Embedded Files
2 Day(s)
🎯 LEARNING OBJECTIVES
By the end of this topic, learners will be able to:
Understand the role of Application Architecture within Enterprise Architecture and its relationship to Business, Data, and Technology Architecture.
Define the current and target application landscape and perform application gap analysis.
Map applications to business capabilities and identify missing applications, features, and responsibilities.
Develop an application technology roadmap covering technologies, standards, methodologies, and architectural approaches.
Develop an application roadmap considering phasing, resources, time-to-market, ROI, and AI capabilities.
Evaluate application engineering decisions, including Web, Mobile, Kiosk, Buy-vs-Make, and application integration.
Design secure and scalable application architectures, including integration with enterprise and external services.
Apply application security practices such as SAST, DAST, WAF, and penetration testing.
Define application testing, deployment, integration, maintenance, and optimization strategies.
Understand how AI can enhance the application lifecycle, from requirements and architecture through development, testing, deployment, and maintenance.
Define application architecture measurements using appropriate OKRs and KPIs
🧠 PREREQUISITES
Basic understanding of business processes and organizational operations.
Basic knowledge of IT systems, infrastructure, applications, and data.
Basic understanding of risk management and cybersecurity incidents.
Familiarity with concepts such as availability, backup, disaster recovery, and incident response.
Basic understanding of RTO and RPO is helpful but not mandatory.
Application Architecture Practices
Phase 01: Architecture Landscape
Phase 01: Architecture Landscape
The application architecture landscape is a structured view of the enterprise's application portfolio: its components, services, interfaces, and lifecycle status, mapped to business capabilities. Within the TOGAF Architecture Repository, it records the baseline, transition, and target states of applications. It supports gap analysis, portfolio rationalization, and investment decisions. Technology infrastructure appears only as a hosting dependency.
At enterprise level, there will be:
Application architecture mapped to capabilities, in the technology landscape model
As-Is Model Vs To Be Model
Gap Analysis:
Find Missing applications
Find missing features/capabilities
Responsibility Matrix
Enterprise continuum: Classification for the solution from the following perspective, to have the proper architecture:
Foundation architecture: Foundation solutions and infrastructure, like networking
Common system architecture: Common systems and solutions, like CRM solutions, that serve all infrastructure.
Industry Architecture: Includes industry standards, regulations, and best practices, like:
SWIFT in banking solutions
HL7 standard for data exchange in EHS(Electronic health record)
Organization Specific architecture: Specific systems for the industry, like:
e-Commerce Solutions
Education platforms
ERP solutions
Approaches & Methodologies & Standards
Phase 03: Application Roadmap (Product Management)
Phase 03: Application Roadmap (Product Management)
We should have the following practices:
Mapping model: between Architecture building blocks and capabilities, and required application building blocks
Phased Implementation: Break down the development and deployment into phases, starting with the most critical components.
Timeline and Resources: Define a realistic timeline for the development, testing, and deployment of the application, and allocate necessary resources.
Consideration of time-to-market
Consideration for the importance and ROI
AI Capabilities: How can we move to an AI-Driven solution and provide related AI capabilities?
For more details, visit product management lecture
Phase 04: Application Engineering
Phase 04: Application Engineering
Determine business requirements
Identification of Application(s)
which can be:
As per type: Web/Mobile/Kiosk
As per source: Buy or make strategy, according to the organization strategy, for example:
Do we have a development department that can develop these solutions
How can that comply with the cost
How can that comply with the time-to-market strategy?
Identification of Integration between applications
Phase 05: Architecture and Design
Phase 05: Architecture and Design
Detailed Architecture and Design
Identification of Integration service providers
As your solution at the scale most probably will integrate with external parties, they should be identified, in as they will be part of your EA model.
It can be:
Payment gateways
SMS gateway
Mail service gateway
Governmental entities
Another solution, provided to the enterprise by another service provider
Phase 06: Application Security
Phase 06: Application Security
What is?
