This is a sel -a chi ed e sion o an o iginal a icle. This e sion
may di e om he o iginal in pagina ion and ypog aphic de ails.
Au ho (s):
Ti le:
Yea :
Ve sion:
Copy igh :
Righ s:
Righ s u l:
Please ci e he o iginal e sion:
CC BY 4.0
h ps://c ea i ecommons.o g/licenses/by/4.0/
Me hod F amewo k o De eloping En e p ise A chi ec u e Secu i y P inciples
© 2019 Sa a La no e al
Published e sion
La no, Sa a; Seppänen, Ville; Nu mi, Ja kko
La no, S., Seppänen, V., & Nu mi, J. (2019). Me hod F amewo k o De eloping En e p ise
A chi ec u e Secu i y P inciples. Complex Sys ems In o ma ics and Modeling Qua e ly, 117(20),
57-71. h ps://doi.o g/10.7250/csimq.2019-20.03
2019
Complex Sys ems In o ma ics and Modeling Qua e ly (CSIMQ)
eISSN: 2255-9922
Published online by RTU P ess, h ps://csimq-jou nals. u.l
A icle 117, Issue 20, Sep embe /Oc obe 2019, Pages 57–71
h ps://doi.o g/10.7250/csimq.2019-20.03
Me hod F amewo k o De eloping En e p ise A chi ec u e
Secu i y P inciples
Sa a La no, Ville Seppänen
*
and Ja kko Nu mi
Facul y o In o ma ion Technology, Uni e si y o Jy askyla, Ma ilanniemi 2,
Jy äskylä, FI-40014, Finland
sa a.la [email protected], ille. .seppanen@jyu. i, ja samnu@s uden .jyu. i
Abs ac . O ganiza ions need o conside many ace s o in o ma ion secu i y in
hei daily ope a ions – among o he s, he apidly inc easing use o IT, eme ging
echnologies and digi aliza ion o o ganiza ions’ co e esou ces p o oke new
h ea s ha can be di icul o an icipa e. I has been a gued ha he secu i y and
p i acy conside a ions should be embedded in all he a eas o o ganiza ional
ac i i ies ins ead o only elying echnical secu i y mechanisms p o ided by he
unde lying sys ems and so wa e. En e p ise A chi ec u e Managemen (EAM)
o e s a holis ic app oach o managing di e en dimensions o an o ganiza ion,
and can be concei ed as a cohe en and consis en se o p inciples ha guide
how he en e p ise mus be designed. This a icle con ibu es wi h a me hod
amewo k o in eg a ing in o ma ion secu i y wi h EAM, aimed a p o iding
suppo o he decision-making ela ed o o mula ing con ex -awa e EA
secu i y p inciples. The p esen ed me hod amewo k is a esul o a
cons uc i e esea ch based on bo h he heo e ical body o knowledge and he
empi ical e idence, ob ained by in e iewing 35 Finnish EA and in o ma ion
secu i y p ac i ione s.
Keywo ds: En e p ise A chi ec u e Managemen , En e p ise A chi ec u e
P inciple, In o ma ion Secu i y, In o ma ion Secu i y Policy, Me hod
F amewo k, Cons uc i e Resea ch.
1 In oduc ion
O ganiza ions cons an ly ace new challenges in he a ea o in o ma ion secu i y. Digi al
ans o ma ion, ne wo ked business models, con inuously e ol ing o ganiza ions, eme ging
echnologies, inc easing complexi y o in o ma ion sys ems and echnology landscapes,
egula o y p essu es and changes in legisla ion, and se e al o he ac o s necessi a e ha
o ganiza ions mus cons an ly keep hei eye on he secu i y equi emen s and ede ine hem as
needed. As an example, since May 2018 he en e p ises ope a ing in Eu ope ha e been obliga ed
*
Co esponding au ho
© 2019 Sa a La no e al. This is an open access a icle licensed unde he C ea i e Commons A ibu ion License
(h p://c ea i ecommons.o g/licenses/by/4.0).
Re e ence: S. La no, V. Seppänen and J. Nu mi, “Me hod F amewo k o De eloping En e p ise A chi ec u e Secu i y
P inciples,” Complex Sys ems In o ma ics and Modeling Qua e ly, CSIMQ, no. 20, pp. 57–71, 2019. A ailable:
h ps://doi.o g/10.7250/csimq.2019-20.03
Addi ional in o ma ion. Au ho ’s ORCID iD: V. Seppänen – h ps://o cid.o g/0000-0003-3843-4843. PII S225599221900117X.
Recei ed: 30 May 2019. Accep ed: 23 Oc obe 2019. A ailable online: 31 Oc obe 2019.
58
o comply wi h he Gene al Da a P o ec ion Regula ion (GDPR); and ailing o gua an ee
o ganiza ional secu i y and p i acy o hei cus ome s’ pe sonal da a may lead o subs an ial
ines. I has been a gued ha nowadays he secu i y and p i acy conside a ions should be
embedded in all he a eas o o ganiza ional ac i i ies ins ead o only elying on echnical secu i y
mechanisms ha unde lying sys ems and so wa e p o ide [1], [2].
