GitHub integration

About

The GitHub integration lets ControlMap check how your GitHub organization is protected, so you can show security evidence without collecting it by hand. ControlMap reads your organization's members, repositories and secrets, and runs four compliance checks on them.

The checks are:

MFA is enabled for Github users
Access to repositories are by teams
Key branch protection is enabled on the main branch
Secrets are updated every six months

In ControlMap, the integration's card is called Github Source Control.

Before you start

You need:

Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
A GitHub organization account. The integration does not work with personal GitHub accounts.
To be a member of that organization. The person who sets up the connection must belong to the organization.
The Installation Id for the ControlMap GitHub app in your organization. The help panel beside the setup form explains the steps on the GitHub side.

Connect GitHub

Go to Monitor › Integrations and select Add Integration.
Search for Github, then select the Github Source Control card.

The Add Integration window with Github typed in the search box and the Github Source Control card shown

On the Connection step, enter the details for the connection:
- Connection name: a name for this connection. ControlMap fills in a default that you can change.
- Installation Id: required.
Select Next: Checks. ControlMap uses the Installation Id to connect to your GitHub organization.
Complete the remaining steps as described in the Connect an integration article.

The Add Github Source Control setup page on the Connection step, with the Connection name and Installation Id fields and a help panel on the right

The note under the Installation Id field repeats that the connector needs an organization GitHub account, and that the person who configures the installation ID must be a member of the organization. Select Cancel to return to the Integrations list without connecting.

What you'll see after connecting

After the first scan, you'll find the results in these places:

Monitor › Compliance Checks: the four GitHub checks. They show No Data until the first scan has run.
Monitor › User Accounts: the members of your GitHub organization.
Monitor › Integrations: the connection's card, with its status, last sync date and number of records. Select the card to open its page.

Disconnect or change settings

To change the connection, schedule or watchers, go to Monitor › Integrations and open the connection's card. The Connect an integration article describes each tab.
To remove the integration, select the bin icon on its card and confirm. Deleting an integration also deletes all of its assets and their compliance status.