ISO/IEC 27034 Foundation case studies
ISO/IEC 27034 Foundation · Put your knowledge to work in context.
The ISO/IEC 27034 Foundation credential is presented by PECB as an individual training-and-certification program in its cybersecurity portfolio, positioned alongside standards-based offerings such as ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005, ISO/IEC 27035, ISO/IEC 27033 and ISA/IEC 62443. It is aimed at professionals who need a working, standards-anchored vocabulary for application security: developers, application owners, security officers, risk and compliance staff, auditors, and project or IT managers whose work touches software delivery. The ISO/IEC 27034 Foundation case studies are 5 cases and about 2,323 words.
1Scope creep in a fintech's application security programme
A financial services firm has 180 items in its application inventory: 12 customer-facing web and mobile apps, 40 internal line-of-business systems, and 128 spreadsheets, scripts and access databases built by business units. The CISO has committed to 'ISO/IEC 27034 for all applications' within 12 months and assigned four security analysts.
498 words, about 2 min2Central ONF versus regional ANFs at a medical device maker
A medical device manufacturer has headquarters in Germany, two development centres in India and Brazil, and three business units that each built their own application security control catalogue. The catalogues contain 420 controls in total; roughly 180 are duplicates with different names, and verification methods conflict.
465 words, about 2 min3The 190-control mobile release at a retail bank
A retail bank operates a mobile banking app with 2.1 million active users and releases every two weeks. Its application security control library contains 220 controls.
451 words, about 2 min4Pen test passed but the payroll API assurance gap
A SaaS company provides an HR platform to 150 enterprise customers, including payroll data for 400,000 employees. It has an annual penetration test with no critical findings, a SOC 2 Type II report, and a completed security questionnaire.
460 words, about 2 min5Integrating application security into a 60-deploy-per-week pipeline
An e-commerce company deploys 60 times per week across 40 product teams. The security team has three engineers.
449 words, about 2 min