GitLab Issues
Connect GitLab Issues to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect GitLab Issues to collect version control evidence automatically.
Step-by-step guide: Connect GitLab Issues.
| Category | Version Control |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In GitLab Issues:
- In GitLab, select your avatar in the upper-right corner, then select Edit profile.
- In the left sidebar, select Access › Personal access tokens.
- From the Generate token dropdown list, select Legacy token.
- In Token name, enter a name, and in Expiration date, enter an expiry date.
- Select the scope read_api (read access to the API, which covers issues).
- Select Generate token, then copy and save the token. After you leave or refresh the page, you cannot view it again.
Where to find the other values:
- Base URL (optional): The address of your GitLab instance for self-managed GitLab (for example https://gitlab.example.com). Leave empty for GitLab.com.
- Account / Org / Workspace (optional): The group path shown in the group's URL (for example gitlab.com/<group>).
GitLab Issues shows the secret only once, so copy it before you leave the page.
read_api grants read access to the API for the token's scope. The token can only read issues in projects and groups the creating user can access. Administrators may cap token lifetime or disable personal access tokens.
Source: docs.gitlab.com, docs.gitlab.com, checked 2026-10-07.
-
On Compliance › Connectors, open GitLab Issues, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read GitLab Issues and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC2.1, CC6.1, CC6.2, CC6.3, CC6.7, CC7.1, CC7.2, CC7.3, CC7.4, CC7.5, CC8.1 | 46 |
| ISO/IEC 27001 | Automated tests | A.5.3, A.5.9, A.5.14, A.5.15, A.5.16, A.5.17, A.5.18, A.5.25, A.5.26, A.5.27, A.6.5, A.8.2, A.8.4, A.8.5, A.8.8, A.8.12, A.8.15, A.8.24, A.8.25, A.8.28, A.8.29, A.8.32 | 46 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d) | 37 |
| PCI DSS | Automated tests | 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.4.2, 8.6.3, 10.5.1, 12.10.1, 12.10.6 | 38 |
| NIST CSF 2.0 | Automated tests | ID.AM-02, ID.IM-03, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.PS-01, PR.PS-02, PR.PS-04, PR.PS-06, RS.MA-02, RS.MA-03, RS.MI-02 | 43 |
These tests are switched on per workspace by the Safeguard team.
GitLab, GitLab Self-Managed connect to the same provider as GitLab Issues, and these tests run for a connection made through any of them.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks