ISO 27001A.8 — Access to source code
A.8.4
Access to source code
ISO 27001 · ISO/IEC 27001:2022 · Last verified August 2026
Objective
Manage read and write access to source code according to business need and security requirements.
Points of focus
- Private repositories
- SSO and least-privilege teams
- Protected branches / code owners
- Secret scanning and credential hygiene
Implementation notes
SSO into GitHub/GitLab. Map repo teams to engineering squads. Require reviews on default branches. Rotate any leaked secrets immediately. Separate infrastructure IaC repos with tighter access. Assign a named owner in the SoA, tie operating evidence to scm access control export, and sample the control during internal audit before Stage 2 fieldwork.
Audit tip: Show team membership for a critical repo, branch protection, and a secret-scanning finding closed with rotation evidence.
Evidence auditors typically request:
- SCM access control export
- Branch protection settings
- Secret scanning alerts/resolutions
- Offboarding removing SCM access
Common gaps
- Public forks of private code
- Shared bot PATs
- Production secrets committed historically
Cross-Framework Mapping
| Framework | Requirement | Implementation note |
|---|---|---|
| ISO 27001 | A.8.4 | This control |
| SOC 2 | CC6.1, CC8.1 | Related SOC 2 themes (CC6.1, CC8.1) — map in your crosswalk; not identical requirements. |
| GDPR | Article 32 | Related GDPR themes (Article 32) — map in your crosswalk; not identical requirements. |
Primary sources
- ISO/IEC 27001:2022 Annex A: ISO/IEC 27001:2022 Annex A (A.8.4)
Frequently Asked Questions
Public OSS is intentional disclosure; still protect private forks and signing keys.
Closely related — protect Actions secrets and OIDC roles as privileged.
Overlaps CC6 access and CC8 change management.
Even without owned data centers, access to source code still applies to how you operate endpoints, IdP, cloud consoles, and vendor services in scope. Exclude controls in the SoA only with a documented, risk-based rationale.
Start with scm access control export, assign a named control owner, and retain dated samples from your ticketing or GRC system — not one-off screenshots assembled before audit fieldwork.