ISO/IEC 27034 Foundation common mistakes
ISO/IEC 27034 Foundation · Understand the traps and how to avoid them.
Treating ISO/IEC 27034 as a catalog of ready-made application security controls and trying to memorize control lists, instead of recognizing that it is a framework for defining, selecting, and managing controls per application.
Candidates come from ISO/IEC 27002 or OWASP backgrounds where controls are enumerated, so they expect the same enumerated list and search for 'the controls chapter' that does not exist.
What to do instead
Anchor on the framework's purpose: it provides processes, roles, and artifacts (such as the Organization Normative Framework and Application Normative Framework) for building and applying controls, not a fixed control catalog. When a question asks 'which control', check whether the framework expects the organization to derive it from its normative framework.
Confusing the Organization Normative Framework (ONF) with the Application Normative Framework (ANF) and assigning ONF-level content to a single application.
Both are called 'normative frameworks' and both contain controls, so candidates map them by name rather than by scope.
What to do instead
Fix the scope in memory: ONF is organization-wide reusable baseline (policies, control library, processes, roles, assessment methods); ANF is the tailored, application-specific selection and justification derived from the ONF for one application. Ask 'does this apply to all applications or to this one?' before answering.
Describing the framework's structure as a simple linear lifecycle and missing that it is layered, with the ONF, ANF, application security control library, and the assurance/verification elements interacting.
Study summaries compress the standard into a process diagram, and candidates lose the layering and the traceability relationships between components.
What to do instead
Redraw the structure from memory as layers: organization-level framework, application-level framework, selected controls, and evidence/assurance records. For each component, state its inputs and outputs and which other component it depends on.
Treating ISO/IEC 27034 as a certification scheme for applications and answering that an application can be 'ISO/IEC 27034 certified'.
Candidates generalize from management-system standards (such as ISO/IEC 27001) where certification of an organization is normal, and assume the same for this framework.
What to do instead
Remember the standard is a framework/guidance for application security, not a certifiable management system requirement, and it does not issue application-level certificates. If a question implies certification, look for the answer about demonstrating assurance through evidence and defined processes.
Skipping the risk assessment step and jumping directly from the ONF control library to selecting controls, without identifying application-specific threats, business context, and security objectives.
The control library feels like the 'answer', and risk assessment feels like a generic preamble, so candidates rush to the control selection.
What to do instead
Practice the chain explicitly: business context and application security requirements, threat and risk assessment, selection and tailoring of controls, justification recorded in the ANF, verification. If an option skips risk assessment before selection, it is usually wrong.
Treating assurance as a one-time verification activity at the end of development rather than as evidence generated and maintained across the application lifecycle.
Candidates conflate 'assurance' with 'final testing' or 'audit', so they choose options that place verification only after deployment.
What to do instead
Frame assurance as the ongoing production and retention of evidence that controls are defined, implemented, and effective, from requirements through operation and change. Look for answers that tie evidence to each lifecycle stage and to change management.
Assuming the framework prescribes specific technologies or development methods (for example mandating a particular secure coding standard, a particular SDLC model, or a particular tool).
Candidates transfer expectations from technical secure-coding courses and pick the most technical-sounding option.
What to do instead
Recognize that the framework is technology- and method-neutral: it requires the organization to define its own normative content. Prefer answers describing organizational definition, tailoring, and evidence over answers naming specific tools or methodologies.
Ignoring the roles and responsibilities element and answering that application security is owned solely by the security team or solely by developers.
Organizational role questions look like common sense, and candidates answer from their own workplace rather than from the framework's emphasis on defined, assigned responsibilities across business, development, and security.
What to do instead
Study the framework's treatment of roles as an explicit component: business owner, application owner, developers, security specialists, and assurance/verification roles with defined responsibilities and competencies. Choose answers that distribute and document accountability rather than concentrating it.
Failing to connect the framework to existing management processes, answering that ISO/IEC 27034 replaces or is independent of the organization's ISMS and risk management.
Candidates study each standard in isolation and do not practice integration questions, so they default to 'separate standard, separate process'.
What to do instead
Prepare integration answers: the application security framework operates within the organization's governance, risk, and lifecycle processes, feeding application-level risk into organizational risk management and reusing ONF content across applications. Reject options that describe it as a parallel, disconnected system.
Memorizing part numbers and clause numbers of the ISO/IEC 27034 series without knowing what each part covers, then misassigning a described activity to the wrong part.
Part numbers are easy to flash-card, but exam questions describe an activity and ask which part addresses it, which requires conceptual mapping rather than recall of numbers.
What to do instead
For each part you study, write one sentence on its scope and one example artifact it produces, and practice matching activity descriptions to those scopes. Verify part numbering against the current published editions rather than secondary summaries, and flag anything you cannot confirm for review.