## 3 Background and Related Work
### Enterprise Security Architecture SABSA  
Enterprise Architecture (EA) is a business function focusing on the structures and behaviors of business roles and processes that create and use business data. Thereby, EA is at the highest level of the architect hierarchy. Various EA frameworks exist, including SABSA. SABSA [4; 5] is a methodology and standard for developing business-driven, risk and opportunity-focused enterprise security and information assurance architectures. The goal is to deliver security infrastructure solutions that, in a traceable manner, support critical business initiatives. The framework consists of several integrated frameworks, models, methods, and processes. It follows [PERSON]'s methodology [55] of distinct and controlled layers, which try to answer the questions \"What is done on this layer?\" and \"How are the requirements fulfilled on this layer?\". The layers, ranging from contextual to management, are described in Table 1. According to [PERSON] [56], the meta-model of SABSA consists of the architectural levels (what, why, how, who, where, and when), and common entity attributes (ID, name, description, category, source, and owner), as well as the domain model, business attribute profiles, risk and opportunity framework, roles and responsibilities, trust framework, architectural strategies, and through-life risk management.  
Figure 3: Process Framework Vis4 Sec [54].  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**SABSA Layer** & **Assets (What)** & **Motivation (Why)** & **Process (How)** & **People (Who)** & **Location (Where)** & **Time (When)** \\ \hline Contextual & Business goals and & Business risks & Business meta-processes & Business governance & Business geography & Business time dependence \\ \hline Conceptual & Business value and & Risk management strategy & Strategies for process & Security and risk & Domain framework & Time management \\ knowledge strategy & and objectives & assurance & governance; trust framework & & framework & \\ \hline Logical & Information assets & Risk management policies & Process maps and services & Trust relationships & Domain maps & Calendar and timetable \\ \hline Physical & Data assets & Risk management practices & Process mechanisms & Human interface & Infrastructure & Processing schedule \\ \hline Component & Component assets & Risk management & Process components and standards & Human entities: components and standards & Locator components and standards & Step timing and sequencing components \\ \hline Management & Delivery and continuity & Operational risk & Process delivery & Governance, relationship and personal management & Environment & Time and performance management \\ \hline \hline \end{tabular}
\end{table}
Table 1: SABSA Matrix based on [57].  
[PERSON] et al. [58] compared several EA frameworks, like SABSA, The Open Group Architecture Framework (TOGAF), and Control Objectives for Information and Related Technology (COBIT) 19, concluding that these EA frameworks were generally missing cyber-security. SABSA complied with existing security standards and, thereby, these should be used in addition. [PERSON] et al. [59] applied SABSA to choose suitable security requirements. Similarly, [PERSON] [60] utilized SABSA to receive more secure applications. Other authors customized SABSA for their areas. [PERSON] et al. [61] adapted SABSA and ISO/IEC 27000 for oil and gas business activities. [PERSON] and [PERSON] [62] outlined their EA for the energy sector. [PERSON] et al. [63] proposed an architecture based on the Open Security Architecture (OSA) concepts and SABSA methodology for SMEs. [PERSON] et al. [64] used an integrated conceptual model for information system security risk management by utilizing SABSA. However, this approach was rather generic and tailored to the area of home care. [PERSON] and [PERSON] [65] gathered their requirements for eIDs from SABSA but did not otherwise use SABSA.