Security Architecture Review: What It Is and When a Small Business Needs One

TL;DR: A security architecture review checks how your systems are put together: where data flows, who and what can log in, which network paths exist, what vendors can reach, whether backups restore and whether logs exist. A small business needs one before a big integration, after an incident, before adding AI tools, or when findings keep returning.

A security architecture review is the part of security work that looks at the drawing instead of the bugs. Most small businesses never ask for a security architecture review by name. They ask why the same scan findings keep coming back, or whether a new vendor connection is safe.

Those are all architecture questions. Here is what a security architecture review covers, when it is worth paying for, and what you should get at the end.

What is a security architecture review?

NIST, the federal standards agency, defines a security architecture as a set of views of a system that "conveys information about how the system is partitioned into security domains" and how security elements enforce policy "within and between security domains based on how data and information must be protected." (NIST SP 800-160 Vol. 1 Rev. 1, November 2022)

For a 15-person office: which systems sit together, which are walled off, how they talk, and who holds the keys.

The same NIST publication makes the point that matters most for a business owner: "Security is an emergent property of a system." You do not get it from one product. You get it from how the parts are arranged. Amelia, my wife and Kief Studio's co-founder and CEO, wrote about why security architecture comes first (opens in a new tab) when you build something new. A security architecture review is how you check the arrangement you already have.

Our knowledge base entry on security architecture review has the short version.

What does a security architecture review look at?

A security architecture review covers six areas, read as one system, because a weakness in one makes the others worse. Each lines up with an outcome in the NIST Cybersecurity Framework 2.0. (NIST CSF 2.0, February 2024)

• Data flows. Where does customer, patient and payment data start, where does it go, and where is it stored? CSF 2.0 asks that "internal and external network data flows are maintained" as a written representation (ID.AM-03). Most small businesses have never drawn this.
• Identities. Every person, service account, shared login and API key that can reach something. CSF 2.0 asks that access follows "the principles of least privilege and separation of duties" (PR.AA-05). In practice: who still has admin, and why?
• Network paths. Can a laptop on guest Wi-Fi reach the server with the accounting data? Can one stolen password reach everything? CSF 2.0 calls for networks protected "from unauthorized logical access and usage" (PR.IR-01). This is where zero trust architecture starts.
• Third-party connections. Your IT provider's remote tool, payroll, the scheduling app that reads your calendar. CSF 2.0 asks that supplier risks be "understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship" (GV.SC-07).
• Backups. Do backups restore, and can the stolen password that encrypts your files also delete them? CSF 2.0: "Backups of data are created, protected, maintained, and tested" (PR.DS-11).
• Logging. If something went wrong last Tuesday, could you tell what happened? CSF 2.0 asks that "Log records are generated and made available for continuous monitoring" (PR.PS-04).

Two of those deserve numbers. Verizon's 2026 Data Breach Investigations Report found that breaches with third-party involvement "increased by 60% from last year's dataset, reaching 48% of total breaches." (Verizon DBIR 2026, executive summary) Nearly half of breaches now involve someone other than the business that got hit.

On logging, the Massachusetts data is blunt. When the state's MassCyberCenter analyzed 2024 breach reports, who was behind the breach was "unknown or other" in 1,793 cases, and the report concluded that "the largest exposure continues to arise from gaps in detection, monitoring and attribution capabilities." (MassCyberCenter and OCABR, May 2026) If you want the hands-on side, I keep a guide to log analysis and management (opens in a new tab) on HxHippy.

How is it different from a penetration test or a vulnerability scan?

NIST defines vulnerability scanning as "a technique used to identify hosts/host attributes and associated vulnerabilities," and penetration testing as testing in which evaluators "mimic real-world attacks in an attempt to identify ways to circumvent" security features. (NIST glossary, vulnerability scanning; NIST glossary, penetration testing) A scan lists what might be wrong with the software you run. A penetration test proves what an attacker can do today. A security architecture review looks at the design that decides what an attacker will be able to do next time, and it is the one that tells you a server should not be reachable from the internet at all, rather than that it is missing a patch. The review shapes the design, the pen test checks it, and vulnerability management keeps it clean between tests.

When does a small business need a security architecture review?

Four moments, cheapest fix first.

Before a big integration or migration

This is the best time for a security architecture review, because changing a drawing costs less than changing a running system: a new practice management system, a cloud move, a vendor that wants deep access to your email.

CSF 2.0 puts it in one line: "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships" (GV.SC-06). Massachusetts says something similar. The state data security regulation, 201 CMR 17.00, requires "Reviewing the scope of the security measures at least annually or whenever there is a material change in business practices." (201 CMR 17.03) A big integration is a material change.

A dental office in Shrewsbury adding an online patient portal might ask three questions before signing: what patient data leaves the building, what the portal vendor can reach inside the network, and who gets the alert if the connection misbehaves.

After an incident

After a breach, most businesses fix the thing that broke. Fewer ask why the design let it spread.

The Massachusetts numbers show the pattern. Of the 2024 breach reports where companies named what they changed afterward, MassCyberCenter counted 314 mentions of passwords, 189 of multifactor authentication, and 14 of assessments. (MassCyberCenter and OCABR, May 2026) Better passwords and MFA are cheap and right. Fourteen assessments is a small number next to them, and a new password does not change a design that let one login reach everything.

NIST's incident response guidance, updated in April 2025, says lessons learned "should often be shared as soon as they are identified, not delayed until after recovery concludes." (NIST SP 800-61 Rev. 3) A security architecture review is how those lessons reach the design. If you are in the middle of one now, start with what happens in the first 24 hours after a breach.

