Atlassian for Government in Australia
For federal, state and local agencies, and government-owned organisations
Adopting Jira, Confluence or Jira Service Management in government takes more than a licence. Senzo sets out the decisions to settle first and where a partner fits.
Five decisions before your agency adopts Atlassian Cloud
Commonwealth entities work to the Protective Security Policy Framework; other governments to their own. The same five decisions come up either way.
| Decision | What to establish | Evidence from |
|---|---|---|
| Procurement route | A whole-of-government arrangement, a jurisdiction panel or an open approach to market | Commonwealth: BuyICT. State and local: their own rules |
| Security assessment | Whether it covers your products, plans and classification level | Atlassian's IRAP material, read by your security team |
| Data location and processing | What is pinned to Australia, what is out of scope, where AI processes data | Data residency documentation; AI on our Rovo and Atlassian AI page |
| Hosting assurance | Whether your policy requires a Hosting Certification Framework level | The framework (new registrations paused since 3 November 2025); the provider's status |
| Identity, access and data contribution | Single sign-on, administration and AI data contribution | Your identity team; Atlassian Guard Standard; data contribution FAQs |
Reading Atlassian's IRAP material
ASD says "it is integral for customers to read and understand security assessment reports". The report is evidence for your own assessment.
- An assessment, not a certificationIRAP assessors "do not accredit, certify, endorse or register systems on behalf of ASD", and Atlassian says its report "is not a certification".
- Against your scopeCheck the products, plan, residency setting and Marketplace apps in scope.
- AI is a separate itemAustralian data residency does not, by itself, establish that AI inference occurs in Australia.
Where Atlassian Cloud may not be the right home
Atlassian publishes its assessment at PROTECTED, while IRAP assessors can assess systems up to SECRET. Atlassian has set 28 March 2029 as the end of life for Jira, Jira Service Management and Confluence Data Center. For workloads above PROTECTED, another platform may be right; saying so before procurement saves a cycle.
Where Senzo fits
Your agency owns the risk decisions, procurement and authority to operate. We do the Atlassian work, within our wider consulting practice.
- Assessment scopePinning down the scope your security team assesses.
- Plans and licencesThe plan settled alongside Guard and your data-contribution position.Learn more
- Service desk designNative Jira Service Management features where apps are not permitted.Learn more
- Cloud migrationPlanning the move to Atlassian Cloud.Learn more
- Helpdesk migrationPlanning the move off another service tool.Learn more
- Managed servicesRunning the platform once live.Learn more
Frequently asked questions
Have Jira, Confluence and Jira Service Management Cloud been assessed under IRAP?
Yes, at PROTECTED. Atlassian says it "has successfully attained the PROTECTED classification under the IRAP framework for its products".
Can our Atlassian data stay in Australia?
In part. Atlassian's data residency can pin in-scope Jira, Jira Service Management and Confluence data to Sydney on Standard, Premium and Enterprise. User account information is out of scope.
Is Atlassian Government Cloud the route for Australian agencies?
Generally not. It is Atlassian's FedRAMP-authorised US offering, and its purchase "is restricted to US government agencies".
Does the partner need its own IRAP assessment?
IRAP assesses ICT systems and cloud services; the platform's assessment is Atlassian's own. What your agency requires of people working in your site, such as a clearance, is set by its policy.
Can we start before the security assessment is finished?
Design work can: workshops and solution design run while approvals progress. Where policy permits, so can a dummy-data build in a non-production site, which may need its own approval. Real records wait for sign-off.
Do the staff who raise requests need licences?
No. Jira Service Management is licensed per agent, a user who can work on tickets and communicate directly with your customers. People raising and tracking requests are customers, who need no agent licence.
What a first conversation should establish
Whether Cloud suits your classification, which products and plan, identity and data settings, and your procurement route.