Skip to content
FedXchange
Menu

Enterprise Architecture Policy

Use this free template to write your agency's Enterprise Architecture Policy. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the Program Management (PM) family. This copy follows the Low baseline. It names 5 controls and leaves 4 values for your agency to fill in. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 15 federal sources.

Approved by: Chief Information Officer (CIO); Chief Information Security Officer (CISO), concurring

From the document: This policy states how the Organization describes its missions, data, applications, technology, and security as one architecture. It also states how the Organization uses that architecture to decide what IT to buy, build, change, and retire.

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

  • PL-08
  • PM-07
  • SA-08
  • SA-17
  • SA-22

Every Program Management (PM) template

The text of the Enterprise Architecture Policy

Approval #

The Chief Information Officer (CIO) approves this document. The Chief Information Security Officer (CISO) concurs on the security and privacy requirements it contains.

Role Name Signature
Chief Information Officer (CIO)
Chief Information Security Officer (CISO), concurring

Revision History #

Date Version Description Reviewer
2026-10-31 1.0 Initial issuance [Reviewer name]

Review cycle: Every year under the Policy and Procedure Management Policy, and within 90 days after the Office of Management and Budget (OMB) changes the enterprise architecture rules in Circular A-130.

Mandate. An enterprise architecture (EA) describes how an agency’s missions, data, applications, technology, and security fit together. The Clinger-Cohen Act makes the Chief Information Officer (CIO) responsible for a sound, secure, and integrated information technology (IT) architecture (40 U.S.C. § 11315(b)(2)). OMB Circular A-130 requires each agency to develop an EA with a baseline architecture, a target architecture, and a transition plan (OMB Circular A-130, §5(a)(2)). Appendix I of the Circular requires agencies to build federal security and privacy requirements into the EA (OMB Circular A-130, Appendix I, §4(b)(5)). The CIO issues this policy to set those rules for the Organization. The policy also carries out National Institute of Standards and Technology (NIST) SP 800-53 control PM-07, Enterprise Architecture. Controls PL-08 and SA-17 carry the same rules to each system’s architecture.

1. Purpose and Scope #

This policy states how the Organization describes its missions, data, applications, technology, and security as one architecture. It also states how the Organization uses that architecture to decide what IT to buy, build, change, and retire. The CIO owns the policy, and the Chief Information Security Officer (CISO) concurs. The Enterprise Architecture Procedure gives the steps.

The policy covers every system and IT service the Organization owns, operates, or uses. That includes:

  • Systems the Organization runs, and contractor systems that process the Organization’s information.
  • Cloud services of every kind, including software as a service (SaaS).
  • Each system the Organization designates a High Value Asset (HVA).
  • Shared services that another agency provides to the Organization.

The EA has five layers. The Chief Architect keeps three views of each layer: the current state, the target state, and the transition plan that moves the Organization from one to the other.

Layer What it describes Lead
Business Mission and support functions, the offices that perform them, and the performance measure for each Program offices, with the Chief Architect
Data Information types, authoritative data sources, data standards, and data flows, including flows of personally identifiable information (PII) Chief Data Officer (CDO)
Application Applications and services, what each one does, and how they connect Chief Architect
Technology Hosting, networks, end-user devices, cloud platforms, and the technical reference model of approved products and standards Chief Architect
Security and privacy Trust zones, shared security services, identity, logging, encryption, and the zero trust target, with the privacy architecture CISO, with the Senior Agency Official for Privacy (SAOP)

2. Authorities and Guidance #

The Organization must follow each binding source. It uses each guidance source as a method, and it records where it departs from one.

Source Binding or guidance What it requires or offers How the Organization applies it
Clinger-Cohen Act (40 U.S.C. § 11315(b)(2)) Binding The CIO develops, maintains, and helps carry out a sound, secure, and integrated IT architecture. Applies directly. The CIO owns the EA.
OMB Circular A-130, §5(a)(2) Binding An EA with a baseline architecture, a target architecture, and a transition plan, aligned to the Information Resources Management (IRM) Strategic Plan. Applies directly.
OMB Circular A-130, Appendix I, §4(b)(5) Binding Federal security and privacy requirements built into the EA. Applies directly through the security and privacy layer.
NIST SP 800-53 controls PM-07, PL-08, and SA-08 Binding through Federal Information Processing Standards (FIPS) 200 An EA that weighs security and privacy risk, a security and privacy architecture for each system, and engineering principles. PM-07 applies to the whole Organization. PL-08 and SA-08 apply to every system.
NIST SP 800-53 control SA-17 Binding at the High baseline A developer’s security and privacy architecture and design. Applies to each High-impact system and each HVA, and to other development the CISO names.
OMB M-19-03 Binding For each HVA, systems security engineering principles reflected in the EA and in procurements. Applies to each HVA.
OMB M-22-09 Binding The federal zero trust strategy and its goals for identity, devices, networks, applications, and data. The target architecture carries these goals.
OMB M-19-23 Binding A Chief Data Officer, and a Data Governance Body that the CDO chairs with senior staff from business units, data functions, and financial management. The CDO leads the data layer and chairs the Data Governance Body.
OMB M-25-05 Binding A comprehensive data inventory of all data assets, updated within 90 days of a new data asset and at least once a year, and an open data plan. The data layer records each data asset, and the CDO keeps the inventory.
NIST SP 800-207 Guidance Zero trust tenets and deployment models. The CISO uses it to design the target security architecture.
Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model, Version 2.0 Guidance Five pillars and three cross-cutting capabilities, each with four maturity stages. The CISO uses it to measure progress toward the target.
NIST SP 800-160 Vol. 1 Rev. 1 Guidance, required for HVAs by OMB M-19-03 Systems security engineering principles and processes. The CISO applies it to each HVA and to each new system.
Federal Enterprise Architecture Framework Version 2 Guidance. OMB published it in 2013 and has not replaced it. Six sub-architecture domains and a reference model for each. The Chief Architect may use its reference models to classify the EA.
GAO-10-846G Guidance Seven stages of EA management maturity. The CIO uses it for the yearly self-assessment.
OMB Circular A-11, section 55 Binding for IT portfolio reporting IT investment portfolio data. It sets no EA reporting rule. The IT Governance and Investment Management Policy covers this reporting.