The en e p ise a chi ec u e (EA) managemen (EAM) has been seen as a iable app oach o
in eg a ing di e en laye s o in o ma ion secu i y and aligning hem wi h he con ex o
con inuously changing business equi emen s. (e.g. [3]). As s a ed by The Open G oup [4, p.1]
“ o oo long, in o ma ion secu i y has been conside ed a sepa a e discipline, isola ed om he
business p ocesses and En e p ise A chi ec u e”. Al hough some esea ch on secu i y and EA
exis ( o ins ance, en e p ise p i acy a chi ec u e (EPA), en e p ise secu i y a chi ec u e (ESA),
en e p ise in o ma ion secu i y a chi ec u e (EISA) and She wood Applied Business Secu i y
A chi ec u e (SABSA)), hese app oaches p opose addi ional a chi ec u es o ein o ce he
exis ing EA me hod [3]. As discussed la e in his a icle, he in o ma ion secu i y policy is
di ided in o h ee ca ego ies o abs ac ion encompassing he whole o ganiza ion [5], hus
necessi a ing he secu i y pe spec i es o be imme sed in o EA i sel , ins ead o being addi ional
a chi ec u al iewpoin s o ex ensions. As a gued in [25], he cu en app oaches o en ocus
solely on in o ma ion sys ems and echnology componen s o he a chi ec u e, and as such do no
o e a equisi e holis ic app oach o in eg a e he in o ma ion secu i y wi h he p ac ices o
EAM. Second, p io esea ch is ocused on discussing he isk managemen aspec s on
in o ma ion secu i y. While, o ins ance, En e p ise A chi ec u e-Based Risk and Secu i y
Modelling and Analysis (ERSM) sugges s secu i y p inciples, no guidance o he de elopmen
o he p inciples is gi en.
Acco ding o [6], he en i e EA can be concei ed as a cohe en and consis en se o p inciples
ha guide how he en e p ise mus be designed, making EA p inciples a iable ins umen o
achie ing o ganiza ional secu i y. The objec i e o his s udy is o de elop an abs ac design
knowledge a e ac in he o m o a me hod amewo k o in eg a ing in o ma ion secu i y
p inciple de elopmen wi h he EAM. As a p ac ical con ibu ion, he a icle p o ides suppo o
decision-making ela ed o o mula ing con ex -awa e EA secu i y p inciples, while a heo e ical
con ibu ion can be ound om he co e age o wo dis inc ye in e ela ed s eams o esea ch:
in o ma ion secu i y and EA. The p esen ed me hod amewo k is he esul o he cons uc i e
esea ch based on bo h he heo e ical body o knowledge and he empi ical e idence, which was
ob ained by in e iewing 35 Finnish EA and in o ma ion secu i y p ac i ione s.
The emainde o his a icle is o ganized as ollows. In he nex sec ion we ou line he
heo e ical ounda ion o his s udy by discussing i s co e concep s, i.e. he en e p ise
a chi ec u e p inciples and secu i y policies, and hei possible ela ion o each o he . The hi d
sec ion desc ibes ou cons uc i e esea ch p ocess phase by phase, and hen he ou h sec ion
p esen s he esul s o he cons uc i e wo k. The i h sec ion p o ides a discussion on he
esul s. Finally, he six h sec ion concludes he pape , add esses limi a ions o he s udy, and
sugges s opics o u he esea ch.
2 Theo e ical Backg ound
This sec ion discusses he key concep s o he esea ch domain and es ablishes he heo e ical
ounda ions o he cons uc i e pa o he s udy. The i s sec ion add esses he en e p ise
a chi ec u e and, mo e speci ically, he en e p ise a chi ec u e p inciples, and he second co e s
he concep o in o ma ion secu i y policy. While he clea dis inc ion be ween he e ms
p inciple and policy is no always d awn (c ., [7]), in he ollowing we cha ac e ize he o me as
a ule o be ollowed and he la e as collec ion o guidelines o be adop ed. By discussing hese
concep s, we aim o add ess he need o and he cu en lack o a holis ic app oach o
in eg a ing aspec s o in o ma ion secu i y in o he EAM.
59
2.1 En e p ise A chi ec u e P inciples
The EAM o e s a holis ic app oach o managing di e en dimensions o an o ganiza ion, such
as i s goals and objec i es, business ac i i ies, so wa e applica ions, da a and in o ma ion, and
echnology in as uc u es. I os e s he use o common language and suppo s he co-ope a ion
be ween s akeholde g oups [8]. EAM is widely used in s a egy o ma ion, planning, and
implemen a ion and in aligning business capabili ies wi h he suppo ing IT esou ces [9].
