Google Cloud Platform
Connect Google Cloud Platform to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Google Cloud Platform to collect cloud infrastructure evidence automatically.
Step-by-step guide: Connect Google Cloud Platform.
| Category | Cloud Infrastructure |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
- On Compliance › Connectors, open Google Cloud Platform, click Connect and choose OAuth.
- Sign in to Google Cloud Platform and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
https://www.googleapis.com/auth/cloud-platform.read-only. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Google Cloud Platform:
- In the Google Cloud console, go to the Service accounts page and select your project.
- Click the email address of the service account Safeguard will use.
- Click the Keys tab, then the Add key drop-down menu, and select Create new key.
- Select JSON as the Key type and click Create; the key file downloads, and you cannot download it again.
- Paste the full contents of the JSON file into Safeguard.
- Go to the IAM page and select the project (or folder/organization) to audit.
- Click Grant Access, enter the service account's email as the principal.
- Click Select a role, search for the role to grant (Safeguard's form suggests roles/viewer), and click Save.
Google Cloud Platform shows the secret only once, so copy it before you leave the page.
Source: docs.cloud.google.com, docs.cloud.google.com, checked 2026-10-07.
-
On Compliance › Connectors, open Google Cloud Platform, click Connect, choose API token and fill in:
Field What to enter Service account key (JSON) Required. Paste the full service-account JSON key. Needs roles/viewer (cloud-platform.read-only). Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Google Cloud Platform and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, A1.2, C1.1, CC2.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3, CC8.1 | 114 |
| ISO/IEC 27001 | Automated tests | A.5.3, A.5.9, A.5.15, A.5.17, A.5.18, A.5.24, A.8.2, A.8.3, A.8.5, A.8.6, A.8.8, A.8.9, A.8.13, A.8.14, A.8.15, A.8.16, A.8.20, A.8.24, A.8.32 | 114 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1) | 100 |
| PCI DSS | Automated tests | 1.3.1, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 8.2.6, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.2 | 100 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, DE.CM-09, ID.AM-02, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.IR-03, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02 | 112 |
| CIS Google Cloud Platform Foundations Benchmark | Automated tests | 1.1, 1.4, 1.5, 1.6, 1.8, 1.9, 1.11, 1.13, 1.14, 1.15, 1.16, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.13, 2.15, 2.16, 3.1, 3.2, 3.3, 3.4, 3.5, 3.9, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.11, 6.1.2, 6.1.3, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4, 7.1, 7.3 | 49 |
For a CIS benchmark, the numbers are its recommendations.
These tests are switched on per workspace by the Safeguard team.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks