Every new project designs its security controls from scratch, which causes delays, duplicated effort and uneven protection for systems that have similar risks. What should the information security manager develop to address this?
Select an answer to reveal the explanation.
Short Explanation
Builders don't redraw the plumbing for every house on the street; they use proven plans and adjust. A reference architecture gives you the same head start for security. The trap is throwing people or audits at the problem when what you're missing is a reusable design.
Full Explanation
A reference security architecture provides pre-approved patterns for common situations, such as an internet-facing web application, an internal data platform or a third-party integration, describing the required controls, how they fit together and how they meet policy. Projects start from a proven pattern and only analyze what is genuinely different, which shortens delivery, removes duplicated design work and gives similar systems similar protection. Adding staff so each project has a dedicated designer increases cost and capacity but keeps the same from-scratch approach, so inconsistency between designers persists. Requiring external consultants for every project adds expense and still produces one-off designs that vary by consultant, with knowledge leaving the organization at the end of each engagement. A post-implementation audit finds gaps only after systems are built, when changes are slowest and most costly, and it does not help teams design correctly in the first place. Exam caveat: reference architectures must be maintained as threats and technologies change, and they should allow documented, risk-assessed deviations rather than forcing a pattern that does not fit. Operational check: track the proportion of new projects that adopt an approved pattern, the number of deviations requested and the change in security design effort and review cycle time over successive quarters.