# Open Security Architecture (OSA)

> Open Security Architecture (OSA) is a free, open-source collection of security architecture patterns, NIST 800-53 control mappings, and compliance framework coverage. It helps security architects, GRC professionals, and engineers design secure systems using proven, peer-reviewed patterns mapped to international standards.

## Patterns

OSA patterns are reusable security architecture designs. Each pattern includes a visual architecture diagram, mapped NIST 800-53 Rev 5 controls, threat analysis, implementation guidance, and cross-references to related patterns.

- [Pattern Catalogue](https://www.opensecurityarchitecture.org/patterns/): Browse all 56 security patterns
- [SP-029 Zero Trust Architecture](https://www.opensecurityarchitecture.org/patterns/sp-029): Zero trust network design with micro-segmentation
- [SP-047 Secure Agentic AI Frameworks](https://www.opensecurityarchitecture.org/patterns/sp-047): Security architecture for autonomous AI agents and MCP
- [SP-027 Secure LLM Usage](https://www.opensecurityarchitecture.org/patterns/sp-027): Secure integration of large language models
- [SP-045 AI Governance and Responsible AI](https://www.opensecurityarchitecture.org/patterns/sp-045): AI governance frameworks and responsible AI practices
- [SP-032 Modern Authentication](https://www.opensecurityarchitecture.org/patterns/sp-032): OAuth 2.0, OIDC, passwordless, and adaptive authentication
- [SP-030 API Security](https://www.opensecurityarchitecture.org/patterns/sp-030): API gateway, rate limiting, schema validation, OAuth scopes
- [SP-028 Secure DevOps Pipeline](https://www.opensecurityarchitecture.org/patterns/sp-028): CI/CD security, SAST/DAST, supply chain integrity
- [SP-034 Cyber Resilience](https://www.opensecurityarchitecture.org/patterns/sp-034): Business continuity, disaster recovery, resilience testing
- [SP-008 Public Web Server](https://www.opensecurityarchitecture.org/patterns/sp-008): DMZ architecture, WAF, TLS, hardening
- [SP-011 Cloud Computing](https://www.opensecurityarchitecture.org/patterns/sp-011): Cloud security architecture across IaaS/PaaS/SaaS
- [SP-023 Industrial Control Systems](https://www.opensecurityarchitecture.org/patterns/sp-023): OT/ICS security, Purdue model, air-gapped networks
- [SP-042 Third Party Risk Management](https://www.opensecurityarchitecture.org/patterns/sp-042): Vendor assessment, supply chain risk, continuous monitoring
- [SP-051 Tokenised Asset Security](https://www.opensecurityarchitecture.org/patterns/sp-051): Blockchain tokenisation, smart contract security, custody
- [SP-052 Decentralised Identity & Verifiable Credentials](https://www.opensecurityarchitecture.org/patterns/sp-052): DID, VC, self-sovereign identity
- [SP-053 Zero-Knowledge Proof Architecture](https://www.opensecurityarchitecture.org/patterns/sp-053): ZK-SNARKs, ZK-STARKs, privacy-preserving computation
- [SP-054 CBDC and Digital Currency](https://www.opensecurityarchitecture.org/patterns/sp-054): Central bank digital currency infrastructure security

## Controls

315 NIST 800-53 Rev 5 controls with descriptions, supplemental guidance, and mappings to OSA patterns that implement each control.

- [Control Catalogue](https://www.opensecurityarchitecture.org/controls/): Browse all NIST 800-53 Rev 5 controls

## Frameworks

Coverage mappings for 80+ compliance and regulatory frameworks, showing how each framework's requirements map to NIST 800-53 controls and OSA patterns.

- [Framework Mappings](https://www.opensecurityarchitecture.org/frameworks/): Browse all framework coverage
- Includes: ISO 27001:2022, PCI DSS v4, SOC 2, GDPR, DORA, NIS2, CIS Controls v8, NIST CSF 2.0, CSA CCM v4, MiCA, Basel, IAEA NSS, and many more

## Foundations

- [Design Principles](https://www.opensecurityarchitecture.org/foundations/design-principles/): Core architectural principles behind OSA
- [OSA Landscape](https://www.opensecurityarchitecture.org/foundations/osa-landscape/): How patterns fit together
- [How to Use OSA](https://www.opensecurityarchitecture.org/foundations/how-to-use/): Getting started guide
- [Glossary](https://www.opensecurityarchitecture.org/definitions/glossary/): Security architecture terminology

## About

- [Website](https://www.opensecurityarchitecture.org)
- [GitHub](https://github.com/opensecurityarchitecture)
- [License](https://www.opensecurityarchitecture.org/about/license-terms/): Creative Commons Attribution-ShareAlike 4.0
- [Core Team](https://www.opensecurityarchitecture.org/about/core-team/)