The ISO/IEC 27000-series of standards lay out how to create and manage an information security management system (ISMS). The ISO/IEC 27001 document provides the main body of the standard and is augmented by a number of sector-specific guideline documents.

The 27001 document includes a lengthy Annex listing a full list of 114 controls, grouped into 14 clauses and 35 categories, against with an ISMS can be audited.

Control A.9.4.5, ‘Access control to program source code’ states the following:

Access to program source code shall be restricted.

Does this mean that ISO 27001 is incompatible with free/open source software, for which the source code is not and can not be restricted?

Is there any way of waiving this, or would any such software produced by an organisation just have to be excluded from the scope of any 27001 certification?

  • It should be "The ability to make modifications to the source code for the binary shall be restricted" – MechMK1 Nov 21 '19 at 16:25

"Access to program source code shall be restricted." does not mean that nobody should be able to access the source code but that it is defined who can access and change the code. The main point is not to have the source code secret but to prevent unauthorized and unaudited changes to the source code.

And this is true for using open source too: one should not simply import and use some code or patches from somewhere without somehow making sure that the code is actually having the expected behavior and only this, i.e.that it does not contain any backdoors and no critical bugs etc. This "somehow making sure" does not mean to audit everything yourself but might also mean to trust upstream distributions and maintainers to do the right thing. How much to trust upstream or how much to review code yourself of course depends on both who is the upstream and how critical the code is which uses third party code.

But blindly using npm, cpan, pip etc to install modules can be dangerous and is against the spirit of using and writing secure code, see Small World with High Risks: A Study of Security Threats in the npm Ecosystem or Malicious Modules — what you need to know when installing npm packages.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.