How do architecture, IT and information security work together around ISO 27001, and what does each contribute?
Architecture designs the plan and demands a secure construction; the IT department builds and operates the cyber system following the plan; information/IT security sets requirements, using ISO 27001 as its template, and demands that the system is securely manageable. The goal is that these requirements meet without conflict.
* Two requirements from two sides, met in one system that IT builds and operates. *
| Role | Does | Its requirement |
|---|---|---|
| Architecture | Designs the plan | Secure construction |
| IT department | (1) Builds and (2) operates the cyber system, following the plan | |
| Information / IT security | Sets requirements for IT, using ISO 27001 as a general framework | Securely manageable |
The system has to satisfy both requirements at once. A design that is secure on paper but cannot be operated according to the ISMS processes fails, and so does a well-managed system built on an insecure construction. The architect's job includes making the two meet without conflict.
A building makes the split easy to remember: the architect designs the house so it can be built, the property management runs it day to day, and the owner commissions both. Part of the architect's job is to design something that can be managed. In the same way, ISO 27001 hands the architect some general requirements focused on manageability, but they are not enough to derive an architecture from.
Go deeper:
NCSC — Cyber security design principles — the construction side: principles for designing systems that are hard to compromise and easier to manage.- ISO/IEC 27001 — Wikipedia — the management side: a management-system standard with reference controls, not a design for a system.