|
| 1 | +--- |
| 2 | +title: Establishing a governance framework for your enterprise |
| 3 | +intro: 'You can manage governance and compliance for your enterprise using features and tools available in {% data variables.product.prodname_enterprise %}.' |
| 4 | +shortTitle: Governance framework |
| 5 | +allowTitleToDifferFromFilename: true |
| 6 | +versions: |
| 7 | + ghec: '*' |
| 8 | + ghes: '*' |
| 9 | +type: overview |
| 10 | +topics: |
| 11 | + - Enterprise |
| 12 | + - Fundamentals |
| 13 | +--- |
| 14 | + |
| 15 | +As an enterprise owner, you are responsible for maintaining a strong security posture, complying with regulations, mitigating risks, and protecting intellectual property, within your enterprise. {% data variables.product.company_short %} has tools that can help with that. |
| 16 | + |
| 17 | +Storing your company's code on {% data variables.product.github %} allows easy collaboration, tracking, and deployment from a single location. While allowing people to work in repositories with as little friction as possible is important for culture and productivity, you will want to implement some controls over people's work to ensure your code stays secure and reliable. |
| 18 | + |
| 19 | +With {% data variables.product.prodname_enterprise %}, you have access to {% data variables.product.github %}'s full range of governance features, allowing you to: |
| 20 | + |
| 21 | +* Control how people can update code |
| 22 | +* Govern how people can use repositories |
| 23 | +* Monitor activity |
| 24 | +* Detect leaked secrets |
| 25 | +* Set up an approval process for important actions |
| 26 | +* Detect vulnerabilities or errors in code |
| 27 | + |
| 28 | +<!-- Please note that we may move the sections below around once we've written them --> |
| 29 | + |
| 30 | +## Protecting your branches |
| 31 | + |
| 32 | +For important branches in your enterprise's repositories, such as branches containing production code, your compliance framework should reduce the risk of errors or malicious code entering your production environments. |
| 33 | + |
| 34 | +With **rulesets**, you can apply rules that govern how people can interact with specific branches. You can also give certain users the right to explicitly bypass the rules, which provides flexibility while still making the intended restrictions clear. |
| 35 | + |
| 36 | +Many enterprises add rules that: |
| 37 | + |
| 38 | +* **Restrict deletions**, so you can be confident users won't accidentally delete the branch |
| 39 | +* **Require a pull request** for all changes, so you have a paper trail and can enforce reviews |
| 40 | +* **Require status checks and deployments to succeed** before merging pull requests, so you can guard against errors in production |
| 41 | + |
| 42 | +Other rules, such as requiring signed commits or a linear commit history, are more situational and depend on your compliance requirements. |
| 43 | + |
| 44 | +{% ifversion enterprise-code-rulesets %} |
| 45 | +As an enterprise owner, you can create rulesets at the enterprise level that flexibly target the repositories and branches where you want rules to apply. You can start by adding a base level of protection to every default branch in your enterprise, then build your framework from there. To get started, see [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-code-governance). |
| 46 | +{% else %} |
| 47 | +To learn more, see [AUTOTITLE](/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). |
| 48 | +{% endif %} |
| 49 | + |
| 50 | +## Governing usage of repositories |
| 51 | + |
| 52 | +Because repositories are where your companies' code and data are stored, it's important to define how users can interact with your repositories to reduce the risk of data leaks. In your enterprise settings, you can set policies to: |
| 53 | + |
| 54 | +* Restrict the default visibility of repositories |
| 55 | +* Prevent non-members from being invited to repositories |
| 56 | +* Prevent repositories from being forked or transferred outside of an organization |
| 57 | + |
| 58 | +The goal of your policies should be to maintain your security requirements while still promoting collaboration and reducing friction for developers. For example, you could create an "open source" organization for all your enterprise's public repositories, and prevent public repositories from being created in any other organization. |
| 59 | + |
| 60 | +{% ifversion repo-policy-rules %} |
| 61 | +The easiest way to enforce restrictions is to create a **repository policy**. This allows you to flexibly target organizations and repositories in your enterprise and apply restrictions around visibility, naming, creation, deletion, and transfers. See [AUTOTITLE](/admin/managing-accounts-and-repositories/managing-repositories-in-your-enterprise/governing-how-people-use-repositories-in-your-enterprise). |
| 62 | + |
| 63 | +Other policies are available as blanket restrictions. These give you more control over the repository lifecycle, but aren't as flexible as the repository policy features. See{% else %}To learn how to set policies, see{% endif %} [AUTOTITLE](/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-repository-management-policies-in-your-enterprise). |
| 64 | + |
| 65 | +## Monitoring activity |
| 66 | + |
| 67 | +If something goes wrong, it's important to be able to search activity in your enterprise to investigate the cause or scope of the problem. |
| 68 | + |
| 69 | +{% data variables.product.github %}'s audit log includes detailed events related to your enterprise account, your organizations, and, if you use {% data variables.product.prodname_emus %}, your managed users. You can filter the audit log for themes like billing activity or search for events associated with a compromised token. |
| 70 | + |
| 71 | +To access the audit log, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/accessing-the-audit-log-for-your-enterprise). |
| 72 | + |
