ISO/IEC 27034 Lead Application Security Implementer cheat sheet

ISO/IEC 27034 is a multi-part standard structured around two process frameworks: the Organization Normative Framework (ONF) and the Application Normative Framework (ANF); the ONF is enterprise-wide and the ANF is scoped to a single application.

The ONF holds the organization's security policies, business context, catalog of security controls, baseline levels, roles, and verification criteria; the ANF is instantiated from the ONF for each specific application and records which controls apply and how they are met.

The standard defines ASCs (Application Security Controls) as reusable, verifiable control specifications; each ASC has attributes including an identifier, objective, verification method, and a defined level of trust (LoT).

Level of trust is expressed as a target LoT (required by business/stakeholders) and an achieved LoT (evidenced by verification); a gap between the two is the primary driver for remediation and improvement.

Application security risk is derived from the business context (data sensitivity, exposure, regulatory obligations, criticality) combined with threat and vulnerability likelihood and impact; the same control set is not applied uniformly to every application.

Key roles in 27034 include the application owner (accountable for the application's risk and LoT), the application security manager (maintains the ONF), and application security practitioners who implement and verify ASCs.

Trust is established by evidence, not assertion: a control only contributes to achieved LoT when its specified verification method has been executed and its result recorded.

Principle of proportionality: control rigor and verification depth scale with the target LoT and business criticality, so low-criticality applications are not burdened with controls whose cost exceeds the risk.

Planning begins by establishing the application's business context and target LoT before selecting controls; control selection without a defined target LoT has no measurable success criterion.

The ONF's catalog of ASCs is filtered against the application's context to produce the ANF; the ANF records the selected ASCs, their tailoring, and the verification evidence required.

Tailoring is permitted and expected: an ASC may be adapted to the application's technology and architecture, but the objective and verification method must remain traceable to the ONF version.

Planning must allocate verification activities (reviews, tests, evidence collection) with owners and timing across the lifecycle, not only at release; controls with no scheduled verification cannot raise achieved LoT.

Threat modeling and risk assessment feed the plan; identified threats that are not addressed by an existing ASC trigger either a new ASC proposal to the ONF or a documented accepted risk.

Roles and responsibilities, including application owner sign-off on target LoT and residual risk, are defined at planning time so accountability is not negotiated during an incident.

Planning outputs are version-controlled and baselined so later changes to scope, architecture, or target LoT are detectable and trigger re-planning rather than silent drift.

Third-party and acquired components are in scope at planning: their security claims must be mapped to ASCs or verified independently before they count toward achieved LoT.

Each ASC in the ANF is implemented and then verified against the verification method defined in the ONF; implementation without recorded verification evidence does not satisfy the ASC.

Implementation evidence should be objective and reproducible (test results, configuration extracts, code review records, scan reports) and linked to the specific ASC identifier and ANF version.

Where an ASC cannot be implemented as specified, the options are: tailor it with justification, substitute an equivalent control with demonstrated equivalence, or record a formal risk acceptance by the application owner.

Controls apply across layers: architecture and design, code and libraries, configuration and deployment, and operational environment; a control verified only at one layer may not hold overall.

Secure coding and configuration standards are the implementation vehicle for many ASCs; their effectiveness depends on enforcement mechanisms (build gates, review checklists, automated policy checks) rather than documentation alone.

Reuse from the ONF is the intended efficiency: implement once, verify once, and apply the same ASC to multiple applications, recording per-application evidence in each ANF.

Environment differences (development, test, production) must be accounted for; evidence gathered in a non-production environment may not demonstrate the control in production where configuration diverges.

Implementation status per ASC should be tracked as a defined state (planned, implemented, verified, accepted risk) so achieved LoT can be computed rather than estimated.

An application security incident is a confirmed or suspected event that compromises, or may compromise, a control relied upon by the ANF; detection sources include monitoring alerts, vulnerability reports, and external disclosure.

Response phases: detection and triage, containment, eradication, recovery, and post-incident review; each phase has defined entry and exit criteria and assigned owners.

Triage classifies the incident by affected application, affected ASCs, data sensitivity, and current achieved LoT, which together determine severity and escalation path.

Containment options include disabling a feature, revoking credentials or keys, applying a virtual patch at the edge, or taking the application offline; the choice trades availability against exposure and is recorded with justification.

Incident records must link to the affected ANF entries so that a control found ineffective can be flagged and its achieved LoT reassessed after resolution.

Post-incident review produces corrective actions that feed the ONF: a recurring root cause indicates a defective ASC specification or verification method, not merely a one-off implementation error.

Communication obligations (regulators, customers, partners) are triggered by data type and jurisdiction and are decided during planning, not improvised during the incident.

