This policy specifies requirements related to the use of GitLab computing resources and data assets by GitLab team members so as to protect our customers, team members, contractors, company, and other partners from harm caused by both deliberate and inadvertent misuse. Our intention in publishing this policy is to outline information security guidelines intended to protect GitLab assets, not to impose restrictions.
It is the responsibility of every member of our Community to interact with GitLab computing resources and data in a secure manner and to that end we provide the following acceptable use standards related to computing resources, company and customer data, mobile and tablet devices, and removable and external media storage devices.
This policy applies to all GitLab team-members, contractors, advisors, and contracted parties interacting with GitLab computing resources and accessing company or customer data.
GitLab-managed assets are provided to conduct GitLab business with consideration given for limited personal use.
Those receiving GitLab-provided assets are responsible for exercising good judgment when using GitLab-managed computers and accessing GitLab-managed data.
As per the onboarding issue procedures outlined in our handbook, evidence of device encryption and device serial number must be provided to IT Ops prior to the completion of onboarding period. All MAC laptops procured by GitLab will come configured with JAMF. GitLab team members procuring and expensing MAC Laptops will require JAMF to be installed. Please work with IT Ops to ensure JAMF is properly installed.
All GitLab data is categorized and must be handled in accordance with the Data Classification Policy. All computing assets that connect to any part of the GitLab network, or 3rd party services that are used by GitLab, must comply with the applicable standards.
Team members and contractors may not use GitLab-managed resources for activities that are illegal or prohibited under applicable law, no matter the circumstances.
Prohibited system and network activities include, but are not limited to, the following:
ci), except when troubleshooting issues for the benefit of GitLab.
Forwarding of confidential business emails or documents to personal external email addresses.
Note: GitLab may retrieve messages from archives and servers without prior notice if GitLab has sufficient reason to do so. If deemed necessary, this investigation will be conducted with the knowledge and approval of the Security, People Business Partners, and Legal Departments.
All GitLab-owned computing resources must be returned upon separation from the company.
As a general rule, non-company devices are not permitted to access company assets. While there are some exceptions listed below, access to RED classified data is, as defined by the GitLab Data Classification Policy, still prohibited.
The exceptions are as follows:
All personal mobile computing devices used to access GitLab-managed data, including but not limited to email and GitLab.com, must be passcode-enabled. 2FA will be enforced by the Security team for all employee and contractor GitLab.com and GSuite accounts. Mobile computing best practices dictate that these devices should be running the latest version of the operating system available, and all new patches applied. For assistance with determining the suitability of your mobile device, please contact the Security Team.
For new employees who have not received a company laptop, there are exception processes for using non-company devices.
The same exception processes apply in the case of a corporate laptop being unavailable due to loss, theft or disrepair. See lost or stolen procedures for additional information. While the exception processes are considered a temporary solution, you still need to make sure the non-company system meets basic configuration standards, and a Microsoft Windows system is still not allowed access under any circumstances.
All GitLab-related conversations need to take place in Slack. It is strongly recommended that the official Slack application, or Slack web application, are used for mobile messaging. Downloads are available for iOS and Android. While it may be more convenient to use an integrated chat application that puts all of your conversations in one place, the use of these applications can unintentionally lead to work-related conversations crossing platforms, or being sent to external contacts. The use of Slack for all work communications assists with our security and compliance efforts. For example, in the case of an incident response issue, it may be necessary to review a conversation to understand the order in which events occurred, or to provide evidence that the chain of custody has been maintained for forensic evidence during a handoff.
For video calls, and as a back-up to Slack, we prefer Zoom. Zoom chats are an acceptable alternative to Slack when in a video call. If the conversation is interesting to others or may be needed for a retrospective, consider recording the call.
The use of removable and external storage devices such as USB flash drives and external backup drives on company-managed devices is not officially sanctioned. If there is a business need for the use of an external storage device, such as a flash drive or an external hard drive on company devices, please contact the Security Team to determine the most suitable encryption-enabled device. All external and removable storage devices must be encrypted and protected by a passcode.
GitLab provides a
email@example.com email address and a lost or stolen procedure for team members to use in situations that require an immediate security response. Should a team member lose a device such as a thumb drive, Yubikey, mobile phone, tablet, laptop, etc. that contains their credentials or other GitLab-sensitive data, they should send an email to
firstname.lastname@example.org right away. When the production and security teams receive an email sent to this address it will be handled immediately. Using this address provides an excellent way to limit the damage caused by a loss of one of these devices.
Compliance with this policy will be verified through various methods, including but not limited to, automated reporting, audits, and feedback to the policy owner.
Any team member or contractor found to be in violation of this policy may be subject to disciplinary action, up to and including termination of employment, or contractual agreement.
Exceptions to this policy must be approved by Security, Legal and PeopleOps Departments.
To consult with the Security Team, use the appropriate contact:
email@example.com, or create an issue in the Security Compliance tracker.