An organisation pursues a certification. What should change in the architecture, and what should not?

What should change

• The perimeter should be deliberately scoped. Every system in scope inherits the regime's obligations — audit, retention, access control, change control, monitoring — so the perimeter's size is the dominant cost of the certification and it is set by architecture rather than by the assessment.
• Controls that were procedural should become automated, since automated controls prevent rather than detect, operate identically on every instance, and produce evidence as a by-product rather than requiring assembly.
• Logging and access records should become complete and immutable, which is a genuine improvement independent of the certification.
• Ownership should become explicit, since frameworks force a named owner per control and that is frequently the only reason one exists.

What should not change

• The architecture should not be reshaped to match a framework's structure. A framework describes controls, not designs, and rearranging services to match its categories is effort with no security benefit.
• Delivery practice should not become slower. The requirement is that changes are authorised, tested, traceable and reversible with evidence — and automated gates satisfy all four better than manual approval does. A process that reduces deployment frequency in the name of the certification is, on the evidence, reducing safety.
• Security investment should not be redirected to whatever the framework enumerates, since compliance is a floor and a communication mechanism, not a security programme.

The gap to hold in mind

A framework can be fully satisfied by a system that is straightforwardly exploitable. Frameworks are weak on control design quality, on coverage as the estate grows, on composition — each service secure and the interaction not — and on anything not enumerated, which by definition includes novel attack paths.

So add adversarial testing scoped to objectives, threat modelling during design, and coverage measured against the authoritative inventory.

The genuine benefits worth acknowledging

Evidence discipline, coverage forcing, named ownership, and budget — the last being unfortunate and real, since compliance obligations release funding that security arguments do not.