GitHub Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for GitHub

1. 1

   Confirm AI training opt-out status before April 24, 2026: If your organization uses any non-enterprise Copilot tier (Free, Pro, Pro+), log in to GitHub personal settings under 'Copilot' and verify the model training opt-out is enabled. For Enterprise/Business tiers, obtain written confirmation from your GitHub account team that the DPA-based no-training commitment applies to your subscription.

   DPA Template (GDPR Art. 28)
2. 2

   Request GitHub's current SOC 2 Type II report and bridge letter: Contact your GitHub Enterprise account manager or GitHub's security team via their [trust center](https://github.com/security). Many enterprise customers can request the report under NDA. Verify the report covers the current period and ask for a bridge letter if the report is more than 6 months old.

   SOC 2 Overview (AICPA)
3. 3

   Obtain the vendor's official incident report for the 2025 supply-chain breach: Contact GitHub's enterprise security team and request a formal incident summary or post-mortem for the supply-chain attack [reported in September 2025](https://www.esecurityplanet.com/cybersecurity/github-breach-exposed-700-companies-in-months-long-attack/). Document the response, remediation steps, and any compensating controls implemented.

4. 4

   Verify ISO 27001 certification status directly: Request a copy of GitHub's current ISO/IEC 27001 certificate from their security team, including the certificate number, issuing body, and expiry date. Cross-check against the issuing registrar's online lookup if available.

   ISO 27001 Standard
5. 5

   Monitor TLS certificate renewal: Set a 30-day reminder to re-check the github.com certificate expiry via the [SSL/TLS analysis service analysis tool](https://www.SSL/TLS analysis service.com/ssltest/analyze.html?d=github.com). If the certificate has not renewed by May 4, 2026, escalate to your GitHub account contact.

   SSL Labs Test
6. 6

   Document complementary user entity controls (CUECs) for SOC 2 compliance: If GitHub is within your organization's SOC 2 audit boundary, work with your auditor to document CUECs — specifically: MFA enforcement for all GitHub users in your organization, repository access reviews, branch protection rules, and secret scanning configuration. These are user-side controls that GitHub's SOC 2 report will delegate back to the customer.

   SOC 2 Overview (AICPA)

• ISO 27001 certification was not found in the IAF CertSearch registry during this assessment. GitHub's trust page references ISO compliance, and questionnaire signals indicate a prior ISO/IEC 27001:2013 certification, but independent registry verification was not available at the time of this scan. Manual verification is recommended via direct request to the vendor.
• HITRUST certification returned an unconfirmed directory match (90% name match confidence) that may represent a name collision with a different entity. This cannot be treated as a confirmed certification without manual verification with the HITRUST Alliance or the vendor.
• The AI data retention policy for GitHub Copilot interactions could not be determined from publicly available documentation — no specific retention period was found. Buyers with data minimization obligations should request this information directly from GitHub's privacy or security team.
• The full scope and remediation timeline of the 2025 supply-chain incident (reported by eSecurity Planet, September 9, 2025) could not be independently verified from public sources alone. The article describes the incident as originating from a GitHub breach affecting 700+ downstream organizations, but GitHub's official incident report or post-mortem was not available in the evidence set.