Continual improvement and auditing of application security
Improvement loop
Continual improvement uses audit findings, incident lessons, and metrics to strengthen the Organization Normative Framework (ONF) and Application Normative Frameworks (ANFs). The exam expects a Plan-Do-Check-Act (PDCA) mindset: plan the framework, implement the ANF, check through verification and audit, and act on gaps.
Core rules
- Audit against ISO/IEC 27034 concepts, the organization's own processes, and the ANF commitments.
- Collect objective evidence: records, logs, test reports, and interview notes.
- Classify findings by severity and assign owners and due dates.
- Close the loop by updating the ONF so improvements benefit future applications.
- Track maturity: repeatable, defined, managed, and optimized processes.
Worked example
An internal audit finds that an application's ANF omits an ASC for logging sensitive transactions. The corrective action adds the ASC to the ANF, implements and verifies it, and updates the ONF so all similar applications inherit the control. A follow-up audit confirms closure and the metric "ANF completeness" improves.
Traps
Treating audit as a compliance checkbox rather than a learning input is a common failure. Fixing the single application but not the ONF means the gap recurs elsewhere. Ignoring metrics and incident trends in improvement planning also loses marks.