What is SABSA in Cyber Security?

SABSA (Sherwood Applied Business Security Architecture) in cyber security is a risk-driven enterprise security architecture framework that helps organizations design, implement, manage, and continuously improve security based on business objectives. Rather than focusing only on technical controls, SABSA aligns cybersecurity with business requirements to ensure security investments support organizational goals.

Developed by John Sherwood, Andrew Clark, and David Lynas, SABSA provides a structured methodology for building security architectures across people, processes, technology, and information. It is widely used by enterprises to create scalable security programs, improve governance, and integrate security into business operations.

Because SABSA begins with business requirements instead of technology, it helps organizations build security architectures that are both effective and aligned with business priorities.

Why SABSA matters

Organizations often implement security controls without fully understanding how they support business objectives. SABSA addresses this challenge by ensuring every security decision can be traced back to a business requirement.

SABSA helps organizations:

• Align cybersecurity with business goals.
• Build risk-driven security architectures.
• Improve security governance.
• Support regulatory and compliance requirements.
• Strengthen enterprise-wide risk management.
• Create measurable security programs.

This business-first approach helps organizations prioritize security investments more effectively.

SABSA layers

SABSA organizes enterprise security architecture into multiple layers that guide security from strategy to implementation and operations.

Each layer builds on the previous one, ensuring technical controls remain aligned with business objectives.

SABSA vs TOGAF

Although both are enterprise architecture frameworks, they serve different purposes.

Many organizations use SABSA alongside TOGAF to integrate security into broader enterprise architecture initiatives.

How Hexnode supports SABSA initiatives

Hexnode UEM helps organizations implement the endpoint security controls defined within enterprise security architectures by enforcing security policies, managing operating system updates, monitoring device compliance, deploying approved applications, and maintaining centralized device management across supported platforms.

Hexnode XDR complements enterprise security programs by providing endpoint telemetry, threat detection, incident visibility, and response capabilities for managed Windows endpoints. These capabilities support the operational layer of a SABSA-based security architecture by helping organizations continuously monitor, investigate, and improve their endpoint security posture.