Security Assurance

1. You are here:
2. Handbook
3. Security at GitLab
4. Security Assurance

On this page

• Overview
• Security Assurance Sub-Department
• Core Competencies of Security Assurance Teams
  • Field Security Core Competencies
  • Security Governance Core Competencies
  • Security Risk Core Competencies
  • Security Compliance, Commercial Core Competencies
  • Security Compliance, Dedicated Core Competencies
• Core Tools and Systems
• Contacting the Team
• References

Overview

As a member of the Security department, the Security Assurance sub-department provides GitLab customers with a high level of assurance around the security of GitLab SaaS service offerings.

There are five teams in the Security Assurance sub-department.

Security Assurance Sub-Department

Governance & Field Security	Security Compliance	Security Risk
Governance Team Page Field Security Team Page	Security Compliance, Commercial Team Page Security Compliance, Dedicated Team Page	Security Risk Team Page

Core Competencies of Security Assurance Teams

Field Security Core Competencies

• Sales Training (Security)
• Sales Enablement (Security)
• Customer Assurance (Security)
• Security Evangelization

Security Governance Core Competencies

• Security Policies, Standards and Control maintenance
• Security Assurance Metrics
• Regulatory Landscape Monitoring
• Security Awareness and Training
• Security Assurance Application Administration
• Security Assurance Automation

Security Risk Core Competencies

• Security Third Party Risk Management
• Tier 2 Operational Security Risk Management
• Business Impact Assessments
• Critical System Tiering

Security Compliance, Commercial Core Competencies

• GitLab.com Production Continuous Control Monitoring/Auditing
• GitLab.com Security Certifications
• GitLab.com Production & SOX ITGC User Access Reviews
• Tier 3 Observation Management
• GitLab.com Production Readiness: Compliance Assessment

Security Compliance, Dedicated Core Competencies

• GitLab Dedicated Production Continuous Control Monitoring/Auditing
• GitLab Dedicated Security Certifcations
• GitLab Dedicated User Access Reviews
• Tier 3 Observation Management
• GitLab Dedicated Production Readiness: Compliance Assessment

Core Tools and Systems

The Security Assurance sub department utilizes a variety of tools to carry out day to day activities. The system admin is responsible for the following:

• Configuration changes
• Onboarding/offboarding/transfers (ie Access)
• Upgrades/patching/incidents
• Migrations to new environments
• Restores from backup
• Admin level audit evidence
• Quality oversight (limited scope)

All other actions are the responsibility of the assigned DRI.

System Name	System Description	Admin	DRI
ZenGRC	Key system utilized for initiating, tracking/documenting, and completing Governance, Risk, and Compliance related activities. Access is provided as a standard baseline entitlement for all team members. Refer to the ZenGRC FAQ and ZenGRC Activities handbook pages for additional information.	Donovan Felton	* Security Compliance - Madeline Lake * Security Risk - Ty Dilbeck
Anecdotes	Key system utilized for Compliance automation	Donovan Felton	Byron Boots
Authomize	Key system utilized by Security Compliance for User Access Reviews	Donovan Felton	Alex Frank
OneTrust Vendorpedia QRA	Key system utilized for Privacy, Security, and Data Governance for completing customer questionnaires	Donovan Felton	Marie-Claire Cerny
OneTrust Vendorpedia Exchange	System utilized for Privacy, Security, and Data Governance for TPRM	Donovan Felton	Ty Dilbeck
ProofPoint	Key system utilized for the creation and distribution of our security training and phishing simulations to provide ongoing testing for adherence of various compliance frameworks.	Donovan Felton	Joe Longo
BitSight	Independent Security Rating Platform configured to monitor GitLab's security, identify potential vulnerabilities, and benchmark our security against our competitors. Additionally, BitSight is used to assess and monitor software vendors as part of our Security Third Party Risk Management Program.	Donovan Felton	Jeff Burrows
GitLab - Security Assurance Projects	Primarily used to engage stakeholders via issues, updates to Security Assurance related handbook pages, etc.	Julia Lake	Each Team is responsible for their Projects, but everyone can contribute

Contacting the Team

• Join our slack channel: #sec-assurance
• Email: security-assurance@gitlab.com

References

Check out these great security resources built with our customers in mind:

• GitLab's Customer Assurance Package
• GitLab's Security - Trust Center
• GitLab's Security Team Page