The basic principles of our Security policy include:

• We will manage access to company information and customer information based on business need and in line with our Atlassian values
• Atlassian will implement a set of controls to manage the implementation of security in line with this policy
• Atlassian will periodically review risks and the effectiveness of controls intended to manage those risks

The basic principles include:

Atlassian will maintain an Access Control policy outlining how to manage access to systems;

• User accounts and passwords will be used to manage access
• All users have responsibility to manage access to their systems
• Systems will be logged and monitored for potential inappropriate access
• Remote access will be managed by multi-factor authentication

The basic principles of asset management at Atlassian include:

• Atlassian will maintain an inventory of assets
• Assets maintained in an asset management database will have identified owners
• Acceptable use of assets will be identified, documented and implemented
• Assets will be returned to Atlassian if employment is terminated

The basic principles include:

• Mission critical system, process or Service Owners must ensure proper Business Continuity and/or Disaster Recovery that is inline with the tolerance for disruption in case of disaster.
• Continuity plans must include appropriate "last stand" environment, that provides core functionality (at the minimum), and a plan to fail to that environment. Considerations for business-as-usual resumption must also be included.
• No mission critical system, process or function could be deployed in production without appropriate continuity plan.
• Plans must be tested quarterly and issues identified and addressed.
• Maximum time for recovery (RTO) starts from event detection until the core functionality is operational. Services are grouped into Tiers that define maximum RTO and RPO.

The basic principles include:

• Network access should be controlled
• Network access is supplied and all users should be familiar with the Global - Electronic System and Communications Policy
• Networks should be segregated based on criticality

Atlassian will ensure:

• Sensitive data is encrypted appropriately
• Strength of selected encryption corresponds with information classification
• Cryptographic keys will be securely managed
• Only approved cryptographic algorithms will be used

All employees share in the responsibility for ensuring that our information receives an appropriate level of protection by observing this Information Classification policy:

• Information should be classified in terms of legal requirements, value and criticality to Atlassian
• Information should be labeled to ensure appropriate handling
• Manage all removable media with the same handling guidelines as below
• Media being disposed of should be securely deleted
• Media containing company information should be protected against unauthorized access, misuse or corruption during transport

Atlassian will ensure:

• This Bring Your Own Device Policy (BYOD) intends to be as unobtrusive and flexible as possible with regard to BYOD usage to maintain the autonomy of Atlassians whilst ensuring we have the ability to protect our customer and corporate data.
• The primary focus will be on configuration / posture checking and monitoring of compliance of devices, with the least restrictive principles that reasonably achieve the required security objectives, rather than enforcement of restrictions. Where restrictions do need to be applied, this will be done selectively depending on the data that can be accessed.
• This Policy covers both our current and our anticipated future needs. Some of the capabilities outlined may not be implemented immediately.

Basic principles include:

• Atlassian procedures should be documented for operational activities
• Our backups should be taken regularly and the backups tested
• All changes should be managed and evaluated by multiple people
• Capacity should be evaluated and planned for
• Software installation should be limited and unnecessary software should be restricted
• Logs must be configured and forwarded to the centralized logging platform
• Any operational incidents should be managed according to our standard Incident process

Here at Atlassian, we will ensure:

• Security responsibilities will be outlined in job definitions
• All employees and users will regularly attend security awareness training
• All employees and contractors have a duty to report security incidents or weaknesses
• Upon employee termination, access and return of assets will occur in a reasonable time frame

The basic principles of physical and environment security include:

• Atlassian will provide for secure areas to work
• We will secure our IT equipment wherever it may be
• We will restrict access to our buildings and offices to appropriate personnel

The basic principles of data privacy include:

• manage controls around collecting customer data
• reviewing customer data should be kept to support purposes only
• the only scenarios where customer data may be cloned is for backup or support purposes

The Atlassian Security Team will:

• Anticipate security incidents and prepare response plans accordingly
• Contain, eradicate and recover from an incident
• We will invest in our people, processes and technologies to ensure we have the capability to detect and analyse an incident when it occurs
• In responding to an incident, we will put the protection of customer data as our top priority
• Learn from and improve the security incident management function

Atlassian will ensure:

• Atlassian will be purposeful in managing our vendor selection process
• The business owner requesting the vendor relationship is responsible for utilizing standard Atlassian contracts
• We will perform oversight of the relationship to ensure it meets our Atlassian standards
• We reserve the right to terminate the contract with any vendor when the service is no longer required

The basic principles include:

• Security requirements will be included and incorporated to any environment or application development or acquisition;
• Product development will follow our internal quality assurance process, which includes integration of security checks;
• Production data will be anonymized or masked when being used in pre-production environments; and
• Integration of any open source frameworks or libraries will follow our internal guidelines

Atlassian will ensure:

• We manage security vulnerabilities in our products and services, including issuing updates, patches or advisories
• We will manage security threats and vulnerabilities throughout our environment, both internal and hosted environments
• We will manage the threat of malware in the environment

Atlassian will ensure:

• We implement technology-focused operations, security and privacy controls to ensure they comply with relevant internal policies, regulations and external industry standards;
• Audits are coordinated and delivered as appropriate to achieve high level of confidence in our control environment, as well as to achieve internal or external certification;
• Atlassian seeks external validation of the implementation of our operational, security, privacy and other controls;
• Atlassian maintains a consolidated view of all its relevant control objectives, activities and tests (Atlassian Controls Framework - ACF)