We’ve achieved “In Process” status on the FedRAMP Marketplace!

[#1]

Hi all,

I’m incredibly proud to share that Atlassian is now "In process" to become FedRAMP Moderate authorized on the FedRAMP Marketplace. This milestone signifies a big step as we get closer to achieving our FedRAMP Moderate Authority to Operate (ATO). Our new offering, Atlassian Government Cloud, will initially include Jira, Confluence, and Jira Service Management. We anticipate completing our 3rd Party Assessment Organization (3PAO) assessment and reviews with our sponsoring agency in Q4 of CY 2024, after which, it will go to the FedRAMP Program Management Office (PMO) for review.

Our sponsor in this process is the US General Services Administration (GSA) - a strong advocate for cloud adoption within the U.S. government - and we’re excited to be partnering with them on this journey.

I know many of you have been eagerly waiting for more information on our progress in this space, and I’m thrilled to share this update as well as details about the expansion of our investments in the public sector. In addition to FedRAMP Moderate, we are also working towards providing FedRAMP High as well as US DoD Impact Level 5 (IL5) compliance in order to meet the needs of the Department of Defense. These developments reflect Atlassian’s commitment to cloud security and addressing the specific requirements of the public sector.

We’re excited to be able to share Atlassian Government Cloud with government teams and organizations that support them soon, so you can leverage innovative cloud capabilities like automation and analytics for improved productivity and data-driven decisions. Over 80% of surveyed customers who migrated to Atlassian Cloud said they realized benefits from cloud-only capabilities like these within 6 months. FedRAMP Moderate authorization will also give you the assurance you need to confidently adopt Atlassian Government Cloud while safeguarding your mission-critical data and sensitive information.

Visit our website to sign up for updates as we approach ATO and follow along on our roadmap!

[Geoff Mether _Togetha Group_]

Wonderful news, congratulations!

[Austin Songer]

I feel like Atlassian would be a perfect solution to submit for a JAB Authorization. Why not JAB?

[Yuri Lapin _Release Management_]

Thanks @Joe Elgabalawi ! Great news, we are all looking forward to it.  Can you share any initial ideas what this mean for Atlassian Marketplace Apps - what will be the process for Marketplace Apps vendors to get to Atlassian Government Cloud? Because the full power of platform and offering could only be achieved together with Marketplace & Solutions Partners.

[James Lester]

Amazing news! Couple of quick questions:

1. Will there be a path to migrate our organization from commercial to government? 
2. Will government maintain feature parity with commercial?

Thank you and congratulations!

[Austin Songer]

@Yuri Lapin _Release Management_ 

Only apps from the Atlassian Marketplace that operate entirely within the Atlassian moderate environment will inherit the Moderate status. Apps that require an external connection will not inherit the same authorization unless the external platform is also listed on the FedRAMP marketplace with the same impact level.

Because any PaaS or SaaS must have their third-party apps documented and given the okay by the FedRAMP PMO, so the marketplace for the Government Cloud will be small compared the commercial product.

[Sam Nadarajan]

This is amazing! I know it has been quite the journey to get here, but kudos to the teams involved for not giving up and plowing forward :)

[Craig Castle-Mead]

Hey @Joe Elgabalawi 

Congrats on the big step, but wanted to check if the same types of "In-scope product data" caveats apply as listed on https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/ - while Marketplace was touched on in a comment by @Austin Songer which is good to know, other major concerns are around:

• PII - when Atlassian Access is not listed. And if there's going to be a FedRamp specific Access product to ensure residency of PII, how does that work when orgs will have significant overlap between domains/users/etc in FedRamp and non-FedRamp Access orgs
• Analytics and the like

Also, where does Bitbucket sit on the roadmap for FedRamp support? We're hamstrung on a number of fronts moving environments to Cloud through Bitbucket (DC) usage, as there's no data residency, and a hybrid model is far from a compelling solution due to the shared authorisation options.

CCM

[Austin Songer]

CSP will list "authorized" services If you view AWS, then you will understand.

https://marketplace.fedramp.gov/products/AGENCYAMAZONEW

And managing PII within FedRAMP-authorized environments involves stringent controls to ensure data security and residency. Organizations must implement specific controls as outlined in the FedRAMP Security Control Baselines. These include:

• Access Control (AC): Controls to ensure that only authorized individuals have access to PII​​​​​​.
• Audit and Accountability (AU): Maintaining thorough audit logs to track access and modifications to PII​​​​.
• Data Protection (DP): Mechanisms to protect PII at rest and in transit​​​​.

If there will be a FedRAMP-specific Access product to ensure PII residency, it would likely involve additional controls to manage and segregate data across different domains and users, both within FedRAMP and non-FedRAMP environments.

Analytics data must also comply with FedRAMP requirements. This includes ensuring that data collected, processed, and stored for analytics purposes adhere to the same stringent controls as other sensitive data. Ensuring data residency means that data must be stored within designated regions that comply with FedRAMP regulations.

[Austin Songer]

Looks like they are not doing Bitbucket right now. And that makes sense, completing against Github and Gitlab for source code ROI probably just didn't make sense.

[David Hunter]

Since we plan to migrate from DataCenter to Cloud at next year's renewal, once you have FedRAMP, how soon can we see pricing, assuming it will increase for FedRAMP users?

[Dawn Fama]

This is excellent news!  Perhaps this will open the door for Microsoft 365 for Jira.  Perhaps Fed agencies could implement public facing helpdesk portals for Fed apps as well as any submission requiring an approval process.  

[Matt Mason]

Since 2024 Q4 has passed, when do you expect Interim Authority to Operate?

[Kevin Shea]

Hi @Joe Elgabalawi , can you share an update on the 3PAO assessment - did it complete successfully in 4Q24?

[James Lester]

@Kevin Shea  and @Matt MasonNew article posted here: FedRAMP Update: One step closer to FedRAMP Moderat... - Atlassian Community

I knew this because I follow the trust & security group: Trust & Security - Atlassian Community