SABSA Institute

What SABSA Institute does

The SABSA Institute C.I.C. is a UK-registered Community Interest Company that governs, develops, and certifies the SABSA (Sherwood Applied Business Security Architecture) methodology, a business-driven, risk- and opportunity-focused framework for enterprise security architecture originally published in 1995 by John Sherwood, Andrew Clark, and David Lynas. The Institute was formally incorporated on 11 March 2013 under UK company law as a not-for-profit with an Asset Lock that legally prevents the IP from being sold, ensures perpetual vendor-neutrality, and mandates reinvestment of all profits into SABSA intellectual property. Its core offerings are a three-tier competency-based certification programme (SABSA Chartered Foundation SCF, Practitioner SCP, and Master SCM) built on Bloom's Taxonomy, a publications library (White Papers W100-W105, Tools & Techniques T100, Guides G152, SABSA at Work case studies, and the foundational Blue Book), and a community-driven membership programme at £50 per year. Training and certification delivery are gated exclusively through a small network of rigorously assessed Accredited Education Partners — primarily ALC Training (part of Thales, 60,000+ graduates) and David Lynas Consulting — with all courses required to be presented by SABSA Masters. The Institute serves enterprise security architects, enterprise architects, government/defence agencies, and regulated industries (banking, nuclear, healthcare, critical infrastructure) across approximately 70 countries, with a community of 5,000+ Foundation-certified and 392+ Practitioner/Master-certified professionals, 700+ members, and 20+ SABSA World local chapters across 11+ countries. The asset-locked non-profit structure, founder-led leadership under CEO David Lynas, and deep partnerships with The Open Group (TOGAF, ArchiMate), ISACA, AISA, and COSAC together define a unique governance and distribution model that prioritizes methodology stewardship over financial scaling.

Name

SABSA Institute

Legal name

The SABSA Institute C.I.C.

Website

https://sabsa.org

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

The SABSA Institute is a UK not-for-profit Community Interest Company that governs the SABSA enterprise security architecture methodology, delivering competency-based certification (Foundation, Practitioner, Master), training through licensed Accredited Education Partners, and a global community of 5,000+ certified security architects across ~70 countries.

Ownership category

akta.pro rank

Product category

Enterprise Security Architecture Certification

akta.pro primary industry

Finance, Accounting & Risk (CFA/CPA/FRM) Certifications (EDAAANAD)

Keywords

• Enterprise security architecture
• Cybersecurity certification training
• Security framework methodology
• Professional security credentials
• Risk management architecture

Headquarters

HQ city

Hove

HQ country

United Kingdom

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Marketing or Sales, Technology or R&D, Others

Revenue model

1. Training and Certification Fees: Revenue is generated through official SABSA training courses delivered by Accredited Education Partners. Certification exams are administered as part of the training. Course fees apply per attendee per course. Training covers Foundation level (SCF) and multiple Advanced modules (A1-A5).
2. Membership Fees: General Membership is priced at £50/year, providing access to the SABSA Forum, early-release white papers, working group materials, and the members area. Chartered Membership is available to SCF-certified individuals with all General Membership benefits plus participation in Working Groups. Founding Membership was a time-limited tier that closed in July 2018.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels8 records

Core offering

The SABSA Institute owns, governs and develops the SABSA (Sherwood Applied Business Security Architecture) methodology and delivers a three-tier competency-based professional certification programme (SABSA Chartered Foundation, Practitioner and Master) for enterprise security architects. It operates a global network of licensed Accredited Education Partners (AEPs) that deliver official training, sells annual memberships to the SABSA community, publishes a Body of Knowledge (white papers, tools & techniques papers, guides, case studies) under The SABSA Press, and issues digital credentials via Credly. All IP is held under an open-use licence governed by the UK Community Interest Company structure.

Product overview

SABSA Institute operates as a professional certification and membership body, not a software product company. Its core offering is the SABSA methodology (Sherwood Applied Security Architecture) for enterprise security architecture, delivered through a multi-tiered certification framework (SCF, SCP, SCM). The portfolio includes official training courses delivered by Accredited Education Partners, professional certifications, digital credentials via Credly, and a publications program encompassing White Papers (W100-W105), Tools & Techniques papers (T100), Guides (G152), SABSA at Work case studies, and webinars. The methodology integrates with other frameworks including TOGAF, ITIL, Zachman, DoDAF, and ArchiMate for modeling purposes.

