Scope creep in a fintech's application security programme
A financial services firm has 180 items in its application inventory: 12 customer-facing web and mobile apps, 40 internal line-of-business systems, and 128 spreadsheets, scripts and access databases built by business units. The CISO has committed to 'ISO/IEC 27034 for all applications' within 12 months and assigned four security analysts. Six months later only eight applications have completed assessment. Business units are refusing to register spreadsheets, arguing they are not applications. The security team has responded by drafting a policy that every inventoried item must have a full Application Normative Framework with all 220 controls in the organizational library. Two business units have paused new automation projects because they cannot get security sign-off. The CISO asks whether the programme is failing because the team is too small or because the scope is wrong.
1. How should the firm decide which inventory items are applications for the purposes of ISO/IEC 27034, and what principle should drive that decision?
Read the worked answer
The decision should not be driven by whether an item is a spreadsheet, script or formally developed system. It should be driven by business context and risk: does the item process, store or transmit information that the organization relies on, and could a failure or compromise cause material harm? A payroll spreadsheet with employee bank details may need to be treated as an application even though it was built by a business unit. A local script that only reformats a report with no sensitive data may be handled through a lightweight baseline rather than a full Application Normative Framework. The principle is that ISO/IEC 27034 is scalable and risk-based; the Organizational Normative Framework should define categorization criteria, ownership, data sensitivity, exposure and criticality. The firm should inventory, classify and prioritize, then apply proportionate process and controls. Saying 'all applications' without a scoping method converts a framework into an unbounded compliance exercise and produces exactly the delay and workarounds described.
2. The draft policy requires all 220 controls for every item. Evaluate this against ISO/IEC 27034's approach to application security controls and assurance.
Read the worked answer
The policy is not consistent with a risk-based framework. An Organizational Normative Framework is a source of reusable controls and processes, not a mandate that every control applies to every application. The application team should derive an Application Normative Framework by selecting the controls that address the application's security requirements and assessed risks, adding application-specific controls where needed, and recording why each control is included or excluded. Requiring all 220 controls for a low-risk reporting script creates excessive cost, encourages tick-box evidence and, as already happened, causes projects to stall or bypass security. Assurance also becomes weaker because reviewers cannot distinguish controls that matter from controls that were selected automatically. A defensible approach is to define a minimum baseline for all applications, then risk overlays for higher-impact applications. Each selected control should have a clear objective, verification method and traceability to a requirement or risk. The CISO should measure coverage of high-risk applications first, not raw control counts across the inventory.