Security · Cyber Assurance · 05
Security architecture review
A security architecture review examines how an environment is structured to enforce access, contain compromise and keep critical functions running: identity, network zones, trust boundaries, data flows, administrative paths and the dependencies between them. It is needed before a significant change such as a cloud migration, a merger, a new product platform or a zero-trust program, when an incident has revealed that a single compromised account or device reached too far, or when a customer or regulator asks how sensitive workloads are isolated. The review produces a documented current-state architecture, the gaps between it and the intended design, the paths an attacker would take through it, and a target architecture with a sequenced route to reach it without disrupting operations.
Scope
What the review covers.
- Identity architecture: directories, federation, privileged paths and service accounts
- Network and cloud segmentation, trust boundaries and administrative access routes
- Data flows for sensitive information and the controls at each boundary
- Dependencies: what fails if a given system, vendor or link fails
- Comparison of the deployed architecture with its documentation
- Fit against the intended model, including zero-trust principles where adopted
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Current-state architecture | Diagrams and narrative of what is actually deployed |
| Gap and attack-path analysis | Where the structure allows compromise to spread, with evidence |
| Target architecture | The intended design with principles and constraints stated |
| Transition plan | Sequenced changes that avoid breaking production |
Prerequisites
What we need from you.
- Existing architecture documentation, however incomplete, and network and cloud diagrams
- Access to identity, network and cloud consoles, or sessions with their administrators
- The business constraints the design must respect: uptime, legacy systems, partner connections
Related
Where this sits.
- Cyber Assurance Service
- Security Hub
- Executive risk reporting Also
- Vendor security assessment Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Will you redesign everything?
No. The target architecture keeps what works. Most environments need a small number of structural changes, sequenced carefully, rather than a rebuild.
Does this cover cloud and on-premises?
Yes. Most environments are both, and the boundaries between them are where the review spends much of its time.
How does this relate to zero trust?
Zero trust is one architectural model. The review establishes where you are and whether that model, or part of it, fits your constraints. See Zero Trust and Secure Architecture.