Atlassian product teams use a blend of agile and DevOps practices. But there are still SOX and ISO compliance standards to meet when it comes to change management. What's a modern dev team to do? Join Guy Herbert, Atlassian's IT compliance lead as he shows how we combine peer review and build testing with a new approach to compliance in order to deliver customer value quickly while meeting our compliance obligations.

1. GUY HERBERT | RISK AND COMPLIANCE | ATLASSIAN | @RISKFUTURIST
DevOps vs. Compliance
A Guide to Having it All

2. Communicate
You need to know the rules
and risk needs to know what
you are doing
3 things
DevSpeed
Use what you already do to
meet compliance obligations
Make it easy
Because you have work to do

3. PCI
PaymentCard
Industry-data
securitystandard
SOX
SarbanesOxley
Legislation
SOC
ServiceOrganisation
Controlreport
GDPR
GeneralData
Protection
Regulations
Our obligations

4. People have
work to do

5. Compliance obligations and control activities

6. Controlactivitylibrary
Wetrackallthecontrolactivitieswerelyon
Verifyinternally
Wechecktomakesurethatthecontrolactivitiesare
operating
Externalaudit
Wetrytolimittheamountoftimethatrealpeople
havetospendwithauditors

7. Compliance
Compliance
Obligation
Control
Objective
Control Activity
Control Test
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

8. Compliance
Compliance
Obligation
Control
Objective
Control Activity
Control Test
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

9. Compliance
Compliance
Obligation
Control
Objective
Control Activity
Control Test
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

10. Compliance
Compliance
Obligation
Control
Objective
Control Activity
Control Test
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

11. Do something
Change
needs context
Organisational risk and compliance
Awareness
Whataretheteamsdoing?
Decision support
What are the boundaries?
Who gets to make them?

12. PeerReview
Changeapproval
GreenBuild
Testingapproval
Approval and Testing

13. CULTURAL CHECK
How good is your
peer review?

14. Compliancecheck
Arethecontrolsinplace?
Signingtheartifact
Soweknowitiscontrolled
Checking and Signing

15. Bitbucket
settings
Let me do it for
you
I want to do it
myself
End result
Reviewers
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

16. Bitbucket
settings
Let me do it for
you
I want to do it
myself
End result
Reviewers
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

17. Bitbucket
settings
Let me do it for
you
I want to do it
myself
End result
Reviewers
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

18. Bitbucket
settings
Let me do it for
you
Iwanttodoit
myself
Endresult
Reviewers
Shape usage
Please only use circles, rectangles, and
rounded rectangles to call attention to a
particular part of a screenshot, for the
sake of consistency.

19. 3600
Audit tests
1

20. The
possibility
that things
will go
wrong
Being able to
show that
you follow
the rules
COMPLIANCE RISK

21. Lessaccessmanagement
Don’tneedtosegregatecreatorsandreviewers
Moreaccessmanagement
Whocanturnoffthecontrols?
Monitoring
Peerreviewandgreenbuildsettings,compliance
checksbeforebuild,productionsignaturecheck

22. Communicate
Jira and Confluence together
to help you be open
Questions
DevSpeed
Bitbucket and Bamboo to
enforce peer review
Make it easy
Atlassian Community - how
we manage risk and
compliance at Atlassian

23. GUY HERBERT | RISK AND COMPLIANCE | ATLASSIAN | @RISKFUTURIST
Thank you!