# Ensure Restrict Repository Creation Permissions to Authorized Users

- Source: https://support.icompaas.com/support/solutions/articles/62000235213-ensure-restrict-repository-creation-permissions-to-authorized-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **Level 1**

**Description:  
**The ability to create new repositories within an organization or project must be restricted to a defined set of authorized members or teams. This control helps prevent unauthorized or uncontrolled creation of repositories, which could lead to shadow IT, unmanaged codebases, or security risks.

**Rationale**:  
 Limiting repository creation reduces the risk of unmanaged code proliferation, enforces governance over code storage and collaboration, and minimizes potential exposure of sensitive or unvetted projects. It supports organizational compliance and resource management policies.

**Impact:  
** **Pros**:

-   Improves governance and control over code repositories.  
      
    
-   Reduces risk of unauthorized or unmanaged repositories.  
      
    
-   Facilitates compliance with organizational policies.  
      
    

**Cons**:

-   May delay repository creation requests if approval processes are slow.  
      
    
-   Requires management and regular review of authorized users.  
      
    

**Default value:  
** By default, many platforms allow broad repository creation permissions for all organization members.

**Audit**:  
 Review organization or project settings to verify that repository creation permissions are limited to specific members or teams. Monitor audit logs for repository creation activities.

**Remediation:  
** Configure platform permissions (e.g., GitHub, GitLab) to restrict repository creation to designated users or teams. Establish approval workflows for repository requests. Educate members on repository governance policies.

**References**:

1.  GitHub Organization Settings – Repository Creation Permissions: [https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-repository-creation-permissions-in-your-organization](https://docs.github.com/en/organizations/managing-access-to-your-organizations-repositories/managing-repository-creation-permissions-in-your-organization)
    
2.  GitLab Group Settings – Repository Creation: [https://docs.gitlab.com/ee/user/group/settings.html#repository-creation](https://docs.gitlab.com/ee/user/group/settings.html#repository-creation)
    
3.  CIS Controls v8, Control 6 – Maintenance, Monitoring, and Analysis of Audit Logs: [https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/](https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.