To s uc u e and guide he EAM- ela ed ac i i ies, o ganiza ions use di e en me hodologies,
which ha e been de eloped bo h in he academia and indus y. The o igins o he mode n EA
can be aced o he Business Sys ems Planning me hodology in he 1960s [10]. Howe e , he
e m “en e p ise a chi ec u e” and he ela ed e minology we e coined la e in he ea ly
publica ions ega ding he PRISM a chi ec u e amewo k (c ., [11]) and he Zachman
F amewo k [12]. Cu en ly, The Open G oup A chi ec u e F amewo k (TOGAF®), in oduced
in 1995, is he mos widely adop ed EA me hodology in he indus y [13]. Howe e , mos o he
o ganiza ions ha e aken a “hyb id amewo k app oach”. [14] a gues ha no single
me hodology mee s all equi emen s o add esses all he needs o a pa icula o ganiza ion [13].
In a hyb id app oach, aspec s, ideas and app oach a e combined om a mul iple di e en
me hodologies and amewo ks.
The e a e some cha ac e is ics ha a e common o he majo i y o EAM me hodologies. These
include he sepa a ion o di e en iewpoin s (such as business- ela ed elemen s and echnology-
ela ed elemen s) when an o ganiza ion’s a chi ec u al s uc u es a e being designed o cons i u e
an aligned whole. Second, a chi ec u al planning and de elopmen is ad ised o conside he
cu en s a e o he a chi ec u al s uc u es in ela ion o he desi ed a ge s a e ha would be e
se e he implemen a ion o business objec i es. By analyzing gaps be ween he cu en and
desi ed s uc u es, i is possible o iden i y and p io i ize he ele an a eas o de elopmen .
Thi d, he EA amewo ks, which can be conside ed as a o m o en e p ise on ology (c ., [15],
[16], [17]), p o ide di e en iewpoin s and di e en le els o abs ac ion (such as con ex ual,
concep ual, logical and physical) o di e en s akeholde s and hei dis inc i e needs. Fo
ins ance, a CIO migh be in e es ed in inding ou da ed so wa e applica ions using he o e all
iew p o ided by he applica ion po olio model, while a so wa e de elope designing he bes -
i ed in eg a ion app oach migh be in e es ed in s udying he APIs suppo ed by he cu en
in o ma ion sys ems a chi ec u e. The design o ac ual implemen able a chi ec u al s uc u es is
guided by he s a egy-le el conside a ions. Fo ins ance, along wi h he business a chi ec u e,
in o ma ion sys ems a chi ec u e, and echnology a chi ec u e, he TOGAF® con en me amodel
sepa a es he a chi ec u e ision de i ed om he business and echnology s a egies, he
a chi ec u e equi emen s and cons ain s, and he a chi ec u e p inciples, which o mula e he
gene al unde lying ules and guidelines o he a chi ec u e de elopmen .
As he p inciples mani es gene al ules and guidelines o suppo an o ganiza ion ul illing i s
mission, de ining he a chi ec u e p inciples is ecommended as he ini ia ing ac i i y o EAM
[18]; whe eas p inciples cons i u e a ounda ion o hinking abou he sys ems design [19] and
he equi emen s, and, on he o he hand, s a e he unc ional and cons uc ional p ope ies o a
sys em o ha e [20]. The e o e, he p inciples can be seen as bounda y condi ions om which he
implemen able equi emen s a e de i ed.
The EA p inciples can ei he se e as he designing p inciples ha a e used o desc ibe he
design o ac ual sys em a e ac s o he egula i e p inciples o con ey a p esc ip i e no ion
limi ing he design op ions allowed in a sys em design [21]. [20] cha ac e izes he EA p inciples
being he la e . I is a gued ha he EA p inciples a e a speci ic o m no ma i e p inciples ha
“guide/di ec he en e p ise no ma i ely es ic ing design eedom” [20, p. 11]. No ma i e
p inciples a e based on a i ac s such as s a egy, he exis ing en i onmen , and ex e nal
de elopmen s [20]. The EA p inciples pu sue he o ganiza ion-wide consensus in he
de elopmen , main enance, and use o EA as well as in guiding i s implemen a ion as ope a ional
ac i i ies and suppo ing asse s. As such he p inciples b idge he s a egy and ope a ions. In
60
p ac ice, he EA p inciples a e widely o mula ed in o ganiza ions and used, o ins ance, o
e iewing de elopmen ini ia i es and p ojec s. The e o e, he documen a ion and
communica ion o EA p inciples is essen ial. The documen a ion should include, as a p o ound
elemen , a clea de ini ion o a p inciple’s s uc u e and he ela ions i has wi h i s en i onmen
[22]. Fu he mo e, he documen a ion should add ess he p inciple’s mo i a ing a ionale,
conc e e implica ions, and measu es wi h which i s ul illmen is e alua ed [23], [24].
