If your version control system is not connected to ComplyJet — or only partially connected — your VCS-related compliance controls won't be checked automatically. Without a VCS integration, 10+ automated tests won't run. These two manual tests let you maintain coverage for the most critical controls while your integration is pending or unavailable.
This applies when:
Your VCS integration isn't set up or isn't supported
Only some of your repositories are connected
Your auditor needs documented evidence from your VCS settings
What these tests cover
Both VCS tests satisfy controls across the following frameworks:
SOC 2 — CC6.0 (Logical Access), CC7.0 (System Operations), CC8.0 (Change Management)
ISO 27001 — Access control, Change management
If these frameworks are enabled in your program, the tests will appear automatically in View Additional Tests.
Step 1 – Check if the tests are already in your program
Go to Tests in the left sidebar. Click the Excluded tab and search for vcs.
If results appear, you can select these tests & activate them.
If there are no results (as shown above), the tests haven't been added yet. Move to Step 2.
Step 2 – Add the VCS tests to your program
From the Tests page, click the three-dot menu (⋯) in the top right corner and select View Additional Tests.
In the modal that opens, search for vcs. You'll see two tests:
VCS version control configurations
VCS identity and authentication settings
Click Add To Program for both tests.
Step 3 – Upload evidence to each test
Go back to the Tests page and search for vcs in the All tab. Both tests will now appear with a Failing status — this means they're active in your program but waiting for evidence.
Click into a test to open it, go to the Evidence tab, and click Add Files.
Repeat for both tests.
What to upload: VCS version control configurations
This test covers repository configuration — how code review, merging, and visibility are controlled.
Upload at least one screenshot or export for each requirement below.
Repositories are set to private
Your in-scope repositories should not be publicly accessible. Upload a screenshot of your repository list or settings showing the repository is set to private.
Code review is required before merging
Changes to your main branch should require at least one approval before they can be merged. Upload a screenshot of the branch protection or merge approval settings showing that approvals are required.
The author cannot approve their own changes
Review should be done by someone other than the person who made the change. Upload a screenshot showing that the PR or MR author cannot be their own approver.
Branch protection applies to administrators too
Protection rules should cover all users, including admins. Upload a screenshot showing admin bypass is disabled or that rules apply to everyone.
A PR or MR template is in use (if applicable)
If your team uses a pull or merge request template, include a screenshot. This shows that code changes follow a consistent review structure.
What to upload: VCS identity and authentication settings
This test covers how access to your version control platform is secured.
Upload at least one screenshot or export for each pattern below.
MFA is enforced for all users
Multi-factor authentication should be required for everyone with access. Upload a screenshot from your organization's security settings showing MFA enforcement is on.
SSO is enforced (if applicable)
If your team uses single sign-on, upload a screenshot showing it's enabled and enforced for your VCS organization.
Accounts are individually assigned
No shared logins. Upload a screenshot of your member or user list showing that each account belongs to a specific person.
Terminated user access is removed
Former employees should not retain access. Upload a screenshot of your current member list, or evidence from your offboarding process showing access is revoked when someone leaves.
Tips for good evidence
Good evidence clearly shows:
The organization, workspace, or repository name
The specific setting being demonstrated
When it was captured (visible in the URL bar, OS clock, or UI timestamp if available)
One screenshot per requirement is enough. Sometimes same screenshot might be applicable for multiple requirements.