3. Governance #

The Architecture Review Board advises the CIO and decides the matters the CIO delegates to it.

Body Chair Members What it decides
Architecture Review Board The Chief Architect, who reports to the CIO Enterprise Security Architect, a delegate of the SAOP, a delegate of the CDO, the infrastructure lead, and the program office that asks for a review Approves, approves with conditions, or denies each architecture review. Recommends changes to the technical reference model. Grants waivers within the limits in this policy.
Investment Review Board As the IT Governance and Investment Management Policy sets As that policy sets Selects IT investments after the Architecture Review Board reviews them.
Change Control Board As the Configuration Management Policy sets As that policy sets Approves changes to systems. It sends each major change to the Architecture Review Board first.

The Architecture Review Board meets at least once each month while a request is open. The CIO decides any matter the board cannot settle, and any appeal of a board decision.

4. Roles and Responsibilities #

Role Responsibilities
CIO Owns this policy and the EA. Approves the yearly current architecture, target architecture, and transition plan. Approves changes to the technical reference model. Decides appeals and waivers above the board’s limits.
Chief Architect Leads the EA program for the CIO. Keeps the architecture repository and the technical reference model. Chairs the Architecture Review Board. Reports EA measures to the CIO.
CISO Defines the enterprise security architecture and the zero trust target. Concurs on this policy. Decides on any proposed departure from the security architecture.
Enterprise Security Architect Keeps the security and privacy layer of the EA for the CISO. Reviews each request for fit with the security architecture. Places each system in the EA during authorization.
SAOP Defines the privacy architecture. Reviews requests that create or change a flow of PII.
CDO Leads the data layer. Names authoritative data sources and data standards. Reviews requests that create or change data stores or data sharing.
System Owner Keeps the system’s security and privacy architecture consistent with the EA. Submits each new system and major change for architecture review. Carries approved architecture changes into the System Security and Privacy Plan (SSPP).
Program Office Describes its business functions and performance measures for the business layer. Submits IT requests for architecture review before investment selection.
Contracting Officer Puts the architecture and design deliverables into each development contract. Confirms the architecture review is complete before award.

5. Policy Rules #

5.1 Current Architecture, Target Architecture, and Transition Plan #

  1. The CIO must keep an EA that describes the current architecture, the target architecture, and a transition plan between them (OMB Circular A-130, §5(a)(2)).
  2. The EA must align with the Organization’s IRM Strategic Plan (OMB Circular A-130, §5(a)(2)).
  3. The transition plan must include the Organization’s plans to upgrade, replace, or retire systems that no longer support a mission well (OMB Circular A-130, §5(a)(2)).
  4. The EA must cover the business, data, application, technology, and security and privacy layers (40 U.S.C. § 11315(b)(2)).
  5. The Chief Architect must update the three views each year, and the CIO must approve them in the yearly update month (NIST SP 800-53 PM-07).
  6. The Chief Architect may classify the EA with the reference models of the Federal Enterprise Architecture Framework (Federal Enterprise Architecture Framework Version 2).

5.2 Security and Privacy Architecture #

  1. The CISO and the SAOP must build federal security and privacy requirements into the EA (OMB Circular A-130, Appendix I, §4(b)(5)).
  2. The CISO must define the enterprise security architecture, and the SAOP must define the privacy architecture (NIST SP 800-53 PM-07).
  3. The security architecture must layer preventive and detective protections, so that no single failure exposes the Organization’s information (NIST SP 800-53 PL-08).
  4. Each System Owner must keep a security and privacy architecture for the system that is consistent with the EA (NIST SP 800-53 PL-08).
  5. For each HVA, the System Owner must apply the systems security engineering principles of NIST SP 800-160 and show them in the EA (OMB M-19-03).
  6. System Owners must apply the Organization’s security and privacy engineering principles to each new system and each major change (NIST SP 800-53 SA-08).