2.2 In o ma ion Secu i y Policy
O ganiza ions need o conside many ace s o in o ma ion secu i y in hei daily ope a ions. The
apidly inc easing use o IT, eme ging echnologies and digi aliza ion o o ganiza ions’ co e
esou ces p o oke new h ea s ha can be di icul o an icipa e [25]. A acks ha damage o
modi y da a can a ec he c i ical in as uc u e wi hou any awa eness o i s owne . I is
no ewo hy ha a he same ime as new secu i y h ea s ha e appea ed alongside eme ging
echnologies, an inc easing numbe o h ea s a e loca ed inside he o ganiza ion. Many o hese
h ea s a e caused by unin en ional, ca eless o negligen beha io [26], [27], [28]. The e o e, a
majo i y o he li e a u e on in o ma ion secu i y ocuses on he use 's pe spec i e and how he
use s o in o ma ion and echnology esou ces can by hei ac ions p e en , de ec and espond o
secu i y h ea s [29].
In o ma ion secu i y also encompasses da a sou ces ha a e no in digi al o ma s. In o ma ion
ha is based on physical documen s o employees' knowledge can as well be a a ge o secu i y
h ea s [30]. Indi idual knowledge can be a key compe i i e ad an age o an o ganiza ion and
he e o e needs o be p o ec ed. In o ma ion secu i y ulne abili ies con ain a signi ican isk, no
only o he ope a ions o an o ganiza ion, bu also om he poin o iew o he o ganiza ion’s
epu a ion. To his end, se e al o ganiza ions ha e been inc easingly ocusing on de eloping
sa e y- ela ed policies and aligning hem wi h non-o ganiza ional egula ions.
The numbe o s udies on he implemen a ion and e iciency o in o ma ion secu i y has
signi ican ly inc eased in he 21s cen u y and he in o ma ion secu i y policy de elopmen is an
a ea o g owing schola ly in e es . Gene ally, he concep o he in o ma ion secu i y policy is
di ided in o he h ee ca ego ies o abs ac ion. A he lowes le el o abs ac ion, in o ma ion
secu i y is looked a om a echnical poin o iew [5]. A his le el, he key conce n is he
secu i y a chi ec u e o echnical sys ems, usually ocusing on s anda ds and p ocedu es o he
sys ems con igu a ion o main enance. A he nex le el o abs ac ion, in o ma ion secu i y is
iewed om he use 's poin o iew [5]. He e, ce ain a eas o echnology, such as he use o
in e ne se ices, a e add essed. These policies may include ins uc ions and p ocedu es ha
employees mus obse e in hei daily in e ac ions wi h he in o ma ion and echnology
esou ces. The majo i y o ex an esea ch li e a u e is examining he secu i y policies h ough an
indi idual and ope a ional abs ac ion le el [29]. A he highes le el o abs ac ion, he
in o ma ion secu i y is app oached om he senio managemen poin o iew [5]. A his le el,
ins ead o he ac ual ope a i e p inciples, he ocus is on he s a egic di ec ion o he
o ganiza ion and he ex en and na u e o secu i y objec i es. These guide he de elopmen ,
implemen a ion and managemen o he secu i y p og ams and assign esponsibili ies o he
a ious secu i y a eas a he mos abs ac , philosophical le el [29].
To gain a needed b oade pe spec i e on he p oblem a ea, he opic o secu i y has been
app oached om he pe spec i es o policy compliance and in o ma ion secu i y cul u e [29].
Howe e , [31] a gue ha he ex an li e a u e on in o ma ion secu i y policies ocuses on
desc ibing he s uc u es and con en , bu usually does no desc ibe a de ailed de elopmen
p ocess. The p o essionals in ol ed in he in o ma ion secu i y policy de elopmen a e p o ided
wi h li le knowledge abou he p ocesses hey should ollow. They o en need o ely on
guidelines which a e no speci ically designed o hei o ganiza ions and hus ail o ecognize
and answe o hei speci ic h ea s and equi emen s [5], [31].

61
Fo cons uc ing he in o ma ion secu i y policy, [5] a gues o h ee ma e s o be conside ed.
Fi s , an o ganiza ion mus be able o compile and upda e i s in o ma ion secu i y policy in an
agile manne . This is especially impo an when he o ganiza ion s i es o a change ha may
con lic wi h he exis ing in o ma ion secu i y policy. Howe e , his does no mean ha he
in o ma ion secu i y objec i es should be igno ed, bu he secu i y elemen s should, as quickly as
possible, be aligned wi h he changed equi emen s. The goal is ha he o ganiza ion is bo h
capable o e ec i ely seeking he change, bu also capable o achie ing an app op ia e le el o
in o ma ion secu i y. This kind o agile aspec is essen ial as o ganiza ional change can also help
o mee he in o ma ion secu i y equi emen s. The e o e, he p inciples o managing he
in o ma ion secu i y mus always be synch onized wi h he o ganiza ional p io i ies and he
p ocesses ha suppo hese goals.
