What Must Be Done Here? Using a Bounded Application-Security Ontology at the Point of Change

Summary

This paper presents a use case for AppSec Core, a bounded application-security ontology, to make engineering-actionable requirements from scattered security authorities addressable as a typed working set. It shows two entry points: a forward path from a code change to its governing obligations, and an inverse path from a normative duty such as NIS2 to the engineering obligations it implies across domain slices.