Fundamental principles and concepts of application security
What the exam tests
This domain checks whether you can define application security in ISO/IEC 27034 terms and navigate its framework architecture. Expect questions on the Organization Normative Framework (ONF), Application Normative Framework (ANF), Application Security Controls (ASCs), and the Application Security Control Library (ASCL).
Core concepts
ISO/IEC 27034 treats application security as the protection of an application's information and data from unauthorized access, use, disclosure, disruption, modification, or destruction. It is risk-based, business-context driven, and applied across the Application Security Life Cycle (ASLC). The standard is a multi-part framework, not a certification scheme. Part 1 gives overview and concepts; Part 2 the ONF; Part 3 the Application Security Management Process (ASMP); Part 4 validation and verification; Part 5 the ASC data structure; Part 7 an assurance prediction framework.
The ONF is the organization-wide repository of ASCs, processes, and roles. The ANF is the subset of the ONF selected for one application. An ASC is a control that addresses a security requirement; it carries attributes such as identifier, objective, implementation guidance, and verification method. The ASCL is the library of ASCs. A Targeted Assurance Level (TAL) expresses how much confidence the organization needs that the ANF is implemented effectively.
Worked example
A bank builds a mobile payment app. The security team reviews the ONF, selects ASCs for strong authentication, encryption, and transaction logging, and assembles the ANF. Because payment data is high-value, it sets a high TAL. The ANF becomes the agreed scope for implementation and verification.
Traps
Confusing ONF (organization) with ANF (application) is the most common error. Another is treating 27034 as a prescriptive checklist or certification; it is a framework for building your own normative framework. Ignoring business context when selecting ASCs also loses marks.