PRISM — Platform, Risk, Integration and Systems Methodology — is a five-layer deterministic framework for enterprise data architecture assessment, integration mapping, and migration planning. Developed through real engagements across government, finance, and professional services. Not adapted from a textbook.
Every system catalogued. Every integration risk-scored. Every API endpoint security-assessed. Fifty rules fire automatically. The output is an evidence-based assessment your board can act on and your delivery team can execute from.
Architects map what exists. They document integrations, draw diagrams, catalogue systems. Then a migration hits and the diagram cannot tell you what breaks, what the impact costs, or in what order to cut things over.
It shows structure but not risk. Connections but not consequence. Current state but not migration impact. This is not a skills problem. It is a methodology problem. Adding more detail to a 2D diagram will not solve it.
A programme that commits to a sequence it cannot execute. A cutover that discovers — mid-migration — that three systems nobody documented depend on the one being retired. A financial integration that drops records silently.
A PRISM assessment delivered before programme planning begins is not a cost. It is the document that prevents the programme from committing to a plan that cannot be executed.
The cost of getting this wrong is not a failed sprint. It is an AI component that modifies production data without a review gate because nobody asked whether one existed. It is a financial integration that drops records silently because nobody defined what happens when it fails.
Five layers. Five pipeline zones. Fifty deterministic rules. The same input always produces the same output.
Every integration must define its failure disposition, escalation threshold, escalation owner, and recovery procedure. An integration without this documentation does not pass the assurance gate.
AI generates, analyses, and recommends. Humans decide, approve, and execute. Without exception — regardless of how sophisticated the AI system is or how urgent the use case feels.
Zero Trust: every access request is authenticated, authorised, and continuously validated. Every integration authenticates explicitly. Every data asset is classified. Every access event is logged.
Most data architects will not go to this level of detail. Here is what PRISM produces that a standard architecture review does not:
A platform migration, a system replacement, a data estate nobody fully understands. You know the risk is in the architecture. You need a systematic way to find it, quantify it, and present it.
You have been handed a programme with 40, 60, or 100 integrations — many of them undocumented, several carrying PII or financial data, and at least one that will break in a way nobody predicted. PRISM finds them all before the cutover.
You need to know exactly which integrations change, which stay, and which retire — classified by risk, documented with error handling specs, and sequenced in the right migration order. That is the integration register PRISM produces.
Your client's architecture has AI components nobody has governed, security gaps nobody has documented, and API endpoints nobody has reviewed in years. PRISM applies 50 rules and gives you a findings report you can take to the client on day one.
You need to walk into a steering committee with a quantified risk score, a priority action list, a phased migration plan, and evidence that the architecture has been systematically assessed — not a diagram someone drew on a whiteboard.
Where a 2D diagram shows you what you have, PRISM shows you what it means. Five layers. Five zones. Fifty rules. One complete assessment.
What exists. Every system catalogued by category and zone.
What moves, what breaks, what stays. 50 deterministic rules across 5 groups.
What is missing, what is fragile, what should be automated.
Platform Assessment
Systems registry with every platform catalogued by category, zone, data layer, API capability, status flags, and ownership. For AI systems: governance fields covering human review gate status, action scope, evaluation strategy, and rollback capability.
Risk Classification
Risk-scored integration register. Every integration receives a change type (Change, No Change, Retired, or TBD), a complexity rating, and a contribution to the overall migration risk score on a 0–100 scale weighted across complexity, PII exposure, financial risk, automation gaps, and TBD items.
Integration Mapping
Complete integration register with interface specifications, data contracts, error handling documentation, and the endpoint registry. Blast radius analysis (downstream and upstream) to depth three. Compliance mapping across PCI-DSS, GDPR, SOX, HIPAA, ISO 27001, and others.
Systems Analysis
Architecture health report against 50 rules: change impact (Rules 1–10), platform governance, automation and quality, AI governance, observability, migration risk, security (Rules 35–44), architecture health, and endpoint security (Rules 46–50). Every finding severity-rated with remediation guidance.
Migration Planning
Phased migration sequence, testing specifications per integration, operational runbooks for high-risk integrations, RTO/RPO recovery profiles, cost and TCO summary, decision log, accepted risk log, and stakeholder-split reporting: an executive summary for the board and a full technical specification for the delivery team.
Data is created
Source systems, events, IoT, user actions
Data is transported
Pipelines, ETL, messaging, file transfers
Data is in active use
Transactional databases, operational stores
Data is transformed
Bronze-Silver-Gold, analytics engines, ML
Data is delivered
Reports, dashboards, downstream systems
Every system is classified by both a zone and a data layer — two independent dimensions that together define its role in the architecture.
Rule 37 fires on every PII or financial integration without encryption in transit, every time, regardless of who runs the assessment. That is the difference between an opinion-based review and a rules-based assessment.
Client name, size, engagement type, primary objective. Five questions that frame the entire assessment.
