Week 17: Review the Architecture Before You Defend It

The final project begins by rebuilding the system model from evidence. Students will not start with recommendations. They will start by proving what the fictional organization actually depends on, which trust boundaries exist, which controls are present, where observability is weak, and which risks remain open.

This week

1. Reconstruct the System From Evidence — turn inventories, routes, roles, services, data flows, logs, and change records into one defensible architecture.
2. Control Coverage Has Gaps and Failure Modes — map preventive, detective, and recovery controls to threat paths and identify shared dependencies or blind spots.
3. An Architecture Review Produces Decisions — build a prioritized gap register and prepare the evidence package for the final defense.

Evidence artifact

Create a Defensive Architecture Review with system diagram, required functions, asset/dependency inventory, trust boundaries, control map, monitoring map, five gap/risk statements, priorities, and verification plans.