ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

ISO/IEC 27034 defines an Application Security Control (ASC) Library as part of the Organization Normative Framework. The ASC Library holds the detailed, application-focused security controls that a project must adopt and therefore validate through functional security testing. While the Organization Normative Framework provides overall governance, the ASC Library is the specific artifact containing the individual controls. ISO/IEC 27002 Annex A offers broad, organization-level controls, and the OSSTMM Attack Surface Matrix is from a different methodology entirely, so neither supplies the application-specific controls required by ISO/IEC 27034.