• Standards adherence dashboard
  • View the standards adherence dashboard
  • GitLab standard
    • Prevent authors as approvers
    • Prevent committers as approvers
    • At least two approvals
• Compliance violations report
  • View the compliance violations report for a group
    • Severity levels
    • Violation types
      • Separation of duties
  • Chain of Custody report
    • Generate Chain of Custody report
    • Generate commit-specific Chain of Custody report
• Compliance frameworks report
  • View the compliance frameworks report for a group
  • Apply a compliance framework to projects in a group
  • Remove a compliance framework from projects in a group
  • Export a report of merge request compliance violations on projects in a group
  • Export a report of compliance frameworks on projects in a group
    • Filter the compliance frameworks report

Compliance center

See report and manage standards adherence, violations, and compliance frameworks for the group

Standards adherence dashboard

Standards adherence dashboard lists the adherence status of projects complying to GitLab standard.

View the standards adherence dashboard

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To view the standards adherence dashboard for a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.

GitLab standard

GitLab standard consists of three rules:

• Prevent authors as approvers.
• Prevent committers as approvers.
• At least two approvals.

Prevent authors as approvers

To comply with GitLab standard, you must prevent users from approving their own merge requests. For more information, see Prevent approval by author.

On self-managed GitLab, when instance-level setting for prevent approval by author is updated, the adherence status for all the projects on the instance is not updated automatically. To update the adherence status for these projects, the group-level or the project-level setting must be updated.

Prevent committers as approvers

To comply with GitLab standard, you must prevent users from approving merge requests where they’ve added commits. For more information, see Prevent approvals by users who add commits.

On self-managed GitLab, when instance-level setting for prevent approvals by users who add commits is updated, the adherence status for all the projects on the instance is not updated automatically. To update the adherence status for these projects, the group-level or the project-level setting must be updated.

At least two approvals

To comply with GitLab standard, you must have at least two users approve a merge request to get it merged. For more information, see Merge request approval rules.

Compliance violations report

With compliance violations report, you can see a high-level view of merge request activity for all projects in the group.

When you select a row in the compliance report, a drawer appears that provides:

• The project name and compliance framework label, if the project has one assigned.
• A link to the merge request that introduced the violation.
• The merge request’s branch path in the format [source] into [target].
• A list of users that committed changes to the merge request.
• A list of users that commented on the merge request.
• A list of users that approved the merge request.
• The user that merged the merge request.

View the compliance violations report for a group

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To view the compliance violations report:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.

You can sort the compliance report on:

• Severity level.
• Type of violation.
• Merge request title.

You can filter the compliance violations report on:

• Project.
• Date range of merge.
• Target branch.

Select a row to see details of the compliance violation.

Severity levels

Each compliance violation has one of the following severities.

Violation types

From GitLab 14.10, these are the available compliance violations.

The following are unavailable compliance violations that are tracked in epic 5237.

Separation of duties

GitLab supports a separation of duties policy between users who create and approve merge requests. Our criteria for the separation of duties is:

• A merge request author is not allowed to approve their merge request.
• A merge request committer is not allowed to approve a merge request they have added commits to.
• The minimum number of approvals required to merge a merge request is at least two.

Chain of Custody report

The Chain of Custody report provides a 1 month trailing window of all commits to a project under the group.

To generate the report for all commits, GitLab:

1. Fetches all projects under the group.
2. For each project, fetches the last 1 month of commits. Each project is capped at 1024 commits. If there are more than 1024 commits in the 1-month window, they are truncated.
3. Writes the commits to a CSV file. The file is truncated at 15 MB because the report is emailed as an attachment (GitLab 15.5 and later).

The report includes:

• Commit SHA.
• Commit author.
• Committer.
• Date committed.
• Group.
• Project.

If the commit has a related merge commit, then the following are also included:

• Merge commit SHA.
• Merge request ID.
• User who merged the merge request.
• Merge date.
• Pipeline ID.
• Merge request approvers.

Generate Chain of Custody report

To generate the Chain of Custody report:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. Select List of all merge commits.

Depending on your version of GitLab, the Chain of Custody report is either sent through email or available for download.

Generate commit-specific Chain of Custody report

You can generate a commit-specific Chain of Custody report for a given commit SHA. This report provides only the details for the provided commit SHA.

To generate a commit-specific Chain of Custody report:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. At the top of the compliance report, to the right of List of all commits, select the down arrow ().
4. Enter the commit SHA, and then select Export commit custody report.

Depending on your version of GitLab, the Chain of Custody report is either sent through email or available for download.

Alternatively, use a direct link: https://gitlab.com/groups/<group-name>/-/security/merge_commit_reports.csv?commit_sha={optional_commit_sha}, passing in an optional value to the commit_sha query parameter.

Compliance frameworks report

With compliance frameworks report, you can see the compliance frameworks that are applied to projects in a group. Each row of the report shows:

• Project name.
• Project path.
• Compliance framework label if the project has one assigned.

The default framework for the group has a default badge.

View the compliance frameworks report for a group

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To view the compliance frameworks report:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.

Apply a compliance framework to projects in a group

You can apply a compliance framework to projects in a group.

Prerequisites:

• You must have the Owner role for the group.

To apply a compliance framework to one project in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. Next to the project you want to add the compliance framework to, select Add framework.
5. Select an existing compliance framework or create a new one.

To apply a compliance framework to multiple projects in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. Select multiple projects.
5. From the Choose one bulk action dropdown list, select Apply framework to selected projects.
6. Select framework to apply.
7. Select Apply.

Remove a compliance framework from projects in a group

You can remove a compliance framework from projects in a group.

Prerequisites:

• You must have the Owner role for the group.

To remove a compliance framework from one project in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. Next to the compliance framework to remove from the project, select on the framework label.

To remove a compliance framework from multiple projects in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. Select multiple projects.
5. From the Choose one bulk action dropdown list, select Remove framework from selected projects.
6. Select Remove.

Export a report of merge request compliance violations on projects in a group

Export a report of merge request compliance violations on merge requests belonging to projects in a group. Reports:

• Do not use filters on the violations report.
• Are truncated at 15 MB so the email attachment is not too large.

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To export a report of merge request compliance violations for projects in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Violations tab.
4. On the Violations tab, select the Export full report as CSV action in the top right corner

A report is compiled and delivered to your email inbox as an attachment.

Export a report of compliance frameworks on projects in a group

Export a report of compliance frameworks that are applied to projects in a group. Reports:

• Do not use filters on the framework report.
• Are truncated at 15 MB so the email attachment too large.

Prerequisites:

• You must be an administrator or have the Owner role for the group.

To export a report of compliance frameworks on projects in a group:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. On the Frameworks tab, select the Export as CSV action in the top right corner

A report is compiled and delivered to your email inbox as an attachment.

Filter the compliance frameworks report

To filter the list of compliance frameworks:

1. On the left sidebar, select Search or go to and find your group.
2. On the left sidebar, select Secure > Compliance center.
3. On the page, select the Frameworks tab.
4. In the search field:
   1. Select the attribute you want to filter by.
   2. Select an operator.
   3. Select from the list of options or enter text for the search.
5. Select Search ().

Repeat this process to filter by multiple attributes.