Before adding AI tools

AI tools are new connections with new reach, and use has grown fast. Verizon's 2026 report found that "45% of employees are now considered regular users of AI (authorized or not) on their corporate devices, up from 15% in the previous year," and that 67% of users reach AI services through non-corporate accounts on corporate devices. (Verizon DBIR 2026, executive summary)

Put those side by side. Your staff may already be pasting company data into accounts you do not control, and nobody drew that line on the diagram. I went through the AI companies' own terms on that in whether staff can put customer data into AI tools (opens in a new tab).

For AI that takes actions, OWASP, the open security nonprofit, names the risk "excessive agency" and traces it to "excessive functionality," "excessive permissions" and "excessive autonomy." Its fix: "require a human to approve high-impact actions before they are taken." (OWASP LLM06:2025) A security architecture review before rollout answers what the tool can read, what it can change, where the data goes, and who approves what. We cover the agent side in agentic security.

When the same findings keep coming back

This is the one most teams recognize. The scan report in March looks like the scan report in December. Patches fix instances. If the design creates the weakness, the same finding returns with the next change.

Closing findings is hard for everyone. Verizon found only 26% of vulnerabilities on CISA's Known Exploited Vulnerabilities list were fully fixed in 2025, and the median time to fix rose to 43 days. (Verizon DBIR 2026, executive summary) A security architecture review asks why the design keeps producing the same class of finding.

What happens during a security architecture review?

The core method is threat modeling. The Threat Modeling Manifesto, written by a group of practitioners and quoted in OWASP's own threat modeling guidance, boils it down to four questions: "What are we working on? What can go wrong? What are we going to do about it? Did we do a good enough job?" (Threat Modeling Manifesto)

A small business security architecture review usually runs in this order:

1. Collect the drawing. Network notes, the vendor list, who has admin, where backups go. If nothing exists, building it comes first.
2. Follow the data. Trace one customer record from the web form to storage to backup to the vendor who sees it. OWASP's guidance says a good model shows "trust boundaries, data flows, data stores, processes," which "often represent possible attack points." (OWASP Threat Modeling Cheat Sheet)
3. Ask what can go wrong at each boundary. A stolen password, a vendor breach, a deleted backup.
4. Rank by what an attacker gains. A weakness that reaches payroll outranks one that reaches the lobby TV.
5. Change the design, in order of risk. Then check that the change held.

Vendors get their own attention. CISA's Secure by Design guidance says "The burden of security should not fall solely on the customer," and calls out the "SSO tax": products that charge more for single sign-on or MFA. (CISA and partners, Secure by Design, October 2023) A security architecture review finds out which of your vendors log activity, support MFA and single sign-on, and charge extra for them.

What should the deliverable include?

Ask what a security architecture review will hand you before you hire anyone. A useful deliverable has:

• A current-state diagram. Data flows, trust boundaries and network paths on a page or two, kept "in a form the team can update," as OWASP puts it. If you only get a PDF of findings, you did not get the drawing.
• An inventory of identities and connections. Every admin, service account and third party, with what each one can reach.
• Findings tied to design choices. Not "47 issues," but "these 12 come from one flat network."
• A prioritized action plan. CSF 2.0 describes this as comparing a Current Profile with a Target Profile and building "a prioritized action plan (e.g., risk register, risk detail report, Plan of Action and Milestones [POA&M]) to address those gaps."
• A target-state drawing. What the design looks like when the plan is done.
• Accepted risks, written down. OWASP's guidance is to document each threat's response, including the risks you choose to live with.
• A revisit date. OWASP: "A threat model is something that should be maintained, updated and refined alongside the system."

The warning sign is a checklist review that changes nothing about the design. If the drawing stays wrong, the findings come back.

What does a security architecture review cost?

There is no reputable published price range for small business architecture reviews. The figures we found online came from firms selling the service, so we will not repeat them. What we can do is name what drives the cost:

• How many systems and locations are in scope.
• How many vendors connect, and how deep their access goes.
• Whether a current diagram and inventory exist, or have to be built from scratch.
• Whether regulated data is involved, such as health records, card payments or Massachusetts residents' personal information.
• Whether the engagement stops at recommendations or includes help making the changes. That one matters most.

What can you do this week before a review?

Two hours, no budget.

1. Draw it on one page. Boxes for systems that hold customer or employee data, arrows for how data moves.
2. List every outside login. IT provider, payroll, bank feed, scheduling app, AI tools, and what each can reach.
3. Count your admins. If the answer surprises you, that is your first finding.
4. Restore one file from backup. Time it. Then check whether a normal staff login could delete the backups.
5. Find where your logs go. Could you see last month's logins on one key system?

NIST's free CSF 2.0 Small Business Quick-Start Guide covers the same ground for businesses "who have modest or no cybersecurity plans in place." And MyRHC keeps a plain index of the NIST Cybersecurity Framework 2.0 (opens in a new tab) if you want to read the outcomes in full.

What should a Central Massachusetts business know?

Few small businesses have a security architect on staff, so the design grows by accident.

Breaches here are frequent and well documented. The state's Office of Consumer Affairs and Business Regulation received 2,292 breach reports in 2024, affecting 4,448,136 Massachusetts residents, a count where one person in two breaches is counted twice. In the 1,526 reports with enough detail, MassCyberCenter counted 249 where the vector was a third party. (MassCyberCenter and OCABR, May 2026) The 2025 reports tell the same story, and I broke them down in Massachusetts data breach statistics for 2025 (opens in a new tab).

A manufacturer in Webster giving a machine vendor remote access, or an accounting firm in Worcester moving client files to a new portal, is the kind of material change 201 CMR 17.00 asks you to look at again.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.