whole relationship, from the decision to engage to exit. Outsourcing a service does not outsource the responsibility, so each relationship needs a tier, evidence, contract terms and a named decision on the risk that remains.

Read the guide · 21 min read

Australia

What are PSPF security zones?

PSPF security zones are the five levels of restricted physical access that the Australian Government's Protective Security Policy Framework uses to protect security classified information, from Zone One, a public area, to Zone Five, a highly restricted area with dual-factor authentication. A zone is certified and accredited before it is used, and the zone a data centre needs follows the aggregated classification of what it holds.

Read the guide · 16 min read

What is APRA CPS 230?

APRA Prudential Standard CPS 230 Operational Risk Management is the Australian prudential rule that requires banks, insurers and superannuation trustees to manage operational risk, keep critical operations running within stated tolerance levels through severe disruptions, and manage the risks of the service providers they rely on. The current version commenced on 1 July 2026 and replaced five older standards.

Read the guide · 20 min read

What is the Hosting Certification Framework (HCF)?

The Hosting Certification Framework (HCF) is the Australian Government policy, administered by the Department of Home Affairs, that certifies data centre and cloud service providers to host sensitive government data. It assesses who owns and controls a provider's facilities, core infrastructure and supply chain, grants Strategic or Assured certification, and is the certification PSPF Requirement 0111 asks entities to use for security classified information.

Read the guide · 16 min read

What is the SOCI Act?

The Security of Critical Infrastructure Act 2018, the SOCI Act, is the Australian law that places security obligations on the owners and operators of critical infrastructure assets across eleven sectors. Depending on the asset class, it requires ownership and operational details for a government register, cyber incident reports within 12 or 72 hours, and a written risk management program reported on to government each year.

Read the guide · 24 min read