Security Architecture,
Open Source

A security architecture framework gives architects a repeatable way to design security into systems, with the controls each part needs. OSA is a free, open one: 53 patterns with diagrams, built from NIST SP 800-53 controls and mapped to 95 frameworks such as ISO 27001, NIS2, DORA and PCI DSS. Trusted by security architects in 190+ countries since 2008.

Security Patterns Capability Model New Control Catalogue Assess Your Maturity
New Map your own controls to any of 95 frameworks, from NIS2 to SOC 2 →
53
Security Patterns
317
NIST Controls
95
Framework Mappings
17+
Years Active

Featured Patterns

SP-030 New 47 controls

API Security

Now includes ArchiMate diagrams contributed by the Cyber Security Coalition.
SP-029 51 controls

Zero Trust Architecture
SP-034 37 controls

Cyber Resilience
SP-047 35 controls

Secure Agentic AI Frameworks
SP-011 54 controls

Cloud Computing Pattern
SP-048 21 controls

Offensive AI and Deepfake Defence
View all 54 patterns →

How Mature Is Your Security Architecture?

Assess your organisation against OSA patterns. Get a maturity score, radar chart visualisation, gap analysis, and see how you compare to industry benchmarks — all free, all encrypted client-side with AES-256-GCM. We cannot read your scores.

Start an Assessment My Assessments

Free Policy Templates

NIST-mapped, concise, and modern — covering AI, cloud, BYOD, and remote work. Download in Markdown format, free for registered users.

Information Security Policy

20 sections from governance to compliance

Acceptable Use Policy

10 sections for staff and third parties

Open Source, Open Standards

All OSA content is released under CC BY-SA 4.0. Use it in your security architecture practice, contribute improvements, or build tools on top of our structured data.

View on GitHub