CIS.GH.1.3.8 - (L1) Ensure strict base permissions are set for repositories
Overview
1.3.8 (L1) Ensure strict base permissions are set for repositories
CIS Benchmark: CIS GitHub Benchmark v1.2.0
Assessment Status: Manual
Rationale
Base permissions apply broadly across organization repositories. Keeping the default at none or read follows least privilege and lowers the chance that every member can change code where they do not have a specific business need.
Impact
Some members may lose default write access and require explicit repository, team, or role assignments before they can contribute changes.
Maester automation note
CIS marks this recommendation as Manual. This Maester test automates the portion of CIS GH 1.3.8 that maps to documented GitHub REST API evidence. It should be treated as automated evidence collection for the corresponding GitHub setting, not as a claim that every possible manual review path has been fully evaluated.
API evidence
Endpoint: GET /orgs/{org}
Evidence field: default_repository_permission
The test passes when default_repository_permission is none or read. It fails when the value is write or admin.
Permissions required
GitHub requires organization-owner visibility for full organization details. Use Connect-MtGitHub with a classic PAT that has admin:org, or a fine-grained PAT with organization Members read and Administration read permissions.
Remediation summary
In the organization settings, open Member privileges and set Base permissions to None or Read.
Known limitations
This test verifies the organization default repository permission only. It does not review per-repository collaborators, teams, or custom access grants.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.GH.1.3.8 |
| Severity | High |
| Suite | CIS |
| Product | GitHub |
| Feature | Organization settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1677 Poisoned Pipeline Execution, T1195.002 Compromise Software Supply Chain |
| Supports benchmark | CIS GitHub Benchmark (version 1.2.0), requirement 1.3.8 |
| Benchmark level | L1 |
| Benchmark profiles | GH Level 1 |
| Supports controls | cis-github:1.3.8, nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisGitHubStrictBasePermission |
| Services | GitHub |
Source
- Test:
tests/cis/Test.CIS.GH.1.3.8.ps1 - Documentation:
tests/cis/Test.CIS.GH.1.3.8.md