At risk

Start here

Secure administrator access

Identity and access

Protect the accounts that can change security settings, billing, and production access.

Why this matters for your business

Administrator accounts can change anything: add people, remove protections, and hand out access to your code and customer data. If one is taken over, nothing else has to be broken.

Why we can say that

Members can sign in with just a password, so a stolen password alone would be enough for someone to get into your organisation. Requiring a second form of verification would close this gap.

3 requirements have no evidence yet

See all 4 requirements and 1 finding

Review finding

Discuss

At risk

Secure workforce sign-in

Identity and access

Ensure people need a strong second factor when they access company systems.

Why this matters for your business

Most break-ins at companies your size start with one reused password. A second step at sign-in is the cheapest answer to that, and it is the first thing a customer security questionnaire asks about.

Why we can say that

Members can sign in with just a password, so a stolen password alone would be enough for someone to get into your organisation. Requiring a second form of verification would close this gap.

6 requirements have no evidence yet

See all 8 requirements and 1 finding

Review findings

Discuss

At risk

Manage privileged access

Identity and access

Limit powerful access, keep it separate from everyday work, and restrict delegated roles.

Why this matters for your business

Powerful access used for everyday work turns a routine mistake into a company-wide one. Keeping it separate, and handing it out only when it is needed, is what keeps a bad day small.

Why we can say that

Any member of your organisation can invite outside people to join, without an administrator needing to approve it first.

4 requirements have no evidence yet

Requirements

Outstanding invitations do not retain broad or privileged access At risk

A direct violation is currently open.

GitHub An unaccepted invitation allows code changes Review finding

GitHub An unaccepted invitation grants more than ordinary access Review finding

GitHub An unaccepted invitation carries access to every repository Review finding

GitHub Any member can invite people from outside the organisation Review finding

VercelCloudflare 2 tools are connected, but have not been assessed yet. Run assessment