N.6.01 Access to the source code
Control Overview
This control mandates that the organization comprehensively protects its application source code, proprietary software assets, and configuration scripts from unauthorized access, intellectual property theft, and malicious modification. Because the source code repository forms the foundational supply chain layer of a software platform, access must be tightly regulated through centralized identity governance, strict Role-Based Access Control (RBAC), mandatory Multi-Factor Authentication (MFA), and automated branching protections within a secure version control system (VCS).
Applicability Note: This control is highly critical and fully applicable to the anDREa platform, serving as a primary defense for the core myDRE codebase and deployment templates.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, treating our source code infrastructure as a highly sensitive tier-1 logical asset.
anDREa utilizes GitHub Enterprise as its authoritative version control system, fully integrated with our central identity provider, Microsoft Entra ID. Code access is never granted ad-hoc; instead, permissions are bound directly to Entra ID security groups mapped to verified developer roles. We enforce universal, non-bypassable MFA across our GitHub organization.
Furthermore, to eliminate standing administrative risks at the code layer, repository configuration rights are severely restricted, monitored, and coupled with our Privileged Identity Management (PIM) workflows. Branches powering production environments are locked via repository policy, mandating multi-party peer reviews, automated security scanning, and signed commits before any code modification can be merged.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.08.04 - Access to source code | Mandates that access to program source code is restricted in accordance with the access control policy. |
| ISO/IEC 27001 | A.05.15 - Access control, A.05.16 - Identity management | Core identity management structures governing user onboarding and centralized account routing. |
| ISO/IEC 27001 | A.05.18 - Access rights | Controls the lifecycle of provisioning, modifying, and withdrawing permissions to intellectual property assets. |
| Identity Integration | Entra ID / GitHub Directory Mapping | Active technical configurations proving that repository access is synchronized with corporate identity life cycles. |
| VCS Governance | GitHub Branch Protection Profiles | Enforcement rule templates demonstrating mandatory peer code reviews, status check requirements, and admin overrides restrictions. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Centralized identity mapping, mandatory MFA enforcement, and privileged administrative restrictions over the codebase are fully functional and verified.
- Continuous Improvement (NIS 2 Alignment): To further strengthen audit readiness and systematically verify least-privilege enforcement, explicitly incorporate the repository-level user permission states into your scheduled Periodic Controls Security access review cycles. This creates a documented, recurring bridge back to your core A.05.18 and A.08.02 management review loops.