Our process:
THE SABSA®
Methodology

SABSA is an Enterprise Security Architecture framework that aligns security with business objectives through a layered, risk-based approach.

It allows large enterprises to identify and address risks while prioritising business goals.

The use of a structured, holistic framework empowers your enterprise with strategic insights and practical solutions, transforming cybersecurity from a siloed function into a unified strategic asset.

Businesses looking to implement SABSA into their enterprise will find a strong strategic partner in David Lynas Consulting.

In 1995 David Lynas, and his associates John Sherwood and Andy Clark, devised a unique methodology to address cybersecurity issues for organisations. They called it SABSA (Sherwood Applied Business Security Architecture). They saw a better, more positive way to look at security – holistically embedded in innovation.

David, John and Andy authored the ‘blue book’ Enterprise Security Architecture: A Business-Driven Approach in 2005 and the field of Enterprise Security Architecture was born.

DLC is proud to have built a team of unrivalled depth with decades of experience defining and leading enterprise programmes or reporting directly to Corporate CEOs and Government Ministers.

Each member of our team has a history of demonstrable success, can articulate the bigger picture, transform the enterprise conversation, engage stakeholders at every level, and deliver insightful, actionable, practical advice with value-add, and skills transfer.

DLC provides unrivalled assurance of capabilities. All of our team members are SABSA® authors, certified SABSA® Masters, or multi-Practitioner level with Masters in progress.

Once established, SABSA becomes a decision-making framework that can be applied to all IT and security activities.

When a stakeholder proposes a new cloud service or application, questions that would be factored in under a SABSA approach would likely include: “What business objective does this support? What are the risks? What security services are needed?”

Security architects can perform a mapping against the existing architecture to identify which controls already exist and which gaps need filling.

The SABSA framework is suited to organisations where security directly impacts business value. This can include sectors with significant regulatory requirements.

It has been designed to scale for large complex enterprises with multiple business units and diverse technology environments.

Typically, architecture is built and maintained by enterprise and security architects, and its holistic nature means that security leaders, risk teams, IT, and senior management teams all contribute to the overall framework.