CR-1
Customer Responsibility: Customers are responsible for creating, updating and removing accounts for their organizations in accordance with their policies and procedures. Customers are also responsible monitoring user actions logged within their specific repositories.
Controls Reference: AC-2

CR-2
Customer Responsibility: Customers are responsible for authorizing application level access, and individual repository access to end-users prior to provisioning access to the application or repository. Customers are responsible for integrating with their single sign-on solution, using SAML.
Controls Reference: AC-3

CR-3
Customer Responsibility: Customers are responsible for authorizing application level access, and individual repository access to end-users prior to provisioning access to the application or repository. Customers are responsible for implementing and correctly configuring SAML for user authentication.
Controls Reference: AC-17

CR-4
Customer Responsibility: Customers are responsible for reviewing application logs within their repositories to identify their own defined inappropriate or unusual activity, and notify individuals within their organization and GitHub security team members.
Controls Reference: AU-6

CR-5
Customer Responsibility: Customers are responsible for obtaining and reviewing the report.
Controls Reference: CA-2

CR-6
Customer Responsibility: Customers are responsible for initiating Interconnection Security Agreements when needed.
Controls Reference: CA-3

CR-7
Customer Responsibility: The Federal agency utilizing the application is responsible for designating an authorizing official, reviewing the system and granting authorization.
Controls Reference: CA-6

CR-8
Customer Responsibility: Agencies that have authorized GitHub.com are responsible for reviewing the monthly continuous monitoring reports and providing questions to the organization.
Controls Reference: CA-7

CR-9
Customer Responsibility: Agencies that have authorized GitHub.com are responsible for reviewing the monthly inventory reports and providing questions to the organization.
Controls Reference: CM-8

CR-10
Customer Responsibility: Customers are responsible for initiating the backup when the customer requires it.
Controls Reference: CP-9

CR-11
Customer Responsibility: Customers are responsible for providing two-factor authentication for their end users. See IA-8(2).
Controls Reference: IA-2 (1)

CR-12
Customer Responsibility: Customers are responsible for implementing SAML and two-factor authentication for their users, based on the customer’s requirements. Federal agencies are responsible for authenticating users with PIV credentials prior to granting access to GitHub.com.
Controls Reference: IA-2 (12)

CR-13
Customer Responsibility: Customers are responsible for implementing hardware-based authentication and configuring SAML assertions to authenticate to GitHub.com.
Controls Reference: IA-5 (11)

CR-14
Customer Responsibility: Customers are responsible for implementing SAML and two-factor authentication for their users, based on the customer’s requirements. Federal agencies are responsible for authenticating users with PIV credentials prior to granting access to GitHub.com.
Controls Reference: IA-8 (1)

CR-15
Customer Responsibility: Customers are responsible for providing SAML based authentication information.
Controls Reference: IA-8 (2)

CR-16
Customer Responsibility: FICAM can be implemented through the use of the SAML tokens provided by GitHub. Customers are responsible for utilizing SAML tokens provided by GitHub.
Controls Reference: IA-8 (3)

CR-17
Customer Responsibility: FICAM can be implemented through the use of the SAML tokens provided by GitHub. Customers are responsible for utilizing SAML tokens provided by GitHub.
Controls Reference: IA-8 (4)

CR-18
Customer Responsibility: Customers are responsible for reporting suspected or actual incidents to GitHub.
Controls Reference: IR-4

CR-19
Customer Responsibility: Customers are responsible for identifying and providing contact information for their internal contact to be included in incident response communications.
Controls Reference: IR-6

CR-20
Customer Responsibility: Customers are responsible for obtaining, reviewed and approving the security plan as part of their on-going system authorization.
Controls Reference: PL-2

CR-21
Customer Responsibility: Customers are responsible for removing access from terminated individuals.
Controls Reference: PS-4

CR-22
Customer Responsibility: Customers are responsible fo modifying employee access when individuals changs job responsibilities.
Controls Reference: PS-5

CR-23
Customer Responsibility: The customer agency reviews the updated Risk Assessment Report when possible.
Controls Reference: RA-3

CR-24
Customer Responsibility: PIV can be implemented through the use of the SAML tokens provided by GitHub. Customers are responsible for utilizing SAML tokens provided by GitHub.
Controls Reference: SA-4 (10)

CR-25
Customer Responsibility: Customers are responsible for reporting any identified system flaws with the application.
Controls Reference: SI-2

CR-26
Customer Responsibility: Customers are responsible for installing and maintaining anti-virus and other malicious code protection mechanisms on their end users’ workstations.
Controls Reference: SI-3

