I'm studying for the CCSP exam and I'm confused with some of the terminologies between Organization normative framework and application normative framework.
The training material defines them as:
Organization normative framework: An organization-wide framework where all application security best practices recognized by the organization are stored.
Application normative framework: A set of application security controls and application security processes that apply to a particular application, based on its contexts, specifications, and it's development & operational processes (a.k.a application lifecycle).
I get that the application normative framework is limited to just security controls for ONE application... and that it fits inside the organization normative framework... But is that all that the ONF is? Is the ONF just a bucket holding smaller buckets? I get the unconfirmed sense that the ONF has a LOT more to it and may contain other information not related to application security.
I asked Mr Google about this and it's hard to find an authoritative source (without paying $$$ for the ISO 27034 spec).