A Company would like to get ISO 271001 certified. With 10 developers and 4 others (product, QA) having access to various Github Repositories, they managed their access rights pretty good. 3 people have full access (admin) rights on the Organization level, while everybody else is in a team which has just read/write rights to certain repositories.
The branches have protection rules, force pushes as an example are not allowed and code only gets merged after a code review.
An external advisor said, in order to achieve ISO 27001 certification, the company must upgrade to a Github Enterprise schema AND fully utilize their single sign on. There won't be a way around, but people must link their personal github accounts to their (company) google login. From within google, the permissions for the Github organization are given.
Looking into the ISO 27001 standards, I simply don't find anything that would suggest such a dramatic permission shift. I can find best practice to protect branches, restrict access to minimum required, have a test suite, use dependabot and don't store credentials inside your git. Noithing related to Enterprise/SSO
Is the external advisor wrong?