---
name: workload-protection-cspm-implement
title: Enabling cloud compliance with CSPM
description: Enable cloud security posture management (CSPM) in Workload Protection to scan your IBM Cloud resources for compliance with security and regulatory frameworks. With CSPM enabled, Workload Protection continuously evaluates your cloud resources against predefined policies, helping you identify and resolve issues before they become security risks.
last-updated: 2026-07-30
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/workload-protection?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Enabling cloud compliance with CSPM
{: #cspm-implement}

Enable cloud security posture management (CSPM) in Workload Protection to scan your IBM Cloud resources for compliance with security and regulatory frameworks. With CSPM enabled, Workload Protection continuously evaluates your cloud resources against predefined policies, helping you identify and resolve issues before they become security risks.
{: shortdesc}

This topic focuses on enabling CSPM for IBM Cloud. Need to enable CSPM for another cloud provider, like AWS, Azure, GCP, or OCI? See [Connect cloud accounts](https://docs.sysdig.com/en/sysdig-secure/connect-cloud-accounts/){: external} for more information.
{: tip}

To learn more about CSPM and how it works, go to [About Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-about&format=markdown). To see an example workflow, go to [Analyzing compliance postures from detection to remediation](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-compliance&format=markdown). 

CSPM for Workload Protection depends on App Configuration, which collects configuration details from your IBM Cloud resources. The [configuration aggregator feature](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator&format=markdown) in App Configuration is included at no charge as part of the Lite plan. The integration uses [IAM trusted profiles](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&interface=ui&format=markdown) to manage permissions securely.

You can enable CSPM for individual IBM Cloud accounts or for your entire enterprise. For enterprise-level compliance scanning, see [Enabling cloud compliance for enterprises](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-cspm-tutorial-enterprise&format=markdown).

CSPM is enabled by default when you create an instance of Workload Protection. However, if you decide to disable it, you can enable it at any time by completing the following steps. For more information on creating an instance of Workload Protection with CSPM enabled, see [Getting started](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started&interface=ui&format=markdown#setup).
{: tip}

## Before you begin
{: #cspm-implement-prereqs-ui}

Before you get started, make sure that you have the following:

- An existing App Configuration instance. For more information, see [Creating an instance](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-create-an-instance&format=markdown).
- `Manager` role or greater on the [App Configuration service](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-service-access-management&format=markdown).
- An existing Workload Protection instance with CSPM disabled. For more information, see [Set up Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-cspm-tutorial-enterprise&format=markdown#setup-wp).
- [Permissions to create and manage trusted profiles](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&interface=ui&format=markdown#tp-roles-reqs).
- `Editor` role or greater on the Workload Protection service.
- The CRNs for your Workload Protection and App Configuration instances. If you don't already have them, you can find the CRNs by completing the following steps: 
    1. In the IBM Cloud console, click the **Navigation Menu** icon ![Navigation Menu icon](../icons/icon_hamburger.svg) **> Resource list** and search for the service, either Workload Protection or App Configuration. 
    2. After you open your instance of App Configuration, click **Details** and copy the CRN. 
    3. After you open your instance of Workload Protection, copy the CRN from the Details panel. 

If context-based restrictions are enabled for resources in your account, you must create a rule to allow App Configuration to collect configuration data. When creating the rule, [select App Configuration as the reference service](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator&format=markdown#ac-configuration-aggregator-with-workload-protection).
{: important}

<!-- ## Before you begin
{: #cspm-implement-prereqs-cli}
{: cli}

Before you get started, make sure that you have the following:

- An existing App Configuration instance. For more information, see [Creating an instance](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-create-an-instance&format=markdown).
- `Manager` role or greater on the [App Configuration service](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-service-access-management&format=markdown).
- An existing Workload Protection instance with CSPM disabled. For more information, see [Set up Workload Protection](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-cspm-tutorial-enterprise&format=markdown#setup-wp).
- [Permissions to create and manage trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui&format=markdown#tp-roles-reqs).
- `blank` role or greater on the Workload Protection service.
- Install the [stand-alone IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown).
- Install the [Workload Protection CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-plug-ins&format=markdown#cli-search-plugin).
- The CRNs and names of your Workload Protection and App Configuration instances. You also need the instance ID for your App Configuration instance. You can find this information by running the [`ibmcloud resource service-instances`](https://cloud.ibm.com/docs/cli/build/cli-review-output?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_instances) command.
    - To retrieve the information for your Workload Protection instance, run `ibmcloud resource service-instances --service-name sysdig-secure --long`.
    - To retrieve the information for your App Configuration instance, run `ibmcloud resource service-instances --service-name apprapp --long`.
    
    The instance ID is identified as the `GUID` in the CLI output. 
    {: important}

- Get your IBM Cloud account ID. You can find the account ID by running the [`ibmcloud account show`](https://cloud.ibm.com/docs/cli/build/cli-review-output?topic=cli-ibmcloud_commands_account&format=markdown#ibmcloud_account_show) command. 