| 73 | +{% data variables.product.github %} does not retain audit log data indefinitely. We recommend streaming your audit logs to an external location, which allows you to retain the data for as long as you need and query the data with external tools. See [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise). |
| 74 | + |
| 75 | +## Preventing sensitive information from reaching your codebase |
| 76 | + |
| 77 | +To protect intellectual property and prevent security incidents, it's important to implement a system to keep sensitive information such as tokens out of your codebase. |
| 78 | + |
| 79 | +### {% data variables.product.prodname_secret_scanning_caps %} |
| 80 | + |
| 81 | +With **{% data variables.product.prodname_secret_scanning %}**, you can scan your code to detect sensitive information such as API keys, passwords, and other credentials in the codebase, preventing unauthorized access and potential breaches. {% data variables.product.prodname_secret_scanning_caps %} alerts you to sensitive information in your codebase, allowing you to respond appropriately by changing passwords or rotating tokens.{% ifversion ghec %} For generic secrets such as passwords, {% data variables.product.prodname_secret_scanning %} is powered by {% data variables.product.prodname_copilot %} and uses AI. See [AUTOTITLE](/code-security/secret-scanning/copilot-secret-scanning/responsible-ai-generic-secrets){% endif %} |
| 82 | + |
| 83 | +To learn more, see [AUTOTITLE](/code-security/secret-scanning/introduction/about-secret-scanning). |
| 84 | + |
| 85 | +{% data variables.product.prodname_secret_scanning_caps %} can be enabled at the enterprise, organization, and repository level. See {% ifversion ghes %}[AUTOTITLE](/admin/managing-code-security/managing-github-advanced-security-for-your-enterprise/configuring-secret-scanning-for-your-appliance){% elsif ghec %}[AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/about-security-configurations){% endif %} for enablement at enterprise level. |
| 86 | + |
| 87 | +### Push protection |
| 88 | + |
| 89 | +Additionally, you can prevent sensitive data and credentials from being accidentally pushed to repositories with **push protection**. |
| 90 | + |
| 91 | +Push protection acts as a safeguard by scanning for secrets in real-time and blocking pushes that contain potentially sensitive information. Organization owners can configure push protection policies at the organization level to enforce consistent security standards across all repositories. When a push is blocked, developers receive detailed guidance on how to remediate the issue, such as removing the secret from the code. |
| 92 | + |
| 93 | +See [AUTOTITLE](/code-security/secret-scanning/introduction/about-push-protection). |
| 94 | + |
| 95 | +Push protection can be enabled at the organization, repository, and user account level. See [AUTOTITLE](/code-security/secret-scanning/enabling-secret-scanning-features/enabling-push-protection-for-your-repository). |
| 96 | + |
| 97 | +{% ifversion push-protection-delegated-bypass %} |
| 98 | + |
| 99 | +## Setting up an approval process for sensitive actions |
| 100 | + |
| 101 | +You may want to set up an approval process for better control over who in your enterprise can perform sensitive actions. An approval process helps mitigate the risk of unauthorized or malicious changes, and can provide a record of who used the bypass and why, ensuring that all actions are traceable and accountable. |
| 102 | + |
| 103 | +>[!NOTE] The implementation of these approval processes can potentially cause some friction, so it's important to ensure that your security management team has adequate coverage before proceeding. |
| 104 | +
|
| 105 | +Approval processes are available for: |
| 106 | +* Bypasses of push protection—You can choose who is allowed to bypass push protection, and add a review and approval cycle for pushes containing secrets from all other contributors. For more information about **delegated bypass for push protection**, see [AUTOTITLE](/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/delegated-bypass-for-push-protection/about-delegated-bypass-for-push-protection).{% ifversion security-delegated-alert-dismissal %} |
| 107 | +* Dismissals of alerts for {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}—You can provide additional control and visibility over alert assessment by ensuring that only designated individuals can dismiss (or close) alerts. For more information about **delegated alert dismissal**, see [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/enabling-delegated-alert-dismissal-for-code-scanning) and [AUTOTITLE](/code-security/code-scanning/managing-your-code-scanning-configuration/enabling-delegated-alert-dismissal-for-code-scanning). |
| 108 | + |
| 109 | + {% data reusables.advanced-security.delegated-alert-dismissal-beta %} |
| 110 | + |
| 111 | +{% endif %} |
| 112 | + |
| 113 | +{% endif %} |
| 114 | + |
| 115 | +## Identifying security vulnerabilities and errors |
| 116 | + |
| 117 | +Many industries have regulations that require regular security assessments and vulnerability management. **{% data variables.product.prodname_code_scanning_caps %}** helps ensure compliance with industry standards by identifying and mitigating security risks in your code, such as insecure patterns. |
| 118 | + |
| 119 | +{% data variables.product.prodname_code_scanning_caps %} can be integrated to your CI/CD pipeline, providing continuous monitoring and assessment of your codebase. |
| 120 | + |
| 121 | +To get started quickly with {% data variables.product.prodname_code_scanning %}, we recommend you use the default setup. See [AUTOTITLE](/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning). |
| 122 | + |
| 123 | +{% data variables.product.prodname_code_scanning_caps %} can be enabled at the enterprise, organization, and repository level. See {% ifversion ghes %}[AUTOTITLE](/admin/managing-code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance){% elsif ghec %}[AUTOTITLE](/admin/managing-code-security/securing-your-enterprise/about-security-configurations){% endif %} for enablement at enterprise level. |
0 commit comments