ISO 27002:2022 8.4: Access to source code

What else in your programme already covers this

This control maps to 41 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 4 controls

CM-5 Access Restrictions for Change
CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records. (a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions
CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation. (a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment:
SA-10 Developer Configuration Management

FedRAMP Moderate · 4 controls

CM-5 Access Restrictions for Change
CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records. (a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions
CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation. (a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment:
SA-10 Developer Configuration Management

NIST SP 800-53 Rev 5 · 4 controls

NIST800-AC-5 Separation of duties
NIST800-AC-6 Least privilege
NIST800-AU-12 Audit record generation
NIST800-CM-5 Access restrictions for change

PCI DSS 4.0 · 4 controls

6.5.1 Changes to all system components in the production environment are made according to established procedures that include: • Reason for, and description of, the change. • Documentation of security impact. • Documented change approval
6.5.3 Pre-production environments are separated from production environments and the separation is enforced with access controls
7.2.5 All application and system accounts and related access privileges are assigned and managed as follows: • Based on the least privileges necessary for the operability of the system or application. • Access is limited
8.6.2 Passwords/passphrases for any application and system accounts that can be used for interactive login are not hard coded in scripts, configuration/property files, or bespoke and custom source code

Australian Information Security Manual · 3 controls

ISM-1422 Unauthorised access to the authoritative source for software is prevented.
ISM-1816 Unauthorised modification of the authoritative source for software is prevented.
ISM-2029 The authoritative source for software restricts the use and import of third-party librarie

NIST SP 800-53 Revision 5.1 HIGH · 3 controls

CM-5 Access Restrictions for Change
CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records. (a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and (b) Automatically generate audit records of the enforcement actions
SA-10 Developer Configuration Management

SOC 2 · 3 controls

SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
SOC2-CC6.3 Role-based access and least privilege are enforced
SOC2-CC8.1 Change management processes are in place

AWS Well-Architected Security Pillar · 2 controls

SEC11-BP05 Centralize services for packages and dependencies
SEC11-BP07 Regularly assess security properties of the pipelines

C5 (Germany) · 2 controls

C5-DEV-07 Logging of changes
C5-DEV-08 Version Control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-CCC-04 Unauthorized Change Protection
CCM-IAM-05 Least Privilege

NIST SP 800-218 · 2 controls

SP800-218-PO.5.1 Secure Development Environment Implementation
SP800-218-PS.1.1 Protect All Forms of Code from Unauthorized Modification

NIST SP 800-53 Rev 5 MODERATE · 2 controls

CM-5 Access Restrictions for Change
SA-10 Developer Configuration Management

Azure Security Benchmark · 1 control

ASBv3-DS-3 Secure DevOps infrastructure

NIST Cybersecurity Framework 2.0 · 1 control

NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

NIST SP 800-161 Rev 1 · 1 control

161R1-AC-5 Separation of Duties

NIST SP 800-172 · 1 control

3.4.1e Authoritative Source for Software and Firmware

NIST SP 800-53 Rev 5 LOW · 1 control

CM-5 Access Restrictions for Change

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO 27002:2022 have you already done?

ISO 27002:2022 8.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gaps If you hold FedRAMP Moderate80.6% covered · 18 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gaps If you hold C5 (Germany)69.9% covered · 28 gaps If you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps If you hold NIST SP 800-171 Rev 357% covered · 40 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free