ISO 27001:2022 Annex A 8.4 Access to Source Code Explained

ISO 27001:2022 Annex A 8.4 (Access To Source Code) is an ISO 27001 annex a control that requires you to make sure you have controls in place for access to code.

In this guide you will learn how to implement Access to Source Code (ISO 27001 Annex A 8.4) and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Key Takeaways

• Manage read and write access to your source code, development tools, and software libraries.
• The goal is to protect your Intellectual Property (IP) and, more importantly, to prevent the unauthorised introduction of “rogue” code or backdoors that could lead to a catastrophic security breach.

ISO 27001 Annex A 8.4 Purpose & Definition

The purpose of ISO 27001 Annex A 8.4 Access To Source Code is to prevent the introduction of unauthorised functionality, avoid unintentional or malicious changes and to maintain the confidentiality of valuable intellectual property.

The ISO 27001 Standard defines ISO 27001 Annex A 8.4 as:

Read and write access to source code, development tools and software libraries should be appropriately managed.

ISO/IEC 27001:2022 Annex A 8.4 Access To Source Code

ISO 27001 Annex A 8.4 Video Tutorial

In this training video you will learn How to implement ISO 27001 Access To Source Code (Annex A 8.4) and Pass Your Audit

Access to Source Code Guidelines

There are five essential elements of a comprehensive Access to Source Code implementation as covered in the control guidance in ISO 27002:2022 Control 8.4 (Access to Source Code):

1. Control access to source code and development documentation
2. Give read and write access to code based on business need
3. Have change control for updates to source code
4. Use developer tools to access source code repositories
5. Have audit logs of all access and changes to source code

How to implement ISO 27001 Access to Source Code (Annex A 8.4)

Applicability

If you have source code then you want to protect access to it. If you do not then this is not in scope for you, you can update your statement of applicability to put it out of scope, add it to the risk register and accept the risk.

You are going to manage access to your source code, program code, libraries and associated software. The requirement is to stop unauthorised modification that can lead to an information security incident.

The Three Pillars of Implementation

The effective implementation of Annex A 8.4 is a continuous process that is built on three foundational pillars that ensure that your controls are robust, documented and resilient.

• Risk Based Foundation: assess assets and threats to implement proportionate controls
• Documented Process and Governance: formalise policies and procedures for access management
• Continuous Assurance and Monitoring: establish mechanisms for logging, monitoring and control effectiveness

Pillar 1: Risk Based Approach

• Risk Assessment: Conduct a risk assessment to identify all repositories of source code, program code, libraries and associated software.
• Threat Modelling: Understand the specific threats to each code asset.
• Proportionate controls: Implement proportionate controls based on risk.

Pillar 2: Documented Process and Governance

If you do have source code then you already know what to do as there is nothing revolutionary in this particular control. The control is looking for documentation and maturity of process of what you already do. The required documentation includes:

• ISO 27001 Access Control Policy: governs access including access to source code.
• ISO 27001 Secure Development Policy: details the requirements for source code access in the development lifecycle.
• Process and Procedural records of evidence: records of changes, updates, reviews, monitoring and logging.

Pillar 3: Assurance

You will ensure that there is ongoing assessment of the effectiveness of the controls. Activities include:

• Logging and monitoring: implement logging to create audit trails of read/write access and codebase changes
• Integrity Verification: employ digital signatures where required to provide assurance of code integrity
• Third Party Assurance: consider escrow services for high value code bases

ISO 27001 Annex A 8.4 Toolkit & Templates

Access Control Policy Template

Secure Development Policy Template

ISO 27001 Toolkit

How to pass the ISO 27001 Annex A 8.4 audit

1. Have policies and procedures in place: Write, approve, implement and communicate the documentation required for access to source code.
2. Assess your code use and code requirements and perform a risk assessment: For each code type perform a risk assessment.
3. Implement controls proportionate to the risk posedBased on the risk assessment implement the appropriate controls to mitigate the risk.
4. Keep records: For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.
5. Test the controls that you have to make sure they are working: Perform internal audits that include the testing of the controls to ensure that they are working.

Top 3 Annex A 8.4 Audit Mistakes (And How to Fix Them)

The top 3 mistakes people make for ISO 27001 Annex A 8.4 are

1. Allowing everyone to access code: Depending on the size of teams, complexity and mix of internal and external resource the requirements for access restrictions on code can often get over looked. Be sure to understand and document the requirements, put in place processes and lock the access down based on organisation need and business risk.
2. Your code is on laptops: This common mistake actually relates to copies of your code being all over the place. It can be hard to manage code and developers and teams to maintain a single source of truth in a controlled way that protects your intellectual property and the integrity of the code base. Some people use check in and check out solutions but be aware of rogue copies of your code out in the real world and the risk it poses to you, usually in terms of that code being taken and used some where else for commercial gain without your approval or knowledge.
3. Your document and version control is wrong: Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27002:2022 Control 8.4 (Access to Source Code)

ISO 27002:2022 Control 8.4 provides implementation guidance for Access to Source Code.

Related ISO 27001:2022 Annex A Controls

The following ISO 27001:2022 Annex A controls relate directly to ISO 27001 Annex A 8.4:

• ISO 27001 Annex A 8.28 Secure Coding
• ISO 27001 Annex A 8.25 Secure Development Life Cycle
• ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance
• ISO 27001 Annex A 8.17 Clock Synchronisation

ISO 27001 Annex A 8.4 Control Attributes

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Identity and access management	Protection
	Integrity		Application Security
	Availability		Secure Configuration