The IA Process - Information Assurance Architecture - page 57

governance, strategic objectives); defining the environment for the IA application
(e.g., physical infrastructure, safety and comfort of people); and defining the scope
(e.g., business processes and the systems and applications that support them).
Appendix B presents a template that offers a single table for capturing risks by
the IA 2 view. The same template applies to each phase of the IA 2 Process.
Once again, review the IA 2 Framework in chapter 2. Having documented risks,
consider if there are compliance requirements imposing qualifications on business
or technical operations. Moreover, the current ELCM phase affects what questions
to ask, how to ask them, and who to ask them of. The same process of walking
through the IA 2 F applies to each phase of the IA 2 Process. The questions may
change slightly according to the intent of the IA 2 P phase.

3.3.1.2 Commentary

Wow! This seems like a lot! Well, yes it is. IA architecture can be quite involved. The
traditional approach to IA lacks the discipline of the IA 2 approach. he shortcom-
ings of the bolt-on approach will become evident as you use the IA 2 Framework and
the IA 2 Process. So, while it seems like a lot, you now have a discipline to follow to
know what IA aspects you have covered and what you have not. The phases of the
IA 2 Process and the IA 2 views in the IA 2 Framework provide inherent checklists
that provide a consistent, repeatable, and dare we say comprehensive manner to
address IA.

3.3.2 Define the Environment

3.3.2.1 Define Where the Solution Resides

he IA 2 P environment phase identifies the business or technical environment, and
then identifies the risks associated with that environment. The IA 2 P environment
includes geography, organization, business, and technical. Geography includes loca-
tion and physical infrastructure. Location addresses demography (country, region,
province, state, county, city, municipality) as well as political, legal, social, religious,
and environmental (e.g., earthquake, hurricane, flooding) aspects of the location
that affect the project and introduce risks. Physical infrastructure addresses cam-
pus, building, floor, room, workstation, and device. IA 2 addresses risks of the phys-
ical infrastructure with appropriate safeguards, including lighting, video, guards,
access controls, etc.
he organizational environment is the type of organization (small business, large
business, commercial, government, private, public, or nonprofit) as well as organi-
zational structure and culture. The structure of the organization may be a single
business in a single location, a single business with hundreds of locations nation- or
worldwide, or a holding company with many separate businesses.