Implementation of application security controls
What implementation means
Implementation turns the Application Normative Framework (ANF) into working controls. Each Application Security Control (ASC) has implementation guidance; the team must follow it or formally record a deviation with risk acceptance. Implementation can be technical (code, configuration), procedural (training, approvals), physical, or hybrid.
Core rules
- Maintain traceability from requirement to ASC to implementation evidence to verification.
- Capture evidence as you build: code review records, static analysis reports, configuration baselines, test results, screenshots, and logs.
- Integrate controls into design, coding, testing, and deployment, not as an afterthought.
- For high Targeted Assurance Levels, require independent review of critical ASCs.
- Update the ANF status only when evidence exists.
Worked example
An ASC requires input validation on all user input. The team adopts a vetted validation library, adds a code review checklist item, runs static analysis, and commissions a penetration test. Evidence includes the SAST report, reviewer sign-off, and a closed penetration-test finding. The ANF entry moves to "implemented and verified" only after all three evidence items are attached.
Traps
Marking an ASC implemented without evidence is a frequent audit finding. Implementing a control that is not in the ANF creates scope creep and untracked risk. Treating procedural ASCs such as security training or change approval as optional also loses marks.