ISO/IEC 27034-3:2018 情報技術—アプリケーションセキュリティ—パート3：アプリケーションセキュリティ管理プロセス | ページ 6

3.1

application security audit

AS audit

systematic, independent and documented process for obtaining audit evidence from the verification of application security activities, and evaluating it objectively to determine the extent to which the audit criteria required by an application security authority are fulfilled

3.2

application security verification

process of reviewing and verifying security activity outcomes by performing the associated verification-measurement activity

Note 1 to entry: For an organization, required ONF elements and security activities meet ONF specifications and are compliant with ONF management process.

Note 2 to entry: For an application, a security activity and its associated verification-measurement activity may be part of an ASC.

3.3

critical information

information which, if compromised, can result in an unacceptable risk

3.4

domain expert

person who is an expert in a particular domain, area or topic

3.5

risk management

coordinated activities to direct and control an organization with regard to risk

Note 1 to entry: This document uses the term “process” to describe risk management overall. The elements within the risk management process are termed “activities”.

[SOURCE:ISO Guide 73:2009, 2.1]