# Ensure ​Restrict Issue Deletion Permissions to Authorized Users

- Source: https://support.icompaas.com/support/solutions/articles/62000235217-ensure-restrict-issue-deletion-permissions-to-authorized-users
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **Level 1**

**Description:  
** The ability to delete issues within a repository or project must be limited to designated users or teams. This control prevents unauthorized or accidental removal of issue records, preserving the integrity of the project’s history, audit trails, and collaboration transparency.

**Rationale:  
** Restricting issue deletion minimizes the risk of loss of important discussion, bug reports, or feature requests. It ensures accountability and maintains a reliable record of project activities, supporting audit and compliance requirements.

**Impact**:  
 **Pros**:

-   Protects important project documentation and history.  
      
    
-   Prevents unauthorized or accidental deletions.  
      
    
-   Supports transparency and accountability in project management.  
      
    

**Cons**:

-   May require additional management of user permissions.  
      
    
-   Could delay removal of obsolete or irrelevant issues if too restrictive.  
      
    

**Default value:  
** By default, many platforms allow broad permissions for issue deletion, sometimes including all project maintainers or admins.

**Audit**:  
 Review repository or project permission settings to verify that issue deletion rights are limited. Monitor audit logs for issue deletion events and investigate any unauthorized activity.

**Remediation:  
** Configure permissions to restrict issue deletion to a specific group of trusted users. Implement approval workflows if needed. Educate team members about issue management policies.

**References**:

1.  GitHub Issue Permissions: [https://docs.github.com/en/issues/tracking-your-work-with-issues/assigning-issues-and-pull-requests-to-other-github-users](https://docs.github.com/en/issues/tracking-your-work-with-issues/assigning-issues-and-pull-requests-to-other-github-users)
    
2.  GitLab Issue Management: [https://docs.gitlab.com/ee/user/project/issues/](https://docs.gitlab.com/ee/user/project/issues/)
    
3.  CIS Controls v8, Control 6 – Maintenance, Monitoring, and Analysis of Audit Logs: [https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/](https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.