Reference architectures
This model does not redraw architecture. For the target-state design of a secure AWS environment, it defers to the AWS Security Reference Architecture (AWS SRA) — the authoritative, prescriptive guidance from AWS for deploying security services across a multi-account environment.
AWS Security Reference Architecture (AWS SRA)
The AWS SRA is a holistic set of guidelines for deploying the full complement of AWS security services in a multi-account environment. It shows how the security services work together, which account each one belongs in, and how they align with AWS recommended practices — a reference you can use to design, implement, and manage security across your organization.
How this model uses the SRA
The controls in this maturity model are meant to be implemented within an environment structured along AWS SRA lines. Where the SRA defines the target-state placement of a service (for example, centralizing findings in a Security Tooling account or aggregating logs in a Log Archive account), this model tells you the tactical control to apply and how to validate it. The two are complementary: the SRA is the blueprint, this model is the phased adoption path.