ISO 27001 · A.8 Technological controls
A.8.4
Access to source code
frameworkISO/IEC 27001:2022
sectionA.8 Technological controls
csf 2.0PR.AA-05 PR.DS-01 PR.DS-02 PR.DS-10
topics—
frameworks1 0 0
Official text · not licensableTitle: Access to source code. The control text is ISO's copyright; see ISO/IEC 27001:2022.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-05PR.DS-01PR.DS-02PR.DS-10 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties; The confidentiality, integrity, and availability of data-at-rest are protected… | No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| CIS v8.1 | CIS 3.3CIS 3.10CIS 3.11CIS 5.1 | Configure Data Access Control Lists; Encrypt Sensitive Data in Transit… | No mapping. Only shares CSF PR.AA-05, PR.DS-02, PR.DS-01: related, not a mapping+27 more loosely related (not mappings)CIS 6.8 Define and Maintain Role-Based Access Control Only shares CSF PR.AA-05: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.5 Securely Dispose of Data Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 23 more in the downloads | |
| SOC 2 | CC6.7C1.2CC6.1CC6.5 | Restricting transmission, movement and removal of information; Disposing of confidential information… | No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping+4 more loosely related (not mappings)CC6.3 Role-based access, least privilege and segregation of duties Only shares CSF PR.AA-05: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.AA-05: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF PR.DS-02: related, not a mapping | |
| PCI DSS | 7.2.22.3.13.2.13.3.1 | Access assigned by job function and least privilege; Wireless vendor defaults changed… | No mapping. Only shares CSF PR.AA-05, PR.DS-10, PR.DS-02, PR.DS-01: related, not a mapping | |
| CMMC | AC.L2-3.1.13AC.L2-3.1.19MP.L2-3.8.6SC.L2-3.13.1 | Remote Access Confidentiality; Encrypt CUI on Mobile… | No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping+34 more loosely related (not mappings)SC.L2-3.13.2 Security Engineering Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 30 more in the downloads | |
| 800-53 | AC-3CM-5 | Access Enforcement; Access Restrictions for Change | Crosswalk | NIST SP 800-53 → ISO 27001 mapping |
| HIPAA | §164.308(a)(4)(ii)(A)§164.308(a)(1)(ii)(D)§164.308(b)(1)§164.308(b)(4) | Isolating Health care Clearinghouse Function; Information System Activity Review… | No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping+25 more loosely related (not mappings)§164.312(a)(2)(iv) Encryption and Decryption Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(i) Integrity Controls Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 21 more in the downloads | |
| GDPR | Art.32(1)(b)Art.5(1)(e)Art.5(1)(f)Art.32(1)(a) | Security of processing; Principles relating to processing of personal data… | No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping+2 more loosely related (not mappings)Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| NIS2 | 9.111.111.211.5 | Cryptography; Access control policy… | No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.AA-05: related, not a mapping | |
| Essential Eight | ISM-0445ISM-1175ISM-1380ISM-1387 | Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online…… | No mapping. Only shares CSF PR.AA-05: related, not a mapping+17 more loosely related (not mappings)ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF PR.DS-02: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Only shares CSF PR.AA-05: related, not a mapping …and 13 more in the downloads | |
| DORA | Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(3)(a) | Protection and prevention; Protection and prevention… | No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping+2 more loosely related (not mappings) | |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| Cyber Essentials | CE 2CE 4 | Secure Configuration; User Access Control | No mapping. Only shares CSF PR.AA-05: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.