SmartSuite for the Security Architect

Security standards and reference patterns are kept in the Control Framework & Regulatory Libraries as controls mapped to NIST CSF, ISO 27001 and CIS, so a pattern is a control with a framework reference, not a wiki page nobody can test against.

Every architecture exception records its owner, expiry date, compensating control and remediation roadmap, and the dashboard shows which are approaching expiry. An exception cannot drift into the permanent estate, because the record will ask about it.

Threats identified in your architecture risk assessments are captured in Cyber Threat Management and linked to the vulnerabilities, incidents and controls that concern them, so the Security Analyst's findings show up against the threat you assessed and root cause analysis tells you which pattern is failing in practice.

Solution designs and significant changes route through security review inside the change workflow, with your findings recorded against the change itself. The Change and Release Manager cannot schedule what you have not cleared, and your findings travel with the CAB record.

The asset register and Configuration Management (CMDB) tell you which systems, applications and dependencies a design touches, so review scope is derived from the inventory and controls are mapped to the systems they protect, not to a diagram from last year.

In-record conversations, mentions and emails bring the Engineering Manager and DevOps Engineer into the review where the finding lives, so clarifications, pushback and the agreed fix are on the record and not spread across three channels.

Review throughput, open exceptions and control coverage by system are live, so the CISO sees where the estate meets the standard and where it does not. Risk-based prioritization ranks the gaps by inherent risk and business dependency.

Because patterns are controls mapped to NIST CSF, ISO 27001 and CIS, the IT Compliance Manager's framework evidence and the IT Risk Manager's risk linkage come from your mapping. One set of standards serves design review, audit and risk.

Standards, tests and documented processes carry version history and audit trails, so when a pattern changes for a new threat or a post-quantum migration, who approved it and what it replaced are recorded. Engineering builds to the current version.

Chief Information Security Officer

The Security Architect is accountable for the security standards systems are built to: the architecture principles, patterns and reference designs, the review of solution designs, changes and vendors against them, the translation of framework and policy requirements into technical controls, threat modeling and architecture risk assessments, advice on identity, network, cloud and data protection design, and the register of architecture exceptions with their remediation roadmaps. They keep the standards current as threats and technologies change, which now includes post-quantum readiness.

SmartSuite holds the security standards and reference patterns and tracks architecture exceptions with owners, expiry dates and remediation roadmaps, so an exception granted to a project is a record with the person accountable, the date it lapses and the plan to remove it, rather than an email that is forgotten once the project ships. The Security Architect sees every open exception and which are approaching expiry. Control Framework & Regulatory Libraries holds the framework requirements the standards derive from.

Change Management routes solution designs and significant changes through security review with findings recorded against the change, so a design reaches the Security Architect as a review task and the findings, conditions and approval are attached to the change the Change and Release Manager tracks. The Engineering Manager and DevOps Engineer see what was required before the change proceeds. Review throughput and what is waiting on security are visible, which is the usual complaint about architecture review answered.

Configuration Management (CMDB) and the asset register are used to scope reviews and map controls to systems, so when the Security Architect reviews a change or assesses a threat model, the systems in scope, their dependencies and the controls already applied are read from the CMDB. Control coverage by system then becomes a question with an answer: which systems meet the pattern, which carry exceptions and which have not been reviewed. The IT Compliance Manager works from the same mapping.

Cyber Threat Management captures the threats an architecture risk assessment identifies and links each to the vulnerabilities in Vulnerability Management that would realize it and to the incidents and controls that concern it, so a modeled threat is connected to the findings that matter. The Security Architect can show that a modeled threat is either mitigated by design, monitored or carried as an exception. Post Quantum Security (PQS) sits alongside, so the cryptographic transition is planned in the same place as the rest of the architecture roadmap.

SmartSuite reports review throughput, open exceptions and control coverage by system to the CISO, so the Security Architect's report to the Chief Information Security Officer and Chief Technology Officer shows how many reviews were completed and how long they took, which exceptions are open and expiring, and which systems meet the standards. The IT Risk Manager reads the exception list as a source of technical risk. The report is a view of the records, produced when it is asked for.

The current standards and reference patterns, the list of known exceptions with their owners, the CMDB or asset register as it stands and the change process the review attaches to. Standards are loaded as the documents they already are; exceptions become records with expiry dates. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an architect the first workflow is the exception register, because that is where the unmanaged risk is, with reviews routed through Change Management once the Change and Release Manager agrees the trigger.