← Back to all integrations
Create an inventory of your code repos and automate ensuring PRs and repos are configured correctly.


Aptible’s Github integration keeps your asset inventory up to date, triggers recurring security activities, and ensures your repo security settings are compliant.

Automate Asset Inventories

Not all of your code repos will be in scope of your ISMS. By maintaining this list over time, you’ll be able to more quickly react to requests from auditors and customers when they are investigating your SDLC policies.

Automate procedures on repo changes

You can leverage procedures to automatically trigger processes when code repos are added or removed from Githab (e.g. conduct a risk analysis when a code repo is created or remove sensitive data the code repository was utilizing).

Automatic Evidence Collection

Secure Settings

When syncing your code repos, we automatically check them for secure settings and collect evidence of all correct instances as well as create an issue and collect evidence for all non-secure settings identified.

SDLC Evidence

Comply will automatically record every Pull Request merged as an event and then process them using pre-configured checks to provide evidence that your SDLC policies are being followed and visibility into when they are not being followed. The automations that come with integration will generate healthy evidence for "Approved" and "CI Success" tagged events as well as unhealthy evidence and an issue for all others.


Code Repo Pull Request CI

Ensures code tests using continuous integration ("CI") were run and were passing prior to merge.

  • CC8.1
Code Repo Pull Request Approval

Ensures that pull (merge) requests are reviewed by someone other than the author prior to merge.

  • A.12.1.2
  • A.12.1.4
  • A.14.2.2
  • CC3.4
  • CC7.1
  • CC8.1

How to use Aptible and GitHub

  • Run automations on security configuration and changes to repos
  • Trigger notifications to designated asset owners when changes are made to security configurations and when repos are created without the required permissions.
  • Automatically collect evidence of changes, issues, and remediations.
Assets synced
  • Code Repositories
Domains Automated
  • Secure System Development
Frameworks Automated
ISO 27001:2013
Requirements Automated
ISO 27001:2013
Change management
Changes to the organization, business processes, information pro- cessing facilities and systems that affect information security shall be controlled
ISO 27001:2013
Separation of development, testing and operational environments
Development, testing, and operational environments shall be separated to reduce the risks of unauthorized access or changes to the operational environment.
ISO 27001:2013
System change control procedures
Changes to systems within the development lifecycle shall be controlled by the use of formal change control procedures.
Risk Assessment
COSO Principle 9: The entity identifies and assesses changes that could significantly impact the system of internal control.
System Operations
To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
Change Management
The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.
Integration scopes
  • Read: All repos
  • Read: All teams
  • Read: All pull request events
  • Permissions: Read Only