This rule detects when a GitHub organization or enterprise disables the enforced two-factor authentication (2FA) requirement. It monitors GitHub audit logs for two event actions: business.disable_two_factor_requirement and org.disable_two_factor_requirement. When triggered, the change downgrades all members to password-only authentication and permits inviting new members without 2FA, creating a high-risk opportunity for account takeover or persistence by an attacker who has compromised an owner or enterprise-admin account. The rule maps to MITRE ATT&CK: Impair Defenses (T1562) and Modify Authentication Process with a focus on Multi-Factor Authentication (T1556.006) under Credential Access and Defense Evasion. The detection payload surfaces key context: actor identity (user.name), origin (github.actor_ip), access type (github.programmatic_access_type), user agent (github.user_agent), and the affected scope (github.org/github.business). Investigation guidance emphasizes confirming legitimate ownership, assessing change-management approval, and correlating with other high-risk identity changes (new owners, PAT/OAuth grants, key additions, SSO/SAML changes). False positives may occur during documented break-glass procedures during outages or planned governance/migration changes by trusted admins. Remediation focuses on restoring 2FA, terminating sessions not enrolled in 2FA, credential/token rotation, and auditing for follow-on changes. The rule also guides escalation to incident response if changes seem unauthorized or accompanied by additional suspicious activity, and recommends hardening controls to prevent future 2FA changes at the enterprise level and improve alerting on such configuration modifications.