Evidence handling during response must preserve integrity (chain of custody, hashes, timestamps) because incident artifacts may support legal, regulatory, or audit processes.

Verification confirms that an ASC is implemented as specified using the method defined in the ONF; monitoring confirms the control continues to operate over time; both are required for sustained achieved LoT.

Verification methods include inspection, analysis, demonstration, and testing; the ONF should specify which method and the acceptance criterion for each ASC.

Achieved LoT is a function of verified ASCs against the target LoT; unverified or partially verified controls count only to the extent the verification method defines.

Continuous monitoring signals include runtime telemetry, configuration drift detection, dependency and vulnerability feeds, and access anomalies; each signal should map to the ASC it evidences.

Independent verification (separate from the implementing team) reduces self-assessment bias and is expected at higher target LoT levels.

Verification results must be time-stamped and version-linked; a verification performed against a prior ANF version does not evidence the current implementation.

Metrics for monitoring should be tied to control objectives (e.g., percentage of ASCs verified, mean time to detect drift) rather than raw activity counts, so they inform LoT decisions.

Drift between deployed state and the verified baseline is a finding; it reopens the affected ASC and requires re-verification before achieved LoT is restored.

The ONF is a living artifact: audit findings, incidents, and verification gaps feed back as changes to ASCs, verification methods, or baseline requirements, with version control and change justification.

Audit of application security compares the ANF against the ONF and the deployed reality against the ANF; a common finding class is an ANF that claims controls the deployed application does not have.

Audit evidence must be traceable: each sampled control should resolve to an ASC identifier, an ANF version, a verification record, and the deployed artifact or configuration.

Trend analysis across applications (repeat findings, recurring ASC failures, aging risk acceptances) identifies systemic weaknesses that per-application review cannot surface.

Risk acceptances must have an owner, an expiry or review date, and a rationale; an expired acceptance reverts to an open gap and reduces achieved LoT.

Improvement is measured by movement in achieved versus target LoT and by reduction in repeat findings, not by the number of controls added to the catalog.

Changes to the ONF propagate: when an ASC is revised, affected ANFs must be reassessed and re-verified, and the impact of the revision on each application's achieved LoT recorded.

Audit independence and sampling scope are defined in advance; the sampling rationale and population should be documented so results are reproducible in a later audit cycle.

ONF is organization-wide and reusable; ANF is application-specific and instantiated from the ONF.

An ASC is a reusable control specification with an identifier, objective, verification method, and level of trust.

Target LoT is what stakeholders require; achieved LoT is what verification evidence supports.

Business context (data sensitivity, exposure, criticality) drives target LoT and control selection.

The application owner is accountable for the application's risk and LoT; the application security manager maintains the ONF.

Trust requires recorded evidence from the specified verification method, not assertion.

Control rigor scales with target LoT and criticality (proportionality).

Roles, responsibilities, and sign-off authority are defined in the ONF.

Define business context and target LoT before selecting controls.

Derive the ANF by filtering and tailoring ONF ASCs to the application's context.

Tailoring must preserve traceability to the ONF ASC objective and verification method.

Schedule verification activities with owners and timing across the lifecycle, not only at release.

Threat modeling gaps trigger a new ASC proposal to the ONF or a documented risk acceptance.

Baseline and version-control the plan so scope or LoT changes trigger re-planning.

Third-party components are in scope; their claims must map to ASCs or be independently verified.

Application owner signs off on target LoT and residual risk at planning time.

Implementation is complete only when verified per the ONF verification method and evidence is recorded.

Evidence must be objective, reproducible, and linked to the ASC identifier and ANF version.

When an ASC cannot be met: tailor with justification, substitute with demonstrated equivalence, or obtain formal risk acceptance.

Controls span design, code, configuration, deployment, and operations; single-layer verification is insufficient.

Enforcement mechanisms (build gates, automated policy checks) make coding and configuration standards effective.

Reuse ASCs across applications, recording per-application evidence in each ANF.

Evidence from non-production environments may not demonstrate production control where configuration diverges.

Track each ASC as planned, implemented, verified, or accepted risk so achieved LoT is computed, not estimated.

Response phases: detection and triage, containment, eradication, recovery, post-incident review, each with entry and exit criteria.

Triage severity is set by affected application, affected ASCs, data sensitivity, and current achieved LoT.

Containment options include feature disablement, credential revocation, edge virtual patching, or taking the application offline, with recorded justification.

Incident records link to affected ANF entries so ineffective controls are flagged and LoT reassessed.

Recurring root causes indicate a defective ASC specification or verification method and feed back to the ONF.

