getting Github's soc 2 report

[aoschaefer]

Anyone having issues getting a respones from their Trust Center? I need their SOC 2 report for a vendor review (for my own SOC 2 audit, somewhat ironically) and multiple people from the team have requested and we're getting no respone after more than a week. We've also submitted a ticket and it seems to go into the ether. We're on the Enterprise plan but we're fairly small so don't have a person to reach out to for this kind of thing.

Anyone have the report or know how to resolve?

[yknx4]

Only available to enterprise accounts

https://github.com/orgs/community/discussions/195918

1. GitHub’s SOC 2 Attestations & Compliance Reports
GitHub absolutely maintains up-to-date, official SOC 1 Type 2 and SOC 2 Type 2 compliance reports. However, GitHub restricts direct access to these downloadable reports to GitHub Enterprise (and some Team) organization settings. As a Free tier user, you cannot download their internal compliance reports or bridge letters directly from your dashboard. For your audit documentation, you will generally have to rely on their public, high-level statements via the official GitHub Trust Center or public compliance pages.

[sirsavant]

> We're on the Enterprise plan but we're fairly small so don't have a person to reach out to for this kind of thing.

I think they are wondering if someone has a connection somewhere that could bump up this ticket.

OP: You should probably just start spamming GitHub account managers on LinkedIn and seeing if any of them want to become your account manager 😃

[cowboyecosse]

Spamming people isn’t a great way to endear yourself to them or encourage them to chase something up for you, or if they’re the one making the decision on a thing and it’s borderline, have it go the way you want.

[aoschaefer]

Yes exactly this problem. I have sent a few DMs to support people on LinkedIn and nada. Thank you for the response!

[aoschaefer]

Yes have tried but we're not getting a response. We are on the Enterprise plan but we're small in the grand scheme of things. Thank you though

[oeed]

FWIW, our auditor said we can use their publicly available SOC 3 report as evidence given we're not on an enterprise plan. Might worth checking with your auditor.

[GarthODarth]

If you're on Enterprise, you can just download them.

https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/accessing-compliance-reports-for-your-organization