همايش ملی پيشرفت های معماری سازمانی

صفحه اصلی / نهمین همایش پیشرفت‌های معماری سازمانی ایران

Redesigning the Security Unit Structure in Parent-Subsidiary Organizations Based on Security Capabilities

نویسندگان :

Saeed Shokrollahi¹

1- Shahid Beheshti University

کلمات کلیدی :

Enterprise Architecture،Operating Model،Security Unit Redesign،Parent-Subsidiary Structure،Security Capabilities

چکیده :

In parent-subsidiary organizations, which consist of a headquarters and multiple subsidiaries, cybersecurity challenges have become increasingly prominent due to their multidimensional nature. These challenges arise from the traditional structure of security units, which often fails to align with the demands of complex, distributed environments, and can be grouped into people, process, and technology domains. Enterprise architecture, as a key framework for integrating strategies, processes, and technologies, offers a vital opportunity to redesign the security unit within its business layer. This redesign enhances system reliability, regulatory compliance, risk management, and business continuity. This article analyzes security capabilities and their related processes to propose a restructured security unit in the enterprise architecture's business layer. By embedding security as a core element of business strategy, it ensures alignment with organizational goals. The redesign serves as both an operational necessity and a strategic imperative, boosting resilience, cost efficiency, and inter-unit coordination. We introduce a systematic method grounded in six key security capabilities: security strategy, security management, external compliance, risk management, internal control and audit, and response and recovery. Through an analysis of inter-capability relationships, we identify how capabilities are mapped to the sections of the security unit. Furthermore, a multi-modal operating model is proposed to balance centralization and decentralization between headquarters and subsidiaries. This model centralizes governance capabilities for unified oversight while decentralizing operational ones for local agility, achieving a dynamic equilibrium between control and flexibility. Implementing this approach not only elevates organizational security effectiveness but also fosters deeper adherence to enterprise architecture principles, promoting long-term sustainability in cybersecurity.