Differentiator

Problem solved

Functional benefit

Products and services

• SABSA Chartered Foundation Certificate (SCF) Entry-level competency-based SABSA certification that creates broad-spectrum knowledge and understanding of the SABSA method, its frameworks, concepts, models and techniques. Candidates must pass two test modules (F1 & F2) covering major principles, design concepts, and management processes of Enterprise Security Architecture. Each module is 48 multiple-choice questions with a 75% pass mark and 60-minute duration. Required as the prerequisite for SABSA Chartered Practitioner certification.
• SABSA Chartered Practitioner Certificate (SCP) Advanced certification requiring demonstration of competence to apply SABSA for analysing business problems, customising solutions, designing work-products, and demonstrating skills under examination pressure. Delivered through Advanced modules A1 (Risk, Assurance & Governance), A2 (Architecture Programme Management), A3 (Architecture Design Development), A4 (Incident, Monitoring & Investigations Architecture), and A5 (Business Continuity and Crisis Management). SCF certification is required as a prerequisite. Examinations are 5-question papers with 75% pass mark, dual-marked by two SABSA Masters.
• SABSA Chartered Master Certificate (SCM) Highest-level certification demonstrating advanced competencies and leadership in a chosen area of specialism. Requires SCP certification, attendance at a second Advanced training course, and submission of a SABSA Master Thesis for assessment. Represents the apex of the competency-based SABSA certification framework built on Bloom's Taxonomy.
• SABSA Training Courses Official SABSA training delivered exclusively through a globally licensed network of Accredited Education Partners (AEPs) that are rigorously assessed for delivery quality and experience. All training courses must be presented by SABSA Masters. Includes Foundation courses and the Advanced module suite (A1-A5) covering Risk/Assurance/Governance, Architecture Programme Management, Architecture Design Development, Incident/Monitoring/Investigations, and Business Continuity/Crisis Management. Course fees are set by individual AEPs and certification exams are administered as part of training.
• SABSA Institute Membership Annual subscription membership of The SABSA Institute at £50 per year, available in General Membership and Chartered Membership tiers. Benefits include access to the SABSA Institute Community Forum, early access to white papers before general release, working group charters/reports/published IP, access to the members area, and (for Chartered Members with SCF certification) the ability to request participation in SABSA Institute Working Groups.
• SABSA White Papers (W-series) Series of official White Papers focused on developing, enhancing, extending, and evolving the SABSA methodology, published by The SABSA Press. Includes W100 (Executive Summary), W101 (Architecting a Secure Digital World), W102 (Risk Management Part One), W103 (Responsibility Assignment Modelling), W105 (Enterprise Security Architecture Principles), and W117 (SABSA-TOGAF Integration). Members receive early access before general release.
• T100 - Modelling SABSA with ArchiMate SABSA Tools & Techniques Paper published by The SABSA Press that describes how security architecture concepts can be expressed using ArchiMate 3.0, The Open Group's widely-adopted Enterprise Architecture modelling language. Reflects the conclusions of a joint Working Group between The SABSA Institute and The Open Group developing security elements, relationships and properties for the ArchiMate language. Current version is Release 2.5.
• G152 - Integrating Risk and Security within a TOGAF Enterprise Architecture An official Open Group Guide addressing how to integrate considerations of security and risk into an Enterprise Architecture using SABSA, jointly developed by The SABSA Institute and The Open Group. Companion to White Paper W117.

Quantifiable outcome

• Used in approximately 50-70 countries across diverse sectors including Banking, Government, Nuclear Power, Healthcare, and Manufacturing.
• +3 more outcomes

Named customers4 records

Segments5 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature7 records

Partnerships

Ten partnerships are on record, tiered core, supporting and minor.

