Security Assurance

1. You are here:
2. Security Assurance

Maintained by:

On this page

• Overview
• Functions of Security Assurance
• Security Assurance Sub-Department
• Core Tools and Systems
  • Field Security Core Competencies
  • Security Governance Core Competencies
  • Security Risk Core Competencies
  • Security Compliance Core Competencies
• Core Tools and Systems
• Contacting the Team
• References

Overview

As a member of the Engineering organization and sub-department of the greater Security department, the Security Assurance team provides GitLab customers with a high level of assurance around the security of GitLab as an enterprise application.

Functions of Security Assurance

There are four functions and three teams in the Security Assurance sub department:

• Field Security and Security Governance
• Security Compliance
• Security Risk

Security Assurance Sub-Department

Core Tools and Systems

Field Security Core Competencies

These are the primary functions of the Field Security team:

• Sales Training (Security)
• Sales Enablement (Security)
• Customer Knowledge Management (Security)
• Customer Support (Security)

Security Governance Core Competencies

• Security Policies, Standards and Control maintenance
• Security Assurance Metrics
• Security Awareness and Training
• Regulatory Landscape Monitoring
• Security Assurance Application Administration

Security Risk Core Competencies

• Third Party Risk Management
• Tier 2 Operational Security Risk Management

Security Compliance Core Competencies

• Continuous Control Monitoring/Auditing
• GitLab SOX ITGC Compliance
• Security Certifications
• Tier 3 Observation Management

Core Tools and Systems

The Security Assurance sub department utilizes variety of tools and systems to carry out day to day activities related to the core competencies metnioned above. Some key tools that are utilized:

• ZenGRC: Key system utilized for initiating, tracking/documenting, and completing Governance, Risk, and Compliance related activities. For details on the various processes that are carried out of ZenGRC, refer to the ZenGRC Activities handbook page.
• GitLab: Primarily used to engage stakeholders via issues, updates to Security Assurance related handbook pages, etc.
• Slack for internal communication
• BitSight: Independent Security Rating Platform configured to monitor GitLab's security, identify potential vulnerabilities, and benchmark our security against our competitors. Additionally, BitSight is used to assess and monitor software vendors as part of our Third Party Risk Management Program.

Contacting the Team

• Join our slack channel: #sec-assurance
• Email: security-assurance@gitlab.com

References

Check out these great security resources built with our customers in mind:

• GitLab's Customer Assurance Package
• GitLab's Security - Trust Center
• GitLab's Security Team Page
• Security Terms Glossary