Application security is the discipline of embedding security requirements, controls, and patterns into the design of every application layer, so that data and business functions are protected from the start. In TOGAF it is a cross-cutting concern. It begins in Phase C (Application Architecture) and is governed through architecture principles, standards, and ADRs. It is not a separate activity added after development.
Security by layer
At the presentation layer, security relies on input validation, content security policies, protection against XSS and CSRF, and bot protection (for example Cloudflare WAF). At the API and integration layer, it relies on OAuth 2.0 and OIDC for authentication and authorization, rate limiting, schema validation, and mutual TLS through an API gateway such as Kong or Azure API Management. The business logic layer enforces role-based access control and secure session and error handling, typically integrated with Entra ID or Okta. The data layer protects information with encryption at rest and in transit, tokenization, masking, and key management (for example HashiCorp Vault). The hosting layer adds hardened images, segmentation, and patching. The delivery pipeline adds SAST, DAST, dependency scanning, secrets scanning, and SBOMs.
Risks and principles
The design addresses recognized risks, mainly the OWASP Top 10. The 2025 edition was announced in November 2025 and finalized in January 2026. In it, Broken Access Control remains the top risk and now includes SSRF. The edition also introduces Software Supply Chain Failures and Mishandling of Exceptional Conditions as new categories. For AI-enabled applications that use Agentic AI and MCP, the OWASP Top 10 for LLM Applications adds risks such as prompt injection and excessive agency. The architecture follows the principles of least privilege, defense in depth, Zero Trust (NIST SP 800-207), and secure by design. Threat modeling and a secure SDLC apply these principles early, and compliance requirements such as PCI DSS for payments are mapped to the relevant components. Parasoft Logo Search +2
Link to cybersecurity
Application security feeds the enterprise cybersecurity program, which can be framed with the six functions of NIST CSF 2.0. Under Govern, the application architecture contributes security principles, standards, and risk ownership. Under Identify, it provides the application inventory, data classification, and threat models. Under Protect, it supplies identity and access management, encryption, WAF, and secure coding. Under Detect, it supplies application logging, SIEM use cases, and vulnerability scanning. Under Respond and Recover, it contributes incident playbooks, credential revocation, backup, disaster recovery, and defined RTO and RPO per application.
Tools
SAST: Static analysis security testing, Tools like SonarQube, SonarCloud, Fortify, Checkmarx
DAST: Dynamic analysis security testing, Example Tools: OWASP ZAP, Burp Suite, AppSpider.
WAF: Web application firewall
Pentation testing:
For more details, go to the cybersecurity track
Phase 07: Application Development
Phase 07: Application Development
Role in EA
Application development is the stage where the target application architecture becomes working software. Architecture sets the principles, standards, and patterns (recorded as ADRs), and development delivers within them. In TOGAF this covers Phase C (design) and the implementation governance that follows in Phase G.
Build, buy, or reuse
Before development starts, the architecture decides how each capability will be delivered. Options are to reuse an existing application, buy a product (SaaS or COTS), configure a platform, or build custom software. Building is reserved for what differentiates the business, which keeps cost and risk down.
Delivery approach
Most teams use Agile (Scrum or Kanban) for iterative delivery. At enterprise scale, Scaled-Agile (SAFe) aligns many teams to the same roadmap, with work prioritized using WSJF, RICE, or MoSCoW. Product roadmaps feed the backlog, and the technology roadmap tells teams which stack changes are due.
Architecture styles
The style depends on the need. A monolith suits small, simple systems, and a modular monolith is a safer step for growing ones. Microservices suit large systems with independent teams, and event-driven design suits real-time workflows. API-first and headless designs separate the front end from the back end so that web, mobile, and partner channels share the same services.
Technology stack
Each layer has its own technology choices. Examples are Next.js or React for presentation, REST or GraphQL for APIs, .NET or Node.js for business logic, and PostgreSQL with Redis for data. Hosting runs on VMs, containers, or cloud platforms, and the stack should follow the approved standards.
Development lifecycle
The lifecycle runs through requirements, design, coding, testing, release, and operations, repeated in short cycles. Each step has a clear output: user stories, design decisions, code in version control, test results, and a deployable release. Clear definitions of done keep quality consistent between teams.
