# Ensure Restrict Repository Deletion Permissions to Authorized Users

- Source: https://support.icompaas.com/support/solutions/articles/62000235215-ensure-restrict-repository-deletion-permissions-to-authorized-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **Level 1**

**Description**:  
 The ability to delete repositories must be restricted to a defined group of authorized users or teams. This control helps prevent accidental or malicious deletion of repositories, preserving code integrity, historical data, and project continuity.

**Rationale**:  
 Limiting repository deletion reduces the risk of data loss and supports accountability. It ensures that repository removal is performed only by trusted personnel following appropriate approval processes, maintaining organizational security and compliance.

**Impact**:  
**Pros**:

-   Protects critical code and project history.  
      
    
-   Prevents accidental or unauthorized deletions.  
      
    
-   Supports audit and compliance requirements.  
      
    

**Cons**:

-   May require an approval process, potentially delaying necessary deletions.  
      
    
-   Needs management of user permissions and regular review.  
      
    

**Default value:  
** By default, many platforms allow broad repository deletion permissions, sometimes including all admins or organization owners.

**Audit:  
** Review platform permission settings to confirm repository deletion is limited to authorized users. Monitor audit logs for repository deletion events and verify compliance.

**Remediation:  
** Configure repository platform permissions to restrict deletion rights. Establish formal procedures for repository deletion requests and approvals. Train users on repository management policies.

**References**:

1.  GitHub Repository Deletion Permissions: [https://docs.github.com/en/github/administering-a-repository/deleting-a-repository](https://docs.github.com/en/github/administering-a-repository/deleting-a-repository)
    
2.  GitLab Repository Deletion: [https://docs.gitlab.com/ee/user/project/settings/#removing-a-project](https://docs.gitlab.com/ee/user/project/settings/#removing-a-project)
    
3.  CIS Controls v8, Control 6 – Maintenance, Monitoring, and Analysis of Audit Logs: [https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/](https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.