(L1) Ensure repository creation is limited to specific members
Part of CIS · GitHub · Organization settings · All checks
Invoke-Maester -TestId CIS.GH.1.2.2Overview
Section titled “Overview”Organization members cannot create public or private repositories.
Limiting repository creation makes ownership and access easier to review and reduces the risk of code or data being exposed through an unmanaged repository. Members who need a new repository may need an owner, administrator, or approved internal process to create it.
CIS GitHub Benchmark v1.2.0 lists section 1.2.2 as a Manual assessment. This test checks the connected organization’s repository-creation settings from GET /orgs/{org}; it does not replace the rest of the manual review.
The test passes when members_can_create_public_repositories and members_can_create_private_repositories are both Boolean false. Either value being Boolean true is enough to fail, even if the other value is missing or invalid. Otherwise, a missing, null, or non-Boolean value produces Skipped, with a reason explaining what could not be checked. Request or JSON parsing failures produce Error.
The report also shows members_can_create_internal_repositories and the legacy members_allowed_repository_creation_type when GitHub returns them. Neither decides the result: the CIS audit covers public and private repository creation, and Maester uses the separate settings for those repository types.
The test covers the connected organization’s returned settings. It does not scan other organizations or reconstruct inherited policies. Maester checks these fields after parsing the response, rather than validating the entire response schema. Missing data does not mean a setting is disabled or the recommendation does not apply.
Permissions required
Section titled “Permissions required”Use an organization owner with a classic PAT or OAuth token carrying admin:org to read the full organization settings. With fine-grained PATs, the connection’s membership check uses organization Members: read, and its separate administration check uses Administration: read. A successful connection does not guarantee that GitHub returns the fields this test needs. See Connect-MtGitHub for the connection checks.
For GHE.com, use https://api.SUBDOMAIN.ghe.com and a token for that host; do not assume the github.com device flow applies. The same missing-data rules apply to GHEC, Enterprise Managed Users, and GHE.com.
Remediation action
Section titled “Remediation action”- On the connected GitHub web host (
github.comor your enterprise’sSUBDOMAIN.ghe.com), open Your organizations, select the organization, then go to Settings > Access > Member privileges. - Clear the public and private repository-creation options for members and save the changes. If an enterprise policy controls the options, ask an enterprise owner to make the change.
- Review internal repository creation separately; it does not decide this check.
Related links
Section titled “Related links”- CIS GitHub Benchmark v1.2.0 - Section 1.2.2
- GitHub: Restricting repository creation
- GitHub REST API: Get an organization
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.GH.1.2.2 |
| Severity | Medium |
| Suite | CIS |
| Product | GitHub |
| Feature | Organization settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1567.001 Exfiltration to Code Repository |
| Supports benchmark | CIS GitHub Benchmark (version 1.2.0), requirement 1.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | GH Level 1 |
| Supports controls | cis-github:1.2.2, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCisGitHubRepositoryCreationLimited |
| Services | GitHub |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.GH.1.2.2.ps1 - Documentation:
tests/cis/Test.CIS.GH.1.2.2.md