...
Section Heading
...
Control Heading
...
Original ID
...
Question Text
...
Answer
...
Notes/Comment
...
Application & Interface Security
...
Application Security
...
AIS-01.2
...
Do you use an automated source code analysis tool to detect security defects in code prior to production?
...
Yes
...
We use OWASP Dependency-Check that is executed for each build we produce.
...
AIS-01.5
...
(SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
...
Yes
...
We do have an established code review process for any deployment to STG and PROD. Checks for security vulnerabilities are an integral part of this process. Post PROD deployment we are part of Atlassian Cloud Security / Bug Bounty Program where circa 300 white hackers are trying to find security vulnerabilities in our Apps on a daily basis.
...
Customer Access Requirements
...
AIS-02.1
...
Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?
...
Yes
...
We provide full details on this via our End User License Agreement (EULA) and Data Security & Privacy statement on our Confluence space for each of the Apps.
...
Data Integrity
...
AIS-03.1
...
Does your data management policies and procedures require audits to verify data input and output integrity routines?
...
Yes
...
We have input/output validation at APIs and Frontend levels. This is checked via tests and extensive code review practices. Our document storage cluster is resilient & backed up to guarantee minimal data loss in the event of data corruption. Data and schema migrations are controlled using source controlled database change scripts.
...
Audit Assurance & Compliance
...
Independent Audits
...
AAC-02.1
...
Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?
...
No
...
We don't hold a valid ISO 27k certificate at the moment. Same time we completed a number of private ISO27k assessments upon enterprise clients' requests in order to justify compliance of our process and tools to the rigorous information security policies.
...
AAC-02.2
...
Do you conduct network penetration tests of your cloud service infrastructure at least annually?
...
Yes
...
In the scope of network penetration testing, we are conducting regular network scans in order to identify:
Unwanted opened ports (Admin, Database and files sharing) and internal servers
Exposed technical information that could define attack vector (such as used software, versions including potentially vulnerable versions)
Certificates validity
Secure cookies configuration
DNS analysis
Email spoofing and phishing risks, DMARC
...
AAC-02.3
...
Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance?
...
Yes
...
This is in scope of our "Cloud Security Participant Program" with Atlassian. Also some of our clients are performing regular network penetration tests on our Cloud infrastructure (latest reports are available upon request).
...
Information System Regulatory Mapping
...
AAC-03.1
...
Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements?
...
Yes
...
We review the changes to regulatory requirements as we receive them via subscribed bulletins and make amends to our internal policies when necessary.
...
Business Continuity Management & Operational Resilience
...
Business Continuity Testing
...
BCR-02.1
...
Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?
...
Yes
...
We have a number of BCP plans according to "Business Continuity and Disaster Recovery Plans (Release Management by Y2 ENGR)". Could be provided upon demand.
...
Policy
...
BCR-10.1
...
Are policies and procedures established and made available for all personnel to adequately support services operations’ roles?
...
Yes
...
We have an internal Confluence space with all the policies available to our personnel. Could be provided upon demand.
...
Retention Policy
...
BCR-11.1
...
Do you have technical capabilities to enforce tenant data retention policies?
...
Yes
...
Yes, we support it at Cloud infrastructure level.
...
BCR-11.3
...
Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?
...
Yes
...
We do regular backups of our dataset to store it in AWS (Germany).
...
BCR-11.7
...
Do you test your backup or redundancy mechanisms at least annually?
...
Yes
...
Yes, we do test it annually.
...
Change Control & Configuration Management
...
Unauthorized Software Installations
...
CCC-04.1
...
Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?
...
Yes
...
Access to business critical infrastructure and PROD is restricted to a limited number of personnel with 2FA used plus VPN to access segregated PROD networks.
...
Data Security & Information Lifecycle Management
...
E-commerce Transactions
...
DSI-03.1
...
Do you provide standardized (e.g. ISO/IEC) non-proprietary encryption algorithms (3DES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?
...
Yes
...
Yes, we have such. In particular we use AES 256. Also we use SSL certificates SHA 256.
...
DSI-03.2
...
Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?
...
Yes
...
We use HTTPS for all API calls. All our components are connected within a private network that is segregated from the public internet via Firewall.
...
Nonproduction Data
...
DSI-05.1
...
Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?
...
Yes
...
DEV, STG and PROD are fully segregated with limited access to PROD via a number of quality gates.
...
Secure Disposal
...
DSI-07.1
...
Do you support the secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data?
...
Yes
...
Yes, upon request.
...
DSI-07.2
...
Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?
...
Yes
...
...
Datacenter Security
...
Asset Management
...
DCS-01.2
...
Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership?
...
Yes
...
In scope of Information Security Policy available upon request.
...
Controlled Access Points
...
DCS-02.1
...
Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented for all areas housing sensitive data and information systems?
...
Yes
...
https://www.hetzner.com/AV/TOM_en.pdf
...
User Access
...
DCS-09.1
...
Do you restrict physical access to information assets and functions by users and support personnel?
...
Yes
...
