SABSA: Business-Driven Enterprise Security Architecture and Risk Management

The provided sources offer a comprehensive look at the Sherwood Applied Business Security Architecture (SABSA) framework, emphasizing its role as a business-driven methodology for developing enterprise security architectures. Several texts highlight how SABSA shifts the focus from purely technical controls to aligning security with high-level business objectives, managing both threats and opportunities, and ensuring information assurance across the organization. Specifically, the texts explain SABSA's layered model for security architecture, which provides views for different organizational stakeholders, and detail how it integrates with other frameworks like TOGAF and concepts like Enterprise Risk Management (ERM) and Information Security Management (ISM). Furthermore, one source critically assesses SABSA's traditional weakness in systematically incorporating socio-technical factors in risk analysis, proposing enhancements to address the complex interplay of culture, technology, and organizational structure in cyber security risk.