Methodology

What We Produce

Each reference architecture output includes:

• Deployment context summary: A plain-language description of the scenario based on intake responses
• Reference architecture diagram: A generic control layer diagram showing architectural responsibilities without vendor-specific components
• Required control layers: Identity, data, runtime, network, and governance requirements for the deployment
• Tradeoffs and alternatives: Key decisions that may require balancing competing priorities
• Explicit assumptions: What we assumed about your environment that you should validate
• What this does NOT decide: Items explicitly out of scope for the reference architecture

What We Do Not Do

• We do not recommend specific vendors
• We do not rank or compare products
• We do not provide security assessments
• We do not certify compliance readiness
• We do not guarantee outcomes
• We do not replace qualified professionals

How Outputs Are Generated

Reference architectures are generated based on your intake responses using a structured framework that maps deployment characteristics to control requirements.

The framework considers: organization size, industry, cloud infrastructure, geographic region, data sensitivity, and timeline. These factors influence which control layers receive emphasis and which tradeoffs are highlighted.

Limitations

• Outputs are based solely on intake responses and do not reflect detailed knowledge of your environment
• Control layer requirements are generalized and may not capture organization-specific needs
• Tradeoffs presented may not be exhaustive for your particular circumstances
• This tool is designed for pre-decision guidance and should not be used as the sole basis for implementation

Corrections

If you identify errors in a reference architecture output, please report them via our errata page. We review all submissions and update outputs when corrections are warranted.