• Flag for EnglishEnglish
    Flag for FrançaisFrançais
    Flag for العربيةالعربية
    Flag for DutchDutch
    Flag for EnglishEnglish

Building the ONF

Application Security

Further information

Speak to a GRC expert

If you have any questions or need assistance, please don't hesitate to contact us.

Share on social media

ONF (Organizational Normative Framework) Structure in ISO 27034

Policies define the organization's formal commitments to application security.
They reflect legal, regulatory, and business-driven security requirements.
Policies guide all security activities across the application lifecycle.

Policies are endorsed by top management to ensure enforcement.
They serve as the foundation for developing standards and procedures.
Well-defined policies create consistency and reduce decision-making uncertainty.

Image
Image

ONF Components of ISO 27034

ONF components help structure application security processes across the development lifecycle.

  • Defined Security Policies

    Establishes rules and responsibilities for maintaining application-level security standards.

  • Documented Implementation Guidelines

    Offers best practices and methods for secure application development and deployment.

  • Repeatable Security Procedures

    Ensures consistent execution of security tasks across development environments.

ONF vs Policies in ISO 27034

ONF includes multiple components, while policies are just one element.

ONF is Broader

Includes policies, standards, procedures, and guidelines.

image

Policies Define Intent

State organizational goals for application security.

image

Enables Execution

Operationalizes security across development processes.

image

Policies Guide ONF

Act as the foundation for ONF components.

image
image

Related pages

Continue Reading

Ready to learn more about Security Context Integration?