Focus of the 27001 Standard
The ISO/IEC 27001 Security Standard is applicable to all sorts of organizations, its focus is on the management system, so to be in compliance with the Standard the organization is no expected to apply all the 114 controls, but to systematically apply a risk management strategy focused on the security of the processes and assets in scope.
In fact, there is the Statement Of Applicability (SoA), where the organization declares which controls will be applied, with a short explanation of how is a selected control to be implemented, and for those inapplicable controls, a justification, so, if the organization is aligned with FOSS, this should be explained and documented in the SoA. This documentation should back up the selection of this control or its exclusion.
The spirit of the A.9.4.5 control
The spirit of this specific control, as stated in the ISO/IEC 27002 standard (which explains every one of the 114 controls) is:
... to prevent the introduction of unauthorized functionality and to avoid unintentional changes as well as to maintain the confidentiality of valuable intellectual property.
So, this control is meant to protect the source code against unauthorized changes and protect intellectual property.
If the control is selected to be implemented, there are several guidelines that can be applied even if the organization embraces FOSS, for example:
- source code should not be held in operational (production) systems.
- source code should be managed according to established procedures, (in the case of FOSS, these procedures should also exist and be enforced).
If the organization uses FOSS, there should still be things like version control, change control and order in the use of the source code. That's what this control is about.
All these guidelines are to be considered, not necessarily adopted or implemented. Every organization defines which controls to apply and how to do it.
Conclusion
The important thing for being in compliance of this standard is to self explain and comply to the decisions the organization make regarding each control. So, the ISO 27001 Standard can be compatible with FOSS, how compatible depends on the consistency of the policy and procedures applied by the organization.
Having said that, it is clear that the authors of the Standard did not have Free/Open Source Software in mind when they wrote the norm, probably the organizations for which these standards were built in the first place were not focused on FOSS, but the standard can be adopted by an organization oriented to use FOSS.
In the ISO27001 Standard, there is an absence of other terms that recently grew in notoriety, like cloud computing, Internet of Things or cybersecurity. The standard is complemented with other documents of the ISO 27000 family that are being developed after the main standard, hopefully FOSS will be included in one of the latter documents.
