Information technology — Application security —Part 3: Application security management process Technologie de l’information — Sécurité des applications — Partie 3: Processus de gestion de la sécurité d'une application INTERNATIONAL STANDARDISO/IEC27034-3 Reference numberISO/IEC 27034‑3:2018(E)First edition2018‑05‑25 © ISO/IEC 2018 ii © ISO/IEC 2018 – All rights reserved COPYRIGHT PROTECTED DOCUMENT © ISO/IEC 2018, Published in SwitzerlandAll rights reserve Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 • CP 401CH‑1214 Vernier, Geneva, SwitzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyright@iso.orgwww.iso.org ISO/IEC 27034-3:2018(E) ISO/IEC 27034-3:2018(E) Forewor .......................................................................................................................................................................................................................................... v Introduction ................................................................................................................................................................................................................................ vi 1 Scope ................................................................................................................................................................................................................................. 1 2 Normative references ...................................................................................................................................................................................... 1 3 Terms and definitions ..................................................................................................................................................................................... 1 4 Abbreviated terms .............................................................................................................................................................................................. 2 5 Application Security Management Process .............................................................................................................................. 2 5.1 General ........................................................................................................................................................................................................... 2 5.2 Purpose .......................................................................................................................................................................................................... 4 5.3 Principles and concepts .................................................................................................................................................................. 4 5.3.1 General ...................................................................................................................................................................................... 4 5.3.2 Clearly communicate roles and responsibilities .................................................................................. 4 5.3.3 Relationship of the ASMP with the Organizational Normative Framework (ONF) ........................................................................................................................................................... 4 5.3.4 Use approved tools ......................................................................................................................................................... 5 5.3.5 Level of Trust ................