The Open Group · TOGAF-RS
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture Practice Tests
This credential validates an individual's understanding of essential security and risk concepts in relation to the TOGAF® Architecture Development Method (ADM), including Enterprise Risk Management (ERM), Information Security Management (ISM), and Enterprise Security Architecture (ESA). It demonstrates knowledge of how IT security and risk standards such as ISO/IEC 27000, ISO 31000, and COBIT relate to the TOGAF standard.
Exam Details
Practice Questions
600
≈ 10 practice exams
Duration
180 minutes
Passing Score
Pass/Fail
Difficulty
FoundationalLast Updated
Jun 2026
Topics Covered
Security and Risk Concepts in TOGAF ADMEnterprise Security Architecture (ESA)Enterprise Risk Management (ERM)Information Security Management (ISM)IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT)Security as a Cross-Cutting ConcernTOGAF Architecture Content Metamodel and ISM/ERM Relationships
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture Practice Exam Preparation
Use this TOGAF-RS practice exam to prepare for The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture with realistic questions, detailed explanations, and focused study modes. The practice bank includes 600 questions for The Open Group TOGAF-RS, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Security and Risk Concepts in TOGAF ADM, Enterprise Security Architecture (ESA), Enterprise Risk Management (ERM), Information Security Management (ISM), and IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT). Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The Open Group Certified: Integrating Risk and Security within a TOGAF® Enterprise Architecture is an awareness-level credential that validates foundational knowledge of how security and risk management integrate with the TOGAF® Architecture Development Method (ADM). It demonstrates that the holder understands the essential concepts of Enterprise Security Architecture (ESA), Enterprise Risk Management (ERM), and Information Security Management (ISM), and knows how these disciplines relate to each phase and artifact of the TOGAF ADM. The credential is part of the broader TOGAF Certification Portfolio built upon the TOGAF Standard, 10th Edition, and is designed to establish a common language between Security Architects and Enterprise Architects when developing risk-aware enterprise architectures.
The certification also covers how major IT security and risk standards — specifically the ISO/IEC 27000 family of standards, ISO 31000, and COBIT® — relate to and complement the TOGAF standard. Candidates learn why security and risk management must be treated as cross-cutting concerns that span the entire enterprise architecture lifecycle rather than being addressed in isolated phases. The credential is structured as a compact learning credential requiring approximately three hours of study, making it accessible as a standalone qualification or as a complement to broader TOGAF Enterprise Architecture certifications.
Who Should Take This Exam
This credential is designed for professionals who need a structured, foundational understanding of security and risk concepts in the context of enterprise architecture. Primary audiences include Enterprise Architects who want to incorporate security and risk practices into their TOGAF ADM work, Security Architects seeking to align their practice with enterprise architecture frameworks, and IT risk and compliance professionals who collaborate with architecture teams. It is equally relevant for individuals working with governance frameworks such as COBIT or standards like ISO/IEC 27001 and ISO 31000 who need to understand how these standards interact with the TOGAF methodology.
Because the credential is at the awareness level with no prerequisites, it is well-suited to those who are early in their enterprise architecture or security architecture careers, as well as experienced practitioners expanding their knowledge into adjacent disciplines. Program managers, IT auditors, and CISOs who need to communicate with architecture teams or evaluate security architecture outputs will also find the credential valuable.
Prerequisites
There are no formal prerequisites to sit for this credential. Candidates are not required to hold any prior TOGAF certification, though familiarity with the basic concepts of the TOGAF ADM — such as the architecture phases (Preliminary through Architecture Change Management) and core TOGAF terminology — will help candidates contextualize the security and risk content more effectively. No prior security certifications are required.
In practice, candidates will benefit from some exposure to enterprise IT environments and a general awareness of IT governance concepts. Those with experience in security operations, IT risk management, or enterprise architecture will find the material more immediately applicable. The Open Group offers a self-study option through its learning management system for candidates who wish to build prerequisite TOGAF knowledge before attempting this credential.
Exam Format
The assessment for this credential is delivered either through an Accredited Training Course (ATC) provider — in which case the assessment format is at the provider's discretion — or through The Open Group's own self-study online learning option, which includes a built-in assessment. The self-study path is available through The Open Group's online shop and learning management system. The credential requires a minimum of three hours of learning to be completed before the assessment is attempted. The Open Group awards a digital Open Badge via Credly and a certificate upon successful completion.
