Which two GitHub artifacts commonly support external compliance audits? (Choose two)
Select all correct answers, then click Submit.
Short Explanation and Infographic
Auditors want evidence controls exist and operated: audit logs, policy configs, access reviews, maybe SOC reports from GitHub the company. Public gists of prod passwords are findings, not evidence. Never disable logging to 'save storage' before an audit.
Full explanation below image
Full Explanation
The correct answers are audit logs and documented protection/ruleset configurations as control evidence. These demonstrate who changed what and that branch/tag policies exist. Option C is a control failure. Option D destroys evidence. Map GitHub controls to your frameworks (SOX, ISO, FedRAMP customer responsibilities), retain exports per policy, and screenshot or export settings baselines. Streaming audit events to immutable storage further strengthens operating-effectiveness evidence when auditors ask whether controls ran continuously, not only on the day of sampling.