Application security · PECB Authorized Partner

ISO/IEC 27034: security throughout the application life cycle.

A secure application needs more than a test just before release. Choose the learning path that helps you understand security requirements, establish consistent processes or assess how those processes are put into practice.

Compare learning paths Discuss your needs

Move from isolated measures to reliable processes

The ISO/IEC 27034 series supports the organisation of application security: from shared policies and application-specific requirements to the verification of security controls. It covers internally developed, purchased and externally developed applications.

Start with your responsibilities. Do you coordinate business teams, developers and security specialists? Do you establish responsibilities and evidence? Or do you assess whether those processes operate effectively? The three PECB courses address different perspectives.

Choose your application security learning path

Foundation provides orientation. Lead Implementer focuses on implementation; Lead Auditor develops the assessment perspective. Match the course to your role and prior knowledge.

PECB course

ISO/IEC 27034 Foundation

Understand the concepts and contribute

For development, IT, business representatives and project teams.

Content and focus: Core concepts, organisational and application-level frameworks, security controls and verification.
Prior knowledge: No formal course prerequisites.
Duration: 2 days

PECB course

ISO/IEC 27034 Lead Application Security Implementer

Establish security processes

For AppSec leads, development managers and consultants.

Content and focus: Plan application security, introduce controls, monitor implementation and organise improvement.
Prior knowledge: General knowledge of application security and ISO/IEC 27034.
Duration: 5 days · 4 training days + exam

PECB course

ISO/IEC 27034 Lead Application Security Auditor

Assess implementation using evidence

For auditors and security or governance professionals.

Content and focus: Plan, conduct, document and follow up audits of application security processes.
Prior knowledge: Familiarity with application security and in-depth knowledge of its principles.
Duration: 5 days · 4 training days + exam

See the individual course page for the current price and available formats.

Three questions to guide your decision

Use these questions in a discussion with your manager or team.

What should change in your daily work?

Name a concrete task: agreeing requirements, structuring approvals or carrying out an audit assignment. This makes the intended learning outcome easier to discuss.

Who needs a shared foundation?

Product owners, developers, procurement and security teams view the same application from different angles. A shared vocabulary makes collaboration easier.

Which results need to be traceable?

Consider which decisions and checks you will need to explain later. Bring an anonymised description of your situation to the course consultation.

Learn live and discuss your questions

Full courses take place live online or in person. Discuss your professional questions with the trainer; your learner portal provides practical information and materials.

Teaching is available in German, English or Hungarian. Hungarian refers to the teaching language; available examination and material languages are agreed separately. In-person training includes catering and time to talk with the trainer after class, without overnight accommodation.

Understand what your credential demonstrates

Attendance, passing the exam and receiving a PECB credential are separate steps. Apply to PECB after passing. The level awarded depends on its requirements and any required professional, project or audit experience. A Lead course alone does not confer a Lead credential.

Questions about ISO/IEC 27034

Is this a programming or penetration testing course?

The focus is systematic application security and its processes. These courses do not replace specialist programming-language training or a practical penetration testing course.

What do ONF, ANF and ASC mean?

ONF is the organisation-wide framework, ANF is its application-specific form, and ASCs are application security controls. The course explains how these concepts fit together.

Do I need to complete Foundation first?

Foundation is one possible starting point. The stated prior knowledge matters for the Lead courses. We can help you assess whether your practical experience provides an appropriate basis.

When should I choose Implementer rather than Auditor?

Choose the implementation perspective when you design and introduce processes. The audit perspective suits responsibilities that involve assessing existing practice against requirements and evidence.

Does the series apply to purchased software?

Yes. Application security also matters when procuring software, outsourcing development and using external applications. Your organisation’s responsibilities remain central.

Will our software be ISO 27034 certified after the course?

No. ISO/IEC 27034 is not a certifiable management system standard. PECB training and personal credentials must be distinguished from certification of an organisation or its software.

Does passing the exam automatically give me a Lead credential?

No. Each PECB credential has its own requirements. Lead levels generally include relevant experience. Discuss the credential you want to achieve with us before booking.

Where can I find the format, price and date?

Open the relevant course page and select an offered format. We will agree the date and language with you. An additional short examination preparation session does not replace the full course.

What would you like to take responsibility for next?

Tell us about your role, experience and goal. We will help you choose a course, format and teaching language. For teams, we take different responsibilities into account.

Arrange a consultation

Self-employed in Germany? Ask us about KOMPASS before booking. A KOMPASS advisory point assesses your individual eligibility and the proposed training.

All courses

Official course information

Course information checked on 31 October 2026.