Establish repository security baseline standard
Implementation Effort: Low – Defining the baseline of branch protection, review, scanning, and access settings is a focused policy-writing exercise for the security team with limited coordination to publish it. User Impact: Low – Setting the baseline standard is an administrative and governance activity; developers are not prompted when the standard is defined. Lifecycle Stage: Code Phase: First – Foundational governance control that should precede downstream repository governance work.
Overview
Define and enforce a repository security baseline standard that every repository in the organization must meet. The baseline should require branch protection, code review, security scanning, and controlled access settings so repositories do not rely on individual owner preference.
A repository security baseline standard defines the minimum configuration that every repository must meet. This typically includes branch protection rules or rulesets that prevent direct pushes to the default branch, a required number of reviewers, mandatory status checks from security tools, and secret scanning or equivalent controls. In GitHub, the baseline can also include repository rulesets, required code owner review through CODEOWNERS, push protection, and a SECURITY.md file that documents vulnerability disclosure procedures.
Azure DevOps provides comparable coverage through branch policies such as required reviewers and path filters, repository templates, and documented security contacts or processes. Azure DevOps does not natively provide GitHub-style CODEOWNERS or SECURITY.md enforcement, so those expectations must be implemented through policy, templates, or extensions where needed. Microsoft Defender for Cloud DevOps security recommendations can continuously assess repositories against these baseline expectations and surface drift as actionable findings.
Without a baseline standard, security becomes a matter of individual discipline rather than organizational policy, and consistency is impossible to verify at scale. By requiring mandatory code review, security status checks, and controlled access settings on every repository, this task supports Verify explicitly and Use least privilege access.