PECB Certified ISO/IEC 27034 Lead Application Security Auditor

• Duration: 5 days

Course Overview

The PECB Certified ISO/IEC 27034 Lead Application Security Auditor training course equips participants with the knowledge and practical skills required to plan, conduct, manage, and follow up on application security audits based on the ISO/IEC 27034 family of standards.

This five-day training course provides a comprehensive understanding of application security principles, auditing methodologies, and conformity assessment practices. Participants will learn how to evaluate an organisation’s Organization Normative Framework (ONF), Application Security Management Process (ASMP), associated application security processes, and the level of trust assigned to applications.

The course covers the complete application security audit lifecycle, including audit initiation, planning, evidence collection and validation, evaluation of conformity, reporting, and follow-up. It also introduces relevant auditing principles and guidance from ISO/IEC 17021-1 and ISO 19011 to support effective and structured audit practices.

Upon successful completion of the training course and examination, participants may apply for the PECB Certified ISO/IEC 27034 Lead Application Security Auditor credential, subject to the applicable certification requirements.

Learning Objectives

Upon successful completion of this training course, participants will be able to:

• Explain the fundamental concepts and principles of application security based on ISO/IEC 27034.
• Interpret ISO/IEC 27034 guidelines from an application security auditor’s perspective.
• Evaluate an organisation’s application security conformity against relevant ISO/IEC 27034 guidelines.
• Understand the principles and requirements of effective application security auditing.
• Plan, initiate, conduct, and close application security audits in accordance with applicable audit requirements and best practices.
• Evaluate the Organization Normative Framework (ONF) and Application Security Management Process (ASMP).
• Assess application security evidence and evaluate actual and targeted levels of trust.
• Prepare and distribute audit reports and support the resolution of nonconformities.
• Manage an application security audit programme and contribute to continual improvement.

Target Audience

This training course is intended for:

• Auditors seeking to perform and lead application security audits.
• Information security professionals responsible for application security governance and compliance.
• IT professionals involved in application security management and assurance.
• Consultants and managers conducting application security assessments.
• Members of internal and external audit teams.
• Professionals preparing to undertake ISO/IEC 27034 application security audits.
• Individuals responsible for evaluating application security controls, processes, and conformity.

Course Content

Day 1: Introduction to Application Security and the ISO/IEC 27034 Family of Standards

• Training course objectives, structure, and methodology.
• Fundamental concepts and principles of application security.
• Introduction to the ISO/IEC 27034 family of standards.
• Relationship between ISO/IEC 27034 and other relevant standards.
• Overview of ISO/IEC 27034 requirements and guidelines.
• Application security throughout the software life cycle.
• Introduction to application security governance and management frameworks.

Day 2: Initiating and Preparing an Application Security Audit

• Understanding targeted and actual levels of application trust.
• Fundamental audit concepts and principles.
• Establishing initial contact and audit authority.
• Determining audit feasibility, agreements, and constraints.
• Defining audit objectives, scope, criteria, and responsibilities.
• Planning and preparing an application security audit.
• Developing audit activities and preparing relevant documentation.

Day 3: Conducting an Application Security Audit

• Evaluating the Organization Normative Framework (ONF) management process.
• Evaluating the Application Security Management Process (ASMP).
• Assessing application security processes and associated components.
• Initiating audit activities and coordinating with relevant stakeholders.
• Managing audit communication and supervision.
• Collecting and validating audit evidence.
• Evaluating conformity against applicable ISO/IEC 27034 guidelines.
• Documenting findings and identifying potential nonconformities.

Day 4: Reporting, Completing, and Following Up on the Audit

• Finalising audit activities and conducting the closing meeting.
• Preparing and distributing the audit report.
• Documenting audit findings, conclusions, and lessons learned.
• Managing audit evidence and associated records.
• Conducting audit follow-up activities.
• Supporting nonconformity resolution and corrective action verification.
• Reviewing the overall audit process and continual improvement opportunities.
• Certification examination preparation.

Day 5: Certification Examination

• Review of key application security auditing concepts.
• Examination preparation and clarification of key learning areas.
• PECB ISO/IEC 27034 Lead Application Security Auditor certification examination.

Examination and Certification

The PECB ISO/IEC 27034 Lead Application Security Auditor examination evaluates participants’ understanding of application security principles, audit planning, audit execution, evidence evaluation, reporting, and follow-up activities.

The examination covers the following competency domains:

• Domain 1: Fundamental Principles and Concepts of Application Security.
• Domain 2: Application Security Audit Concepts and Principles.
• Domain 3: Initiating an Application Security Audit.
• Domain 4: Preparing an ISO/IEC 27034 Audit.
• Domain 5: Conducting an ISO/IEC 27034 Audit.
• Domain 6: Audit Closure and Follow-up for Application Security.

Examination Duration: 3 Hours

After successfully passing the examination, participants may apply for the relevant PECB certification, subject to the professional experience, application security experience, and other requirements of the selected credential.

Certification Requirements

Candidates may qualify for one of the following credentials, depending on their documented professional experience and application security experience.

1. PECB Certified ISO/IEC 27034 Provisional Application Security Auditor

• Successfully pass the applicable examination or meet the relevant equivalent examination requirements.
• No professional or application security experience is required.
• Sign and comply with the PECB Code of Ethics.

2. PECB Certified ISO/IEC 27034 Application Security Auditor

• Successfully pass the applicable examination or meet the relevant equivalent examination requirements.
• At least two years of professional experience, including one year in application security.
• At least 200 hours of application security experience.
• Sign and comply with the PECB Code of Ethics.

3. PECB Certified ISO/IEC 27034 Lead Application Security Auditor

• Successfully pass the applicable examination or meet the relevant equivalent examination requirements.
• At least five years of professional experience, including two years in application security.
• At least 300 hours of application security experience.
• Sign and comply with the PECB Code of Ethics.

4. PECB Certified ISO/IEC 27034 Senior Lead Application Security Auditor

• Successfully pass the applicable examination or meet the relevant equivalent examination requirements.
• At least ten years of professional experience, including seven years in application security.
• At least 1,000 hours of application security experience.
• Sign and comply with the PECB Code of Ethics.

The final credential awarded is subject to PECB’s applicable Certification Rules and Policies and verification of the candidate’s qualifications and experience.

Course Benefits

• Develop advanced auditing skills for application security based on ISO/IEC 27034.
• Gain the knowledge required to plan, conduct, manage, and report application security audits.
• Understand how to evaluate application security frameworks, processes, and controls.
• Strengthen capabilities in audit evidence collection, conformity assessment, and nonconformity management.
• Learn how to assess application security management practices and levels of application trust.
• Apply recognised auditing principles and guidelines to support effective audit practices.
• Receive comprehensive training materials containing over 450 pages of information, practical examples, exercises, and quizzes.
• Obtain an attestation of course completion worth 31 Continuing Professional Development (CPD) credits, subject to applicable attendance requirements.
• Benefit from examination and certification fees included in the training course price.
• Access one free examination retake within 12 months, subject to PECB’s applicable conditions. For courses completed through a PECB partner, the free retake is subject to the stated coupon and examination policies.

Duration

• Training Duration: 5 Days
• Examination Duration: 3 Hours

Prerequisites

No specific formal prerequisites are stated for participating in this training course. However, a basic understanding of application security, information security management, auditing principles, and software development processes may help participants gain greater value from the programme.

Professional experience and documented application security experience are required for the higher-level certification credentials, as specified by PECB.

Certification Body

PECB (Professional Evaluation and Certification Board)

PECB provides professional training, examination, and certification services across information security, application security, auditing, risk management, governance, and related professional disciplines.