Where scenario-based questions are used, as is common across the TOGAF Certification Portfolio, each question presents a real-world scenario with four possible answers ranked from best to worst. Under this model, the best answer earns 5 points, the second-best 3 points, the third-best 1 point, and the worst answer 0 points. Specific details such as the total number of questions and a published numeric passing score are not publicly disclosed by The Open Group for this credential; candidates should confirm the precise assessment parameters with their chosen training provider or The Open Group's official exam portal. The overall credential is classified as a pass/fail award.
Skills Measured
- 1.Security and Risk Concepts in the TOGAF ADM: Understanding the essential principles of security and risk and how they map to each phase of the TOGAF Architecture Development Method, including how risk and security considerations are introduced, maintained, and governed throughout the architecture lifecycle.
- 2.Enterprise Security Architecture (ESA): Knowledge of what ESA is, how it is defined within the context of TOGAF, and how security architecture artifacts are developed, positioned, and maintained as part of an overall enterprise architecture practice.
- 3.Enterprise Risk Management (ERM): Understanding ERM concepts, including risk identification, assessment, and treatment approaches, and how ERM frameworks are applied within and aligned to the TOGAF ADM phases and architecture governance structures.
- 4.Information Security Management (ISM): Knowledge of ISM principles and how information security management functions relate to and integrate with TOGAF architecture development, including the roles of policies, controls, and management systems.
- 5.IT Security and Risk Standards (ISO/IEC 27000, ISO 31000, COBIT): Understanding how the ISO/IEC 27000 family of information security standards, the ISO 31000 risk management standard, and the COBIT governance framework relate to and complement the TOGAF standard.
- 6.Security as a Cross-Cutting Concern: Understanding why security and risk management must be treated as concerns that span all architecture domains (Business, Data, Application, Technology) and all ADM phases rather than being addressed only within the Technology Architecture.
- 7.TOGAF Architecture Content Metamodel and ISM/ERM Relationships: Knowledge of how the TOGAF Architecture Content Metamodel relates to Information Security Management and Enterprise Risk Management, including which metamodel entities and relationships are relevant to security and risk artifacts.
Study Tips
- Use The Open Group's official self-study online course as your primary resource — it was authored to align precisely with the credential's learning outcomes and includes built-in quiz questions that mirror the assessment style.
- Download and read the official publication 'Integrating Risk and Security within a TOGAF® Enterprise Architecture' (Open Group document G152), which is the authoritative reference text for all topics covered in this credential.
- Map each chapter of G152 to a specific ADM phase and practice explaining how security and risk concerns are addressed in that phase — this reinforces the cross-cutting nature of security and helps anchor abstract concepts to familiar TOGAF structures.
- Study the relationship table between the TOGAF Architecture Content Metamodel and ISM/ERM concepts specifically, as this is a distinct knowledge area that candidates without a strong TOGAF background often underestimate.
- Review the key definitions and scope of ISO/IEC 27001, ISO 31000, and COBIT side by side, then practice articulating how each standard's concepts (e.g., risk appetite, information security controls, governance objectives) are referenced or incorporated within the TOGAF ADM.
- If you do not already hold a TOGAF Foundation certification, spend time reviewing the TOGAF ADM phase objectives and key deliverables before beginning this credential's material, as the course assumes baseline familiarity with TOGAF terminology.
- Practice with scenario-based questions if available from your ATC provider, focusing on selecting the 'best' architectural response to a security or risk situation rather than a technically correct but architecturally misaligned answer — the partial-credit scoring model rewards nuanced judgment.
Career Benefits
Earning this credential signals to employers that an architect or security professional understands how to embed risk and security thinking into enterprise architecture work from the outset, rather than treating them as compliance afterthoughts. It is particularly valued in organizations that have adopted TOGAF as their architecture framework and are seeking to align security governance with frameworks like ISO/IEC 27001 or COBIT. Roles that benefit directly from this credential include Enterprise Architect, Security Architect, IT Risk Manager, IT Governance Analyst, and Information Security Manager. Because it is an awareness-level credential, it is often pursued alongside or as preparation for higher-level TOGAF certifications rather than as a standalone career milestone.
The credential carries one point in The Open Group's TOGAF Certification Portfolio, contributing to broader TOGAF professional recognition. While salary data specific to this credential is not published, professionals who combine TOGAF certification with security and risk specialization are well positioned for senior architecture and governance roles. Industry demand for architects who can speak fluently across security, risk, and enterprise architecture continues to grow, particularly in regulated sectors such as financial services, healthcare, and government, where risk-aware architecture is a compliance requirement.
Sample Questions
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 10 full-length practice exams.
