PingOne
Connect PingOne to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect PingOne to collect identity & sso evidence with automated compliance tests, switched on per workspace.
| Category | Identity & SSO |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
Connect with an API token
-
In PingOne:
- In the PingOne admin console, select the environment Safeguard should read and go to Applications › Applications.
- Create a new application of type Worker, then use the toggle to enable it.
- In the application details panel, click the Roles tab and add the Identity Data Read Only role (scoped to this environment).
- Click the Configuration tab and copy the Client ID, Client Secret, Environment ID and Token Endpoint.
Where to find the other values:
- Environment ID: The Worker application's Configuration tab shows the Environment ID.
- Region: The domain suffix in the Token Endpoint on the Worker application's Configuration tab (for example auth.pingone.eu means eu).
- Worker app client ID: The Worker application's Configuration tab shows the Client ID.
Source: docs.pingidentity.com, docs.pingidentity.com, checked 2026-10-07.
-
On Compliance › Connectors, open PingOne, click Connect, choose API token and fill in:
Field What to enter Environment ID Required. Region Optional. The domain suffix of your PingOne environment: com, eu, ca, asia or com.au. Worker app client ID Required. Create a Worker application with the Identity Data Read Only role. Worker app client secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read PingOne and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.1, CC6.2, CC6.3 | 6 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.17, A.5.18, A.6.5, A.8.2, A.8.5 | 6 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.312(d) | 6 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.3.4, 8.3.6, 8.4.2 | 6 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-03, PR.AA-05 | 6 |
These tests are switched on per workspace by the Safeguard team.
Ping Identity connect to the same provider as PingOne, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks