Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Cybersecurity Architecture
  4. >Cybersecurity Architecture - Objective 1
  5. >C2M2-ARCHITECTURE-1D
C2M2-ARCHITECTURE-1DActive

Governance for cybersecurity architecture (such as an architecture review process) is established and maintained that includes provisions for periodic architectural reviews and an exceptions process

Statement

Governance for cybersecurity architecture (such as an architecture review process) is established and maintained that includes provisions for periodic architectural reviews and an exceptions process

Location

Domain
Cybersecurity Architecture
Objective
Cybersecurity Architecture - Objective 1

Practice Details

Identifier
C2M2-ARCHITECTURE-1D
Domain
Cybersecurity Architecture
Objective
Objective 1
Maturity Level
MIL-2

Help Text

There is sufficient oversight of the cybersecurity architecture or equivalent cybersecurity architecture governance function to prevent architectural drift—the discrepancy between the documented architecture and the implemented architecture. For example, proposed changes to the architecture are subject to review and approval, and exceptions are approved with knowledge of the risks and consequences.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: ARCHITECTURE-1d, ARCHITECTURE-1e.

AESCSF
AESCSF-ARCHITECTURE-1dequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Cybersecurity Architecture - Objective 1
Cybersecurity Architecture - Objective 111 controls
C2M2-ARCHITECTURE-1AThe organization has a strategy for cybersecurity architecture, which may be developed and managed in an ad hoc mannerC2M2-ARCHITECTURE-1BA strategy for cybersecurity architecture is established and maintained in alignment with the organization’s cybersecurity program strategy (PROGRAM-1b) and enterprise architectureC2M2-ARCHITECTURE-1CA documented cybersecurity architecture is established and maintained that includes IT and OT systems and networks and aligns with system and asset categorization and prioritizationC2M2-ARCHITECTURE-1DGovernance for cybersecurity architecture (such as an architecture review process) is established and maintained that includes provisions for periodic architectural reviews and an exceptions processC2M2-ARCHITECTURE-1ESenior management sponsorship for the cybersecurity architecture program is visible and activeC2M2-ARCHITECTURE-1FThe cybersecurity architecture establishes and maintains cybersecurity requirements for the organization’s assetsC2M2-ARCHITECTURE-1GCybersecurity controls are selected and implemented to meet cybersecurity requirementsC2M2-ARCHITECTURE-1HThe cybersecurity architecture strategy and program are aligned with the organization’s enterprise architecture strategy and programC2M2-ARCHITECTURE-1IConformance of the organization’s systems and networks to the cybersecurity architecture is evaluated periodically and according to defined triggers, such as system changes and external eventsC2M2-ARCHITECTURE-1JThe cybersecurity architecture is guided by the organization’s risk analysis information (RISK-3d) and threat profile (THREAT-2e)C2M2-ARCHITECTURE-1KThe cybersecurity architecture addresses predefined states of operation (SITUATION-3g)