Preview — answers shown1. During the kickoff of a major digital infrastructure program at Northwind Energy, the newly assigned security architect argues that security principles should be defined in Phase A (Architecture Vision) because that is when the high-level security vision and strategic direction for the program are established. The enterprise architect disagrees, stating that security principles belong in a different phase. According to G152, which phase is the correct location for establishing security principles? (Select one!)
AThe Preliminary Phase, before Phase A begins, because security principles provide foundational governance guidance that must be in place before architecture development work commences
BPhase E (Opportunities and Solutions), because security principles should reflect implementation options and control selections that emerge during solution evaluation
CPhase B (Business Architecture), because business requirements must be fully understood before security constraints and principles can be meaningfully defined
DPhase A (Architecture Vision), because security principles must be aligned with the Architecture Vision statement before any security activities can begin
Explanation
According to G152, security principles are established in the Preliminary Phase, not Phase A. The Preliminary Phase is where foundational governance elements are put in place before architecture development begins, including organizational context, architecture principles, and the conditions under which all subsequent architecture work will be conducted. Security principles are high-level statements composed of four components — Name, Statement, Rationale, and Implications — that guide all security decisions throughout every ADM phase from Phase A onward. Examples include principles such as Defense in Depth, Simplicity, Open Design, Complete Mediation, and Psychological Acceptability. Establishing security principles in the Preliminary Phase ensures they apply universally as enduring governance instruments rather than being reactive to a single initiative. Deferring security principles to Phase A would mean they are developed mid-stream for a specific program rather than serving as organization-wide guidance. Deferring them to Phase B or Phase E would allow early Phase A architectural decisions to be made without the benefit of guiding security principles.
2. A vendor management team at First Up Consultants is reviewing risk management credentials submitted by a potential supplier. The supplier's proposal prominently states that their organization holds an ISO 31000 certification as evidence of mature enterprise risk management practices. The enterprise architect advising the team must explain what this claim actually represents. Which response is most accurate? (Select one!)
AISO 31000 is an accreditation standard for risk assessment consulting firms rather than a certifiable management system applicable to general organizations.
BISO 31000 certification is functionally equivalent to ISO 27001 certification and demonstrates that the supplier's management system has been formally assessed by an accredited third-party auditor.
CISO 31000 organizational certification is a valid and recognized credential that confirms the supplier's risk management processes have been independently audited against the standard's requirements by an accredited body.
DISO 31000 provides only a framework and guidelines for enterprise risk management; organizations cannot be certified against ISO 31000 itself, though individual practitioners may obtain related credentials such as the ISO 31000 Risk Manager certificate from third-party certification bodies.
Explanation
Unlike ISO 27001, which is a certifiable management system standard, ISO 31000 provides a framework and guidelines for risk management principles and processes and explicitly states that it is not intended for certification purposes. No accredited third-party organizational certification against ISO 31000 exists. A supplier claiming to hold an ISO 31000 organizational certification is making an inaccurate claim that warrants further investigation. Individual practitioners can obtain credentials related to ISO 31000 principles, such as the ISO 31000 Risk Manager or ISO 31000 CICRA qualifications offered by third-party training and certification bodies, but these are individual practitioner credentials rather than organizational management system certifications. Organizations seeking external validation of risk management maturity typically pursue standards that support formal certification, such as ISO 27001 for information security management. The vendor team should request clarification on what specific credential the supplier actually holds.
3. Proseware Energy's board publishes the following formal statement: 'We accept moderate cybersecurity risk in order to support our digital transformation agenda.' The CISO subsequently instructs the risk management team to define specific operational boundaries, including a maximum tolerable unplanned downtime of two hours per incident for SCADA control systems. A risk governance consultant is asked to explain how these two declarations relate to each other within a structured risk management programme. Which two statements correctly characterise the relationship between these two declarations? (Select two!)
