The ISO/IEC 27000-series of standards lay out how to create and manage an information security management system (ISMS). The ISO/IEC 27001 document provides the main body of the standard and is augmented by a number of sector-specific guideline documents.
The 27001 document includes a lengthy Annex listing a full list of 114 controls, grouped into 14 clauses and 35 categories, against with an ISMS can be audited.
Control A.9.4.5, ‘Access control to program source code’ states the following:
Access to program source code shall be restricted.
Does this mean that ISO 27001 is incompatible with free/open source software, for which the source code is not and can not be restricted?
Is there any way of waiving this, or would any such software produced by an organisation just have to be excluded from the scope of any 27001 certification?