What is the ISO standard that helps entities to implement security processes, concepts in the application security field ?

  • I Googled "security processes, concepts in the application security field" and got many links to ISO/IEC 27034. Please do some research before posting here else your answers will end up being links to well-known resources (like the answer you accepted). – schroeder Apr 29 '18 at 22:45

You are looking for the ISO/IEC 27034-1:2011. The target audience is:

The following audiences will benefit from ISO/IEC 27034 while carrying out their designated organizational roles:

a) managers;
b) provisioning and operation teams;
c) acquisition personnel;
d) suppliers; and
e) auditors

To understand what this norm is actually for, read the following quote:

The purpose of ISO/IEC 27034 is to assist organizations in integrating security seamlessly throughout the life cycle of their applications by:
a) providing concepts, principles, frameworks, components and processes;
b) providing process-oriented mechanisms for establishing security requirements, assessing security risks, assigning a Targeted Level of Trust and selecting corresponding security controls and verification measures
c) providing guidelines for establishing acceptance criteria to organizations outsourcing the development or operation of applications, and for organizations purchasing from third-party applications;
d) providing process-oriented mechanisms for determining, generating and collecting the evidence needed to demonstrate that their applications can be used securely under a defined environment;
e) supporting the general concepts specified in ISO/IEC 27001 and assisting with the satisfactory implementation of information security based on a risk management approach; and
f) providing a framework that helps to implement the security controls specified in ISO/IEC 27002 and other standards.

ISO/IEC 27034:
a) applies to the underlying software of an application and to contributing factors that impact its security, such as data, technology, application development life cycle processes, supporting processes and actors; and
b) applies to all sizes and all types of organizations (e.g. commercial enterprises, government agencies, non-profit organizations) exposed to risks associated with applications.


ISO/IEC 27034does not:

a) provide guidelines for physical and network security;
b) provide controls or measurements; or
c) provide secure coding specifications for any programming language.

All controls can be found in ISO/IEC 27002 and other standards. Read more towards that in ISO/IEC 27000 and 27001.

All quotes are taken from: ISO/IEC 27034-1:2011(en) Information technology — Security techniques — Application security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.