Notification obligations are determined by data type and jurisdiction and decided during planning.

Preserve evidence integrity with chain of custody, hashes, and timestamps for legal and audit use.

Post-incident corrective actions are tracked to closure and verified, not merely logged.

Verification confirms implementation per the ONF method; monitoring confirms continued operation over time.

Verification methods include inspection, analysis, demonstration, and testing, each with a defined acceptance criterion.

Achieved LoT reflects verified ASCs against target LoT; unverified controls do not count.

Monitoring signals (telemetry, drift detection, vulnerability feeds, access anomalies) should map to the ASC they evidence.

Independent verification reduces self-assessment bias and is expected at higher target LoT.

Verification results are time-stamped and version-linked to the current ANF version.

Metrics should express control objectives (percent ASCs verified, mean time to detect drift), not raw activity counts.

Configuration drift from the verified baseline reopens the affected ASC and requires re-verification.

The ONF changes from audit findings, incidents, and verification gaps, with version control and justification.

Audit compares ANF against ONF and deployed reality against ANF; claimed-but-absent controls are a common finding.

Each sampled control must trace to an ASC identifier, ANF version, verification record, and deployed artifact.

Trend analysis across applications reveals systemic weaknesses invisible in per-application review.

Risk acceptances require owner, rationale, and review or expiry date; expiry reopens the gap.

Improvement is measured by achieved versus target LoT movement and reduced repeat findings.

Revising an ONF ASC requires reassessing and re-verifying affected ANFs and recording LoT impact.

Audit sampling rationale and population are documented in advance so results are reproducible.

ONF is organization-wide and reusable; ANF is application-specific and instantiated from the ONF.

An ASC is a reusable control specification with an identifier, objective, verification method, and level of trust.

Target LoT is what stakeholders require; achieved LoT is what verification evidence supports.

Business context (data sensitivity, exposure, criticality) drives target LoT and control selection.

The application owner is accountable for the application's risk and LoT; the application security manager maintains the ONF.

Trust requires recorded evidence from the specified verification method, not assertion.

Control rigor scales with target LoT and criticality (proportionality).

Roles, responsibilities, and sign-off authority are defined in the ONF.

Define business context and target LoT before selecting controls.

Derive the ANF by filtering and tailoring ONF ASCs to the application's context.

Tailoring must preserve traceability to the ONF ASC objective and verification method.

Schedule verification activities with owners and timing across the lifecycle, not only at release.

Threat modeling gaps trigger a new ASC proposal to the ONF or a documented risk acceptance.

Baseline and version-control the plan so scope or LoT changes trigger re-planning.

Third-party components are in scope; their claims must map to ASCs or be independently verified.

Application owner signs off on target LoT and residual risk at planning time.

Implementation is complete only when verified per the ONF verification method and evidence is recorded.

Evidence must be objective, reproducible, and linked to the ASC identifier and ANF version.

When an ASC cannot be met: tailor with justification, substitute with demonstrated equivalence, or obtain formal risk acceptance.

Controls span design, code, configuration, deployment, and operations; single-layer verification is insufficient.

Enforcement mechanisms (build gates, automated policy checks) make coding and configuration standards effective.

Reuse ASCs across applications, recording per-application evidence in each ANF.

Evidence from non-production environments may not demonstrate production control where configuration diverges.

Track each ASC as planned, implemented, verified, or accepted risk so achieved LoT is computed, not estimated.

Response phases: detection and triage, containment, eradication, recovery, post-incident review, each with entry and exit criteria.

Triage severity is set by affected application, affected ASCs, data sensitivity, and current achieved LoT.

Containment options include feature disablement, credential revocation, edge virtual patching, or taking the application offline, with recorded justification.

Incident records link to affected ANF entries so ineffective controls are flagged and LoT reassessed.

Recurring root causes indicate a defective ASC specification or verification method and feed back to the ONF.

Notification obligations are determined by data type and jurisdiction and decided during planning.

Preserve evidence integrity with chain of custody, hashes, and timestamps for legal and audit use.

Post-incident corrective actions are tracked to closure and verified, not merely logged.

Verification confirms implementation per the ONF method; monitoring confirms continued operation over time.

Verification methods include inspection, analysis, demonstration, and testing, each with a defined acceptance criterion.

Achieved LoT reflects verified ASCs against target LoT; unverified controls do not count.

Monitoring signals (telemetry, drift detection, vulnerability feeds, access anomalies) should map to the ASC they evidence.

Independent verification reduces self-assessment bias and is expected at higher target LoT.

Verification results are time-stamped and version-linked to the current ANF version.

Metrics should express control objectives (percent ASCs verified, mean time to detect drift), not raw activity counts.

