[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-4":3},{"item":4,"lessons":16,"controls":26,"related":44},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-4","Annex A 8.4","Access to source code",2,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Read and write access to source code, development tools and software libraries should be appropriately managed. Source code is a valuable asset and changes to it can undermine security.\n\n**In practice.** Code lives in a central version control system with access granted per repository on a need to know basis, and write access to protected branches limited and subject to peer review. Strong authentication, ideally with phishing resistant multi factor authentication, protects developer accounts and automation tokens. Secrets are kept out of repositories and scanned for. Evidence includes repository permission reports, branch protection settings, review logs and periodic access reviews covering both people and service accounts.\n\n**Common gaps.** Broad organisation wide read or write access, long lived personal access tokens and forgotten deploy keys are common. Build pipelines often have more access than any individual developer, yet are excluded from reviews.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22],{"slug":19,"title":20,"published_at":21},"hospital-employee-reprimanded-for-unauthorized-patient-record-access","Hospital Employee Reprimanded for Unauthorized Patient Record Access","2026-10-09T10:20:42.004+00:00",{"slug":23,"title":24,"published_at":25},"shadow-ai-tools-creating-invisible-risk-in-uk-workplaces","Shadow AI Tools Creating Invisible Risk in UK Workplaces","2026-09-09T16:21:40.856+00:00",[27,32,36,40],{"slug":28,"name":29,"problem":30,"stories":31},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":33,"name":34,"problem":35,"stories":31},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":37,"name":38,"problem":39,"stories":31},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":41,"name":42,"problem":43,"stories":31},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[45,50,55,59,63,67,71,75],{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":51,"item":52,"code":53,"title":54,"together":31},"cis","3","Control 3","Data Protection",{"family":46,"item":56,"code":57,"title":58,"together":31},"32","Article 32","Security of processing",{"family":51,"item":60,"code":61,"title":62,"together":31},"8","Control 8","Audit Log Management",{"family":46,"item":64,"code":65,"title":66,"together":31},"25","Article 25","Data protection by design and by default",{"family":46,"item":68,"code":69,"title":70,"together":31},"28","Article 28","Processor",{"family":51,"item":72,"code":73,"title":74,"together":31},"6","Control 6","Access Control Management",{"family":51,"item":76,"code":77,"title":78,"together":31},"2","Control 2","Inventory and Control of Software Assets"]