Security architecture should prescribe when (e.g. what information to log to facilitate audit or when to encrypt data) and how to implement security in a product (e.g. what should be in an audit ...