5.3 Zero Trust Alignment #

  1. The target architecture must carry the zero trust goals for identity, devices, networks, applications, and data (OMB M-22-09).
  2. The Enterprise Security Architect must design the target security architecture with the zero trust tenets (NIST SP 800-207).
  3. The CISO must rate the Organization each year against each pillar of the CISA Zero Trust Maturity Model (Zero Trust Maturity Model).
  4. The transition plan must list the steps that move each pillar to its next maturity stage (OMB M-22-09).

5.4 Architecture Review #

  1. The Architecture Review Board must review each new IT investment before the Investment Review Board selects it (OMB Circular A-130, §5(a)(2)).
  2. The board must review each major change to a system before the Change Control Board approves it (NIST SP 800-53 PM-07).
  3. The board must review each new cloud service before the Organization buys it, including software as a service bought with a purchase card (OMB Circular A-130, §5(a)(2)).
  4. The board must judge each request on mission fit, reuse of what the Organization already has, data, technology standards, security, privacy, and zero trust (NIST SP 800-53 PM-07).
  5. The board must decide within the architecture review window after a request is complete (NIST SP 800-53 PM-07).
  6. A Contracting Officer must not award an IT contract until the board’s review is complete. The IT Governance and Investment Management Policy sets the CIO’s acquisition review that follows.

5.5 Technology Standards #

  1. The Chief Architect must keep a technical reference model that gives each product and standard one status: proposed, approved, contained, sunset, retired, or prohibited (40 U.S.C. § 11315(b)(2)).
  2. Offices must buy and deploy only approved products, or contained products under a waiver (NIST SP 800-53 PM-07).
  3. The Chief Architect must set a retirement date for each sunset product and announce it at least one sunset notice period ahead (OMB Circular A-130, §5(a)(2)).
  4. System Owners must replace a product before its vendor ends support (NIST SP 800-53 SA-22).
  5. A product barred by law, by a federal exclusion order, or by a CISA directive is prohibited. The Supply Chain Risk Management Policy names those products.

5.6 Developer Architecture and Design #

  1. For each High-impact system and each HVA, the System Owner must require each developer to deliver a security and privacy architecture and a design specification (NIST SP 800-53 SA-17).
  2. The System Owner must apply the same requirement to other development that the CISO names (NIST SP 800-53 SA-17).
  3. HVA procurements must require developers to use systems security and privacy engineering methods (OMB M-19-03).
  4. The CISO must approve any design that departs from the security architecture (NIST SP 800-53 SA-17).

5.7 Measures, Self-Assessment, and Records #

  1. The Chief Architect must report the EA measures to the CIO each quarter (NIST SP 800-53 PM-07).
  2. The CIO must assess the EA program each year against the GAO maturity stages and record actions for each gap (GAO-10-846G).
  3. The Chief Architect must keep the EA and every review decision for the periods in the records schedule (NARA General Records Schedule 3.1).

5.8 Waivers #

  1. Only the CIO, or the Architecture Review Board within the longest waiver term, may waive a standard in this policy (NIST SP 800-53 PM-07).
  2. A waiver must name the standard, the reason, the risk, the end date, and the plan to conform (NIST SP 800-53 PM-07).
  3. A waiver that affects security or privacy also needs the CISO’s or the SAOP’s concurrence, and the System Owner must record the risk in the SSPP (NIST SP 800-53 PL-08).
  4. No one may waive a rule that a statute, OMB, or a CISA directive sets (OMB Circular A-130, §5(a)(2)).

6. Values the Organization Sets #

Value Setting What it controls
Architecture review window [Assignment: organization-defined architecture review window in business days — to be defined] The Architecture Review Board decides on a complete review request within this many business days.
Longest waiver term [Assignment: organization-defined longest architecture waiver term in months — to be defined] A waiver from an architecture standard ends after this many months unless the CIO renews it.
Sunset notice period [Assignment: organization-defined sunset notice period in months — to be defined] The Chief Architect announces a retirement date at least this many months before it.
Yearly update month [Assignment: organization-defined month of the yearly architecture update — to be defined] The CIO approves the updated current architecture, target architecture, and transition plan in this month each year.

7. Derived Governance Requirements #

  • Have the CIO develop, maintain, and help carry out a sound, secure, and integrated IT architecture for the agency. (40 U.S.C. § 11315(b)(2))
  • Develop an enterprise architecture that describes the baseline architecture, the target architecture, and a transition plan to reach the target, aligned to the IRM Strategic Plan. (OMB Circular A-130, §5(a)(2))
  • Include in the enterprise architecture plans to upgrade, replace, or retire information systems that can no longer support missions or business functions. (OMB Circular A-130, §5(a)(2))
  • Build federal information security and privacy requirements into the enterprise architecture so that risk is addressed and systems reach the needed trustworthiness, protection, and resilience. (OMB Circular A-130, Appendix I, §4(b)(5))
  • Make the security and privacy requirements for each HVA reflect the systems security engineering principles built into the enterprise architecture and procurements. (OMB M-19-03)

9. References #

These are the sources this document cites, with a link to each official text.

Sources on the governance tracker

The FedXchange governance tracker follows each source this document cites and records each change to it.

More related templates

Change history

  1. : First published in the library. Template version 783d0494946e.