Skip to content
Technological controls
ISO 27001A.8.4

ISO 27001 Annex A 8.4 Access management for source code and tools

What it says

Read and write access to source code, development tools and software libraries shall be appropriately managed.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Control who can read and change source code to avoid risks and maintain security.

This control is about managing who can see and change the computer code that runs your business. It matters because if the wrong person can get in and change your code, they could break your systems or steal your ideas, causing chaos and potentially costing you money.

Why it matters

If access to source code, libraries and dev tools is not controlled, unauthorised changes may be introduced, causing backdoors, outages, IP theft or breaches.

How to implement

  1. IT manager should ensure that access to source code is limited.

    Set up a system where only certain people can change the code, like a source code management tool. Use passwords or access cards to make sure only these people can access important files.

  2. HR should work with IT to make sure only the right roles have access to development tools and code.

    This means creating clear job descriptions and access levels so everyone knows who should have access to what.

  3. Security officer should implement policies for code changes.

    This involves setting rules about how code can be updated, requiring approval before changes are made. Develop a change control process to manage this, incorporating an approval system.

  4. IT team should maintain an audit log of all code access and changes.

    This means setting up a logging tool to automatically record who accessed what and when. Regularly review these logs to spot any suspicious activity.

  5. Compliance officer should regularly review access rights.

    Conduct checks to ensure that only the necessary personnel can access the code and tools. Adjust access rights promptly if someone leaves the company or changes roles.

Keep it running

Limit repo/tool access via RBAC and least privilege; require MFA and approvals for write access; review access and audit logs regularly; enforce code review and signed commits.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of individuals who have access to the source code.

    Look at

    Their roles and authorisation levels within the company.

    Good evidence

    Roles matching access needs with clear documentation for why access is given.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see the policy on modifying source code.

    Look at

    How changes are authorised and tracked in the system. GOOD policy is one that requires multiple levels of approval before code changes are integrated.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Logs of source code access over the past month.

    Look at

    Any unusual access patterns or unauthorised access attempts. GOOD logs contain no anomalies or unexplained entries, showing consistent, authorised usage.

  4. Check 4 of 5What an auditor asks for

    Ask for

    About the access review process for development tools and libraries.

    Look at

    How frequently these reviews are conducted and the results. GOOD reviews are performed regularly, with findings acted upon promptly.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Documentation on how external code use is managed, such as open-source libraries.

    Look at

    How write access is controlled and limited to specific personnel. GOOD practice involves clear restrictions and documentation around the use and approval of external code.

Mappings

Closest match in ASD Information Security Manual: ISM-1422, Prevent unauthorised access to software source, which this control covers in full and more.

ASD ISM

ASD Information Security Manual: 4 mappings

  • ISM-1422Prevent unauthorised access to software sourceBroader than
  • ISM-0441Restricting temporary system access to data required for dutiesPartially overlaps
  • ISM-1746Restrict file system permission changesPartially overlaps
  • ISM-2024Utilise authoritative sources in software developmentSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 27001 training

Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.