Prepare Marketplace security without ticking boxes blindly.
Atlassian includes a partner security questionnaire in its listing and review process. This workspace turns its 28 topics into owners, references, gaps, and next actions—without pre-filling a single answer.
A preparation packet, not a badge.
- Authoritative source
- Official Atlassian documentation
- Source updated
- April 28, 2026
- Data transfer
- None—browser only
The official form asks the question. The packet keeps the evidence.
The wording below consists of working summaries. The current Atlassian source remains authoritative when answering or submitting an app.
Open the 28 official questionsOrganization
Company context and history required for the partner packet.
Workstations and accounts
Development workstation protection, encryption, updates, and authentication.
Infrastructure and logs
Encryption, event coverage, retention, and anomaly detection.
Development
Code controls, reviews, security tests, dependencies, and secrets.
Policies and response
Password rules and a documented incident-response plan.
Bug bounty and penetration tests
Reporting programs and internal or independent penetration tests.
Audits and certifications
Certifications actually held and shareable external assessments.
Vulnerabilities and incidents
Scanning, remediation rules, notification, and an operational security contact.
Turn 28 questions into verifiable decisions.
Each control retains its state, owner, reference, and date. ‘Confirmed locally’ only means someone completed this local copy; Atlassian has neither received nor validated it.
Activate a state to filter; activate it again to show all 28 controls.
28 controls displayed.
Organization
Company context and history required for the partner packet.
Q01Organization sizeDocument the workforce range that must be declared in the partner packet.Not reviewed
Expected evidence: Dated HR or administrative source with a named data owner.
Suggested owner: Leadership / operations. This suggestion is not a real assignment.
No local review has been saved for this control.
Q02Marketplace historyVerify whether an organization account or app has ever been suspended from or revoked by Marketplace.Not reviewed
Expected evidence: Approved declaration and, where applicable, references to decisions and remediation.
Suggested owner: Marketplace owner. This suggestion is not a real assignment.
No local review has been saved for this control.
Workstations and accounts
Development workstation protection, encryption, updates, and authentication.
Q03Endpoint protectionInventory the anti-malware or EDR protection actually active on workstations used to develop the apps.Not reviewed
Expected evidence: Device policy, coverage inventory, and recent monitoring evidence.
Suggested owner: Security / information technology. This suggestion is not a real assignment.
No local review has been saved for this control.
Q04Full-disk encryptionConfirm that development workstations encrypt their volumes and that exceptions are known.Not reviewed
Expected evidence: Device-management setting, coverage rate, and exception register.
Suggested owner: Security / information technology. This suggestion is not a real assignment.
No local review has been saved for this control.
Q05Patch managementDescribe how workstation systems and software are inventoried, updated, and checked.Not reviewed
Expected evidence: Procedure, target timelines, latest compliance report, and open exceptions.
Suggested owner: Security / information technology. This suggestion is not a real assignment.
No local review has been saved for this control.
Q06MFA on company systemsVerify that accounts with access to organization systems require multi-factor authentication.Not reviewed
Expected evidence: Identity policy, covered scope, and an exception list with end dates.
Suggested owner: Security / information technology. This suggestion is not a real assignment.
No local review has been saved for this control.
Infrastructure and logs
Encryption, event coverage, retention, and anomaly detection.
Q07Data and backup encryptionEstablish encryption at rest for app services and any backups without inferring an algorithm before evidence exists.Not reviewed
Expected evidence: Architecture, provider configuration, and separate backup verification.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q08Logged-event coverageMap authentication, sessions, APIs, permissions, imports, exports, integrations, configuration, administrative actions, network address, client agent, and MFA-factor enrollment or removal.Not reviewed
Expected evidence: Event → source → timestamp → owner → retention-period matrix.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q09Secret exclusion from logsVerify that passwords, credentials, tokens, and unnecessary personal data are not written to logs.Not reviewed
Expected evidence: Redaction rules, automated tests, and a reviewed log sample.
Suggested owner: Engineering / privacy. This suggestion is not a real assignment.
No local review has been saved for this control.
Q10Log-retention periodCompare configured retention with the twelve-month threshold requested by the official questionnaire.Not reviewed
Expected evidence: Configuration by source, rationale, cost, and deletion mechanism.
Suggested owner: Security / operations. This suggestion is not a real assignment.
No local review has been saved for this control.
Q11Detection and alertsDescribe the rules that detect anomalies and the escalation path to an accountable person.Not reviewed
Expected evidence: Alert catalog, destination, any on-call coverage, and the latest verified exercise.
Suggested owner: Security / operations. This suggestion is not a real assignment.
No local review has been saved for this control.
Development
Code controls, reviews, security tests, dependencies, and secrets.
Q12MFA on source controlConfirm multi-factor authentication for every account with repository access.Not reviewed
Expected evidence: Git organization policy, member coverage, and documented exceptions.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q13Mandatory pull-request pathVerify that production code cannot bypass the protected branch and review workflow.Not reviewed
Expected evidence: Branch rules, administrative permissions, and a recent bypass test.
Suggested owner: Engineering lead. This suggestion is not a real assignment.
