CIS.GH.1.3.8: Ensure strict base permissions are set for repositories

Not run by Mito today

This check needs a connection to GitHub, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.GH.1.3.8
Severity	High
Suite	CIS Microsoft 365 Foundations Benchmark
Product	GitHub
Feature	Organization settings
Security area	Access control
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Benchmark	CIS GitHub Benchmark 1.2.0, 1.3.8 (L1, GH Level 1)
Framework controls	cis-github:1.3.8 nist-800-53-r5:AC-6 Least Privilege nist-800-53-r5:AC-3 Access Enforcement
MITRE ATT&CK	T1677, T1195.002
Reads from	GitHub

What this checks and how to fix it

1.3.8 (L1) Ensure strict base permissions are set for repositories

CIS Benchmark: CIS GitHub Benchmark v1.2.0

Assessment Status: Manual

Rationale

Base permissions apply broadly across organization repositories. Keeping the default at none or read follows least privilege and lowers the chance that every member can change code where they do not have a specific business need.

Impact

Some members may lose default write access and require explicit repository, team, or role assignments before they can contribute changes.

Mito automation note

CIS marks this recommendation as Manual. This Mito test automates the portion of CIS GH 1.3.8 that maps to documented GitHub REST API evidence. It should be treated as automated evidence collection for the corresponding GitHub setting, not as a claim that every possible manual review path has been fully evaluated.

API evidence

Endpoint: GET /orgs/{org}

Evidence field: default_repository_permission

The test passes when default_repository_permission is none or read. It fails when the value is write or admin.

Permissions required

GitHub requires organization-owner visibility for full organization details. Use Connect-MtGitHub with a classic PAT that has admin:org, or a fine-grained PAT with organization Members read and Administration read permissions.

Remediation summary

In the organization settings, open Member privileges and set Base permissions to None or Read.

Known limitations

This test verifies the organization default repository permission only. It does not review per-repository collaborators, teams, or custom access grants.

Related links

• CIS GitHub Benchmark v1.2.0 - Section 1.3.8
• GitHub REST API: Get an organization

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: thetechgy. Open-source licences.