# Ensure Maintain a Minimum of Two Administrators Per Repository

- Source: https://support.icompaas.com/support/solutions/articles/62000235237-ensure-maintain-a-minimum-of-two-administrators-per-repository
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  **Level 1**

**Description:  
** Each repository must have at least two designated administrators responsible for managing repository settings, access controls, and overall maintenance. Having multiple administrators ensures continuity of management, reduces the risk of single points of failure, and improves oversight.

**Rationale:  
**Assigning a minimum of two administrators promotes shared responsibility and accountability. It mitigates risks associated with administrator unavailability, prevents potential mismanagement, and supports secure and resilient repository governance.

**Impact**:  
 **Pros:**

-   **Ensures availability of administrative oversight at all times.  
      
    **
    
-   **Facilitates continuity during absences or turnover.  
      
    **
    
-   **Enhances security through shared responsibility.  
      
    **
    

**Cons:**

-   **Requires careful coordination to avoid conflicting changes.  
      
    **
    
-   **Needs ongoing management of administrator roles and access.  
      
    **
    

**Default value:  
****Some repositories may have only one or no designated administrators by default, increasing management risks.**

**Audit****:  
 Review repository settings to verify the presence of at least two administrators. Check access logs and permission assignments for compliance.**

**Remediation:  
** **Assign and document two administrators for each repository. Establish role management policies and periodic reviews to maintain appropriate administrative coverage.**

**References****:**

1.  **GitHub Repository Access Management: [https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings)**
    
2.  **GitLab Project Members and Roles: [https://docs.gitlab.com/ee/user/permissions.html](https://docs.gitlab.com/ee/user/permissions.html)**
    
3.  **CIS Controls v8, Control 5 - Account Management: [https://www.cisecurity.org/controls/account-management/](https://www.cisecurity.org/controls/account-management/)**

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.