ISO/IEC 27034 is an international standard that focuses on application security, designed to help organizations embed security practices throughout the application life cycle. It provides a framework that integrates security controls at each stage of development, operation, and maintenance to ensure that the information processed, stored, or transmitted by applications is adequately protected. ISO/IEC 27034 is divided into several parts, each focusing on a specific aspect of application security:

• Part 1: Overview and concepts ― Introduces key concepts like the Organization Normative Framework (ONF) and Application Security Controls (ASCs)
• Part 2: Organization Normative Framework ― Details the ONF, a centralized repository for security practices and policies, aligning these with organizational goals and regulatory requirements
• Part 3: Application security management process ― Provides guidance on managing security risks across the application life cycle, including defining roles, conducting risk assessments, and monitoring controls
• Part 5: Protocols and ASCs data structure ― Provides protocols and data structures to standardize ASC formats for interoperability
• Part 5-1: Protocols and ASCs data structure, XML schemas ― Adds XML schemas to Part 5, allowing structured, standardized representation of ASCs and facilitating data exchange
• Part 6: Case studies ― Offers case studies and examples for applying security controls in specific application types
• Part 7: Assurance prediction framework ― Offers models for predicting application security assurance based on implemented controls