The second ma e is poli ical simplici y. [5] no es ha in lexible policies induce sec e and
poo ly conside ed non-compliance. The e o e, he p ocess o policy cons uc ion mus be
anspa en , awa e o i s con ex , and in ol e he s akeholde s a he di e en le els o an
o ganiza ion. The policy- ela ed decisions need o be well- easoned and hei implica ions
explici . Thi dly, an in o ma ion secu i y policy mus implemen he exis ing c i e ia ha can be
ob ained, o ins ance, om legisla ion o o ganiza ion's own p io i ies. I should be no ed,
howe e , ha i hese c i e ia a e no de ailed, i is pe missible o policy make s o ha e a be e
chance o esponding lexibly in modi ying he o ganiza ion's in o ma ion secu i y policy so ha
he o ganiza ion can eac e icien ly in he o ganiza ional changes.
Cybe secu i y isks a e socio- echnical in na u e as hey include no only echnical
ulne abili ies bu o en also include ac o s ela ed o beha io o human ac o s [28].
Consequen ly, se e al esea che s ha e ph ased he po en ial o he EAM o se e as an
encompassing ins umen o app oaching in o ma ion secu i y ela ed ques ions. Fo ins ance,
[32] no es ha he EAM p o ides a mean o mi iga e he limi ing siloed hinking o adi ional
isk managemen p ocesses as i gi es a be e unde s anding on how an asse and i s alue can
be a ec by a mani es a ion o a isk. Simila ly, [2] a gues ha he EAM is a p omising app oach
o deal wi h he inc easing complexi y o o ganiza ions, echnologies and he ela ed secu i y
h ea s. Mos o he cu en e o s, howe e , ha e ocused only on indi idual a eas on he
domain o EAM, such as in o ma ion sys ems isk managemen (e.g. [2], [33], [34]). The e o e,
as a gued in [35], he holis ic app oach o he secu i y in EA is s ill lacking.
3 The Cons uc i e Resea ch App oach
As s a ed p e iously, he objec i e o his s udy is o de elop an abs ac design knowledge
a e ac . Design knowledge, p oduced by design esea ch, can be sepa a ed in o wo ou comes,
namely, abs ac and si ua ional design knowledge. Abs ac design knowledge comes om
me a-design, o ins ance, li e a u e e iew, modelling and engagemen schola ship [36] and
p oduces abs ac concep s, gene ic models, guidelines o design p ac ices and sys ems
abs ac ions wi h key p ope ies [36]. The me hod amewo k is c ea ed based on he li e a u e
om bo h esea ch ields: he EA and he in o ma ion secu i y. Engagemen schola ship was
execu ed h ough in e iews.
Bo h he me a-design and he design p ac ice ha e di e se ypes o e alua ion ha should be
conduc ed du ing he design and de elopmen phase. Design science e alua ion has wo o ms:
a i icial and na u alis ic e alua ion [46] o which a i icial e alua ion was used in his s udy. In
design science esea ch, he e a e wo e alua ion ela ed phases, e alua ion and demons a ion.
In his s udy, he demons a ion phase was conduc ed as a se ies o expe in e iews.
In e iewees we e asked o e alua e he sui abili y o he me hod amewo k, and he a e ac
was e alua ed based on he iews o he in e iewees. The me hod amewo k was modi ied he
i s ime a e ou in e iews, and he second ime a e all he nine in e iews we e conduc ed.
In he ield o me hod enginee ing, i is o en a gued ha no me hod is sui able as such and
some si ua ional adap a ion is always needed. The me hod adap a ion e e s o he ac i i ies o
62
enhancemen , ex ension o es ic ion o make a me hod sui able o a speci ic domain, an
o ganiza ion, o a p ojec [14], [37], [38]. Adap abili y o he EA me hods is pa icula ly
impo an due o he conside able he e ogenei y o o ganiza ions and hei business en i onmen s
[39], [40], [41], [42]. In compa ison o a me hod, a me hod amewo k is pu pose ully a mo e
abs ac me hodological elemen ha suppo s he de ini ion o me hods [43]. The me hod
amewo k can be conside ed as a gene aliza ion o a me hod, which is hen adjus ed and
speci ied o he con ex o a ce ain o ganiza ion.
This sec ion desc ibes s ep-by-s ep he cons uc i e esea ch p ocess ha adop s ideas om
se e al no able wo ks on he design science esea ch (e.g. [44], [45], [46], [47]). Also, he goals
and equi emen s ega ding he me hod amewo k’s con en and expedience a e p esen ed.
Figu e 1 summa izes he phases o he esea ch p ocess ha was ollowed while cons uc ing he
Me hod F amewo k o En e p ise A chi ec u e Secu i y P inciples (MF4EASP).