• The Open GroupcoreStrategic or Co-development Partner · 17 April 2018The SABSA Institute collaborates with The Open Group on multiple development projects, including the SABSA-TOGAF Integration (white paper W117 and guide G152) and joint development of a Security Services Catalogue (report R100). A joint Working Group was established to develop a security overlay — security elements, relationships and properties — for the ArchiMate modelling language. This collaboration was recognized with The Open Group Partnership Award 2018. The relationship is governed by formal legally binding agreements between the two organizations.
• ALC Training (Part of Thales)coreChannel Partner/ Reseller/ DistributorALC Training is an Accredited Education Partner (AEP) of The SABSA Institute, delivering official SABSA training and education programmes. It is rigorously assessed by the Institute for delivery quality and experience. ALC has over 30 years of experience and 60,000+ graduates. It was the first to launch SABSA courses in the world (Sydney, March 2007; Singapore, May 2007) alongside Matt Whelan. Part of Thales Cyber Services, providing additional credibility and scale.
• David Lynas ConsultingcoreChannel Partner/ Reseller/ DistributorDavid Lynas Consulting is the primary Accredited Education Partner, led by David Lynas (co-author of SABSA, CEO of The SABSA Institute). It offers the most direct access to the source of SABSA IP. David Lynas personally presents courses wherever possible and selects highly experienced SABSA professionals to complement the schedule. The firm operates globally with virtual and in-person courses across multiple time zones.
• CredlysupportingTechnology or IntegrationCredly is The SABSA Institute's partner for issuing and managing digital credentials (badges). Credly translates learning outcomes demonstrated through SABSA certification into Open Badge standard-compliant digital badges that can be shared on LinkedIn, social media, and email signatures. The platform provides real-time verification, labour market insights, and privacy controls. The technology is based on Open Badge Standards maintained by IMS Global.
• PA ConsultingminorGTM or Marketing PartnerPA Consulting sponsors SABSA World UK events, providing venue hosting (near Victoria Station, London) for events such as the Security Architect's Roundtable on 19th May 2026. PA Consulting hosts and supports SABSA community events as a venue and logistics provider.
• InfobloxminorGTM or Marketing PartnerInfoblox sponsors SABSA World UK events, including the Security Architect's Roundtable on 19th May 2026. Contact person Simon Cross ([email protected]) manages SABSA World UK coordination. Provides event sponsorship and community support.
• COSAC Security ConferencecoreStrategic or Co-development PartnerCOSAC is the annual Ireland-based security conference where The SABSA Institute was formed. It hosts the SABSA World Congress annually with a full SABSA stream across multiple days. COSAC APAC hosts the Asia-Pacific edition in Australia. The Institute is a major supporter and sponsor of these events. David Lynas is Founder and Chairman of both COSAC and SABSA World Congress.
• ISACA Melbourne Chapter / ISACA Ireland ChaptersupportingStrategic or Co-development PartnerSABSA Institute events and training are co-organized with ISACA chapters. David Lynas ran SABSA Masterclasses for ISACA Ireland Chapter in Belfast and Dublin in September 2018. SABSA World Melbourne events are organized in association with ISACA Melbourne Chapter's Security Architecture Working Group.
• MacEwan UniversitysupportingStrategic or Co-development PartnerMacEwan University (Edmonton, Alberta, Canada) serves as a host venue for SABSA Foundation training delivered by David Lynas Consulting. Thomas Wong Matthews, Senior Director, Cyber Security & CISO of MacEwan University, conceptualized and drove the SABSA revival in Edmonton. The university hosted 15 students from government, universities, and consulting firms at its downtown campus.
• Australian Information Security Association (AISA) — SecARCH SIGsupportingStrategic or Co-development PartnerSABSA World Brisbane (July 2023) was hosted as a joint event with the AISA Security Architecture Special Interest Group (SecARCH SIG). This partnership provides access to a broader community of information security professionals in the APAC region.

Scale indicators5 records

Recent moves8 records

Expansion highlights5 records

Direct peers

• (ISC)²: (ISC)² is a globally recognized non-profit information security certification body (CISSP, CCSP, CSSLP). It is the most direct peer to SABSA Institute: a vendor-neutral professional membership organization that certifies individual security professionals via competency-based exams and supports a global practitioner community.
• ISACA: ISACA issues widely adopted security and governance certifications (CISA, CISM, CRISC, CGEIT) and operates a global chapter network. It is structurally similar to SABSA Institute as a non-profit, member-driven certification body whose credentials are mandated by employers in financial services and government.
• The Open Group: The Open Group maintains the TOGAF enterprise architecture standard and operates the Open Group Certified Architect (OGCA) program. It is a formal SABSA partner on TOGAF integration and ArchiMate overlays, and competes for the same enterprise architecture and security architecture practitioner audience.
• GIAC (SANS Institute): GIAC, the certification arm of the SANS Institute, offers technical cybersecurity certifications (GSEC, GCIA, GISF) with a competency-based structure. Like SABSA, it is a non-profit certification body whose credentials are widely requested by employers in security and risk roles.
• Cloud Security Alliance (CSA): CSA issues the CCSK and CCSP cloud security credentials and maintains security guidance frameworks (e.g., Cloud Controls Matrix). It is comparable to SABSA as a non-profit certification and standards body targeting enterprise security architects and risk professionals.
• AXELOS (PeopleCert): PeopleCert (which acquired AXELOS) administers ITIL, PRINCE2, and related service management/IT governance certifications. It competes with SABSA for the same enterprise architecture and IT governance practitioner audience and is referenced as an integration target in SABSA training materials.
• EC-Council: EC-Council issues the CEH, CHFI, and ECSA credentials and operates a global training partner network. It is comparable to SABSA's AEP-based training delivery model and targets similar security professional demographics worldwide.

Emerging players

• OffSec: OffSec issues the OSCP and other hands-on offensive security credentials. It is comparable to SABSA as a competency-based certification body whose value proposition centers on demonstrated skill rather than knowledge recall, but it focuses on offensive/technical security rather than enterprise security architecture.

Others

• NIST (National Institute of Standards and Technology): NIST publishes the Cybersecurity Framework (CSF) and related standards (800-53, 800-30) that SABSA integrates with via the SENC working group. It is not a certifying body but is a framework authority that competes for the same architecture and compliance design space and is explicitly referenced in SABSA training materials.
• ISO/IEC 27001 Certification Bodies (e.g., BSI, TÜV SÜD): ISO/IEC 27001-accredited certification bodies issue ISMS certifications that SABSA is designed to support. They are adjacent to SABSA as credentialing organizations, but they certify organizations rather than individual architects, and SABSA is positioned as a complementary implementation methodology.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/SABSA_Institute
• LinkedInlinkedin.com/company/the-sabsa-institute

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about SABSA Institute