GitHub Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for GitHub

1. 1

   PRIORITY 1 — Confirm AI training opt-out status before April 24, 2026: Log in to GitHub settings, navigate to Copilot preferences, and verify that data training use is disabled for your organization. If using Copilot Business or Enterprise, obtain a copy of your Data Protection Agreement confirming the no-training clause. Document and retain evidence for SOC 2 audit purposes.

   SOC 2 Overview (AICPA)
2. 2

   PRIORITY 2 — Request GitHub's current SOC 2 Type II report: Contact your GitHub account manager or GitHub's security team via their [Trust Center](https://github.com/security) to request the latest SOC 2 Type II report and a bridge letter covering any gap period. Many enterprise customers can access this through the GitHub Enterprise Agreement portal.

   SOC 2 Overview (AICPA)
3. 3

   PRIORITY 3 — Audit organization SSH keys and access credentials: Review all SSH keys registered to your GitHub organization (Settings → SSH and GPG keys), revoke any stale or unrecognized keys, and enforce a key rotation schedule. Evaluate migrating automated pipelines from SSH to short-lived HTTPS tokens to reduce persistent credential exposure.

4. 4

   PRIORITY 4 — Monitor TLS certificate renewal: Set a calendar reminder to verify that github.com's TLS certificate has been renewed before June 3, 2026. Check renewal status using the [SSL/TLS analysis service analyzer](https://www.SSL/TLS analysis service.com/ssltest/analyze.html?d=github.com) approximately 2 weeks before expiry.

   SSL Labs Test
5. 5

   PRIORITY 5 — Review the 2025 supply-chain breach impact on your repositories: Read the incident coverage at [eSecurity Planet](https://www.esecurityplanet.com/cybersecurity/github-breach-exposed-700-companies-in-months-long-attack/) and confirm with your GitHub account team whether your organization's repositories or Actions workflows were within the affected scope. Request a post-incident report or security advisory if one exists.

6. 6

   PRIORITY 6 — Document this assessment as CC9.2 evidence: Retain this report with a reviewer signature and date to satisfy SOC 2 Trust Services Criterion CC9.2 (Third-Party Risk Management). Your SOC 2 auditor may request this documentation during fieldwork.

   SOC 2 Overview (AICPA)NIST Supply Chain Risk (SP 800-161)

• Certificate Transparency log data returned zero results for github.com, which is inconsistent with GitHub's established 18-year domain history and likely reflects a query or cache limitation in the CT log source rather than an actual absence of certificates. This data point should not be interpreted as a genuine anomaly.
• Web archive history data returned a first-seen date of April 2, 2026, which contradicts the WHOIS-confirmed domain registration date of October 9, 2007. This appears to be a provider-specific index limitation and does not reflect GitHub's actual web presence history.
• The AI data retention period for GitHub Copilot interactions is not specified in the available policy evidence — the policy page states no explicit retention window for AI-processed prompts and outputs. Organizations with data minimization requirements should request clarification directly from GitHub.
• ISO 27001 certification status returned not_found via the IAF CertSearch registry. This does not confirm GitHub lacks the certification — the registry coverage is incomplete and many certified entities are not indexed. Organizations should request certificate documentation directly from GitHub's security team.
• HITRUST certification status could not be confirmed via the HITRUST directory. This is not a negative signal for a general-purpose SaaS platform and is noted only for completeness.
• External cyber risk scoring data was not available for this assessment. The SaaS industry benchmark comparison could not be completed against the stated average threshold.