Access to PROD is restricted to a limited number of personnel with 2FA used plus VPN to access segregated PROD networks.
...
Encryption & Key Management
...
Key Generation
...
EKM-02.1
...
Do you have a capability to allow creation of unique encryption keys per tenant?
...
No
...
Encryption
...
EKM-03.1
...
Do you encrypt tenant data at rest (on disk/storage) within your environment?
...
No
...
There is an item in our backlog for such implementation.
...
Governance and Risk Management
...
Baseline Requirements
...
GRM-01.1
...
Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?
...
Yes
...
All of our infrastructure provisioning is automated. Amends to these templates are done via extensive code review.
...
Policy
...
GRM-06.1
...
Are your information security policies and procedures made available to all impacted personnel and business partners, authorized by accountable business role/function and supported by the information security management program as per industry best practices (e.g. ISO 27001, SOC 2)?
...
Yes
...
This is part of our onboarding process with employees as well as reoccurring trainings on any change we do in scope of yearly review.
...
Policy Enforcement
...
GRM-07.1
...
Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?
...
No
...
We are a small team, therefore we have much more control over such things and we do not tolerate violations if any.
...
Policy Reviews
...
GRM-09.1
...
Do you notify your tenants when you make material changes to your information security and/or privacy policies?
...
Yes
...
It's publicly available in every App confluence space. All the watchers are automatically updated on any change.
...
GRM-09.2
...
Do you perform, at minimum, annual reviews to your privacy and security policies?
...
Yes
...
In the scope of the yearly self-assessment / security review process we review and upgrade our information security policies.
...
Human Resources
...
Asset Returns
...
HRS-01.1
...
Upon termination of contract or business relationship, are employees and business partners adequately informed of their obligations for returning organizationally-owned assets?
...
Yes
...
This is part of the policy.
...
Background Screening
...
HRS-02.1
...
Pursuant to local laws, regulations, ethics, and contractual constraints, are all employment candidates, contractors, and involved third parties subject to background verification?
...
Yes
...
We do reasonable checks across open available databases and blacklists.
...
Employment Agreements
...
HRS-03.1
...
Do your employment agreements incorporate provisions and/or terms in adherence to established information governance and security policies?
...
Yes
...
Part of the MLA/SOW/NDA package we sign with every employee.
...
Employment Termination
...
HRS-04.1
...
Are documented policies, procedures, and guidelines in place to govern change in employment and/or termination?
...
Yes
...
This is part of the “User provisioning and de-provisioning procedure“ policy.
...
Training / Awareness
...
HRS-09.5
...
Are personnel trained and provided with awareness programs at least once a year?
...
Yes
...
This is part of the policy.
...
Identity & Access Management
...
Audit Tools Access
...
IAM-01.1
...
Do you restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)?
...
Yes
...
IAM-01.2
...
Do you monitor and log privileged access (e.g., administrator level) to information security management systems?
...
Yes
...
We have an established process for onboarding employees where we decide on access and Privileged Access if required. We use SSO to access our services, only limited # of people have access to PROD (actually, only co-founders). We also have an established termination process to revoke all the access and terminate the accounts.
Our cloud infrastructure provider supports logging of Privilege Access events to business critical components out of the box.
...
User Access Policy
...
IAM-02.1
...
Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes?
...
Yes
...
Part of the policy.
...
Policies and Procedures
...
IAM-04.1
...
Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access?
...
Yes
...
Part of the policy.
...
Source Code Access Restriction
...
IAM-06.1
...
Are controls in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only?
...
Yes
...
IAM-06.2
...
Are controls in place to prevent unauthorized access to tenant application, program, or object source code, and assure it is restricted to authorized personnel only?
...
Yes
...
User Access Restriction / Authorization
...
IAM-08.1
...
Do you document how you grant, approve and enforce access restrictions to tenant/customer credentials following the rules of least privilege?
...
Not Applicable
...
We do not grant access to customer credentials.
...
User Access Reviews
...
IAM-10.1
...
Do you require a periodical authorization and validation (e.g. at least annually) of the entitlements for all system users and administrators (exclusive of users maintained by your tenants), based on the rule of least privilege, by business leadership or other accountable business role or function?
...
Yes
...
We conduct quarterly users audits, their particular roles and privileges assigned. We also take actions upon results.
...
User Access Revocation
...
IAM-11.1
...
Is timely deprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties?
...
Yes
...
This is part of the respective procedure in Information Security Policy.
...
Infrastructure & Virtualization Security
...
Audit Logging / Intrusion Detection
...
IVS-01.1
...
Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?
...
No
...
The implementation of file integrity and intrusion detection is in progress for internal services and networks.
Cloud infrastructure has file integrity systems while intrusion detection is not applicable, as we rely on immutable Kubernetes containers.
...
IVS-01.2
...
Is physical and logical user access to audit logs restricted to authorized personnel?
...
Yes
...
IVS-01.5
...
Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?
...
Yes
...
Yes, we do review those on a quarterly basis.
...
Clock Synchronization
...
IVS-03.1
...
Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?
