ISO 27001:2022 · Technological controls
ISO 27001:2022 8.4: Access to source code
ISO 27001:2022 8.4 covers Access to source code. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.8.4, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is All developers have write and admin rights on every repository.
Who may read or change source code, software libraries and development tools is to be properly managed. Purpose (stated in ISO/IEC 27002:2022): prevents unauthorized functionality, unintended or malicious changes and loss of confidentiality of valuable intellectual property. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.4.
What evidence supports 8.4?
- Annex A technological controlStatement of Applicability entry for control A.8.4, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A technological controlSource code management system configuration showing repository permissions with write access limited to designated owners or privileged staff
- Annex A technological controlBranch protection or merge rules requiring authorized review before changes are accepted, tied to change control
- Annex A technological controlAccess request and approval records for repository write access
- Annex A technological controlAudit logs of repository access and code changes
Where this requirement comes from
This is our own statement of ISO 27001:2022 8.4, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- All developers have write and admin rights on every repository
- Changes can be pushed directly to main branches without review
- Secrets or production data copies are stored in repositories accessible to many people
- Leavers retain access to hosted repositories through personal accounts
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.