audit-labs/audit-report

 1# Ruleset: GitHub
 2#
 3# Evaluated against an audit-tools GitHub evidence package
 4# (github_audit_<org>_<date>/). Complements gh-attest: same spirit of mapping
 5# GitHub signals to controls, applied offline to a captured CSV package.
 6#
 7# Provenance and control-mapping rationale: see MAPPING.md. Bump `version` on any
 8# change to a rule's controls, checks, or thresholds so reports stay traceable.
 9name: GitHub ITGC ruleset
10version: "2026.08.0"
11platform: github
12
13rules:
14  - id: github.org.require-2fa
15    title: Organization requires two-factor authentication
16    table: org_security
17    severity: high
18    controls: [SOC2:CC6.1, ISO:A.5.17, NIST:IA-2]
19    rationale: >
20      Org-enforced 2FA raises the floor for every member at once. Without it, a
21      single member with a weak or reused password is an org-wide risk.
22    remediation: Enable "Require two-factor authentication" in the organization security settings.
23    check:
24      type: assert_row
25      require:
26        - {column: two_factor_required, op: is_true}
27
28  - id: github.org.default-permission
29    title: Base repository permission is read or less
30    table: org_security
31    severity: medium
32    controls: [SOC2:CC6.3, ISO:A.5.15, NIST:AC-6]
33    rationale: >
34      A permissive base permission (write/admin for all members) violates least
35      privilege by granting broad access that should be explicit.
36    remediation: Set the organization base permission to "read" or "none" and grant write/admin per team.
37    check:
38      type: assert_row
39      require:
40        - {column: default_repo_permission, op: in, value: [read, none]}
41
42  - id: github.org.secret-scanning
43    title: Secret scanning push protection is on for new repos
44    table: org_security
45    severity: medium
46    controls: [SOC2:CC7.1, ISO:A.5.17, NIST:CM-6]
47    rationale: >
48      Push protection stops secrets from entering history in the first place,
49      which is far cheaper than rotating a leaked credential after the fact.
50    remediation: Enable secret scanning and push protection for new repositories at the org level.
51    check:
52      type: assert_row
53      require:
54        - {column: secret_scanning_push_protection_for_new_repos, op: is_true}
55
56  - id: github.branch.default-protected
57    title: Default branches are protected
58    table: branch_protections
59    severity: high
60    controls: [SOC2:CC8.1, ISO:A.8.32, NIST:CM-6]
61    rationale: >
62      An unprotected default branch can be force-pushed or have its history
63      rewritten with no review — the change-management trail auditors expect is
64      absent.
65    remediation: Add a branch protection rule or ruleset covering the default branch of each repository.
66    check:
67      type: fail_rows_where
68      when: {column: protected, op: is_false}
69
70  - id: github.branch.require-reviews
71    title: Protected branches require at least one review
72    table: branch_protections
73    severity: medium
74    controls: [SOC2:CC8.1, ISO:A.8.32, NIST:CM-6]
75    rationale: >
76      Required review is the core segregation-of-duties control in the SDLC: no
77      change reaches the default branch without a second person approving it.
78    remediation: Require at least one approving review on the default branch.
79    check:
80      type: fail_rows_where
81      when:
82        all:
83          - {column: protected, op: is_true}
84          - {column: required_reviews, op: lt, value: 1}