ISO/IEC 27034-5:2017

Overview

ISO/IEC 27034-5:2017 is part of the ISO/IEC 27034 series on application security. It documents the minimal set of essential attributes and a standardized data structure for Application Security Controls (ASCs) and describes the Application Security Life Cycle Reference Model (ASLCRM) - its activities, roles and processes. The standard promotes consistent creation, exchange, protection and reuse of ASCs to reduce cost and improve application-level security governance.

Key topics and technical requirements

• ASC information requirements - a defined, minimal set of essential attributes that should accompany an ASC to ensure it is usable, verifiable and reusable across projects and tools.
• Integrity assurance - guidance that ASC data must support integrity mechanisms (for example, recognized signing or verification methods) so controls can be trusted.
• Multilingual / multiregional data representation - support for representing ASC metadata in multiple languages or regions to enable global reuse.
• ASC data structure recommendations - principles for structuring ASC content to facilitate exchange (interoperability between tools/suppliers) and self-containedness (packaged controls include required metadata and context).
• Application Security Life Cycle Reference Model (ASLCRM) - detailed activities and roles across layers such as Application Management, Provisioning & Operation, Infrastructure Management and Application Audit. This includes processes for initiating, planning, executing, monitoring, transitioning, utilization, archival and destruction of application assets.
• Roles and ASC package - responsibilities for managers, ONF (Organization Normative Framework) committees, domain experts, suppliers and acquirers; and guidance on packaging ASCs for distribution and lifecycle mapping.
• Normative linkage - aligns with ISO/IEC 27034-1 (overview and concepts) and other parts of the 27034 suite.

Practical applications

• Standardizing how application security controls are described, stored and exchanged across organizations and vendors.
• Building an ASC library or repository where approved controls are discoverable and reusable across projects.
• Selecting or developing security tooling that interoperates using a common ASC data structure and exchange protocol.
• Supporting audits, provisioning and lifecycle activities by mapping ASC responsibilities into organizational processes.
• Reducing duplication and implementation cost by reusing verified, integrity-protected controls.

Who should use it

• Managers responsible for enterprise application security governance.
• ONF committees that manage organizational ASC libraries and approval processes.
• Domain experts who develop and validate ASCs.
• Tool vendors and ASC suppliers creating, signing and distributing controls.
• Acquirers integrating third‑party ASCs and mapping them to internal lifecycles.

Related standards

• ISO/IEC 27034-1 (Overview and concepts) - foundational concepts referenced normatively by ISO/IEC 27034-5.