(L1) Ensure issue deletion is limited to specific users
Part of CIS · GitHub · Organization settings · All checks
Invoke-Maester -TestId CIS.GH.1.2.4Overview
Section titled “Overview”1.2.4 (L1) Ensure issue deletion is limited to specific users
CIS Benchmark: CIS GitHub Benchmark v1.2.0
Assessment Status: Manual
Rationale
Section titled “Rationale”Issues often capture defects, milestones, operational history, and security-relevant discussion. Broad issue deletion rights can disrupt development records or remove evidence of suspicious activity, so deletion should be limited to trusted users.
Impact
Section titled “Impact”Members without the required repository or organization role will not be able to delete issues. Organizations may need a documented escalation path for legitimate issue cleanup.
Maester automation note
Section titled “Maester automation note”CIS marks this recommendation as Manual. This Maester test collects the organization setting evidence that maps to CIS GH 1.2.4, then reports Investigate because CIS still requires a human trust review.
When members_can_delete_issues is true, CIS requires verifying that repository admin members are trusted and qualified. When it is false, CIS still requires verifying that organization owners are trusted and qualified.
API evidence
Section titled “API evidence”Endpoint: GET /orgs/{org}
Evidence field: members_can_delete_issues
When this field is returned, the test records the actual value and returns Investigate so the remaining CIS manual review path is visible in Maester results.
Permissions required
Section titled “Permissions required”GitHub requires organization-owner visibility for full organization details. Use Connect-MtGitHub with a classic PAT that has admin:org, or a fine-grained PAT with organization Members read and Administration read permissions.
Remediation summary
Section titled “Remediation summary”In the organization settings, open Member privileges and disable the option that allows members to delete issues for the organization. If the setting remains enabled, manually verify that repository administrators are limited to trusted users and document the review. If the setting is disabled, verify that organization owners are limited to trusted users and document the review.
Known limitations
Section titled “Known limitations”This test verifies the organization setting only. It does not enumerate repository administrators, organization owners, or decide whether those users are trusted.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.GH.1.2.4 |
| Severity | Medium |
| Suite | CIS |
| Product | GitHub |
| Feature | Organization settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1070 Indicator Removal, T1485 Data Destruction |
| Supports benchmark | CIS GitHub Benchmark (version 1.2.0), requirement 1.2.4 |
| Benchmark level | L1 |
| Benchmark profiles | GH Level 1 |
| Supports controls | cis-github:1.2.4, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCisGitHubIssueDeletionLimited |
| Services | GitHub |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.GH.1.2.4.ps1 - Documentation:
tests/cis/Test.CIS.GH.1.2.4.md