8.4 Access to source code
Requires managed control over who can read and who can write to source code, and equally over development tools and software libraries.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Source control / CI pipeline
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Controls over development tools, libraries and build systems, including who can alter build configuration · Source control / CI pipeline
periodic reviewEvidence produced at each review
- Evidence of branch protection, mandatory review and restriction on direct commits to protected branches · Source control / CI pipeline
- Records of periodic review of repository access, including external collaborators and service accounts · Identity provider / directory
- Evidence of secrets management, showing credentials are not held in source code, with scanning evidence · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Access controls over source code repositories, showing read and write permissions and who holds them · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Source control / CI pipeline on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Write access broadly granted across the engineering organisation with no per repository restriction
- Credentials, keys and tokens committed to repositories, present in history even after removal from the current version
- Build systems and pipelines able to be modified by anyone who can commit, which bypasses code review entirely
- Access reviews covering people while service accounts, integrations and deploy keys are never reviewed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.3 Information access restriction · 8.5 Secure authentication