The Organizational Normative Framework is the organization-wide structure containing containers for all application-security best-practice components that the organization catalogs and reuses. Application-specific frameworks draw only the applicable subset from that complete organizational framework. ISO/IEC 27034-2 provides the detailed description and implementation guidance for the Organization Normative Framework.
Community Discussion