3

A Company would like to get ISO 271001 certified. With 10 developers and 4 others (product, QA) having access to various Github Repositories, they managed their access rights pretty good. 3 people have full access (admin) rights on the Organization level, while everybody else is in a team which has just read/write rights to certain repositories.

The branches have protection rules, force pushes as an example are not allowed and code only gets merged after a code review.

An external advisor said, in order to achieve ISO 27001 certification, the company must upgrade to a Github Enterprise schema AND fully utilize their single sign on. There won't be a way around, but people must link their personal github accounts to their (company) google login. From within google, the permissions for the Github organization are given.

Looking into the ISO 27001 standards, I simply don't find anything that would suggest such a dramatic permission shift. I can find best practice to protect branches, restrict access to minimum required, have a test suite, use dependabot and don't store credentials inside your git. Noithing related to Enterprise/SSO

Is the external advisor wrong?

Improve this question
4
  • 4
    What was the advisor's reasoning? Because there is nothing in ISO 27001 that would require such a specific technical control.
    – schroeder ♦
    Nov 15, 2022 at 9:33
  • 1
    Agreeing with schroeder, this sounds like a pretty baroque interpretation of the standard.
    – Bruno Rohée
    Nov 15, 2022 at 9:46
  • @schroeder i got told by our interim CTO, who is working as a freelancer, that we must upgrade to github enterprise, he will take care on it, in order to fit the ISO 27001 certification. Of course this is him creating work for hisself, which is billable hour. I questioned this decision. We are a team of 15 people who work on github, but my concern got shut down and i was told "it's basically impossible to fit certification unless you have github enterprise with single sign on".
    – Tim Kretschmer
    Nov 15, 2022 at 16:16
  • 1
    yeah .... no...
    – schroeder ♦
    Nov 15, 2022 at 18:58

1 Answer 1

Reset to default
2

We've just gone through ISO27001 Certification (and achieved it) and were not required to change to GitHub Enterprise - although it was an option.

As long as we had the right controls in place to manage the risks, there was no mandate to use a particular technical solution.

From what we can tell as long as you've got the processes documented and they are being followed - that is the important thing.

We did have to do the following (some of which we'd already started before our ISO journey kicked off):

  • Protect main branches
  • Require PRs into main
  • Create PR templates (.github/pull_request_template.md) with checklists of items for developers to check off when creating/updating PRs
  • Ensure we had the correct approvals in place (in our case managed with GitHub teams)

We did have some disagreements with our assessor around the detail required in the policies, but in the end as long as the policies are approved by the appropriate person, then that is generally enough (at least in our experience).

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .