Overview
ISO/IEC 27034-5:2017 is part of the ISO/IEC 27034 series on application security. It documents the minimal set of essential attributes and a standardized data structure for Application Security Controls (ASCs) and describes the Application Security Life Cycle Reference Model (ASLCRM) - its activities, roles and processes. The standard promotes consistent creation, exchange, protection and reuse of ASCs to reduce cost and improve application-level security governance.
Key topics and technical requirements
- ASC information requirements - a defined, minimal set of essential attributes that should accompany an ASC to ensure it is usable, verifiable and reusable across projects and tools.
- Integrity assurance - guidance that ASC data must support integrity mechanisms (for example, recognized signing or verification methods) so controls can be trusted.
- Multilingual / multiregional data representation - support for representing ASC metadata in multiple languages or regions to enable global reuse.
- ASC data structure recommendations - principles for structuring ASC content to facilitate exchange (interoperability between tools/suppliers) and self-containedness (packaged controls include required metadata and context).
- Application Security Life Cycle Reference Model (ASLCRM) - detailed activities and roles across layers such as Application Management, Provisioning & Operation, Infrastructure Management and Application Audit. This includes processes for initiating, planning, executing, monitoring, transitioning, utilization, archival and destruction of application assets.
- Roles and ASC package - responsibilities for managers, ONF (Organization Normative Framework) committees, domain experts, suppliers and acquirers; and guidance on packaging ASCs for distribution and lifecycle mapping.
- Normative linkage - aligns with ISO/IEC 27034-1 (overview and concepts) and other parts of the 27034 suite.
Practical applications
- Standardizing how application security controls are described, stored and exchanged across organizations and vendors.
- Building an ASC library or repository where approved controls are discoverable and reusable across projects.
- Selecting or developing security tooling that interoperates using a common ASC data structure and exchange protocol.
- Supporting audits, provisioning and lifecycle activities by mapping ASC responsibilities into organizational processes.
- Reducing duplication and implementation cost by reusing verified, integrity-protected controls.
Who should use it
- Managers responsible for enterprise application security governance.
- ONF committees that manage organizational ASC libraries and approval processes.
- Domain experts who develop and validate ASCs.
- Tool vendors and ASC suppliers creating, signing and distributing controls.
- Acquirers integrating third‑party ASCs and mapping them to internal lifecycles.
Related standards
Open preview (PDF)Information technology — Security techniques — Application security — Part 5: Protocols and application security controls data structure
