> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets.md).

# VCS organization assets

Cortex Cloud Application Security automatically discovers every connected Version Control System (VCS) organization, establishing it as the foundational, top-level governance boundary for your software supply chain.

## Prerequisites

Before viewing and managing VCS organization assets, verify the following:

| Prerequisite        | Description                                                                                                                                                           |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **License**         | An active Cortex Cloud license with Application Security entitlements                                                                                                 |
| **RBAC role**       | The AppSec Admin or SOC Analyst role, or an equivalent custom role with asset inventory and issue management permissions                                              |
| **VCS integration** | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active. VCS organizations are discovered through active VCS integrations |

## Core capabilities and scope

* **Discovery and visibility**: Automatically identifies organizations via active integrations, capturing their unique identity, provider, and URL
* **Aggregated posture**: Calculates the collective security health across all child entities to determine the organization's overall posture
* **Scope constraints**: The asset represents the organization as a whole; it does not represent individual repositories, specific CI/CD pipelines, or business applications

## Key achievements

* **Code-to-Cloud lineage root**: The VCS organization acts as the starting point of the Code-to-Cloud graph. All downstream assets inherit their governance scope (policies, compliance frameworks, and business criticality) from this parent node.
* **Policy propagation**: Organization-level policies automatically flow to all child repositories, ensuring consistent security standards across the environment.

## Relationship model

The VCS organization is the root node of the asset hierarchy, interacting with other assets as follows:

* **Child - Repository**: Repositories inherit organization-level policies and compliance scopes. Their individual security findings aggregate up to the organization's overall health profile.
* **Child - CI/CD Instance**: CI/CD platforms associated with the organization (e.g., GitHub Actions for a GitHub org) inherit the VCS provider type and organizational context.
* **Sibling - VCS Organization**: Other VCS organizations within the same tenant. They operate side-by-side but maintain completely independent policy scopes, governance boundaries, and health profiles.

## Next steps

* [Understand and prioritize VCS organization assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets/understand-and-prioritize-vcs-organization-assets.md)
* [Investigate and manage VCS organization assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets/investigate-and-manage-vcs-organization-assets.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.