Central ONF versus regional ANFs at a medical device maker
A medical device manufacturer has headquarters in Germany, two development centres in India and Brazil, and three business units that each built their own application security control catalogue. The catalogues contain 420 controls in total; roughly 180 are duplicates with different names, and verification methods conflict. A new cloud-connected insulin pump controller is being developed by a joint team. Each business unit wants to apply its own catalogue to the pump because 'our controls are proven'. The pump has a 15-year field life, receives over-the-air updates, and is regulated as a medical device. The corporate security team has ISO/IEC 27034-2 available but no single organizational normative framework. The programme manager proposes that the joint team simply merge all 420 controls into one spreadsheet and apply every control to the pump.
1. What is the difference between an ONF and an ANF in this situation, and why is 'merge all 420 controls' not a sound ONF?
Read the worked answer
The ONF is the organization-level normative framework: the single source for application security processes, control definitions, control objectives, risk assessment method, lifecycle model, roles and verification approaches. The ANF is the application-specific normative framework: the subset of ONF controls and processes that applies to a particular application, plus any application-specific additions. Merging 420 rows into a spreadsheet does not create an ONF because duplicates are not reconciled, controls lack unique identities and clear objectives, and conflicting verification methods remain. The joint team would still have to interpret which of the duplicate entries is authoritative, so the 'single' catalogue would produce inconsistent evidence. A sound ONF would deduplicate and normalize controls, assign stable identifiers, map each control to objectives and risks, harmonize verification, and define change control. The pump's ANF should then be derived from that ONF and supplemented for medical-device regulation, not inherited wholesale from three business units.
2. Recommend how to derive the pump's ANF and govern changes across the three business units.
Read the worked answer
First, perform an application security risk assessment for the pump that considers patient safety, regulatory obligations, cloud connectivity, over-the-air update integrity, 15-year support and supply-chain dependencies. Use the resulting requirements to select controls from the consolidated ONF. Record for each selected control its objective, implementation guidance, verification method, responsible role and rationale. Add pump-specific controls where the ONF does not cover device regulation or safety. The ANF should be versioned and tied to the release baseline, with approval by the application owner and security authority. Governance across business units should require changes to be proposed against the ONF, reviewed once, and then reflected in affected ANFs; business units should not maintain private variants. A pilot on the pump can generate evidence for improving the ONF, but local deviations need documented justification and time-bound approval. This preserves reuse while keeping the pump's assurance traceable to its own risk profile.