# Required commit signatures enforced on default branch

- Source: https://support.icompaas.com/support/solutions/articles/a_1781197128088806-required-commit-signatures-enforced-on-default-branch
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Version Control System (VCS)](https://support.icompaas.com/support/solutions/c_1781179095087930) › [GitHub](https://support.icompaas.com/support/solutions/folders/f_1781179116560328)
- Last updated: 2026-06-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This check verifies that commits merged into the default branch are required to have valid cryptographic signatures. Commit signing helps verify the authenticity and integrity of commits by ensuring that changes originate from trusted contributors and have not been tampered with.

  

Rationale:

Unsigned commits can make it difficult to verify the identity of contributors and the integrity of code changes. Requiring signed commits strengthens the software supply chain by providing assurance that commits were created by authenticated users and have not been modified after signing. This control helps mitigate risks associated with unauthorized code changes, impersonation, and malicious contributions.

  

Impact:

Enforcing signed commits may:

-   Require developers to configure GPG, SSH, or S/MIME commit signing.
    
-   Prevent unsigned commits from being merged into protected branches.
    
-   Increase administrative effort during initial setup.
    
-   Improve traceability and authenticity of code changes.
    

  

Default Value:

By default, GitHub does not require signed commits on repository branches. Repository administrators must explicitly configure branch protection rules or rulesets to enforce commit signature requirements.

  

Remediation:

Test Plan:

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Select Settings → Branches.
    
4.  Review the Branch protection rules section.
    
5.  Verify whether a branch protection requiring signed commits is enabled. 
    

6.  If a branch protection rule doen’t have the Require signed commits is enabled.  follow the 
    

implementation steps.

  

Implementation:

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Select Settings
    

4.  Select Rules in the left-hand side menu → Rulesets and click New Branch Ruleset or edit existing rule.
    

5.  Enter a meaningful ruleset name (e.g., "Required commit signatures enforced on default branch "). Set Enforcement Status to Active.Under Target Branches, click Add Target. And select include the default branch(typically main or master)
    

  

6.  In the Branch rules, enable Require signed commits.
    

7.  Click Create.
    

Backout Plan:

1.  Log in to GitHub with access to the repository.
    
2.  Navigate to the repository.
    
3.  Navigate to Settings → Rules → Rulesets.
    
4.  Locate the ruleset protecting the Required commit signatures enforced on default branch .
    
5.  Disable or delete the ruleset.
    

6.  Verify that repository operations return the repository to its previous state.
    
7.    
    

References:

-   [https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
    
-   [https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
    
-   [https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches)
    
-   [https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/about-protected-branches](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/about-protected-branches)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.