audit-labs/control-coverage

 1{
 2  "subject": "acme",
 3  "platform": "github",
 4  "source_package": "github_audit_acme_2025-10-01",
 5  "generated_at": "2025-10-01 00:00:00 UTC",
 6  "summary": {"pass": 2, "fail": 2, "not_applicable": 0},
 7  "coverage": ["SOC2:CC6.1", "SOC2:CC6.3", "SOC2:CC7.1", "SOC2:CC9.2"],
 8  "findings": [
 9    {
10      "id": "github.org.require-2fa",
11      "title": "Organization requires two-factor authentication",
12      "status": "fail",
13      "severity": "high",
14      "controls": ["SOC2:CC6.1", "ISO:A.5.17", "NIST:IA-2"],
15      "reason": "2fa not enforced at the time of this snapshot",
16      "evidence": [{"two_factor_required": "false"}]
17    },
18    {
19      "id": "github.org.default-permission",
20      "title": "Base repository permission is read or less",
21      "status": "fail",
22      "severity": "medium",
23      "controls": ["SOC2:CC6.3", "ISO:A.5.15", "NIST:AC-6"],
24      "reason": "base permission is write",
25      "evidence": [{"default_repo_permission": "write"}]
26    },
27    {
28      "id": "github.org.secret-scanning",
29      "title": "Secret scanning push protection is on for new repos",
30      "status": "pass",
31      "severity": "medium",
32      "controls": ["SOC2:CC7.1", "ISO:A.5.17", "NIST:CM-6"],
33      "reason": "1 row asserted true",
34      "evidence": []
35    },
36    {
37      "id": "github.org.vendor-review",
38      "title": "Third-party OAuth app access is restricted",
39      "status": "pass",
40      "severity": "medium",
41      "controls": ["SOC2:CC9.2"],
42      "reason": "1 row asserted true",
43      "evidence": []
44    }
45  ]
46}