## Chapter 1 — Advanced security decision-making ### Learning outcomes You will (1) frame an organisation-scale architecture decision; (2) separate facts, assumptions and values; (3) record a decision so others can challenge it. ### 1.1 The decision at Corvane Priya Ramanathan is a postgraduate student and the lead security architect at Corvane Health Network, a fictional group of twenty-two community clinics. Her supervisor, Dr Elena Voss at the fictional Brookmere University, asks her to bring a live decision to the course. Corvane must decide whether to consolidate its clinic networks behind one cloud-based access service or keep each clinic's local firewall and VPN. The choice affects patient data, clinic uptime, staff workflow and budget for five years, so it is an organisation-scale decision rather than a project detail. ### 1.2 Facts, assumptions and values Priya splits her briefing into three columns. Facts are things she can check: twenty-two clinics, four firewall models, two outages last year caused by expired VPN certificates. Assumptions are beliefs she cannot yet verify, such as the cloud service meeting availability targets in rural areas with poor connectivity. Values are priorities the board must set, such as how much clinic downtime is acceptable to save money. Mixing these three is the most common cause of circular arguments in architecture meetings, because people argue about values while appearing to argue about facts. ### 1.3 Recording the decision Priya writes an architecture decision record: context, options considered, criteria, the decision, consequences and the conditions that would cause the decision to be revisited. She cites the zero trust principles in NIST SP 800-207 as the design direction but notes they do not dictate any product. The record is short, dated and signed by the chief information officer. Two years later, a new architect can read why the choice was made and judge whether its conditions still hold, rather than guessing at the reasoning or repeating the whole debate. ### Worked example Priya frames the clinic network decision, sorts her briefing into facts, assumptions and values, and records it in a decision record with revisit conditions. > **Synthetic case.** Corvane, Brookmere and all people are synthetic; SP 800-207 is real. ### Errors and limits Decision records can become paperwork if no one reads them. Assumptions must be tested, not just listed. ### Exercises - **EX001 — Organisation-scale test.** Why is the clinic network choice an organisation-scale decision? *Rubric:* 3 = it affects patient data, uptime, workflow and budget for five years across all clinics;; 2 = several effects;; 1 = it is technical;; 0 = none. - **EX002 — Assumption example.** Give the assumption Priya could not yet verify. *Rubric:* 3 = cloud service availability in rural clinics with poor connectivity;; 2 = availability;; 1 = certificate outages;; 0 = none. - **EX003 — Value for the board.** Which value did Priya leave to the board? *Rubric:* 3 = how much clinic downtime is acceptable to save money;; 2 = downtime;; 1 = firewall models;; 0 = none. - **EX004 — Circular arguments.** What causes circular architecture arguments, according to the chapter? *Rubric:* 3 = mixing facts, assumptions and values;; 2 = mixing;; 1 = budget;; 0 = none. - **EX005 — Revisit conditions.** Why include revisit conditions in a decision record? *Rubric:* 3 = so a later architect can judge whether the decision still holds;; 2 = future review;; 1 = vague;; 0 = none. ### Synthesis Advanced decisions improve when facts, assumptions and values are separated and the reasoning is recorded for later challenge. ### Continue studying — chapter 01 of 12 [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02) ## Worked answers **EX001.** Because it shapes patient data protection, clinic uptime, staff workflow and budget across all clinics for five years. **EX002.** That the cloud service would meet availability targets in rural clinics with weak connectivity. **EX003.** How much clinic downtime the organisation accepts in exchange for cost savings. **EX004.** Arguing about values while appearing to argue about facts, by mixing the three categories. **EX005.** So a later architect can see whether the conditions behind the choice still hold.