Multiple correct answersAThe board statement represents risk appetite: a strategic, aggregate, and organisation-wide declaration of the level of risk the organisation is prepared to accept in pursuit of its objectives
BThe board statement represents risk tolerance because it is expressed qualitatively rather than as a precise numerical threshold, which is the defining characteristic of tolerance
CThe CISO's operational boundary of two hours represents risk tolerance: a granular, measurable limit applied to a specific individual risk at an operational level
DRisk appetite and risk tolerance are interchangeable concepts and the distinction is purely a matter of organisational preference rather than a defined governance hierarchy
EThe CISO's two-hour limit overrides the board's risk appetite statement wherever a conflict arises between strategic and operational risk decisions
Explanation
Risk appetite and risk tolerance are related but distinct concepts operating at different levels of a risk governance hierarchy. Risk appetite is a strategic, board-level declaration expressing the aggregate amount and type of risk an organisation is prepared to accept in pursuit of its objectives. It is typically expressed qualitatively and applies organisation-wide, as illustrated by the board's statement regarding moderate cybersecurity risk. Risk tolerance, by contrast, represents measurable, granular boundaries applied to individual risks at an operational level, specifying the maximum acceptable deviation before escalation or treatment is required. The two-hour SCADA downtime limit is a classic expression of risk tolerance: it translates the board's strategic appetite into a concrete, actionable metric for a specific system and process. Risk appetite and risk tolerance are not interchangeable, and operational risk tolerance does not override board-level risk appetite statements.
4. A security architect at Litware Manufacturing is developing an enterprise security architecture using the SABSA framework. During a requirements workshop, the architect must identify which SABSA matrix dimensions should address two specific concerns: first, identifying who within the organization is accountable for protecting critical manufacturing data; and second, defining the temporal constraints that govern when automated production systems must be available for secure operation. Which two SABSA matrix column dimensions directly address these concerns? (Select two!)
Multiple correct answersAWhat (Assets)
BWhy (Motivation)
CWho (People)
DWhere (Location)
EWhen (Time)
Explanation
The SABSA matrix consists of six layers and six column dimensions applied at each layer. The Who (People) dimension addresses organization, accountability, and responsibility for security at each architectural layer — directly applicable to identifying which roles and individuals are accountable for protecting manufacturing data. The When (Time) dimension addresses timing, scheduling, and temporal constraints governing when processes and systems must operate securely — directly applicable to defining availability windows and timing requirements for production systems. The What (Assets) dimension covers business data and information assets in terms of what needs to be protected. The Why (Motivation) dimension addresses business risks, goals, and motivations that drive security requirements. The Where (Location) dimension covers business locations, network domains, and geographic deployment constraints. SABSA's analytical power comes from examining all six dimensions consistently across all six layers from Contextual through Operational.
5. The CISO at Bellows College presents a security investment proposal to the board following a successful audit cycle that achieved full compliance with FERPA, PCI-DSS, and institutional accreditation requirements. A board member challenges the proposal, arguing that since all external compliance obligations have been satisfied, additional security spending is redundant and unjustifiable. The CISO must explain why compliance achievement alone does not make the proposed investment unnecessary. Which statement most accurately describes the relationship between compliance and security risk management according to G152 principles? (Select one!)
ACompliance establishes externally mandated minimum baselines, while security risk management addresses the actual threat landscape and may require controls that exceed compliance requirements.
BCompliance and security risk management are equivalent disciplines; achieving full compliance guarantees that all significant security risks have been addressed.
CCompliance activities provide more rigorous protection than internal risk management because they are validated by independent auditors rather than internal staff.
DSecurity risk management should replace compliance obligations once an organization reaches a mature risk posture, as the two disciplines serve redundant purposes.
Explanation
G152 emphasizes that compliance and security risk management are distinct but complementary disciplines, and neither alone is sufficient. Compliance is rules-based and externally motivated, establishing the minimum requirements that satisfy regulatory, legal, or contractual obligations as defined by external bodies. Security risk management is threat-driven and internally motivated, proactively identifying and treating the actual risks facing the organization, which may demand controls well beyond what any compliance framework mandates. A fully compliant organization may still carry significant unmitigated risk if actual threats exceed what regulations address. Conversely, a highly secure organization may still fail a compliance audit due to documentation or procedural gaps. Treating compliance achievement as equivalent to security adequacy is a misconception that G152 explicitly cautions against. Both programs must operate in parallel, with risk management ensuring that security controls exceed compliance minimums wherever the actual threat landscape warrants.
More The Open Group Practice Exams
TOGAF® Enterprise Architecture Leader
TOGAF EA Leader · 598 questions
TOGAF® Enterprise Architecture Part 2 Exam (OGEA-102)
OGEA-102 · 600 questions
TOGAF® Framework Digital Specialist
OG0-DS1 · 598 questions
The Open Group Certified: TOGAF® Framework Agile Specialist
TOGAF-Agile-Specialist · 589 questions
TOGAF® Business Architecture Foundation (OGBA-101)
OGBA-101 · 600 questions
TOGAF® Enterprise Architecture Foundation (OGEA-101)
OGEA-101 · 600 questions
$17.99
One-time access to this exam
600 questions (10 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available