No local review has been saved for this control.
Q14Peer approvalEstablish the number and quality of approvals required before production code is merged.Not reviewed
Expected evidence: Protection rules, any CODEOWNERS file, and recent review examples.
Suggested owner: Engineering lead. This suggestion is not a real assignment.
No local review has been saved for this control.
Q15OWASP risk reviewConnect common application risks to the app's threat model and development practices.Not reviewed
Expected evidence: Review material, date, participants, and gaps converted into tracked actions.
Suggested owner: Product security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q16Integrated security testingInventory the security controls run during design, CI, and release preparation.Not reviewed
Expected evidence: Pipeline, blocking thresholds, recent reports, and exception procedure.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q17No untreated known dependency vulnerabilityShow how libraries and frameworks are inventoried, scanned, prioritized, and updated.Not reviewed
Expected evidence: SBOM or inventory, recent scan, severity policy, and remediation tickets.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q18Secret management and rotationIdentify where keys live, how they are restricted, and when they are renewed or revoked.Not reviewed
Expected evidence: Inventory, vault used, owners, latest rotations, and emergency procedure.
Suggested owner: Engineering / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Policies and response
Password rules and a documented incident-response plan.
Q19Password policyDocument authentication requirements that remain relevant when SSO or MFA does not apply.Not reviewed
Expected evidence: Approved policy, identity configuration, and latest review date.
Suggested owner: Security / information technology. This suggestion is not a real assignment.
No local review has been saved for this control.
Q20Incident-response planPrepare a plan covering detection, qualification, containment, notification, recovery, and retrospective.Not reviewed
Expected evidence: Versioned plan, roles, contacts, exercises, and actions from the latest test.
Suggested owner: Security lead. This suggestion is not a real assignment.
No local review has been saved for this control.
Bug bounty and penetration tests
Reporting programs and internal or independent penetration tests.
Q21Bug-bounty programClarify any participation in the Marketplace program, another program, or a future enrollment plan.Not reviewed
Expected evidence: Program URL or agreement, scope, rules, and actual enrollment status.
Suggested owner: Security lead. This suggestion is not a real assignment.
No local review has been saved for this control.
Q22Regular penetration testsDescribe the frequency, scope, and independence of penetration tests actually performed.Not reviewed
Expected evidence: Statement of work, dated summary, scope, exceptions, and remediation tracking.
Suggested owner: Security lead. This suggestion is not a real assignment.
No local review has been saved for this control.
Audits and certifications
Certifications actually held and shareable external assessments.
Q23Certifications heldList only valid certifications that actually cover the relevant organization or product.Not reviewed
Expected evidence: Certificate, issuing body, scope, validity period, and exclusions.
Suggested owner: Compliance / leadership. This suggestion is not a real assignment.
No local review has been saved for this control.
Q24External security assessmentsInventory external audits, their scope, and the conditions under which a report can be shared.Not reviewed
Expected evidence: Assessment name, period, scope, summary, and controlled sharing channel.
Suggested owner: Compliance / security. This suggestion is not a real assignment.
No local review has been saved for this control.
Vulnerabilities and incidents
Scanning, remediation rules, notification, and an operational security contact.
Q25Vulnerability scansDistinguish the static, dynamic, and dependency analyses actually run and reviewed.Not reviewed
Expected evidence: Tools, frequency, scope, latest result, and evidence that alerts were handled.
Suggested owner: Product security. This suggestion is not a real assignment.
No local review has been saved for this control.
Q26Atlassian remediation policyHave the relevant owners read and accept the Marketplace remediation policy.Not reviewed
Expected evidence: Review date, participants, identified impacts, and aligned internal procedure.
Suggested owner: Security / Marketplace operations. This suggestion is not a real assignment.
No local review has been saved for this control.
Q27Critical-incident notificationPrepare the notification path to Atlassian and customers, then record review of the official guide without announcing a timeline before operational validation.Not reviewed
Expected evidence: Notification matrix, approved templates, owners, and a communication exercise.
Suggested owner: Security / communications. This suggestion is not a real assignment.
No local review has been saved for this control.
Q28Operational security contactName the person or team that will monitor Atlassian security communications and verify their access to the ecosystem.Not reviewed
Expected evidence: Named role, monitored channel, required account, and absence cover.
Suggested owner: Security lead. This suggestion is not a real assignment.
No local review has been saved for this control.
JSON is the reimportable backup. Markdown is for reviewing and sharing the packet. Before a real submission, compare every answer with the current Atlassian form and have its owner validate it.
What ‘confirmed’ does not mean.
- It is neither Atlassian approval, a certification, nor listing validation.
- It is not evidence until the reference is accessible, dated, and aligned with the declared scope.
- It is not a submission: data stays in the browser and exports are produced locally.
- It does not replace the official form, which may change after the stated review date.
- This workspace does not cover KYC/KYB identity and business verification, which Atlassian documentation treats as a separate step.
A useful answer always connects yes to its evidence.
Export the packet, have each control validated by its owner, then compare it with the current Atlassian questionnaire before any submission.