Security architecture templates

Using the records

Adapt these records to your own method. Blank and worked versions use the same headings. The worked versions continue the fictional training-provider example.

• Blank risk and control record — Markdown

• Worked risk and control record — Markdown

• Blank access decision record — Markdown

• Worked access decision record — Markdown

• Blank security operation record — Markdown

• Worked security operation record — Markdown

Checks and diagrams

• Blank checks — CSV
• Worked checks — CSV
• Access to the case — Mermaid
• Security decision cycles — Mermaid
• Diagram relationships — JSON

The checks distinguish expected and actual results. Mermaid is a text format for diagrams; the JSON file records their relationships as structured data. Both can be edited to adapt the diagrams.

Edition and reuse

Version 1.0 · September 2026 · © 2005–2026 Adrian Sutherland.

Refreshed for the September 2026 website update. Keep the edition note with the files and identify adaptations by their source asset, version and filename. The completed examples are fictional; proposed checks need actual results before they can support a service decision.

Read the edition note for authorship and version history.

The Portal-authored downloads use CC BY 4.0: reuse and adapt them with credit, a licence link and changes identified. The edition note records the scope and any separate notices.