Testing and quality
Quality is built in through unit, integration, API, and end-to-end tests, plus performance and accessibility checks. Automated tests run on every change, so defects are found early. Code reviews and static analysis (for example SonarQube) support maintainability.
CI/CD and DevOps
Continuous integration builds and tests each change, and continuous delivery releases it through controlled environments. Infrastructure as code (Terraform, Ansible) and containers (Docker, Kubernetes) make environments repeatable. Teams track delivery with DORA metrics: deployment frequency, lead time, change failure rate, and recovery time.
Secure development
Security is part of the pipeline (DevSecOps). This includes threat modeling, SAST, DAST, dependency scanning, secrets scanning, and SBOMs. Developers design against the OWASP Top 10:2025, which now includes software supply chain failures, and the OWASP Top 10 for LLM Applications when AI is involved.
Integration and data
Applications rarely stand alone. Development defines APIs, events, and data contracts through an API gateway or messaging platform, with versioning and documentation. Data ownership, quality, and privacy rules are set early so that integrations stay stable.
AI-assisted and agentic development
AI coding assistants now support code generation, review, testing, and documentation. Agentic AI and MCP let applications connect to tools and data through standard interfaces. These features need clear guardrails: human review, least-privilege access for agents, and protection against prompt injection.
Governance and measurement
Architecture review boards check that projects follow principles, standards, and ADRs, and approve exceptions. Roadmaps and the landscape are updated as applications change. Typical measures are delivery speed, quality, security findings, cost, and business value.
Phase 08: Application Testing
Phase 08: Application Testing
Testing and Validation
Functional Testing: Verify that the application functions as intended and meets all business requirements.
Performance Testing: Ensure the application performs under expected workloads and handles peak traffic effectively.
Security Testing: Conduct vulnerability assessments and penetration testing to identify and resolve security weaknesses.
Phase 09: Deployment and Integration
Phase 09: Deployment and Integration
Deploy in Stages: Roll out the application in phases (e.g., pilot, full-scale deployment) to mitigate risk.
Integration with Enterprise Systems: Connect the new application with other systems in the enterprise environment (e.g., CRM, ERP, etc.).
Monitor Performance: Implement monitoring tools to track application performance and detect issues post-deployment.
Phase 10: Maintenance and Optimization
Phase 10: Maintenance and Optimization
Ongoing Support: Provide regular updates and patches to ensure the application remains secure and operational.
Continuous Improvement: Gather user feedback and make iterative improvements to enhance application functionality over time.
Phase 11: AI Capabilities in application architecture
Phase 11: AI Capabilities in application architecture
To deliver smarter software solutions, organizations should focus on modernizing SDLC processes and embedding AI into solutions. AI enhances decision-making by forecasting trends, analyzing data models, and providing actionable insights throughout the lifecycle.
1️. Process Modernization
CI/CD Pipelines: Automate build, test, and deployment (Jenkins, GitHub Actions).
Code Quality & Governance: Enforce standards with static analysis tools (SonarQube, ESLint).
Automation of Repetitive Tasks: Reduce manual effort in code integration, testing, and reporting
2️. AI-Driven Solutions
Forecasting & Trend Analysis: AI predicts future patterns in data models to guide strategy.
Decision Support: AI provides insights and recommendations for business or technical decisions.
Requirements Analysis: AI identifies gaps, anomalies, and suggests optimal user stories.
Design Optimization: AI-assisted architecture modeling, anti-pattern detection, and schema optimization.
Development Assistance: AI coding assistants (Copilot, Claude AI) suggest code, refactoring, and unit tests.
Testing & QA: AI generates test cases, predicts defects, and detects anomalies automatically.
Deployment & Maintenance: Predictive analytics optimize resource allocation, monitor trends, and trigger proactive fixes.
Tools
Tools
Enterprise Architect
Archimate
Dr. Ghoniem Lawaty
Tech Evangelist
Page updated
Google Sites
Report abuse