GitHub Enterprise
Connect GitHub Enterprise to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect GitHub Enterprise to collect version control evidence automatically.
| Category | Version Control |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
Before you start, an administrator of GitHub Enterprise must allow third-party apps:
- If the organization has OAuth app access restrictions enabled, an organization owner must approve the Safeguard OAuth app.
- Click your profile picture, then click Organizations, and select the organization.
- Under your organization name, click Settings.
- In the Third-party Access section of the sidebar, click OAuth app policy.
- Next to the Safeguard application, click Review, then click Grant access.
- On Compliance › Connectors, open GitHub Enterprise, click Connect and choose OAuth.
- Sign in to GitHub Enterprise and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
repo,read:user,read:org.repogrants full access to repositories, including changes; for read-only access, use the API token method with read-only permissions. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In GitHub Enterprise:
- In GitHub (your enterprise instance), click your profile picture in the upper-right corner of any page, then click Settings.
- In the left sidebar, click Developer settings.
- In the left sidebar, under Personal access tokens, click Fine-grained tokens, then click Generate new token.
- Under Token name, enter a name (for example Safeguard), and under Expiration, select an expiration.
- Under Resource owner, select the organization Safeguard should read. If the organization requires approval for fine-grained tokens, enter a justification in the box below the resource owner.
- Under Repository access, select the repositories Safeguard should read (choose the minimal access that meets your needs).
- Under Permissions, grant read-only access only (for example Metadata and Contents set to read), then click Generate token and copy the token.
- Alternative (classic token): under Personal access tokens, click Tokens (classic), select Generate new token › Generate new token (classic), fill the Note field, choose an Expiration, select the scope repo, then click Generate token. If the organization uses SAML single sign-on, authorize the token.
Where to find the other values:
- Base URL (optional): For GitHub Enterprise Server, the API base is http(s)://HOSTNAME/api/v3, where HOSTNAME is the name of your GitHub Enterprise Server instance. Leave empty for GitHub.com / Enterprise Cloud.
- Account / Org / Workspace (optional): The organization name shown in Organizations (profile picture menu) and in the organization URL.
Source: docs.github.com, docs.github.com, docs.github.com, docs.github.com, checked 2026-10-07.
-
On Compliance › Connectors, open GitHub Enterprise, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read GitHub Enterprise and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC2.1, CC6.1, CC6.2, CC6.3, CC6.8, CC7.1, CC7.2, CC7.3, CC7.4, CC7.5, CC8.1 | 44 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.15, A.5.16, A.5.17, A.5.18, A.5.19, A.5.25, A.5.26, A.5.27, A.5.32, A.6.5, A.8.2, A.8.3, A.8.4, A.8.5, A.8.8, A.8.12, A.8.15, A.8.25, A.8.28, A.8.29, A.8.32 | 44 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(6), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d) | 40 |
| PCI DSS | Automated tests | 6.2.4, 6.3.1, 6.3.2, 6.3.3, 6.5.1, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.4.2, 8.6.3, 10.5.1, 12.10.1, 12.10.6 | 42 |
| NIST CSF 2.0 | Automated tests | GV.SC-05, ID.AM-02, ID.IM-03, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.PS-01, PR.PS-02, PR.PS-04, PR.PS-06, RS.MA-02, RS.MA-03, RS.MI-02 | 44 |
These tests are switched on per workspace by the Safeguard team.
GitHub, GitHub Issues connect to the same provider as GitHub Enterprise, and these tests run for a connection made through any of them.
Related
- Version Control connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks