ISO/IEC 27034-2:2015 Application security, Part 2: Organization normative framework
Clause 5.5: ONF elements (context components, repositories, ASC library, life cycle models, processes) – ISO/IEC 27034-2:2015 Application security, Part 2: Organization normative framework

ISO/IEC 27034-2:2015 Application security, Part 2: Organization normative framework 5.5.10: Application security life cycle model

What does 5.5.10 require?

This component maps one or more life cycles actually used in the organisation onto the reference model, so the organisation can discover and formally describe the life cycle models it already uses, complete them with layers, stages, activities or actors where needed, and communicate and integrate ASCs into each team's familiar life cycle. ASCs, which reference the standardised model, are translated before being communicated to teams; the mapping can be as simple as the enumeration tables in Part 5-1 extended by one column for each life cycle the organisation runs. Provisioning stages include all provisioning activities and operation stages all operation activities, and the model is improved from audit findings, risk results, the organisation's methodologies, its ASCs and stakeholder feedback.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 1 control

  • 8.25 Secure development life cycle

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Clause 5.5: ONF elements (context components, repositories, ASC library, life cycle models, processes) – ISO/IEC 27034-2:2015 Application security, Part 2: Organization normative framework

Query this from an agent

The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.