Cybersecurity Business Data Model: AI-Ready Edition

The Cybersecurity Business Data Model: AI-Ready Edition is for CIOs, architects and transformation leads who need to know what information cybersecurity work runs on before an AI agent touches it. It covers 16 subject areas, 116 entities, 871 key attributes and 400 relationships. Every entity and key attribute is classified for sensitivity, with the AI uses and data-quality requirements an agent depends on. It is the data-model part of Business Architecture for Cybersecurity: AI Transformation Blueprint, sold on its own.

What's Inside

The same model comes in three files: the full model in Word, a workbook to filter and extend, and a guide to the scales and the license.

• 16 subject areas and 116 entities, each with a definition, its typical system of record, sensitivity class, AI uses and data-quality requirements
• 871 key attributes with sensitivity and AI relevance, and 400 relationships with cardinality
• Under each entity, the capabilities that need it and the agents that read it, by name and ID
• The Business Data Model (Word): every subject area and entity in full
• The workbook (Excel): subject areas, entities, attributes and relationships in sheets you can filter and extend
• The guide (Word): the scales the model refers to, the data foundation, and the license
• Free corrections, and new versions free for 180 days

Every file names your organization and carries your license ID.

The 16 Subject Areas

The 116 entities are grouped into 16 subject areas. The list gives what each holds and how many entities it has.

• Security Strategy, Program & Performance (7 entities): The direction and funding of the security program: the security strategy, the initiatives that deliver it, the investment cases and budget that pay for it, the security technology portfolio, and the measures and results that show whether it works.
• Policies, Standards & Awareness (7 entities): The rules the organization sets for security and how people learn them: policies, standards, configuration baselines, policy acknowledgments, the awareness program, education assignments and simulated phishing exercises.
• Security Risk & Exceptions (6 entities): The security risk the organization carries and what it decides about it: the information assets at stake, the threat scenarios against them, assessed risks, treatment actions, risk acceptances and security exceptions.
• Controls & Assurance (7 entities): Whether security controls exist and work, and how that is shown: the control library, the applicable requirements the compliance function identifies, the mappings between them, control tests, evidence, assurance findings and customers' security inquiries.
• Third-Party Security (6 entities): The security of the suppliers, service providers and partners the organization relies on: who they are, what they do for it, how deeply they were assessed, the conditions set, the security approval and the issues found.
• Security Architecture & Technology Environment (7 entities): The security design of the technology estate and how far what is deployed matches it: reference architectures, architecture reviews, network zones and filtering rules, endpoint devices, cloud environments and configuration deviations.
• Identities & Authentication (6 entities): Who and what can sign in: workforce and external identities, the accounts they hold, joiner, mover and leaver events, authentication methods and sign-in risk events.
• Access & Entitlements (8 entities): What each identity may do and why: access roles and entitlements, access requests and grants, separation of duties rules and conflicts, and access certification campaigns and decisions.
• Privileged & Nonhuman Access (7 entities): Access that can change systems or reach large amounts of data, and identities that are not people: privileged accounts, elevation requests, privileged sessions, emergency access, service accounts and workload identities, application secrets and AI agent permission scopes.
• Data Protection & Cryptography (7 entities): Where sensitive data lives and how it is protected: data stores and the sensitive data found in them, data loss rules and alerts, cryptographic keys, digital certificates and secure disposal.
• Application & Software Security (8 entities): Security in the software the organization builds and buys: applications, releases, threat models, security checkpoint results in delivery, application security findings, software components reports from outside about weaknesses in the organization's products, and the product security advisories published to customers.
• Threats, Exposure & Vulnerabilities (8 entities): What threatens the organization and where it is exposed: intelligence requirements and reports, threat indicators, external exposures, brand and domain impersonation, attack paths, vulnerabilities and the fix commitments made with System Owners.
• Readiness, Testing & Exercises (7 entities): How the organization shows it can withstand and recover from attack: security test engagements and their written authorization, test findings, the incident response plan, incident exercises, the cyber recovery plan and recovery tests.
• Monitoring, Detection & Insider Risk (9 entities): What security watches and what it finds: log sources, security events, detection rules, threat hunts, alerts and their dispositions, and the insider risk program's indicators, matters and referrals.
• Incidents, Recovery & Disclosure (9 entities): What happens when an attack succeeds or nearly does: incidents, response playbooks, containment actions, evidence, impact assessments, restoration validation, notification assessments made with the legal function, disclosures and post-incident reviews.
• AI & Digital Labor Governance (7 entities): The records that keep AI in cybersecurity accountable: AI systems, agents, their action logs, AI decision records, validation records, human reviews and agent authority limits.

Who Uses It

Data owners and stewards, data architects, and AI and analytics engineers who need to know what an agent may read, how sensitive it is and how good it must be first; and business architects who link capabilities to data.

How It Fits With the Other Products

The capabilities named under each entity are defined in the Cybersecurity Capability Model: AI-Ready Edition. The agents are specified in Business Architecture for Cybersecurity: AI Transformation Blueprint, which contains this data model and adds the value streams, use cases, controls, an operating model and a roadmap. The Cybersecurity Value Streams are sold on their own too.