[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Step-by-step guides](../index.md) > [Security Deck workspaces](index.md) > Creating a workspace

# Creating a Security Deck workspace 

Before creating a [workspace](../../concepts/workspace.md), make sure you have the necessary [permissions](../../security/index.md) to work with the Security Deck modules. You optimal roles are:

* `security-deck.admin` for the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to store the Security Deck resources and modules.
* `auditor` for the [organization](../../../organization/concepts/organization.md), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or folder security in which will be controlled by the workspace.

To create a Security Deck workspace:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. In the left-hand panel, select ![vector-circle](../../../_assets/console-icons/vector-circle.svg) **Workspace**.
  1. If you do not have any workspaces yet, click **Create workspace**.

      If you already have a workspace and want to create another one to complement your existing environment, click **More** ![chevron-down](../../../_assets/console-icons/chevron-down.svg) at the top of the window and click **Create workspace**.
  1. In the window that opens, select **Creating and configuring workspace** in the **Main parameters** section:
     
     1. Under **Workspace name**, enter a name for the new workspace. Follow these naming requirements:
     
         * It must be from 1 to 63 characters long.
         * It may contain lowercase Latin letters, numbers, and hyphens.
         * It must start with a letter and cannot end with a hyphen.
     
         Provide a brief description for the new workspace, if required.
     1. Under **Resource storage folder**, select the folder to store Security Deck resources for the new workspace.
     
         For security reasons, we recommend storing Security Deck resources in a separate [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) restricted only to security staff.
     
         {% note info %}
     
         Once the workspace is created, you cannot change this folder.
     
         {% endnote %}
     
     1. Under **Payment for resources**, add a billing account to use to pay for security module resources the workspace consumes.
     1. Under **Alert sink**, select the [alert sink](../../concepts/workspace.md#alert-sinks) to receive all [alerts](../../concepts/alerts.md) generated in the workspace.
        
        Create a new alert sink if needed. Do it by clicking **Create sink**. In the window that opens, enter enter a name for the sink **Create**.
     1. Click **Create and continue** to proceed to the next step and configure the workspace resources.
  1. In the **Resources** section that opens:
     
     1. Under **Workspace resources**, select the connector to use in the workspace being created to access the controlled resources.
     
         If needed, create a new connector:
         
         1. Click ![plug-connection](../../../_assets/console-icons/plug-connection.svg) **Create connector** and in the window that opens:
         
             1. In the **Name** field, enter a name for the connector.
             1. Optionally, give the connector's description in the **Description** field.
             1. Select the [service account](../../../iam/concepts/users/service-accounts.md) for access to cloud resources in the **Service account** field.
         
                 In the section below, you can see which resources the selected service account has access to.
                 
                 Make sure to assign the `security-deck.worker` [role](../../security/index.md#security-deck-worker) to this service account for the resources controlled in the workspace being created.
         
             1. Click **Create connector**.
     
     1. In the connector section that appears, click ![circle-plus](../../../_assets/console-icons/circle-plus.svg) **Select cloud/catalog** to select the resources ([clouds](../../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folders](../../../resource-manager/concepts/resources-hierarchy.md#folder)) whose security will be managed in the new workspace:
        
        1. Select the resources whose security you want to manage in the workspace. You can only select the resources that are accessible to the previously selected service account.
        1. Click **Save selection**.
     1. Click **Save and continue**.
  1. In the **Control modules** section that opens:
     
     1. Under **Sets of requirements**, select the industry standards and regulations the resources you chose at the previous step will be benchmarked against.
     
