If you would like to request security collateral which are under NDA, (such as SOC 2 Type 2, Pentest executive summary, etc.) please visit the[Trust Center](https://trust.gitlab.com/) and click on the request access button at the top right-hand corner.
Security documentation (such as SOC 2 Type 2, Pentest executive summary, etc.) available at[Trust Center](https://trust.gitlab.com/). _(Click Get Access button at top right of page, enter company email address. This is the same process for customers and GitLab employees. More detailed instructions available below.)_
*The above are for GitLab Team Members only. Customers should contact their GitLab [Account Owner](/handbook/sales/#initial-account-owner---based-on-segment) to initiate their requests. If a customer doesn't know their Account Owner or does not yet have an assigned Account Owner, they can [contact the sales team](https://about.gitlab.com/sales/). Once you have submitted the issue, it is now in our queue and will be assigned to one of our Field Security Engineers when it is next up (please see SLA's listed below).*
_The above are for GitLab Team Members only. Customers can upload questionnaires to GitLab's Trust Center, or contact their GitLab [Account Owner](/handbook/sales/#initial-account-owner---based-on-segment) to initiate their requests. If a customer doesn't know their Account Owner or does not yet have an assigned Account Owner, they can [contact the sales team](https://about.gitlab.com/sales/)._
## Customer Assurance Activity Requests Overview
It's no surprise that GitLab Customers and Prospects conduct Security due diligence activities prior to contracting with GitLab. We recognize the importance of these reviews and have designed this procedure for **GitLab Team Members** to request Customer Assurance Activities.
GitLab Customers and Prospects conduct Security due diligence activities prior to contracting with GitLab. We recognize the importance of these reviews and have designed this procedure for **GitLab Team Members** to request Customer Assurance Activities.
### **GitLab Team Members**
We will start all CAA requests (with the exception of Contract Reviews) by **sharing the Trust Center with the customer**. The Trust Center will answer many of the customer's questions and will enable us to provide the customer with a more efficient and comprehensive experience.
When submitting this request, ensure your customer is aware of GitLab's [Trust Center](https://trust.gitlab.com). The Trust Center will answer many of the customer's questions and will enable us to provide the customer with a more efficient and comprehensive experience.
**Please do not assign the issue. Field Security will assign the issue to the appropriate team member. Thank you!**
@@ -27,73 +27,59 @@ We will start all CAA requests (with the exception of Contract Reviews) by **sha
To access GitLab's Trust Center:
- Navigate to trust.gitlab.com
- Click "Get Access" in the top right corner
- Enter your email address, and click "Continue"
-**Do not click "Log into GitLab's workspace.** That is for the admin portal.
1. Navigate to [trust.gitlab.com](https://trust.gitlab.com)
1. Click "Get Access" in the top right corner
1. Enter your email address, and click "Continue"
The process is exactly the same for customers. If customers do not want to sign the click-wrap NDA, and they already have a fully-executed NDA in SFDC or an active GitLab subscription, we can bypass the click-wrap NDA on our end. Please note, **this should be a last resort**, as it will further delay their access to the trust center. The fastest way to drive customers towards success is to encourage them to leverage the self-service nature of the trust center to its fullest extent. If you have any questions, please reach out in the #sec-fieldsecurity Slack channel.
***Do not click "Log into GitLab's workspace.** That is for the admin portal.
* Some documentation is public and does not require this process (ISO certificate (27001, 27017, 27018; 42001)).
The process is exactly the same for customers. If customers do not want to sign the click-wrap NDA, and they already have a fully-executed NDA in SFDC or an active GitLab subscription, we can bypass the click-wrap NDA on our end. Please note, **this should be a last resort**, as it will further delay access to the Trust Center. The fastest way to drive customers towards success is to encourage them to leverage the self-service nature of the Trust Center to its fullest extent. If you have any questions, please reach out #security_help Slack channel (tag @field-security).
### For Questionnaires
The process will be handled in SafeBase. Customers/prospects who have access to the [Trust Center](https://trust.gitlab.com) can directly upload questionnaires by clicking the *Submit a Questionnaire* link at the top of the Trust Center.
The process will be handled in the Trust Center. Customers/prospects who have access to the [Trust Center](https://trust.gitlab.com) can directly upload questionnaires by clicking the _Submit a Questionnaire_ link at the top of the Trust Center (they must have gone through the Get Access process described above in order to see the _Submit a Questionnaire_ button).
Field Security has certain thresholds when determining when, and to what extent, we will complete custom security review questionnaires from customers. Field Security will consider completing questionnaires as detailed[here](https://internal.gitlab.com/handbook/security/security-assurance/field_security/questionnaire_thresholds) in the Internal Handbook.
As described above, Field Security has certain thresholds for completing customer questionnaires. See[here](https://internal.gitlab.com/handbook/security/security-assurance/field_security/questionnaire_thresholds) in the Internal Handbook.
### For Customer Calls and General Requests
### For Customer Calls
Please use the `Customer Call Request` or `General Request` buttons above and follow the instructions.
- Be sure to include all requested information to expedite the process.
- ARR or potential ARR is required
- Customer calls require a preview of the topics the customer would like to cover to ensure we bring in any required subject matter experts for the call.
