Skip to content

Framework Integration

ORSM's Complementary Role

ORSM does not assume that established security, resilience or architectural frameworks consider only whether controls are present.

Many existing frameworks already address important aspects of:

  • resilience;
  • recovery;
  • governance;
  • secure design;
  • business continuity;
  • dependency;
  • risk management; and
  • lifecycle improvement.

ORSM's role is narrower and more focused.

It provides an architectural assurance method for examining the operational risk introduced or influenced by security architecture itself, particularly the cumulative effects of:

  • complexity;
  • dependency concentration;
  • operational workload;
  • sustainability;
  • recoverability; and
  • human interaction.

ORSM can therefore be applied to the architecture produced through an existing security or risk framework without competing with that framework.

For example:

  • an established framework may define a required security or resilience outcome;
  • architecture and engineering teams determine how that outcome will be implemented;
  • ORSM examines whether the resulting implementation remains proportionate, supportable, sustainable and recoverable.

The distinction is therefore not:

Traditional frameworks versus ORSM

but rather:

Established security and resilience outcomes + ORSM operational architectural assurance

ORSM complements existing frameworks by interrogating the operational consequences of the security architecture that results from their application.

ORSM has not been developed to replace existing frameworks.

It provides an operational assurance layer that complements them by evaluating how well established security capabilities continue to perform once deployed within a live operational environment.

Traditional frameworks ORSM

Define governance Evaluates operational effectiveness Recommend controls Measures architectural quality Manage risk Examines operational risk introduced by architecture Support compliance Supports operational resilience Guide implementation Guides continual architectural improvement

ORSM is most powerful when applied to an existing control estate or architecture produced through an established framework.