We’ve achieved “In Process” status on the FedRAMP Marketplace!

[#1]

Hi all,

I’m incredibly proud to share that Atlassian is now "In process" to become FedRAMP Moderate authorized on the FedRAMP Marketplace. This milestone signifies a big step as we get closer to achieving our FedRAMP Moderate Authority to Operate (ATO). Our new offering, Atlassian Government Cloud, will initially include Jira, Confluence, and Jira Service Management. We anticipate completing our 3rd Party Assessment Organization (3PAO) assessment and reviews with our sponsoring agency in Q4 of CY 2024, after which, it will go to the FedRAMP Program Management Office (PMO) for review.

Our sponsor in this process is the US General Services Administration (GSA) - a strong advocate for cloud adoption within the U.S. government - and we’re excited to be partnering with them on this journey.

I know many of you have been eagerly waiting for more information on our progress in this space, and I’m thrilled to share this update as well as details about the expansion of our investments in the public sector. In addition to FedRAMP Moderate, we are also working towards providing FedRAMP High as well as US DoD Impact Level 5 (IL5) compliance in order to meet the needs of the Department of Defense. These developments reflect Atlassian’s commitment to cloud security and addressing the specific requirements of the public sector.

We’re excited to be able to share Atlassian Government Cloud with government teams and organizations that support them soon, so you can leverage innovative cloud capabilities like automation and analytics for improved productivity and data-driven decisions. Over 80% of surveyed customers who migrated to Atlassian Cloud said they realized benefits from cloud-only capabilities like these within 6 months. FedRAMP Moderate authorization will also give you the assurance you need to confidently adopt Atlassian Government Cloud while safeguarding your mission-critical data and sensitive information.

Visit our website to sign up for updates as we approach ATO and follow along on our roadmap!

[Geoff Mether _Togetha Group_]

Wonderful news, congratulations!

[Austin Songer]

I feel like Atlassian would be a perfect solution to submit for a JAB Authorization. Why not JAB?

[Yuri Lapin _Release Management_]

Thanks @Joe Elgabalawi ! Great news, we are all looking forward to it.  Can you share any initial ideas what this mean for Atlassian Marketplace Apps - what will be the process for Marketplace Apps vendors to get to Atlassian Government Cloud? Because the full power of platform and offering could only be achieved together with Marketplace & Solutions Partners.

[James Lester]

Amazing news! Couple of quick questions:

1. Will there be a path to migrate our organization from commercial to government? 
2. Will government maintain feature parity with commercial?

Thank you and congratulations!

[Austin Songer]

@Yuri Lapin _Release Management_ 

Only apps from the Atlassian Marketplace that operate entirely within the Atlassian moderate environment will inherit the Moderate status. Apps that require an external connection will not inherit the same authorization unless the external platform is also listed on the FedRAMP marketplace with the same impact level.

Because any PaaS or SaaS must have their third-party apps documented and given the okay by the FedRAMP PMO, so the marketplace for the Government Cloud will be small compared the commercial product.

[Sam Nadarajan]

This is amazing! I know it has been quite the journey to get here, but kudos to the teams involved for not giving up and plowing forward :)

[Craig Castle-Mead]

Hey @Joe Elgabalawi 

Congrats on the big step, but wanted to check if the same types of "In-scope product data" caveats apply as listed on https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/ - while Marketplace was touched on in a comment by @Austin Songer which is good to know, other major concerns are around:

• PII - when Atlassian Access is not listed. And if there's going to be a FedRamp specific Access product to ensure residency of PII, how does that work when orgs will have significant overlap between domains/users/etc in FedRamp and non-FedRamp Access orgs
• Analytics and the like

Also, where does Bitbucket sit on the roadmap for FedRamp support? We're hamstrung on a number of fronts moving environments to Cloud through Bitbucket (DC) usage, as there's no data residency, and a hybrid model is far from a compelling solution due to the shared authorisation options.

CCM