ASD ISM 1422 Prevent unauthorised access to software source
What it says
Unauthorised access to the authoritative source for software is prevented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only authorised users can access the main software source to keep it secure.
Unauthorised access to your software's main source can be a major risk because it allows outsiders to change, steal, or damage your software. This is crucial to prevent because it could lead to serious issues like financial loss, data breaches, and even loss of customer trust.
Free. Save your status, tasks and notes.
Why it matters
If access to the authoritative source is not restricted, attackers or insiders can modify code or steal IP, leading to compromised integrity, data exposure, and reputational harm.
How to implement
System owners should ensure a list of authorised users is maintained and regularly updated.
This can be done by identifying who needs access to the software's source based on their job roles and responsibilities, and ensuring only they are on this list.
IT teams should set up secure access controls for the software's source.
This involves using strong passwords and regularly changing them, and where possible, using multi-factor authentication, which means verifying identity using more than one method.
Managers should train staff on the importance of access control.
Organise regular sessions to educate staff about the risks of unauthorised access and how to spot suspicious activity.
Procurement teams should work with IT to select tools or services that monitor access to the software source.
This could include setting up alerts when unusual activity is detected, so any risks are quickly addressed.
Security officers should regularly review and audit access logs.
This involves checking who accessed the software source and when, to spot any unauthorised access attempts quickly.
Keep it running
Enforce least-privilege to source repos (MFA, RBAC), review access regularly, and monitor/audit commits in version control to detect and remove unauthorised changes quickly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The authorised user access list: Request to see the document or system record listing everyone who can access the software source.
Look at
The list's currentness and authorisation for each entry.
Good evidence
An up-to-date list signed off by management.
- Check 2 of 5What an auditor asks for
Ask for
Access control policy: Request the document outlining access procedures to the software source.
Look at
Specific access control measures outlined like password policies and authentication methods.
Good evidence
A policy document that aligns with current best practices.
- Check 3 of 5What an auditor asks for
Ask for
To see training records for staff: Request proof of training sessions conducted on access control importance.
Look at
Attendance records and training content.
Good evidence
Documented records showing completed regular training sessions.
- Check 4 of 5What an auditor asks for
Ask for
Monitoring and alert records: Request logs or reports on how access to the software source is monitored.
Look at
Alert instances and responses documented.
Good evidence
A system or log showing active monitoring and timely response to alerts.
- Check 5 of 5What an auditor asks for
Ask for
To review recent access logs: Request logs that detail recent access events for the software source.
Look at
Unusual patterns or unauthorised attempts.
Good evidence
Comprehensive logs with no unexplained anomalies in access patterns.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.3.
ISM-1422 requires that unauthorised access to the authoritative source for software, such as the source code repository, is prevented. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets according to an access control policy, which includes controlling access to source repositories. Annex A 8.3 is broader as it applies to all information assets, not specifically the authoritative software source.
This control partially meets A.8.4.
ISM-1422 mandates preventing unauthorised access to the software source to protect its integrity and confidentiality. ISO/IEC 27001:2022 Annex A 8.4 requires appropriate management of read and write access to source code and related tools. While both focus on source code access, Annex A 8.4 explicitly covers read/write management.
This control supports A.5.18.
ISM-1422 depends on correctly provisioning and maintaining authorisations to the authoritative software source. ISO/IEC 27001:2022 Annex A 5.18 mandates access rights lifecycle management, ensuring proper authorisation exists over time, crucial to maintaining controlled access to the repository.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.