Close

Atlassian's Common Controls Framework


As with many companies, Atlassian has a number of international control standards that are applicable to our product development and our operations environments. We decided to evaluate the overlap between many of these independent standards, and ensure we have a single view of applying those standards to our internal environments.  The primary environment where we are applying these standards is to our cloud-hosting platform, we understand that we need to show that we are taking appropriate efforts to protect our customers and their data. However, not all of the standards are applicable to all environments.  For example, the focus for Sarbanes-Oxley (SOX) is the systems that support our financial report, of which our cloud services are secondary at best. Let's take a look at the standards we evaluate and why.

Applicable International Standards

Ниже перечислены стандарты, которые мы учитывали при создании собственной общей платформы контрольных процедур:

 
Стандарт
Куратор
Процедуры
Области

ISO 27001

Международная организация по стандартизации 26 требований

6 разделов

ISO 27002

Международная организация по стандартизации 114 требований

14 тем

PCI-DSS

Индустрия платежных карт 247 требований

6 тем

CSA CCM

Альянс безопасности облачных вычислений 133 контрольных требования

16 тем

SOC 2

Контрольные процедуры для обслуживающих организаций 116 требований

5 принципов

SOX 404 (IT)

Федеральный закон США 22 требования

5 тем

GAPP

Американский институт присяжных бухгалтеров 106 требований

10 тем

 

Common Controls Framework

As you can see from the table above, there are a series of different and disparate requirements, many of which are applied to the same environments, systems or teams. In order to make it a bit easier to understand the overlap and the similarities from many of these standards for our teams, we evaluated each of the control requirements and identified where there was overlap - where each of the standards was essentially evaluating the same domain. As a result, we have a common controls framework that easily maps to each of the standards.

Conceptual Model for Applicability

As we evaluated each of the requirements, we realized that it would be inefficient to apply the entire stack of controls to each of our products or online services. We have designed the structure so that different portions of the controls framework are applied to different parts of the delivery stack, which can be inherited by the other portions of the organization.

Логотип Atlassian в окне браузера

Atlassian Applications

App Dev Security

Data Security & Information Lifecycle Management

Lock

Atlassian Security

Crypto & Encryption

Threat & Vulnerability Management

Security Incident Management

Связанные узлы

Atlassian Infrastructure

Asset Management

Access Control

Operations

Communications Security

кластер серверов

Atlassian Data Centers & Offices

Physical & Environmental Security

Портфель

Atlassian Corporate

Security Governance

Organization of Security

Personnel Security

Supplier & Third Party Data Management

Mobile Security

Business Continuity

Audit / Compliance

Privacy

Conclusion

The organization of the Atlassian Common Controls Framework was important so our teams can utilize the mentality of "evaluate many times, perform once". Instead of asking multiple different teams, multiple different times, we used the efficiency of this framework to define where we would organize and apply controls so the entire company could understand the requirements and how each portion of our organization performs collectively to deliver security to all of our customers.