Applying TOGAF for security architecture design

**Executive summary:** This article explains how TOGAF can be used effectively for security architecture by embedding security into each ADM phase, translating business drivers into measurable security requirements, using threat modelling (e.g., STRIDE) to inform design, defining reusable security building blocks (identity, access, segmentation, logging, cryptography), and establishing governance and handover practices—with pragmatic, minimum-viable artefacts and patterns tailored for SMEs.