Purpose

Architecture Controls define the enduring architectural outcomes that must exist regardless of technology, implementation approach, or regulatory change.

Architecture Controls serve as the bridge between business needs, regulatory requirements, and technical implementation. Multiple regulations, policies, standards, patterns, and products may map to the same Architecture Control. This allows the University to maintain a stable architecture framework even as technologies, regulations, and implementation approaches evolve.

Architecture Controls are not regulations, policies, standards, products, or implementation requirements. They define the architectural outcomes that solutions must achieve.

Architecture Controls

1. Data Classification and Regulatory Scope

Data must be identified, classified, inventoried, owned, and associated with applicable regulatory, contractual, research, and business requirements.

2. Identity and Authentication

Users, services, devices, applications, and automated systems must be uniquely identifiable and authenticated.

3. Authorization and Access Management

Access to systems, services, and data must be granted, reviewed, modified, and revoked according to approved business purpose and least privilege.

4. Data Protection

Data must be protected against unauthorized disclosure, modification, destruction, and loss throughout its lifecycle.

5. Boundary Protection and Isolation

Security, operational, and regulatory boundaries must be established and maintained to appropriately separate systems, services, workloads, and data.

6. Asset and Configuration Management

Technology assets, software, services, models, dependencies, and configurations must be identified, managed, maintained, and governed throughout their lifecycle.

7. Interoperability and Information Exchange

Information must be exchanged through defined, governed, secure, supportable, and interoperable interfaces.

8. Monitoring, Logging, and Auditability

Material activities affecting systems, services, data, and automated processes must be observable, attributable, auditable, and reviewable.

9. Resilience and Recovery

Systems, services, and data must be recoverable in accordance with defined continuity, recovery, and availability requirements.

10. Data Lifecycle and Records Management

Data and records must be retained, archived, recovered, disclosed, and disposed of according to approved requirements.

11. Governance and Oversight

Ownership, stewardship, responsibilities, decision authority, and oversight must be defined, assigned, and maintained throughout the lifecycle.

12. Risk and Compliance Management

Risks, compliance obligations, exceptions, compensating controls, and control effectiveness must be identified, assessed, managed, documented, and reviewed.

Desired Outcome

The Architecture Controls provide a stable architectural foundation that enables consistent decision making, regulatory traceability, technology governance, and reusable implementation approaches across the University.