Figu e 1. The phases o he esea ch p ocess and he accompanying sou ces o in o ma ion
3.1 P oblem Iden i ica ion and Mo i a ion
The p oblem, i.e. he need o and he cu en lack o a holis ic app oach o in eg a ing aspec s
o in o ma ion secu i y in o EAM, has been aised in ecen s udies. Fo ins ance, a s udy [35]
a gues ha he in eg a ion o secu i y and isk ela ed conce ns in o he holis ic app oaches o
EAM a e cu en ly a an inadequa e le el. Consequen ly, ecen e o s ha e ocused on
in o ma ion sys ems isk managemen (e.g. [2], [7], [35], [48]). Howe e , in a e iew o 15 yea s
o academic EA endea o s, a s udy [1] no es ha al hough some p og ess has been made, EA has
no ye eached he s a e o being a iable ool o add essing eme ging secu i y challenges and
new h ea s o o ganiza ions’ complex in o ma ion sys ems. Fo ins ance, al hough EAM is
manda ed by legisla ion in he Finnish public sec o , he Na ional Audi O ice o Finland, in
hei 2017 epo , disco e ed se e al p oblems in he a ea o in o ma ion secu i y. Thei epo
s a es ha EA desc ip ions would se e as a aluable ool o e alua ing he c i icali y o
elec onic se ices bu EAM is no p ope ly in eg a ed wi h he ope a ional equi emen s and
p ac ices. I was also ound ha he c i icali y o he ICT sys ems is no egula ly checked,
63
al hough he equen changes occu ing in he ope a ing en i onmen would absolu ely need i .
Finally, he epo s a es ha he in o ma ion secu i y is commonly ins i u ed as he esponsibili y
o he IT uni s, e en hough hey may no be awa e o all he necessa y business- ela ed
conce ns, and he eby he holis ic iew o he in o ma ion secu i y emains lacking.
3.2 Requi emen s and Objec i es
We analyzed he ich quali a i e da a ob ained by in e iewing 26 seasoned expe s on EA, who
con ibu ed o he p oblem iden i ica ion and o cap u ing he equi emen s and objec i es o he
MF4EASP. These in o man s se e in di e en posi ions in bo h p i a e IT companies and
public sec o and hei expe ience in EA- ela ed ac i i ies ange om 3 o 40 yea s wi h he
a e age o 15 yea s. The in e iews add essed he in o man s’ iews o he pas , p esen and
u u e p ac ices o EAM. The da a we e sc eened o he in o ma ion ele an o he objec i es o
his s udy. The de ails o he da a collec ion can be ound in [48]. The iden i ied gene ic
equi emen s o he MF4EASP a e p esen ed in Table 1. These a e accompanied wi h he
ep esen a i e examples o ci a ions om he in e iew ansc ip s. The exce p s a e ansla ed
om Finnish o English.
Table 1. The guiding equi emen s o he de elopmen o MF4EASP
Requi emen
In o man s
Example om an in e iew
1) In o ma ion secu i y should be included
in e e y aspec o EAM.
1, 3, 5, 9, 10,
13, 14, 19, 22
“In o ma ion secu i y mus be aken in o
accoun in all he a chi ec u al solu ions
h ough all he [a chi ec u e] laye s.”
2) In o ma ion secu i y should be included
in EA design p inciples.
1, 12
“Secu i y canno be jus a glued-on
conce n. I mus be a design p inciple.”
3) Risk managemen should be an in eg al
pa o EAM.
1, 2, 5, 20
“Yes, we ha e been ocusing ou a en ion
o ha [ he EA me hod] could guide he
in o ma ion secu i y and isk
managemen .”
4) In o ma ion secu i y managemen
p ac ices should be adap able o he pu pose
o he o ganiza ion.
5, 8, 15, 23, 25
“[Planning o he in o ma ion secu i y]
should be pu pose-d i en. I mean, wha
a e he needs o he business and
ope a ional unc ions. And wha a e he
ela ed isks. Then you can conclude wha
kind o in o ma ion p o ec ion o secu i y
you eally need. Tha way, you don’
always ca ego ically need o ake he
ha des oad.”
5) Silo-men ali y mus be disman led.
2, 6, 7, 19, 21
“I is also o en he case he e ha he e
a e silos among expe s. The in e ac ion
and co-ope a ion a e needed. And in a
way, o cou se, he EAM is a p e y good
ool o acili a ing ha con e sa ion.”
6) A means o deal wi h legisla i e demands
and egula o y p essu es should be p o ided.
3, 5, 11,16, 17,
19, 26
“[Regula i e laws] a e e y ex ensi e
[and] hey pose la ge and complex
equi emen s. EAM is an app op ia e ool
o dealing wi h hem.”
8) In o ma ion secu i y p ac ices mus be
able o espond o changes aking place in
he ope a ing en i onmen s.
13, 17, 18, 20,
24, 26
“I hink ha he numbe o cloud-based
solu ions and hyb id solu ions, whe e
some o he in o ma ion is s o ed locally
and some o i in he cloud, [will con inue
o inc ease]. You need o be able o
con inuously change he way you do you
wo k.”
64
3.3 Design and De elopmen
The o e all s uc u e o he a e ac p esen ed in his pape d aws om he p e ious wo ks on
he design o EA p inciples and in o ma ion secu i y policies. A numbe o academic
con ibu ions on he EA p inciple de elopmen can also be ound (e.g. [6], [23], [24]), al hough
hei applicabili y is somewha limi ed due o hei gene ali y and pu pose ully wide scope.
