The TOGAF Standard — What It Is, and Where It Belongs

What it does

At its centre is a repeating cycle for developing an enterprise architecture: understanding the business, then data and applications, then technology, then planning how to move from the current state to the target one. Its value is in making the connections explicit, so a technology decision can be traced back to a business need and forward to what it will affect.

Reach for it when: When systems have accumulated one project at a time and nobody can say how they fit together, and before a large change that will touch many of them at once.
Where it stops: It is large and generic, and adopted in full it can produce architecture documents faster than decisions. Most organisations use a small part of it, and small companies may need little of it at all.

The Open Group, TOGAF, first version 1995; The TOGAF Standard, 10th edition, 2022. TOGAF is a registered trademark of The Open Group and is named here only to refer to its work.

Why it sits at Technology

The organisation’s tools and systems taken as a whole: what exists, how it connects, how each part was sourced, how it is protected, and what it will take to keep it working.

A model is only useful when you reach for it at the right moment. This one answers a question that arises here — so it is filed here, and nowhere else. These are the working areas it serves:

The technology estateRoss, Weill & Robertson, Enterprise Architecture as Strategy (2006), on operating models as the prior choice an architecture should follow; Zachman, “A framework for information systems architecture”, IBM Systems Journal (1987); The Open Group Architecture Framework (TOGAF) on architecture principles and landscape views.
Build, buy or subscribeWilliamson, The Economic Institutions of Capitalism (1985), on asset specificity and the make-or-buy boundary; Lacity & Willcocks on IT sourcing decisions (Global Information Technology Outsourcing, 2001); Wardley’s mapping of capabilities by evolution stage (Wardley Maps, 2016).
AI and automationNIST AI Risk Management Framework 1.0 (2023); ISO/IEC 42001:2023 on AI management systems; Parasuraman, Sheridan & Wickens, “A model for types and levels of human interaction with automation”, IEEE Transactions on Systems, Man, and Cybernetics (2000); Regulation (EU) 2024/1689, the AI Act, as the regulatory classification the register has to be able to answer to.
SecurityNIST Cybersecurity Framework 2.0 (2024) and its six functions; ISO/IEC 27001:2022 and the Annex A controls; the CIS Critical Security Controls v8; the NIS2 Directive (EU) 2022/2555 as the regulatory context for many organisations.
Technical debt and renewalCunningham’s debt metaphor (OOPSLA experience report, 1992); Kruchten, Nord & Ozkaya, Managing Technical Debt (2019); Fowler’s technical debt quadrant (2009) and strangler fig pattern (2004); the TIME model of application portfolio rationalisation associated with Gartner.

All of Technology

What it touches elsewhere

Nothing in a business is decided on its own. A conclusion reached with this model at Technology lands in these other cores, whether or not anyone follows it there.

Business CoreOperational Systems, under Tooling, judges whether one tool fits one process. The estate here holds the organisation-wide catalogue that assessment refers to, so the same system is not listed twice.
Business CoreBusiness Assets keeps the asset register, the IP position and the lifecycle dates of held assets. Security and renewal here refer to those entries and add the attacker’s and the architect’s view of them.
Business CoreCompliance maps which rules apply — the AI Act and NIS2 among them — and owns breach notification under incident response. Governance sets the risk appetite that security and AI risks are reported against.
Data CoreData Governance decides who owns which data, who may see it and how long it is kept. Technology owns the systems that enforce those decisions, and the AI register refers to them for the data each use draws on.
Time CoreRenewal is delivered as projects, planned and run under Project management. The roadmap here sets the sequence and the architecture; the schedule lives there.
Omni CorePersonalization and Customer Support are where much customer-facing AI appears. What the customer should experience is decided there; the oversight and evaluation of the underlying system are held here.

Filed at the same place

These answer questions that arise at Technology too. Where they disagree with this one, the disagreement is the useful part.

The technology acceptance modelWhether people use a new system depends mainly on whether they think it will help them and whether they think it will be easy.
The NIST Cybersecurity FrameworkA common structure for managing cyber risk, organised around what an organisation must be able to do before, during and after an incident.
Wardley mappingMap what a user needs, the components that serve it, and how far each component has evolved from novel to commodity.

Elsewhere in Business Core

These are other people’s models, named here so you can go to the source and use them properly. The Omnigoal is not affiliated with their authors and is not endorsed by them; nothing of theirs is reproduced here — no canvas, no diagram, no wording. Each is described in our own words, with the originator credited, because the framework is a place to put thinking, not a replacement for the people who did it. Model names and trademarks belong to their respective owners and are used here only to refer to the work itself.

All 166 models