Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
5 to work through
-
intermediate
An organisation pursues a certification. What should change in the architecture, and what should not?
2 min answer -
intermediate
Your organisation is starting SOC 2. Someone proposes scoping it to the whole estate "to be safe". What is your advice?
2 min answer -
advanced Multiple choice
An online retailer collects card numbers in a form on its own checkout page and posts them to a payment provider. 240 engineers can deploy the checkout service and the annual PCI DSS assessment is consuming three months of engineering time. Which single change most reduces the assessed scope?
3 min answer -
advanced
An organisation pursues a security certification. How should that change the architecture, and how should it not?
2 min answer -
advanced
How does pursuing a certification change how you design, beyond adding controls?
2 min answer
3 terms in this topic
Certification and Architecture
How pursuing a certification shapes architecture — mainly through scope boundaries and the need for automatic evidence.
conceptCertification Scope Boundary
The declared set of systems, locations and people a certification covers, which determines both its cost and what it actually tells a customer.
patternCompliance Scope Reduction
Designing so that regulated data never touches most of the estate, which removes systems from assessment entirely rather than adding controls to them.
Neighbouring topics
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Segregation of Duties
Splitting authority so no single actor can both make and approve a change.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Three Lines Model
Ownership, oversight and independent assurance, and where architecture sits in it.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.