In each iteration the organisation determines application security goals, fixes what the iteration covers and how it will be rolled out (approved by accountable management and communicated), defines its application security posture, priorities and plans, lists the information its applications handle, classifies it for security and ties that list into its information architecture, and designs the in-scope ONF elements. Inputs include risk management outcomes, needs recorded by the improvement and audit processes, information security audit results and current knowledge of attacks. The committee prioritises, assigns responsibility and resources, validates designs, integrates ONF processes into business processes, aligns the application security policy with other policies and the ISMS, aligns with security, information and business architecture, aligns risk indicators and objectives, ensures legal and regulatory compliance, communicates outcomes, designates the ONF repository, sets up communication and reporting, and issues an application security management policy. Auditors verify the approved scope and the correctness of the designs.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.