Prisma Cloud

Connect Prisma Cloud to collect cspm evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Prisma Cloud:

   1. As a Prisma Cloud System Admin, select Settings › Access Control › Users and select Add › User (or open an existing user).
   2. Enter First Name, Last Name and Email, and under Assign Roles give the user a role built on the Account Group Read Only permission group (with the account groups Safeguard should see).
   3. Turn on Allow user to create API Access Keys, then click Save and close.
   4. Signed in as that user, select Settings › Access Control › Access Keys and select Add › Access Key.
   5. Enter a descriptive Name, optionally select the Key Expiry checkbox and set a validity period, then click Create.
   6. Copy or download the Access Key ID and the Secret Key as a CSV file before closing the window, and paste them into Safeguard's Access key and Secret key fields.

   Where to find the other values:

   • API URL: Take the address of your Prisma Cloud admin console and replace app with api (for example https://app2.prismacloud.io becomes https://api2.prismacloud.io; https://app.eu.prismacloud.io becomes https://api.eu.prismacloud.io). Your order fulfillment email also includes the URL for the tenant.

   Prisma Cloud shows the secret only once, so copy it before you leave the page.

   By default only the System Admin role has API access; the admin permissions table shows Account Group Read Only can add, activate, deactivate and delete access keys once API access is allowed. Most roles can hold up to two access keys. After the window closes the secret key cannot be viewed again; delete the key and create a new one. The click path for creating the Account Group Read Only role itself (Settings › Access Control › Roles) was not fetched.

   Source: docs.prismacloud.io, docs.prismacloud.io, docs.prismacloud.io, pan.dev, checked 2026-10-07.

   The permissions Safeguard needs: Account Group Read Only.

2. On Compliance › Connectors, open Prisma Cloud, click Connect, choose API token and fill in:

   Field	What to enter
   Access key	Required. Stored encrypted and never shown again.
   Secret key	Required. Stored encrypted and never shown again.
   API URL	Required. An address under prismacloud.io.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Prisma Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks