Control A.8.4Access to source code
Read and write access to source code, development tools and software libraries must be appropriately managed.
Source code is both intellectual property and a description of how the organisation’s systems can be attacked, and the tooling around it — build systems, package repositories, CI pipelines — is an execution path into production.
The control covers read access, which protects confidentiality, and write access, which protects integrity. Write access to a build pipeline is frequently more powerful than write access to production and is managed less carefully.
The dependencies matter as much as the code. A library pulled from a public repository at build time is code the organisation runs and did not write, which connects this control to A.5.21’s supply chain requirements and A.8.28’s secure coding.
The common gap is credentials in repositories. Secrets committed to source control are exposed to everyone with read access and persist in history after removal, which turns a read permission into an access path.
How to put this in place
Source code holds your logic, your secrets and the route to changing live systems. Your ISMS needs to show that only the right people can read or alter it, or a single compromised account can plant code in your product.
- Move all code into managed repositories and decide who needs read and who needs write access.
- Require multi-factor authentication and protect the main branches with review before merge.
- Keep credentials out of code and scan repositories for any that slip in.
- Remove leavers and changed roles from repositories promptly, and log access.
- If you write no code of your own, record that as the reason this control does not apply.
Evidence an auditor usually looks for: repository access lists, branch protection settings, and secret scanning results.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.