...
Yes
...
Yes, as a part of our Cloud infrastructure.
...
OS Hardening and Base Controls
...
IVS-07.1
...
Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?
...
Yes
...
Yes, as a part of our Cloud infrastructure
...
Production / Non-Production Environments
...
IVS-08.1
...
For your SaaS or PaaS offering, do you provide tenants with separate environments for production and test processes?
...
Not Applicable
...
We don't provide clients with access to DEV, STG. This is not a part of our Apps offering.
...
IVS-08.3
...
Do you logically and physically segregate production and non-production environments?
...
Yes
...
PROD and STG are fully segregated.
...
Segmentation
...
IVS-09.1
...
Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?
...
Yes
...
All our servers are under firewalls and not accessible from the Internet. Only relevant ports are opened.
...
VMM Security - Hypervisor Hardening
...
IVS-11.1
...
Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)?
...
Yes
...
Access to infrastructure virtualization assets is restricted to authorized engineers only using Identity Access Management (IAM), 2FA and Transport Layer Security (TLS).
Failed login attempts are detected and if above thresholds alerted. We take necessary actions if applicable.
...
Wireless Security
...
IVS-12.1
...
Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic?
...
Not Applicable
...
We use work-from-home (WFH) and bring-your-own-device (BYOD) concepts.
...
IVS-12.2
...
Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings)?
...
Not Applicable
...
We use work-from-home (WFH) and bring-your-own-device (BYOD) concepts.
...
IVS-12.3
...
Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network?
...
Not Applicable
...
We use work-from-home (WFH) and bring-your-own-device (BYOD) concepts.
...
Interoperability & Portability
...
APIs
...
IPY-01.1
...
Do you publish a list of all APIs available in the service and indicate which are standard and which are customized?
...
Yes
...
We publish our APIs for most of the App via Swagger. Only standard APIs are available as we do not do any customizations to APIs for clients.
...
Mobile Security
...
Approved Applications
...
MOS-03.1
...
Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device?
...
Not Applicable
...
We deliver Web Apps only. Mobile technology is not applicable for our stack of solutions.
...
Security Incident Management, E-Discovery, & Cloud Forensics
...
Incident Management
...
SEF-02.1
...
Do you have a documented security incident response plan?
...
Yes
...
This is part of "Incident Management Policy" that is available upon demand.
...
SEF-02.4
...
Have you tested your security incident response plans in the last year?
...
Yes
...
Incident Reporting
...
SEF-03.1
...
Are workforce personnel and external business relationships adequately informed of their responsibility, and, if required, consent and/or contractually required to report all information security events in a timely manner?
...
Yes
...
SEF-03.2
...
Do you have predefined communication channels for workforce personnel and external business partners to report incidents in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations?
...
Yes
...
Security Vulnerabilities Process
...
Incident Response Legal Preparation
...
SEF-04.4
...
Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?
...
Yes
...
Supply Chain Management, Transparency, and Accountability
...
Incident Reporting
...
STA-02.1
...
Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?
...
Yes
...
For Critical incidents we proactively inform all the existing clients and prospects that are using Trial Apps.
We provide standard reports for less critical incidents upon the request.
...
Network / Infrastructure Services
...
STA-03.1
...
Do you collect capacity and use data for all relevant components of your cloud service offering?
...
Yes
...
We have a monitoring system in place. We also regularly review capacity reports and take actions if necessarily.
...
Third Party Agreements
...
STA-05.4
...
Do third-party agreements include provision for the security and protection of information and assets?
...
No
...
STA-05.5
...
Do you have the capability to recover data for a specific customer in the case of a failure or data loss?
...
Yes
...
We have backups to recover - either completely or specific customers only.
...
Supply Chain Metrics
...
STA-07.4
...
Do you provide tenants with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance?
...
No
...
At the moment our StatusPage is internal only and not publicly shared. There’s a plan to share an appropriate item that sits in our backlog.
Meanwhile reports are available upon request.
...
Third Party Audits
...
STA-09.1
...
Do you mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met?
...
No
...
Threat and Vulnerability Management
...
Antivirus / Malicious Software
...
TVM-01.1
...
Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your IT infrastructure network and systems components?
...
No
...
Majority of our system components are provisioned using PaaS services.
Threats and vulnerability management for those applications is tackled via extensive human review. The PROD components that do use IaaS use real time antivirus.
...
Vulnerability / Patch Management
...
TVM-02.5
...
Do you have a capability to patch vulnerabilities across all of your computing devices, applications, and systems?
...
Yes
...
Our Apps are patched and deployed where compatible libraries exist.
...
Mobile Code
...
TVM-03.1
...
Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy?
...
Not Applicable
...
| Tip |
|---|
Please check our New Trust Center! https://releasemanagement.atlassian.net/wiki/spaces/TRUSTRM Our commitment to data privacy and security is embedded in every part of our day-to-day business. Use this Confluence Space to learn about our Data Protection, Security Posture and reliability related documentation. The document was moved to CAIQ - Lite: Security Self Assessment Questionnaire |