Implementation, Integration and Management of Application Security in an Organization
This section covers Domain 5: implementation, integration and management of application security in an organization. The exam tests adoption sequencing, governance, lifecycle integration and continual improvement.
Core rules
Implementation starts with management commitment and a clear scope: which applications, business units and suppliers are covered. The organization establishes or updates the ONF, including policies, risk criteria, roles, ASC library and validation approach. It then applies the ASMP across the lifecycle, creating ANFs for target applications and integrating security activities into requirements, design, build, test, release and operations. Governance assigns accountability, approves risk decisions and monitors performance.
Integration means embedding application security into existing processes rather than running a parallel bureaucracy. Gate criteria, definition of done, supplier contracts, change management and incident processes should reference ASCs and validation evidence. Metrics can include percentage of apps with current ANFs, validation coverage, open high-risk findings and time to remediate. Continual improvement uses validation results, incidents and audit findings to update the ONF and ASC library.
Worked example
A fintech piloting 27034 starts with two customer-facing apps. It writes an ONF with risk tiers and a small ASC library, trains product and engineering teams, and adds an ANF and validation evidence to release gates. A supplier contract requires ASC compliance and evidence. After six months, validation finds repeated session-timeout failures; the team updates the ASC's implementation guidance and adds an automated test. The reasoning: start scoped, make the ONF usable, integrate evidence into existing gates, and feed findings back into the framework.
Traps
Do not buy a tool and call it a 27034 implementation; the framework is governance, process and evidence, not a product. Do not skip the ONF and create ad hoc ANFs. Do not exclude suppliers or operations. Do not treat the framework as static; without update from findings it decays.