CIS.GH.1.3.2: Ensure team creation is limited to specific members

Not run by Mito today

This check needs a connection to GitHub, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.GH.1.3.2
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	GitHub
Feature	Organization settings
Security area	Access control
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CIS GitHub Benchmark 1.2.0, 1.3.2 (L1, GH Level 1)
Framework controls	cis-github:1.3.2 nist-800-53-r5:AC-6 Least Privilege
Reads from	GitHub

What this checks and how to fix it

1.3.2 (L1) Ensure team creation is limited to specific members

CIS Benchmark: CIS GitHub Benchmark v1.2.0

Assessment Status: Manual

Rationale

Teams can inherit access and quickly become part of the organization’s permission model. Restricting team creation helps prevent shadow teams, accidental privilege expansion, and unnecessary organizational clutter.

Impact

Members who previously created teams directly may need an owner, administrator, or approved access-management process to create new teams.

Mito automation note

CIS marks this recommendation as Manual. This Mito test automates the portion of CIS GH 1.3.2 that maps to documented GitHub REST API evidence. It should be treated as automated evidence collection for the corresponding GitHub setting, not as a claim that every possible manual review path has been fully evaluated.

API evidence

Endpoint: GET /orgs/{org}

Evidence field: members_can_create_teams

The test passes when members_can_create_teams is false.

Permissions required

GitHub requires organization-owner visibility for full organization details. Use Connect-MtGitHub with a classic PAT that has admin:org, or a fine-grained PAT with organization Members read and Administration read permissions.

Remediation summary

In the organization settings, open Member privileges and disable Allow members to create teams.

Known limitations

This test verifies the organization-level team creation setting. It does not review custom operational processes for who may request or approve new teams.

Related links

• CIS GitHub Benchmark v1.2.0 - Section 1.3.2
• GitHub REST API: Get an organization

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: thetechgy. Open-source licences.