Based on he li e a u e e iew [49], he consolida ed me amodel o EA p inciples has been
p esen ed [22]. By i emizing he elemen s o a p inciple, his me amodel di e en ia es he co e
de ini ion o he EA p inciple, including i s s a emen , a ionale, implica ions, key ac ions, and
ela ed measu es, and also p o ides an ex ended de ini ion ha conside s he p inciple’s impac
on i s en i onmen . We used he wo k p esen ed in [22] o de ining he key componen s and he
a eas o conce n o MF4EASP.
Nex , o he s uc u e o EA secu i y p inciple de elopmen p ocess, we adap ed he p ocess
o he policy de elopmen amewo k [31] and he ele an componen s p esen ed in he
Comp ehensi e In o ma ion Secu i y Policy P ocess Model [50]. Finally, we s i ed o balance
he equi emen s ound in ou empi ical da a wi h he equi emen s o suppleness, poli ical
simplici y and c i e ion-o ien a ion as discussed in ela ion o in o ma ion secu i y me a-policy in
[5].
The MF4EASP was cons uc ed using he A chiMa e® 3.0.1 speci ica ion. The A chiMa e®
modeling language is an Open G oup s anda d, which p o ides a TOGAF® complian modeling
no a ion ha co e s all he EA domains. I is widely used in bo h public and p i a e
o ganiza ions a ound he wo ld and is suppo ed by he majo i y o EA modeling ools. As a
semi- o mal modeling language, i p o ides a cohe en and isually uni o m ep esen a ion o
EA a e ac s co e ing di e en componen s o an a chi ec u e and hei dependencies. As such i
aims a enabling communica ion among s akeholde s, and guides complica ed change p ocesses
on a chi ec u al s uc u es.
3.4 Demons a ion and E alua ion
Nine expe p ac i ione s ook pa in e alua ing he en a i e e sions o MF4EASP. The
e alua o s we e selec ed using he c i e ion sampling (c. ., [48]) so ha he in o man s could
p o ide p o ound and well- easoned insigh s o suppo he u he de elopmen o he cons uc .
Fou o he e alua o s ha e hei expe ise bo h in he ields o EA and in o ma ion secu i y,
h ee in he in o ma ion secu i y, and wo in he EA. Thei occupa ional posi ions included Chie
In o ma ion O ice , Chie Digi al O ice , En e p ise A chi ec , Specialis , Resea che , and
di e en manage ial posi ions. The e alua o s’ p o essional expe ience in he ield o hei
expe ise anged om 2 o 30 yea s wi h he a e age o 14 yea s.
The e alua ion o he me hod amewo k was conduc ed by p esen ing he MF4EASP o he
e alua o who was hen asked o gi e eedback, c i icism and cons uc i e ideas ega ding
a ious aspec s. Each e alua o was me indi idually by he i s au ho , o ensu e ha hei
iews and opinions would no a ec he o he e alua o s. The aspec s o e alua ion we e based
in he me hod enginee ing knowledge and adhe ed o shell model p esen ed in [52]. Table 2
p esen s he hemes co e ed du ing he e alua ion and he ques ions hey we e add essed wi h.
O e all, he e alua ion was a ge ed o he co ec ness, comple eness and applicabili y o he
MF4EASP.
The e alua ion was conduc ed o he wo e sions o MF4EASP in he wo ounds. Some
changes we e implemen ed o he i s e sion o cons uc acco ding o he eedback gi en by
he i s ou e alua o s. These included, o ins ance, a possibili y o bo h objec i es and
cons ain s o de ine equi emen s o design p inciples, he acknowledgemen o possible
s akeholde -induced isks, and ha he p ocess needs o, in addi ion o secu i y p inciple
de elopmen , conside hei implemen a ion in an o ganiza ion.
71
[33] F. Inne ho e -Obe pe le and R. B eu, “Using an En e p ise A chi ec u e o IT Risk Managemen ,” P oc. o
he ISSA 2006 om Insigh o Fo esigh Con e ence, 2006.
[34] J. S. Bu ke , “Business Secu i y A chi ec u e: Wea ing In o ma ion Secu i y in o You O ganiza ion’s
En e p ise A chi ec u e h ough SABSA®,” In . Secu . J., ol. 21, no. 1, pp. 47–54, 2012. A ailable:
h ps://doi.o g/10.1080/19393555.2011.629341
[35] H. Jonke s and D. Qua el, “G aphical Models o Secu i y,” Thi d In e na ional Wo kshop, G aMSec 2016,
ol. 9987, pp. 94–101, 2016. A ailable: h ps://doi.o g/10.1007/978-3-319-46263-9_6
[36] Ł. Os owski, M. Hel e and F. Hossain, “A concep ual amewo k o design science esea ch,” P oc. o he
In e na ional Con e ence on Business In o ma ics Resea ch, Sp inge , LNBIP, ol. 90, pp. 345–354, 2011.
