The news
Atlassian public sector cloud plans moved up on September 23, when Atlassian (TEAM) said it would submit its cloud products for U.S. Defense Department Impact Level 5 authorization in July 2028, six months earlier than planned, and for FedRAMP High in January 2029.
Vikram Rao, Atlassian's chief technology officer for enterprise and chief trust officer, laid out the roadmap in a company blog post. The IL5 and FedRAMP High deployments will include Jira, Confluence, Jira Service Management, Rovo and Guard. Impact Level 5 is the Defense Department's cloud security level for more sensitive controlled unclassified information, and FedRAMP High is the most demanding tier of the federal government's cloud authorization program for unclassified data.
Atlassian is also designing a fully disconnected, air-gapped deployment for IL6 and higher environments, and developing a sovereign cloud option with European infrastructure providers for regional data residency. Its list of deployment options also includes FedRAMP Moderate and Isolated Cloud. Rao wrote that the company has created a dedicated public sector organization with its own leadership and resources and is increasing engineering investment, without giving a figure.
The roadmap sits against a fixed deadline. Atlassian's Data Center products, the self-managed versions customers run on their own infrastructure, reach end of life on March 28, 2029. The FedRAMP High submission target comes about two months earlier, and the post does not say when authorization itself is expected. A submission starts a government review; it does not guarantee approval by a particular date.
Atlassian has been expanding its enterprise business. In its fiscal third quarter, revenue rose 32% to $1.8 billion and its service collection, which includes Jira Service Management, passed $1 billion in annual recurring revenue, The Register reported on May 1. Chief executive Mike Cannon-Brookes said at the time that Atlassian had its largest-ever quarter for competitive displacements from a major IT service management provider.
The numbers
- DoD IL5 submission target
- July 2028 (6 months earlier)
- FedRAMP High submission target
- January 2029
- Data Center end of life
- March 28, 2029
- Fiscal Q3 revenue (The Register, May 1)
- $1.8 billion, up 32%
Why CEOs should care
For federal agencies, defense contractors and others that need IL5 or FedRAMP High, the timeline is the story. If you run Atlassian Data Center, the March 28, 2029 end-of-life date arrives shortly after the FedRAMP High submission target and before any stated authorization date. Build a plan that assumes delays: ask Atlassian about interim options such as Isolated Cloud or FedRAMP Moderate, and seek written commitments on what happens if authorization slips past the Data Center cutoff.
CISOs in regulated industries outside government should read the roadmap as a signal of where Atlassian's cloud controls are heading. Work to meet IL5 and FedRAMP High requirements usually drives investment in encryption, access control and auditing. Ask whether controls built for these environments, and for the planned European sovereign cloud, will be offered in standard enterprise tiers, and on what timeline.
CFOs should budget for migration and possible dual running, since moving from self-managed Data Center to a cloud environment still awaiting authorization may mean paying for both for a period. Boards of organizations that rely on Jira and Confluence for regulated work should ask management for a dated migration plan and a documented fallback.
The bigger picture
Enterprise software vendors are steering customers away from self-managed software and into their own clouds, and government and data sovereignty requirements are among the biggest obstacles. By creating a dedicated public sector organization and designing air-gapped and sovereign options, Atlassian is trying to remove those objections before its Data Center deadline, while it competes with ServiceNow (NOW) for IT service management work.
The roadmap also shows how long government authorization takes. Atlassian is setting targets years in advance, and customers in defense and other sensitive sectors must plan their collaboration and service management software around those dates. The planned European sovereign cloud reflects similar pressure from customers outside the U.S. who want their data kept under regional control.
What’s next
Watch for Atlassian to name its European sovereign cloud partners, to publish expected authorization dates rather than only submission dates, and to say whether Data Center end-of-life terms will flex for customers waiting on IL5 or FedRAMP High environments.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
