Please read this scenario prior to answering the question Your role is that of a senior architect, reporting to the Chief Enterprise Architect, at a medium-sized company with 400 employees. The nature of the business is such that the data and the information stored on the company systems is their major asset and is highly confidential. The company employees travel extensively for work and must communicate over public infrastructure using message encryption, VPNs, and other standard safeguards. The company has invested in cybersecurity awareness training for all its staff. However, it is recognized that even with good education as well as system security, there is a dependency on third-parly suppliers of infrastructure and software. The company uses the TOGAF standard as the method and guiding framework for its Enterprise Architecture (EA) practice. The CTO is the sponsor of the activity. The Chief Security Officer (CSO) has noted an increase in ransomware (malicious software used in ransom demands) attacks on companies with a similar profile. The CSO recognizes that no matter how much is spent on education, and support, it is likely just a matter of time before the company suffers a significant attack that could completely lock them out of their information assets. A risk assessment has been done and the company has sought cyber insurance that includes ransomware coverage. The quotation for this insurance is hugely expensive. The CTO has recently read a survey that stated that one in four organizations paying ransoms were still unable to recover their data, while nearly as many were able to recover the data without paying a ransom. The CTO has concluded that taking out cyber insurance in case they need to pay a ransom is not an option. Refer to the scenario You have been asked to describe the steps you would take to improve the resilience of the current architecture? Based on the TOGAF standard which of the following is the best answer?

This option describes the most appropriate, structured, and comprehensive approach according to the TOGAF standard for addressing a significant new business requirement. The process correctly starts by defining the business context ("determine business continuity requirements"), which is a key activity in Phase A: Architecture Vision. It then proceeds with a gap analysis, a core technique in the ADM (Phases B, C, D) to understand the required changes. The approach follows proper governance by involving the Architecture Board for approval. Crucially, it concludes by creating a formal "Request for Architecture Work," which is the official trigger to initiate an ADM cycle to develop the new target architecture. This ensures the response is business-driven and managed within the established EA framework.

B: This approach is too tactical and reactive, focusing on operational exercises and technology monitoring rather than initiating a strategic, business-driven architecture development process.

C: This option prematurely restricts the solution to the Technology Architecture domain, ignoring the critical business, data, and application layers that are essential for comprehensive resilience.

D: This misapplies the Architecture Compliance Review process. Compliance reviews assess adherence to existing standards, whereas this scenario requires the development of a new target architecture.

1. The TOGAF® Standard

Version 9.2

Chapter 6

Phase A: Architecture Vision: Section 6.2

"Objectives

" states the need to "validate the business principles

business goals

and business drivers." Determining business continuity requirements directly aligns with this objective. The primary output is an approved Statement of Architecture Work

initiated by a Request for Architecture Work.

2. The TOGAF® Standard

Version 9.2

Part III

Chapter 17

Gap Analysis: This chapter details the gap analysis technique

which is fundamental to the ADM. Section 17.1 notes it is a key step in validating an architecture and is used extensively in Phases B

C

and D to compare Baseline with Target Architectures.

3. The TOGAF® Standard

Version 9.2

Chapter 44

Architecture Governance: Section 44.3.4

"Architecture Board

" describes the board's role in providing governance

including the approval of architecture changes. The step to "manage a meeting of the Architecture Board to assess and approve the change request" is a core governance function.

4. The TOGAF® Standard

Version 9.2

Chapter 5

Architecture Development Method (ADM) Overview: Figure 5-1 shows that the ADM is initiated by a "Request for Architecture Work" from a sponsoring organization

which is the final and correct step described in option A to formally begin the architecture development project.