Configuration drift from the verified baseline reopens the affected ASC and requires re-verification.

The ONF changes from audit findings, incidents, and verification gaps, with version control and justification.

Audit compares ANF against ONF and deployed reality against ANF; claimed-but-absent controls are a common finding.

Each sampled control must trace to an ASC identifier, ANF version, verification record, and deployed artifact.

Trend analysis across applications reveals systemic weaknesses invisible in per-application review.

Risk acceptances require owner, rationale, and review or expiry date; expiry reopens the gap.

Improvement is measured by achieved versus target LoT movement and reduced repeat findings.

Revising an ONF ASC requires reassessing and re-verifying affected ANFs and recording LoT impact.

Audit sampling rationale and population are documented in advance so results are reproducible.

ONF is organization-wide and reusable; ANF is application-specific and instantiated from the ONF.

An ASC is a reusable control specification with an identifier, objective, verification method, and level of trust.

Target LoT is what stakeholders require; achieved LoT is what verification evidence supports.

Business context (data sensitivity, exposure, criticality) drives target LoT and control selection.

The application owner is accountable for the application's risk and LoT; the application security manager maintains the ONF.

Trust requires recorded evidence from the specified verification method, not assertion.

Control rigor scales with target LoT and criticality (proportionality).

Roles, responsibilities, and sign-off authority are defined in the ONF.

Define business context and target LoT before selecting controls.

Derive the ANF by filtering and tailoring ONF ASCs to the application's context.

Tailoring must preserve traceability to the ONF ASC objective and verification method.

Schedule verification activities with owners and timing across the lifecycle, not only at release.

Threat modeling gaps trigger a new ASC proposal to the ONF or a documented risk acceptance.

Baseline and version-control the plan so scope or LoT changes trigger re-planning.

Third-party components are in scope; their claims must map to ASCs or be independently verified.

Application owner signs off on target LoT and residual risk at planning time.

Implementation is complete only when verified per the ONF verification method and evidence is recorded.

Evidence must be objective, reproducible, and linked to the ASC identifier and ANF version.

When an ASC cannot be met: tailor with justification, substitute with demonstrated equivalence, or obtain formal risk acceptance.

Controls span design, code, configuration, deployment, and operations; single-layer verification is insufficient.

Enforcement mechanisms (build gates, automated policy checks) make coding and configuration standards effective.

Reuse ASCs across applications, recording per-application evidence in each ANF.

Evidence from non-production environments may not demonstrate production control where configuration diverges.

Track each ASC as planned, implemented, verified, or accepted risk so achieved LoT is computed, not estimated.

Response phases: detection and triage, containment, eradication, recovery, post-incident review, each with entry and exit criteria.

Triage severity is set by affected application, affected ASCs, data sensitivity, and current achieved LoT.

Containment options include feature disablement, credential revocation, edge virtual patching, or taking the application offline, with recorded justification.

Incident records link to affected ANF entries so ineffective controls are flagged and LoT reassessed.

Recurring root causes indicate a defective ASC specification or verification method and feed back to the ONF.

Notification obligations are determined by data type and jurisdiction and decided during planning.

Preserve evidence integrity with chain of custody, hashes, and timestamps for legal and audit use.

Post-incident corrective actions are tracked to closure and verified, not merely logged.

Verification confirms implementation per the ONF method; monitoring confirms continued operation over time.

Verification methods include inspection, analysis, demonstration, and testing, each with a defined acceptance criterion.

Achieved LoT reflects verified ASCs against target LoT; unverified controls do not count.

Monitoring signals (telemetry, drift detection, vulnerability feeds, access anomalies) should map to the ASC they evidence.

Independent verification reduces self-assessment bias and is expected at higher target LoT.

Verification results are time-stamped and version-linked to the current ANF version.

Metrics should express control objectives (percent ASCs verified, mean time to detect drift), not raw activity counts.

Configuration drift from the verified baseline reopens the affected ASC and requires re-verification.

The ONF changes from audit findings, incidents, and verification gaps, with version control and justification.

Audit compares ANF against ONF and deployed reality against ANF; claimed-but-absent controls are a common finding.

Each sampled control must trace to an ASC identifier, ANF version, verification record, and deployed artifact.

Trend analysis across applications reveals systemic weaknesses invisible in per-application review.

Risk acceptances require owner, rationale, and review or expiry date; expiry reopens the gap.

Improvement is measured by achieved versus target LoT movement and reduced repeat findings.

Revising an ONF ASC requires reassessing and re-verifying affected ANFs and recording LoT impact.

Audit sampling rationale and population are documented in advance so results are reproducible.