- If you are unsure of which type it is, please include as much information as you can and our team will adjust as needed.
### For RFP completion
Please follow the directions above for submission, and for more information about our RFP process please view our [RFP page here](/handbook/security/security-assurance/field-security/field-security-rfp).
* Be sure to include all requested information to expedite the process.
* ARR or potential ARR is required
* Customer calls require a preview of the topics the customer would like to cover to ensure we bring in any required subject matter experts for the call.
* If you are unsure of which type it is, please include as much information as you can and our team will adjust as needed.
### For Contract Reviews
Please use the `Contract Review Box` above and follow the instructions.
## Collaborate with Field Security
The Field Security Team also maintains the following resources for **GitLab Team Members** to collaborate with us!
<ahref="https://gitlab.com/gitlab-com/gl-security/security-assurance/field-security-team/field-security/-/issues/new?issuable_template=ad_hoc_field_security_request"class="btn bg-primary text-white btn-lg">Ad Hoc Request</a>
### Knowledge Base
For information on how Field Security uses SafeBase and how it can support your workflows, please visit our [Knowledge Base](/handbook/security/security-assurance/field-security/knowledge_base/) page.
### Feedback from Field Security
The Field Security Team has the unique privilege of conversing with and receiving feedback from both customers and fellow GitLab team members. To ensure we always support our customers, Field Security follows GitLab's [observation creation procedure](/handbook/security/security-assurance/observation-management-procedure/) to relay customers' requirements or concerns internally to the appropriate teams. To proactively request feedback from Field Security, use the [Internal Feedback](/handbook/security/security-assurance/field-security/customer-security-assessment-process/#collaborate-with-field-security) button to open a request.
### For RFP completion
**Note:** Field Security's observations must follow the [Field Security Observation and OFI Quality Guide](/handbook/security/security-assurance/field-security/field_security_observation_and_ofi_quality_guide/)
Please follow the directions above for submission, and for more information about our RFP process please view our [RFP page here](/handbook/security/security-assurance/field-security/field-security-rfp).
---
## Public Documentation
- Search for [General Information about GitLab](https://about.gitlab.com) in our public handbook.
- Review [GitLab's Trust Center](https://trust.gitlab.com) and download publically available security assurance documents. To request our `NDA Required` documents, such as our SOC2 report, utilize the `Request Access` button in the Trust Center.
* Search for general information about GitLab in our [public Handbook](https://handbook.gitlab.com), including policies and standards.
* Review [GitLab's Product Documentation](https://docs.gitlab.com), including security settings to use.
* Review [GitLab's Trust Center](https://trust.gitlab.com) and download publicly available security assurance documents. To request our `NDA Required` documents, such as our SOC2 report, utilize the `Get Access` button in the Trust Center.
## Self-Attestations
In the spirit of iteration, GitLab is continuously evolving our list of compliance self-attestations. Completed self-attestations are reviewed annually for continued applicability and can be found in our [Trust Center.](https://trust.gitlab.com) Customers can submit suggestions and requests for new self-attestations through their Account Manager. GitLab team members can submit recommendations for future compliance assessments through the [Regulatory Security Compliance Feedback and Field Research epic](https://gitlab.com/groups/gitlab-com/gl-security/-/epics/56).
In the spirit of iteration, GitLab is continuously evolving our list of compliance self-attestations. Completed self-attestations are reviewed annually for continued applicability and can be found in our [Trust Center](https://trust.gitlab.com).
* Customers can submit suggestions and requests for new self-attestations through their Account Manager.
* GitLab team members can submit recommendations for future compliance assessments through the [Regulatory Security Compliance Feedback and Field Research epic](https://gitlab.com/groups/gitlab-com/gl-security/-/epics/56).
## Service Level Agreements
-**Security Questionnaires:** 10 Business Day. SA or CSM will utlize the Knowledge Base and/or other self-service resources prior to requesting Field Security assistance. SA or CSM will ensure everyone on the Field Security team has access to any files or portals.
-**Contract Reviews:** 5 Business Days. Field Security must be engaged in all relevant Contract Reviews.
-**Customer Calls:** SA or CSM will provide context to the Customer or Prospects questions or concerns prior to the meeting. Field Security will provide a PowerPoint presentation with critical information about GitLab Security and specifics to the Customer or Prospect's request. Field Security must be invited to all relevant Customer Meetings.
-**Security Documents:** Managed through the Trust Center. Create a General Request for unique enquiries that can't be satisfied through the Trust Center.
***Security Questionnaires:** 10 Business Day. SA or CSM will utlize the Knowledge Base and/or other self-service resources prior to requesting Field Security assistance. SA or CSM will ensure everyone on the Field Security team has access to any files or portals.
***Contract Reviews:** 5 Business Days. Field Security must be engaged in all relevant Contract Reviews.
***Customer Calls:** SA or CSM will provide context to the Customer or Prospects questions or concerns prior to the meeting. Field Security will provide a PowerPoint presentation with critical information about GitLab Security and specifics to the Customer or Prospect's request. Field Security must be invited to all relevant Customer Meetings.
***Security Documents:** Managed through the Trust Center. Tag @field-security in #security_help on Slack with questions.
