-1

I'm studying for the CCSP exam and I'm confused with some of the terminologies between Organization normative framework and application normative framework.

The training material defines them as:

Organization normative framework: An organization-wide framework where all application security best practices recognized by the organization are stored.

Application normative framework: A set of application security controls and application security processes that apply to a particular application, based on its contexts, specifications, and it's development & operational processes (a.k.a application lifecycle).

I get that the application normative framework is limited to just security controls for ONE application... and that it fits inside the organization normative framework... But is that all that the ONF is? Is the ONF just a bucket holding smaller buckets? I get the unconfirmed sense that the ONF has a LOT more to it and may contain other information not related to application security.

I asked Mr Google about this and it's hard to find an authoritative source (without paying $$$ for the ISO 27034 spec).

|improve this question
  • Only in a tiny org could the ONF contain all of the ANF. I'd state it that the ONF includes the Policy, Standards, Guidelines, Requirements, and such that the Applications must abide by. For example, the ONF may say to use certain processes, ciphers, products, etc, and include options, maybe referring to FIPS 140-2. Such as saying to use HTTPS, SSH, SFTP, IPSec, OpenVPN, OpenSSL, etc. The ANF will be more specific about what is in use, for example, they Application might only be using HTTPS and no SSH. – MikeP Apr 26 '18 at 18:41
1

Organization normative framework (ONF) is essentially organizational or Company guidelines/matrix/repository on securing applications controls and process.

Application normative framework is a subset of the ONF that contains the information specific to an application.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.