ISO/IEC 27034 Fundamentals and Application Security Concepts
This domain tests precise use of ISO/IEC 27034 vocabulary and how the parts fit together. Auditors must distinguish the organization's normative framework from an individual application's controls and know what evidence each concept produces.
The core model
- ONF (Organization Normative Framework): organization-wide policies, processes, roles, risk criteria and the ASC library; it is the reference for consistency.
- ASMF: the management system inside the ONF that governs application security across the ASLC.
- ASC: a control with a defined data structure - objective, implementation guidance and verification guidance - held in the ASC library; Part 5 standardizes the data structure and exchange.
- ASLC: a lifecycle reference model; the ONF maps activities and ASCs to stages from requirements through operation and disposal.
- Validation: evidence that selected ASCs are implemented and effective, covered in Part 4.
- Part 1 defines concepts, Part 2 the ONF, Part 3 the management process, Part 4 validation and Part 5 the ASC data structure.
What the exam expects
27034 is a framework standard, not a control catalogue. It does not mandate specific technical controls; it requires the organization to define an ONF, assess application security risk, select ASCs, implement them and validate them. Conclusions should cite the ONF or ASC requirement, not a generic checklist.
Worked example
An organization claims 'all applications comply with 27034'. The auditor finds a secure coding standard but no ONF, no ASC library and no risk-based selection record. Reasoning: the standard is a document, not an ONF; without an ASC library and selection rationale there is no traceable link from application risk to control. The auditor records a nonconformity against the ONF requirement, not a coding rule, because 27034 governs the framework.
Traps
- Treating 27034 as a checklist of technical controls.
- Confusing organization-level ONF with application-level requirements.
- Accepting validation reports without checking them against ASC verification guidance.
- Assuming Part 5 is only XML formatting; the data structure carries control semantics.