# (L1) Ensure repository deletion is limited to specific users

(L1) Ensure repository deletion is limited to specific users. A Maester check for GitHub, Organization settings.

Source: https://maester.dev/docs/tests/CIS.GH.1.2.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/thetechgy" title="Travis McDade · Original author"><img src="https://github.com/thetechgy.png" alt="Travis McDade" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/thetechgy">Travis McDade</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · GitHub · Organization settings · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.GH.1.2.3
```

## Overview

1.2.3 (L1) Ensure repository deletion is limited to specific users

CIS Benchmark: CIS GitHub Benchmark v1.2.0

Assessment Status: Manual

#### Rationale

Deleting repositories can cause major source loss, break delivery workflows, and hide malicious or accidental activity. Repository deletion should therefore be limited to a small set of trusted people whose access is reviewed intentionally.

#### Impact

Members without the required repository or organization role will not be able to delete or transfer repositories. Teams may need a documented owner-led process for repository retirement.

#### Maester automation note

CIS marks this recommendation as Manual. This Maester test collects the organization setting evidence that maps to CIS GH 1.2.3, then reports Investigate because CIS still requires a human trust review.

When `members_can_delete_repositories` is `true`, CIS requires verifying that repository admin members are trusted and qualified. When it is `false`, CIS still requires verifying that organization owners are trusted and qualified.

#### API evidence

Endpoint: `GET /orgs/{org}`

Evidence field: `members_can_delete_repositories`

When this field is returned, the test records the actual value and returns Investigate so the remaining CIS manual review path is visible in Maester results.

#### Permissions required

GitHub requires organization-owner visibility for full organization details. Use `Connect-MtGitHub` with a classic PAT that has `admin:org`, or a fine-grained PAT with organization Members read and Administration read permissions.

#### Remediation summary

In the organization settings, open **Member privileges** and disable the option that allows members to delete or transfer repositories for the organization. If the setting remains enabled, manually verify that repository administrators are limited to trusted users and document the review. If the setting is disabled, verify that organization owners are limited to trusted users and document the review.

#### Known limitations

This test verifies the organization setting only. It does not enumerate repository administrators, organization owners, or decide whether those users are trusted.

#### Related links

* [CIS GitHub Benchmark v1.2.0 - Section 1.2.3](https://www.cisecurity.org/benchmark/github)
* [GitHub REST API: Get an organization](https://docs.github.com/en/rest/orgs/orgs#get-an-organization)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.GH.1.2.3 |
| Severity | High |
| Suite | CIS |
| Product | GitHub |
| Feature | Organization settings |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1485 Data Destruction, T1070 Indicator Removal |
| Supports benchmark | CIS GitHub Benchmark (version 1.2.0), requirement 1.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | GH Level 1 |
| Supports controls | cis-github:1.2.3, nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtCisGitHubRepositoryDeletionLimited](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.GH.1.2.3.ps1) |
| Services | GitHub |

</details>

## Source

- Test: [`tests/cis/Test.CIS.GH.1.2.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.GH.1.2.3.ps1)
- Documentation: [`tests/cis/Test.CIS.GH.1.2.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.GH.1.2.3.md)