SABSA framework for risk-driven security architecture: a practical guide for UK SMEs

This article explains the SABSA framework and how small and medium-sized UK businesses can use it to translate business risk into proportionate security architecture and controls. It covers the SABSA layers (contextual to component), building a risk model for critical services, recommended controls (identity, logging, segmentation, resilience), practical steps for small teams, common implementation mistakes, and governance practices to keep architecture up to date.