Google Security Command Center

Record your Google Security Command Center connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Google Security Command Center:

   1. In the Google Cloud console, go to the Service accounts page, select your project and click the email address of the service account Safeguard will use (create one first if needed).
   2. Click the Keys tab, click the Add key drop-down menu and select Create new key.
   3. Select JSON as the Key type and click Create. The JSON key file downloads; you cannot download it again, so store it securely and paste its contents into Safeguard.
   4. Go to the IAM page in the Google Cloud console and select your organization.
   5. Click Grant Access, enter the service account's email address as the principal, click Select a role and choose Security Center Admin Viewer (roles/securitycenter.adminViewer), or the narrower Security Center Findings Viewer (roles/securitycenter.findingsViewer) for findings only.
   6. Click Save.

   Where to find the other values:

   • Base URL (optional): Not needed; Security Command Center is a Google Cloud API. Not shown in a documented UI location.
   • Account / Org / Workspace (optional): Select the organization in the Google Cloud console resource picker on the IAM page; the organization ID is not described in the fetched pages.

   Google Security Command Center shows the secret only once, so copy it before you leave the page.

   Key creation is blocked when the iam.disableServiceAccountKeyCreation organization policy constraint is enforced; it is enforced by default for organizations created on or after May 3, 2024, so an organization policy administrator must exempt the project first. Other read-only SCC roles include Security Center Assets Viewer and Security Center Compliance Reports Viewer (Beta).

   Source: docs.cloud.google.com, docs.cloud.google.com, docs.cloud.google.com, checked 2026-10-07.

2. On Compliance › Connectors, open Google Security Command Center, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Google Security Command Center yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks