Application Security Controls
This section covers Domain 3: application security controls. The exam tests what an ASC is, how the ASC data structure supports reuse, and how controls are selected, tailored and verified.
Core rules
An Application Security Control (ASC) is a reusable statement of a security measure intended to reduce application security risk. ASCs live in an ASC library and are selected into an application's ANF based on business context and risk. An ASC is not a vulnerability finding or a product feature; it is a control definition that can be implemented in different technologies and verified.
ISO/IEC 27034-5 addresses the ASC data structure and protocols. A well-formed ASC typically identifies the control, states its objective, gives implementation guidance, gives verification guidance, and links to related controls, sources and risk. Good ASCs are precise enough to test and technology-neutral enough to reuse; tailoring happens in the ANF or implementation, with rationale recorded.
Controls should be traceable: each selected ASC maps to a risk or requirement, and each validation result maps back to the ASC. This supports assurance and change impact analysis.
Worked example
A team defines ASC AUTH-02: require multi-factor authentication for privileged access. Objective: reduce account takeover risk. Implementation guidance: MFA for administrative and high-privilege accounts, with a recovery procedure. Verification guidance: attempt privileged login without a second factor and confirm denial; review MFA enrollment reports. Related controls: logging and session timeout. Source: ONF authentication standard. For a low-risk internal app, the ANF may tailor the ASC to a lower-assurance factor but records why; for a banking admin console, it applies the full control. The reasoning: the ASC is reused, while the ANF records risk-based tailoring and validation proves implementation.
Traps
Do not confuse an ASC with a generic policy sentence that cannot be verified. Do not assume every ASC in the library must be applied to every app. Do not skip verification guidance; without it, assurance is unsupported. Do not tailor controls silently: record the rationale in the ANF.