Architecture Decision Record¶
ORSM recommends recording the operational consequences of significant security architecture decisions.
Decision¶
Title:\ Date:\ Owner:\ Status: Proposed / Accepted / Superseded / Retired
Problem¶
What problem or business risk is being addressed?
Protection Intent¶
What asset, service or business outcome requires protection?
What credible threat is being addressed?
What measurable security improvement is expected?
Options Considered¶
- Option A
- Option B
- Option C
ORSM Assessment¶
Security benefit¶
What security outcome does the decision provide?
Operational impact¶
What administrative, support and maintenance burden is introduced?
Complexity¶
What new platforms, integrations, processes or management interfaces are introduced?
Survivability¶
What happens if the capability fails?
Recovery¶
How will the capability be restored, and what does recovery depend upon?
Dependencies¶
What technical, operational, identity, cloud or vendor dependencies are introduced?
Human impact¶
What friction, workload, exceptions or workarounds might result?
Decision¶
What was decided and why?
Residual Risk¶
What risk remains after the decision?
Review Date¶
When should this decision be reassessed?