Every system in the landscape registered with its category, zone, API status, and replacement status.
Every integration between systems defined: method, frequency, PII, financial flags, error handling disposition, and indirect dependencies. API endpoints registered and security-assessed per system.
50 deterministic rules fire automatically across change impact, architecture health, AI governance, cybersecurity, and endpoint security. Every finding ranked by severity with remediation guidance.
Professional PDF report with executive summary, integration assessment, migration roadmap, and supplementary sections covering AI governance and security compliance. Suitable for programme boards and executive stakeholders.
Most consultancies stop at the assessment. PRISM produces a complete migration planning toolkit — phased roadmap, risk scoring, dependency analysis, error handling frameworks, data contracts, operational runbooks, endpoint security registry, AI governance reporting, and compliance mapping. All deterministic. All auditable.
Five-zone swim lane, current and future state side by side.
Select any system; see exactly what breaks during cutover. BFS traversal, 3 levels deep, severity-rated.
Auto-generated from system ownership. Named R, A, C, I per integration.
Sequenced by criticality with pre/post validation and rollback triggers for every integration.
Every integration tagged by GDPR, PCI-DSS, SOX, HIPAA with exposure per framework.
Deterministic test requirements per integration. Exportable as PDF.
Failure disposition, escalation threshold, escalation owner, and recovery procedure per integration.
Every API endpoint assessed for authentication, encryption, input validation, rate limiting, and credential handling.
SUPP A: AI governance for every AI component and autonomous agent. SUPP B: cybersecurity posture mapped to the ACSC Essential Eight.
The PRISM rules engine is governed by four companion playbooks. Every rule, every assessment, every finding traces back to a documented standard — not a consultant's opinion.
Governs every AI component, autonomous agent, and automation pipeline. Three invariants: deterministic first, AI second; every AI component has a human review gate; every AI agent defines its action scope. Six rules fire automatically against AI systems.
Zero Trust foundation across eight security domains. Governs Rules 35–50: identity and authentication, data protection, patch management, logging and monitoring, backup and recovery, access controls, and the full endpoint security registry. Mapped to the ACSC Essential Eight.
One invariant: no error goes unhandled. Every integration must define its failure disposition (dead letter, retry, manual review, or drop), escalation threshold, escalation owner, and review procedure. Governs Rules 29 and 30.
Every data pipeline built to the same standard. Orchestrator-module architecture, Bronze-Silver-Gold medallion layers, deterministic transformations, and no runtime AI. Governs how recommendations translate into implementation.
No silos. All data lives in one system.
Deterministic first, AI second.
Every component belongs to one of five zones: Input, Transform, Loop, Output, Interface.
Every pipeline needs at least one feedback loop.
Right-size the platform. Snowflake is not the answer for a small business.
Consolidate redundant processes. Three payment portals doing the same job is one process waiting to be built.
No manual processes. Everything should be automated.
AI is never used unsupervised at runtime. Every AI component has a human review gate.
No error goes unhandled. Every integration defines its failure disposition, escalation path, and recovery procedure.
Every data pipeline follows the Bronze, Silver, Gold medallion pattern.
25 years designing data systems across enterprise gaming, fitness, retail, and professional services. PRISM was not adapted from a generic framework. It was built from the ground up across real client engagements.
Most organisations know their headline systems. Few have a complete picture of the integrations between them — the 60 or 80 or 120 data flows that connect every system to every other system, many of which carry PII, financial data, or regulatory obligations nobody has documented.
PRISM finds them. It classifies every one of them by change impact, risk, and complexity. It identifies which integrations will break if a system changes, how far that break propagates, and in what order the migration must be sequenced to avoid cascading failures.
A PRISM assessment delivered before programme planning begins is not a cost. It is the document that prevents the programme from committing to a plan that cannot be executed.
Mid-market organisations face the same architectural problems as enterprise — platform consolidation, legacy replacement, data estate modernisation — but without the budget for a Big Four engagement.
PRISM was designed to be applicable at any scale. The same methodology that assessed 32 systems and 62 integrations for a government enterprise applies equally to a 15-system organisation replacing its CRM. The output is the same: a risk score, a prioritised findings report, and a migration plan you can take to your board.
The difference is you get the architect who built the methodology, not a junior who read the playbook last week.
Most architects working on enterprise programmes apply experience and judgement. The output quality is a function of who you placed. PRISM changes that equation. The methodology is documented, the rules are deterministic, and the output is consistent across engagements regardless of how complex the landscape is.
For your clients with platform migration programmes, digital transformation initiatives, or data estate modernisation projects, the question is not whether to do an architecture assessment. It is whether to do one that produces a diagram and some observations, or one that produces a quantified risk score, a 50-rule findings report, a compliance map, an endpoint security registry, an AI governance assessment, and a complete migration planning toolkit.
If you are placing architects on enterprise engagements where the outcome matters, PRISM is the differentiator worth knowing about.
“[Client testimonial — coming soon]”