SOC 2 · GitHub
Fix failing SOC 2 change management tests in GitHub
Deixic enables required reviews and branch protection on every repository that fails, removes former employees from the organization, and re-runs the test.
Tests Deixic fixes in GitHub
Criteria touched: CC8.1 Change management, CC6.2 Provisioning and deprovisioning, CC6.1 Logical access, including MFA.
Failing testWhat Deixic doesCriterion
Code changes require reviewSets required pull request reviews and blocks force pushes on the default branch of each repository that fails.CC8.1
Offboarding revokes accessRemoves a terminated person from the organization and its teams.CC6.2
Two-factor authentication requiredReads the organization setting and lists members without two-factor authentication.CC6.1
What runs, what waits, what is yours
Deixic classifies every GitHub action before it runs.
Runs within policy
- Enable required reviews and block force pushes on a repository
- Remove an organization member whose owner is terminated
Waits for a named approver
- Removing an organization owner
- Changing who can bypass branch protection
Sent to you as a decision
- Deleting a repository or an organization.
- A review count your written policy does not set.
Read back and evidence
Each change is read back from GitHub, attached to the test in your compliance platform (or kept in Deixic if you have none), and the test runs again.
Deixic reads back
- The branch protection rule on each repository after the change
- The organization member list after a removal
Your auditor gets
- Before and after protection settings for each repository
- The policy section that authorized the change
- The member removed and the HR record behind it