SOC II Answers needed

Question

I am looking for a way to talk directly to Atlassian for SOC II questions I need answers to but cannot find a good way to do vendor reviews.

In the Atlassian SOCII There are exceptions that need to be answered before I can go forward.

Sami Shaik · Answer

@Louis Serio ,

Matthew’s pointer is the right starting line. Here is the rest of the route, from the vendor-review side of the table.

1. Get everything Atlassian already publishes before you ask anyone. All of it is self-service on the Customer Trust Portal once you accept the NDA by entering your email:

* the SOC 2 Type II report for the products you use (one report covers Jira, JSM, Confluence, Guard Premium, Rovo and more; Loom and Focus have their own);
* the SOC 2 Bridge Letter, issued each January or February to cover the gap to the next report (the Compliance FAQ describes it);
* the pre-completed CAIQ per product, also on the CSA STAR registry, and a ProcessUnity assessment on request, from the Vendor Security and Risk Responses page. Note Atlassian’s own caveat: those are “self-attestation style responses”, so your auditor will weight them below the SOC 2 report.

2. For the exceptions, read management’s response inside the report first. A SOC 2 Type II lists each exception next to the auditor’s test, and the report normally carries management’s response to it. Most of the questions a reviewer brings to a vendor are already answered there, in the vendor’s own words, and that is the text your risk committee can cite.

3. For anything still open, the only documented channel is a Support request from your verified account, asking for the Trust or Compliance team by name and quoting the control ID and the exception text. Two expectations to set with your reviewers: Atlassian answers through Support and the Trust Portal, not on a call with the auditor, and it will not re-litigate the auditor’s finding. What you can get is the remediation status and compensating controls, which is usually what the review needs.

If the exceptions touch something specific (access reviews, change management, availability), say which and the group here can point at the public control descriptions that cover it.

Matthew Sinclair · Answer

Id start here →

https://www.atlassian.com/trust/compliance/resources/soc2

After that you'll have to reach out to Support for specifics.

At one point I had to get my account verified to access some documentation beyond what is publicly accessible so they do have some things behind a gate that may clear up some of those questions.