Back to Roles

Guide Origin: Official | ArcKit Version: [VERSION]

DDaT Role Family: Architecture Framework: UK Government DDaT Capability Framework

Overview

The Security Architect ensures solutions meet security and compliance requirements. You own ArcKit's security assessment commands — from risk registers to Secure by Design artefacts and MOD-specific assurance.

Primary Commands

Command Purpose Guide
/arckit:risk Create risk register following HM Treasury Orange Book principles Guide
/arckit:secure Generate Secure by Design assessment (NCSC CAF, Cyber Essentials, UK GDPR) Guide
/arckit:mod-secure MOD Secure by Design assessment (JSP 440, IAMM, CAAT) Guide
/arckit:dpia Data Protection Impact Assessment for UK GDPR Article 35 Guide
/arckit:conformance Check architecture drift and security control implementation Guide

Secondary Commands

Command Your Involvement Guide
/arckit:principles Define security principles (confidentiality, integrity, availability) Guide
/arckit:requirements Review NFR-SEC-xxx security requirements Guide
/arckit:tcop Review TCoP compliance for security-related points Guide
/arckit:ai-playbook Assess AI safety and security controls Guide
/arckit:atrs Review algorithmic transparency for security implications Guide
/arckit:jsp-936 MOD AI assurance for defence AI/ML systems Guide
/arckit:hld-review Review HLD for security architecture patterns Guide
/arckit:diagram Review network and data flow diagrams for security boundaries Guide
/arckit:analyze Review governance quality for security gaps Guide

Typical Workflow

principles → risk → requirements (NFR-SEC) → dpia → secure → conformance

For MOD projects

principles → risk → requirements (NFR-SEC) → dpia → mod-secure → jsp-936 → conformance

Step-by-step

  1. Set security principles: Contribute to /arckit:principles — security-specific principles (Zero Trust, defence in depth, least privilege)
  2. Assess risks: Run /arckit:risk to identify threats, vulnerabilities, and mitigations
  3. Define security requirements: Ensure NFR-SEC-xxx requirements exist in /arckit:requirements
  4. Privacy assessment: Run /arckit:dpia for personal data processing
  5. Secure by Design: Run /arckit:secure for civilian projects or /arckit:mod-secure for MOD
  6. AI assurance: Run /arckit:jsp-936 if the project involves AI/ML (MOD only)
  7. Check conformance: Run /arckit:conformance to verify security decisions are implemented

Key Artifacts You Own

  • ARC-{PID}-RISK-v*.md — Risk register
  • ARC-{PID}-SECD-v*.md — Secure by Design assessment (civilian)
  • ARC-{PID}-SECD-MOD-v*.md — MOD Secure by Design assessment
  • ARC-{PID}-DPIA-v*.md — Data Protection Impact Assessment (co-owned with Data Architect)
  • ARC-{PID}-CONF-v*.md — Conformance assessment (co-owned with Enterprise Architect)

UK Government Security Context

  • Civilian: NCSC Cyber Assessment Framework (CAF), Cyber Essentials, UK GDPR, GovS 007
  • MOD: JSP 440 (Defence Manual of Security), IAMM, JSP 604, CAAT continuous assurance
  • AI systems: JSP 936 (Dependable AI in Defence), AI Playbook safety controls
  • Classification: PUBLIC, OFFICIAL, OFFICIAL-SENSITIVE, SECRET