         * ![base-standard-yc](../../../_assets/security-deck/cspm-base-yc.svg) [Yandex Cloud](../../concepts/standard-compliance/yc-security-baseline.md) basic security rules: Minimum set of security requirements ensuring basic protection of cloud infrastructure and applications deployed on the Yandex Cloud platform.
         * ![cspm-standard-yc](../../../_assets/security-deck/cspm-standard-yc.svg) [Yandex Cloud](../../concepts/standard-compliance/yc-cloud-security-standard.md) cloud infrastructure protection standard: [Standard](../../../security/standard/all.md) providing comprehensive security requirements and best practices for protection of the cloud infrastructure and applications deployed on the Yandex Cloud platform. These elements help ensure security policy compliance and protection against common threats and vulnerabilities in the cloud environment.
         * ![pci-dss-standard](../../../_assets/security-deck/cspm-pci-dss.svg) [PCI DSS](https://yandex.cloud/en/security/standards/pci) (Payment Card Industry Data Security Standard): Data security standard for payment cards that includes requirements for security management, rules, procedures, network architecture, software development, and other critical security measures.
         * ![152-fz-standard](../../../_assets/security-deck/cspm-152-fz.svg) [FSTEC Requirements (Order No. 21) for the protection of personal data](https://fstec.ru/dokumenty/vse-dokumenty/prikazy/prikaz-fstek-rossii-ot-18-fevralya-2013-g-n-21): Standard providing measures for protection of personal data from unauthorized or accidental access, destruction, modification, blocking, copying, disclosure, distribution, or other unlawful actions.
         
         * ![cspm-standard-k8s-restricted](../../../_assets/security-deck/cspm-standard-k8s-restricted.svg) Kubernetes Pod Security Standards (Restricted): This standard contains security controls based on the [Kubernetes Pod Security Standards (PSS) Restricted profile](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). A restricted profile is the most secure and provides the highest detection efficiency for container-based attacks. It applies strict security policies that may require modifying applications to ensure compliance. A restricted profile is recommended for security-critical applications and environments where maximum security is required.
         * ![cspm-standard-k8s-baseline](../../../_assets/security-deck/cspm-standard-k8s-baseline.svg) Kubernetes Pod Security Standards (Baseline): This standard contains security controls based on the [Kubernetes Pod Security Standards (PSS) Baseline profile](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline). A baseline profile is designed for easy implementation and provides common best practices for container security. It prevents the most common security issues in containers while maintaining compatibility with most applications. The baseline profile is a good starting point for organizations just getting started with container security.
         * ![cspm-standard-k8s-ms](../../../_assets/security-deck/cspm-standard-k8s-ms.svg) Microsoft Threat Matrix for Kubernetes: This standard contains security controls based on the [Microsoft Threat Matrix for Kubernetes](https://www.microsoft.com/en-us/security/blog/2020/04/02/attack-matrix-kubernetes/), which is a framework that helps security teams understand and fend off threats specific to Kubernetes environments. It provides a comprehensive approach to attack methods and defensive strategies tailored for container orchestration platforms.
         * ![cspm-cis-k8s-standard](../../../_assets/security-deck/cspm-cis-k8s-standard.svg) CIS Kubernetes Benchmark: This standard contains [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes) recommendations for secure configuration of components on Kubernetes worker nodes. It includes only the automated checks from the `4 Worker Nodes` section.
     
         You can select several standards at the same time. In this case, you will see the Security Deck modules under **Control modules**, which will be activated in the workspace being created to check resources for compliance with the selected standards and regulations.
     1. Optionally, under **Control modules**, activate additional Security Deck modules that you need in your environment.
        
        For example, the **Data Security Posture Management (DSPM)
        ** module is independent of the standards and regulations selected in the environment and must be activated manually for the environment in question.
     1. Click **Save and continue**.
  1. Optionally, in the **Access bindings** section that opens, add users who will have access to the workspace being created and assign them roles in this workspace:
     
     1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Add participants** and in the window that opens:
     
         1. Select the user from the list. If required, use the search bar.
         1. In the window that opens, click ![plus](../../../_assets/console-icons/plus.svg) **Add role** and select the role you want to assign to the user. You can assign multiple roles.
         1. Click **Save**.
     
     1. Click **Finish** to complete creating the Security Deck workspace.
     
     You do not have to add additional users to the workspace. In this case, the workspace will only be available to its creator.

{% endlist %}

#### Useful links {#see-also}

* [Security Deck workspaces](../../concepts/workspace.md)
* [Viewing the workspace dashboard and operations in Security Deck](view-dashboard.md)
* [Updating a Security Deck workspace and its components](update.md)
* [Configuring the Security Deck workspace access permissions](manage-access.md)
* [Deleting a Security Deck workspace](delete.md)