All 93 controls · Technological controls
Control 8.4
Access to source code
What ISO/IEC 27002:2022 control 8.4 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Who may read or change source code, software libraries and development tools is to be properly managed. Purpose: stop unauthorized functionality being introduced, prevent accidental or malicious changes and keep valuable intellectual property confidential. Guidance: strictly control access to source code and related items such as designs, specifications and verification and validation plans, and to development tooling including compilers, build and integration tools, and test platforms and environments. For source code, control its central storage, preferably in a source code management system. Read and write access can differ by role: read access may be broad within the organization while write access goes only to privileged staff or designated owners; shared code components should be read from a central repository; open source or third-party repositories may be widely readable but write access stays restricted. To reduce the chance of corrupting programs, consider managing access to source code and source libraries through established procedures; granting read and write access by business need, managed against the risk of alteration or misuse; updating code and related items, and granting access, only under change control (8.32) and after proper authorization; giving developers access through developer tools that control their actions and authorizations rather than directly to the repository; keeping program listings somewhere secure with managed access; and keeping an audit log of all access and changes to source code. If code is to be published, consider added integrity assurance such as a digital signature. Other information: poorly controlled access lets code be altered or lets unauthorized people retrieve development environment data such as production data copies or configuration details.
Purpose in the standard’s terms, in our words: Prevents unauthorized functionality, unintended or malicious changes and loss of confidentiality of valuable intellectual property.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Identity and access management, Application security, Secure configuration; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Identity and access managementApplication securitySecure configuration |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Source code management system configuration showing repository permissions with write access limited to designated owners or privileged staff
- Branch protection or merge rules requiring authorized review before changes are accepted, tied to change control
- Access request and approval records for repository write access
- Audit logs of repository access and code changes
- Access controls on build, integration and test tooling and on designs and specifications
- Code signing or other integrity mechanisms for published code
Where audits commonly find gaps
- All developers have write and admin rights on every repository
- Changes can be pushed directly to main branches without review
- Secrets or production data copies are stored in repositories accessible to many people
- Leavers retain access to hosted repositories through personal accounts
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 3 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (09.4.5) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.