A technical security architecture should be created which of the following?

• A. Annually
• B. Before a firm creates individual countermeasures
• C. Before a firm creates a specific countermeasure
• D. After each major compromise

Answer: (B)

Establishing a technical security architecture upfront provides a blueprint that guides every control you implement, tying together principles, standards, and reference models so all security measures work cohesively. When the architecture is in place before adding any countermeasures, you ensure alignment with business goals, regulatory requirements, and risk tolerance, and you can evaluate how each control affects others, reducing gaps and duplication. This proactive approach supports scalability and consistent governance, rather than attempting to patch things after problems occur.

Waiting until after a breach to create the architecture is reactive and leaves systemic weaknesses exposed. Relying on an annual cycle to do architecture work abstracts it from real risk and changing needs, so timing isn’t the right driver. Focusing on a single countermeasure before the overall architecture risks locking you into a solution that may not fit with other controls or the overall design. Building the architecture first ensures every countermeasure is chosen and designed to fit within a coherent, secure framework.