I might propose migrating away from VSS due to its inability to grant and deny permissions at the file level. The question is what source control systems allow this.
Update I am marking the SVN answer as the "correct" one, since it had the most feedback. However, there is no correct answer. I will make my recommendations to management based on all your feedback.
Perforce does.
Take a look at Plastic SCM and it's ACL model.
subversion does too, but the ACL is managed in a configuration file
If you are using VSS now, Team Foundation Version Control (TFVS) is the logical upgrade, especially if your corporate mandate is Microsoft-only tools.
http://msdn.microsoft.com/en-us/library/ms364074.aspx
Whatever its other flaws, IBM Rational Clearcase does support file-level permission controls. It also has other mechanisms that you can use - notably triggers which can be written to cause an otherwise permitted checkin to fail.
Mercurial does, with the bundled Acl extension