If context-based restrictions are enabled for resources in your account, you must create a rule to allow App Configuration to collect configuration data. When creating the rule, [select {{siede.data.keyword.appconfig_short}} as the reference service](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator&format=markdown#ac-configuration-aggregator-with-workload-protection).
{: important} -->

## Creating a trusted profile
{: #tp-create}

[Create a trusted profile](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&interface=ui&format=markdown) that allows your instance of Workload Protection access to the App Configuration service. Completing the following steps: 

1. Go to **Manage > Access (IAM) > Trusted profiles** and click **Create**.
2. After providing a name for the trusted profile, establish trust by selecting **IBM Cloud services** as the trusted entity type, and enter the CRN for your Workload Protection instance.
4. Add the following access policies to the trusted profile:
    * Viewer and Usage Report Viewer roles on the Enterprise service.
    * Configuration Aggregator Reader and Manager roles on the App Configuration service.
5. After you create the trusted profile, copy the profile ID and save it for the next step.

## Connecting your IBM Cloud account to Workload Protection
{: #cspm-implement-ui}

To start scanning your IBM Cloud account for compliance, add it to your existing Workload Protection instance. By doing so, you enable CSPM for your IBM Cloud account.

1. In the IBM Cloud console, click the **Navigation Menu** icon ![Navigation Menu icon](../icons/icon_hamburger.svg) **> Security > Compliance** then click the name of your instance of Workload Protection.
2. Click **Sources**, then select the **IBM Cloud Account** tab.
3. Click **Add** and enter the trusted profile ID that you just created along with the CRN for your instance of App Configuration.
4. Click **Add** to save your changes.

## Enabling configuration aggregator in App Configuration
{: #cspm-implement-ui-ca}

Your instance of Workload Protection is now connected to your instance of App Configuration. However, configuration aggregator within App Configuration must be enabled to gather information from your IBM Cloud account and resources. Complete the following steps: 

1. In the IBM Cloud console, click the **Navigation Menu** icon ![Navigation Menu icon](../icons/icon_hamburger.svg) **> Resource list** and search for `App Configuration`. 
2. Click the name of the App Configuration instance to open it. 
3. Click **Configuration aggregator > Define an aggregation**. 
4. Select **All regions** to gather data from all regions, and click **Save**.
5. Enable **Recording** to begin collecting configuration data. 

Compliance scan results appear within 5-10 minutes after provisioning, depending on the number of resources in your account.

## Disabling CSPM
{: #cspm-implement-ui-disable}

To stop scanning your IBM Cloud account for compliance, disable CSPM.

1. In the IBM Cloud console, click the **Navigation Menu** icon ![Navigation Menu icon](../icons/icon_hamburger.svg) **> Security > Compliance** then click the name of your instance of Workload Protection.
2. Click **Sources**, then select the **IBM Cloud Account** tab.
3. Click the actions menu for the account you want to remove, then click **Remove**.

Compliance scanning stops for the selected account.



<!-- ### Connect your account to Workload Protection by using the CLI
{: #cspm-implement-cli-step5}
{: cli}

Connect your IBM Cloud account to Workload Protection to start scanning for compliance.

```sh
ibmcloud resource service-instance-update "<workload_protection_instance_name>" -p '{"enable_cspm": true, "target_accounts": [{"account_id": "<ibm_cloud_account_id>", "config_crn": "<app_configuration_instance_CRN>", "trusted_profile_id": "<tp_id_for_wp>"}]}' -g Default
```
{: pre} -->




<!-- 
## Disabling CSPM by using the CLI
{: #cspm-implement-disable}
{: cli}

To stop scanning your account for compliance, run the following command. Replace the placeholder values with your Workload Protection instance name, App Configuration CRN, trusted profile ID from [Step 1](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-cspm-implement&interface=cli&format=markdown#cspm-implement-cli-step1), and IBM Cloud account ID:

```sh
ibmcloud resource service-instance-update "<workload-protection-instance-name>" -p '{"enable_cspm": true, "target_accounts": [{"account_id": "<ibm-cloud-account-id>", "config_crn": "<app-config-aggregator-CRN>", "trusted_profile_id": "<ibmcspm-tp-wp-app-config-ID>", "delete": true}]}' -g Default
```
{: pre}

This is the same command you used to [connect your IBM Cloud account to Workload Protection](#cspm-implement-cli-step5). The only difference is the addition of `"delete": true`.
{: note}

## Verifying compliance scan results
{: #cspm-implement-verify-implementation}

After enabling CSPM, verify that compliance scanning is working correctly.

1. In your Workload Protection instance, click **Sources**, then select **IBM Cloud Account**. Your account should display an `Active` status. The status might take a few minutes to update.
2. Click **Open dashboard**. Your account is listed under **Integrations > Environments > IBM Cloud**.
3. Click **Inventory** to view your IBM Cloud resources. Use the predefined filters or search box to find specific resource types or names. Click any resource to view its configuration, the compliance controls applied to it, and the evaluation results.
4. Click **Posture > Compliance** to review compliance results for available frameworks, such as the IBM Cloud Framework for Financial Services. -->