ISO/IEC 27034 Structure, Components and Framework Elements
This section covers Domain 2: ISO/IEC 27034 structure, components and framework elements. The exam tests part purposes, how ONF, ANF, ASC library and ASMP fit, and which parts are normative versus informative.
Structure and components
ISO/IEC 27034 is multi-part. Part 1 gives overview and concepts. Part 2 addresses the Organization Normative Framework (ONF). Part 3 covers the Application Security Management Process (ASMP). Part 4 covers application security validation. Part 5 specifies protocols and the Application Security Controls (ASC) data structure. Part 6 provides case studies, generally informative. Part 7 addresses an application security assurance prediction framework.
The ONF contains organization-level security policies, standards, procedures, risk-assessment criteria, roles, ASCs and related guidance. The ANF is derived from the ONF for a target application and records selected ASCs, tailoring and application-specific risk decisions. The ASC library stores reusable ASC definitions. The ASMP is the lifecycle process that operationalizes the ONF and ANF through activities, responsibilities and evidence. Validation checks that selected controls are implemented and effective, producing evidence for assurance.
Worked example
A payroll application must satisfy privacy law and internal policy. Part 2's ONF supplies the organization's encryption standard and a reusable 'protect data in transit' ASC. The team creates an ANF for payroll: it selects that ASC, records the legal driver, tailors parameters such as the TLS version, and notes the risk assessment. Part 3's process assigns activities to architecture, development and operations. Part 4 validation tests the TLS configuration and records results. Part 5's ASC data structure makes the control reusable in the library. The reasoning: each part has a distinct role; the ANF links organization rules to this app, while validation supplies evidence.
Traps
Mixing up Part 2 and Part 3 is common: Part 2 is the ONF, Part 3 is the management process. Part 6 case studies are not a compliance checklist. Part 5 is about ASC data structures and exchange protocols, not a testing method. Do not treat the ANF as a copy of the whole ONF; it is a tailored subset.