(L1) Ensure team creation is limited to specific members

Contributed by Travis McDadeAll contributors →

Part of CIS · GitHub · Organization settings · All checks

Run this check

Invoke-Maester -TestId CIS.GH.1.3.2

Overview

Organization members cannot create teams.

Teams can grant access to organization repositories. Restricting who can create them helps prevent unplanned access and makes the organization’s permissions easier to manage. Members who need a new team may need an owner, administrator, or approved access-management process to create it.

CIS GitHub Benchmark v1.2.0 lists section 1.3.2 as a Manual assessment. This test checks members_can_create_teams from GET /orgs/{org} for the connected organization. It does not review the organization’s process for requesting or approving new teams.

The test passes when the field is Boolean false and fails when it is Boolean true. A missing, null, or non-Boolean value produces Skipped, with a reason explaining what could not be checked. Request or JSON parsing failures produce Error. Missing data does not mean team creation is disabled or the recommendation does not apply.

The test covers the connected organization’s returned setting. It does not scan other organizations or reconstruct inherited policies. Maester checks this field after parsing the response, rather than validating the entire response schema.

Permissions required

Use an organization owner with a classic PAT or OAuth token carrying admin:org to read the full organization settings. With fine-grained PATs, the connection’s membership check uses organization Members: read, and its separate administration check uses Administration: read. A successful connection does not guarantee that GitHub returns the field this test needs. See Connect-MtGitHub for the connection checks.

For GHE.com, use https://api.SUBDOMAIN.ghe.com and a token for that host; do not assume the github.com device flow applies. The same missing-data rules apply to GHEC, Enterprise Managed Users, and GHE.com.

Remediation action

1. On the connected GitHub web host (github.com or your enterprise’s SUBDOMAIN.ghe.com), open Your organizations, select the organization, then go to Settings > Access > Member privileges.
2. Under Team creation rules, clear Allow members to create teams.
3. Save the change and use the organization’s approved process for new-team requests.

Related links

• CIS GitHub Benchmark v1.2.0 - Section 1.3.2
• GitHub: Team creation permissions
• GitHub REST API: Get an organization

Details

Every attribute of this check

Field	Value
Test ID	CIS.GH.1.3.2
Severity	Medium
Suite	CIS
Product	GitHub
Feature	Organization settings
Area	Access control
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	None
Supports benchmark	CIS GitHub Benchmark (version 1.2.0), requirement 1.3.2
Benchmark level	L1
Benchmark profiles	GH Level 1
Supports controls	cis-github:1.3.2, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisGitHubTeamCreationLimited
Services	GitHub

Source

• Test: tests/cis/Test.CIS.GH.1.3.2.ps1
• Documentation: tests/cis/Test.CIS.GH.1.3.2.md