Q3 GitHub access review, with the evidence kept (ISO 27001 minor finding 2)

Project: Engineering
Type: Task
Status: Done Done
Priority: Medium
Reporter: Maja Schulz <maja.schulz@acme-hq.example>
Assignee: Rafael Duarte <rafael.duarte@acme-hq.example>
Labels: securityiso-27001
Components: infrastructure
Sprint: Sprint 53
Created: 17 Sep 2026, 08:00 UTC
Updated: 16 Oct 2026, 13:00 UTC
Resolved: 16 Oct 2026, 13:00 UTC

Description

The surveillance audit on 15 September and 16 September found the evidence for the Q2 GitHub access review incomplete (Confluence SEC › ISO 27001 notes). Do the Q3 review now and keep: the list of members and their teams on the day, who was removed and why, who signed it off.

Comments (1)

Rafael Duarte · 16 Oct 2026, 13:00 UTC

Done: 31 members, 3 removed (a deploy token unused since 2025, two people who left in 2025). Evidence filed with Maja. Closes the minor finding.