# Branch protection enabled on default branch

- Source: https://support.icompaas.com/support/solutions/articles/a_1781185116551191-branch-protection-enabled-on-default-branch
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Version Control System (VCS)](https://support.icompaas.com/support/solutions/c_1781179095087930) › [GitHub](https://support.icompaas.com/support/solutions/folders/f_1781179116560328)
- Last updated: 2026-06-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control verifies that branch protection is enabled on the repository's default branch (typically main or master). Branch protection rules help prevent unauthorized or accidental changes to critical branches by enforcing restrictions such as pull request reviews, status checks, force-push prevention, and deletion protection.

  

Rationale:

The default branch usually contains production-ready or business-critical code. Without branch protection, users with write access can directly push changes, force-push commits, or delete the branch, increasing the risk of unauthorized modifications, accidental changes, and supply-chain attacks.

Enabling branch protection ensures that all changes follow an approved development workflow and are subject to appropriate review and validation before being merged.

  

Impact:

Enabling branch protection may introduce additional controls that developers must satisfy before modifying the protected branch. Potential impacts include:

-   Direct pushes to the default branch may be blocked.
    
-   Pull request reviews may be required before merging.
    
-   CI/CD status checks may be mandatory.
    
-   Force pushes and branch deletion may be restricted.
    
-   Development teams may need to update existing workflows to comply with the protection requirements.
    

These impacts are generally positive, improving code quality and repository security.

  

Default Value:

By default, GitHub repositories do not have branch protection enabled unless explicitly configured by a repository administrator.

  

Remediation:

Test Plan:

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Select Settings → Branches.
    
4.  Review the Branch protection rules section.
    
5.  Verify whether a branch protection rule exists for the default branch (for example, main)
    

6.  If a branch protection rule is not created for the default branch(typically main or master), follow the implementation steps.
    

  

Implementation:

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Select Settings
    

4.  Select Rules in the left-hand side menu → Rulesets and click New Branch Ruleset.
    

5.  Enter a meaningful ruleset name (e.g., "Default Branch Protection"). Set Enforcement Status to Active.Under Target Branches, click Add Target. And select include the default branch(typically main or master)
    

  

6.  In the Branch rules, configure the required protections depending on the organization's requirements.
    

                      Required

                      ✅ Restrict deletions  
                      ✅ Block force pushes  
                      ✅ Require a pull request before merging

                       Recommended

                       ✅ Require status checks to pass

                       Optional (depends on organization requirements)

                       ✅ Require signed commits  
                      ✅ Require code scanning results  
                      ✅ Require code quality results  
                      ✅ Require deployments to succeed

  

7.  Click Create.
    

Backout Plan

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Navigate to Settings → Rules → Rulesets.
    
4.  Locate the ruleset protecting the default branch.
    
5.  Delete the ruleset.
    

6.  Verify that repository operations return the repository to its previous state.
    

  

References:

-   [GitHub Branch protection document](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule)
    
-   [GitHub Rulesets Documentation](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.