Framework vs. Architecture

Chassidic1

Hey all, I could use some clarification on terms Harris uses in her "Information Security and Governance and Risk Management" Chapter. Those two terms are: framework, versus architecture. Here is what I've got so far, let me know what you think, thanks:

An Enterprise Security Framework is a collection of Architectures, each of which are a document which demonstrates the alignment of business with (I.T.) Security goals from a specific viewpoint - be it from the CFO's point of view, in dollars and cents; from the CSO's perspective in the form of vulnerability information, etc.

I know that sounds kind of weird, but I figured I'd give it a shot for the time being.

Thanks!
Dovid

TheProfezzor

I think this is quite straightforward. Enterprise Security Framework defines how to build, implement and use the architectures. The architecture allowit to be the guide when implementing solutions to ensure business needs are met, provide standard protection across the environment, and reduce the amount of security surprises the organization will run into. Now, architecture can be from different stand points. If it's more inclined towards financial metering, it could be representing risks on CFO's point of view. If it addresses IT security goals, it is representing CIO's or CISO's point of view.

Frameworks are industry specific generally and define how architectures are brought up