A ailable: h ps://doi.o g/10.1007/978-3-642-24511-4_27
[37] J. Raly e e al., “Towa ds a Gene ic Model o Si ua ional Me hod Enginee ing To ci e his e sion : Towa ds a
Gene ic Model o Si ua ional Me hod,” P oc. o he In . Con . Ad . In . Sys . Eng., Sp inge , LNCS, ol. 2681,
pp. 95–110, 2012. A ailable: h ps://doi.o g/10.1007/3-540-45017-3_9
[38] M. Leppänen, An On ological F amewo k and a Me hodical Skele on o Me hod Enginee ing: A Con ex ual
App oach. Jy äskylä S udies in Compu ing 52, 2005.
[39] M. Leppänen, K. Val onen, and M. Pulkkinen, “Towa ds a Con ingency F amewo k o Enginee ing an
En e p ise A chi ec u e Planning Me hod,” P oc. o 30 h In o ma ion Sys ems Resea ch Semina in
Scandina ia, 2007.
[40] C. Riege and S. Aie , “A Con ingency App oach o En e p ise A chi ec u e Me hod Enginee ing,”
In e na ional Con e ence on Se ice-O ien ed Compu ing, Sp inge , LNCS, ol. 5472, pp. 388–399, 2008.
A ailable: h ps://doi.o g/10.1007/978-3-642-01247-1_39
[41] K. Val onen, V. Seppänen, and M. Leppänen, “Go e nmen en e p ise a chi ec u e g id adap a ion in Finland,”
P oc. o he 42nd Annual Hawaii In e na ional Con e ence on Sys em Sciences, HICSS, 2009. A ailable:
h ps://doi.o g/10.1109/hicss.2009.232
[42] S. Buckl, “De eloping o ganiza ion-speci ic en e p ise a chi ec u e managemen unc ions using a me hod
base,” Ph.D. disse a ion, Technische Uni e si ä München, Leh s uhl ü In o ma ik XIX, 2011.
[43] C. Sal iano, A. Zoucas, J. Sil a, Â. Al es, C. G. on Wangeheim, and M. Thi y, “A Me hod F amewo k o
Enginee ing P ocess Capabili y Models,” 16 h Eu . Sys . So w. P ocess Imp o . Inno . Ind. Eu oSPI 2009.,
ol. 1, pp. 25–36, 2009.
[44] S. T. Ma ch and G. F. Smi h, “Design and na u al science esea ch on in o ma ion echnology,” Decis. Suppo
Sys ., ol. 15, no. 4, pp. 251–266, 1995. A ailable: h ps://doi.o g/10.1016/0167-9236(94)00041-2
[45] A. R. He ne , S. T.Ma ch, J. Pa k, and S. Ram, “Design Science in In o ma ion Sys ems Resea ch,” MIS Q.,
ol. 28, no. 1, pp. 75–105, 2004. A ailable: h ps://doi.o g/10.2307/25148625
[46] J. Venable, “The ole o heo y and heo ising in Design Science esea ch,” P oc. DESRIST, pp. 24–35, 2006.
[47] K. Pe e s, T. Tuunanen, M. A. Ro henbe ge , and S. Cha e jee, “A Design Science Resea ch Me hodology
o In o ma ion Sys ems Resea ch,” J. Manag. In . Sys ., ol. 24, no. 3, pp. 45–77, 2007. A ailable:
h ps://doi.o g/10.2753/MIS0742-1222240302
[48] M. Q. Pa on, Quali a i e e alua ion and esea ch me hods. Thousand Oaks, CA, US: Sage Publica ions, Inc.,
1990.
[49] K. Pen inen, “The Long and Winding Road o En e p ise A chi ec u e Implemen a ion in he Finnish Public
Sec o ,” Ph.D. disse a ion, Facul y o In o ma ion Technology, Uni e si y o Jy äskylä, Finland, 2018.
[50] D. S elze , “En e p ise a chi ec u e p inciples: Li e a u e e iew and esea ch di ec ions,” Se ice-O ien ed
Compu ing. ICSOC/Se iceWa e 2009 Wo kshops, Sp inge , LNCS, ol. 6275, pp. 12–21, 2010. A ailable:
h ps://doi.o g/10.1007/978-3-642-16132-2_2
[51] K. J. Knapp, R. F. Mo is, T. E. Ma shall, and T. A. By d, “In o ma ion secu i y policy: An o ganiza ional-
le el p ocess model,” Compu . & Secu ., ol. 28, no. 7, pp. 493–508, 2009. A ailable:
h ps://doi.o g/10.1016/j.cose.2009.07.001
[52] J.-P. Tol anen, “Inc emen al Me hod Enginee ing wi h Modeling Tools: Theo e ical P inciples and Empi ical
E idence,” Ph.D. disse a ion, Uni e si y o Jy äskylä, Finland, 1998.
[53] C. Magnusson and S. C. Chou, “Risk and compliance managemen amewo k o ou sou ced global so wa e
de elopmen ,” P oc. o he 5 h In . Con . Glob. So w. Eng. ICGSE 2010, pp. 228–233, 2010. A ailable:
h ps://doi.o g/10.1109/ICGSE.2010.34