What is cyber security architecture good for when nothing is being built or changed at all?

Its plans and models are what make the estate auditable, analysable, assessable, transparent and documented — and above all comprehensible.

These are the non-constructive uses, and for many organisations they deliver the first real benefit, long before a single rule is changed:

• Auditing and certification need a picture of components, functions and interconnections to test against.
• Analysis and assessment — you cannot judge whether a risk is covered without a representation of what exists and how it hangs together.
• Transparency towards management: an architecture makes an otherwise invisible estate discussable by people who do not read firewall rules.
• Documentation that outlives the individuals who built the thing.

Underneath all four sits the real payoff: the pictures, models and systematics produced by the discipline help people understand cyber security. They do two different jobs, and the distinction matters — they support the understanding of complicated systems and they support dealing with complex ones.

Tip: a drawing that nobody would change a firewall rule over can still be the most valuable artefact you produce this year, because it is the one that gets the budget conversation started.

Go deeper:

• Wikipedia — Information technology audit — what an audit does with your documentation, and why undocumented reads as uncontrolled.