Security Assurance

1. You are here:
2. Security Assurance

Maintained by:

On this page

• Overview
• Functions within Security Assurance
  • Field Security Core Competencies
  • Security Governance Core Competencies
  • Security Risk Core Competencies
  • Security Compliance Core Competencies
• Core Tools and Systems
• How to Contact Us
• Customer Resources

Overview

As a sub department of the greater Security department and member of the Engineering organization, it is the mission of Security Assurance to provide assurance to GitLab customers of the security of GitLab as an enterprise application to use within their organisation.

Functions within Security Assurance

There are four functions and three teams in the Security Assurance sub department:

• Field Security and Security Governance
• Security Risk
• Security Compliance

Field Security Core Competencies

These are the primary functions of the Risk and Field Security team:

• Sales Enablement (Security)
• Customer Knowledge Management (Security)
• Customer Support (Security)

Security Governance Core Competencies

• Security Policies, Standards and Control maintenance
• Security Assurance Metrics
• Security Awareness and Training
• Regulatory Landscape Monitoring
• Security Assurance Application Administration

Security Risk Core Competencies

• Third Party Risk Management
• Tier 2 Security Operational Risk Management

Security Compliance Core Competencies

• Continuous Control Monitoring/Auditing
• GitLab SOX ITGC Compliance
• Security Certifications
• Tier 3 Observation Management

Core Tools and Systems

The Security Assurance sub department utilizes variety of tools and systems to carry out day to day activities related to the core competencies metnioned above. Some key tools that are utilized:

• ZenGRC: Key system utilized for initiating, tracking/documenting, and completing Governance, Risk, and Compliance related activities. For details on the various processes that are carried out of ZenGRC, refer to the ZenGRC Activities handbook page.
• BitSight: Third Party Security Rating Platform used to monitor GitLab's security rating as well as assess our Third Party's ratings.
• GitLab: Primarily used to engage stakeholders via issues, updates to Security Assurance related handbook pages, etc.
• Slack for internal communication

How to Contact Us

• Join our slack channel: #sec-assurance
• Email: security-assurance@gitlab.com

Customer Resources

Check out these great security resources built with our customers in mind:

• GitLab's Customer Assurance Package
• GitLab's Security - Trust Center
• GitLab's Security Team Page