Add Scratchpad to Tech Stack

Tech Stack - New system

We recently adopted Scratchpad for a batch of team members in Commercial Sales. See coupa request and justification for details.

This adds the tool to our tech stack as outlined in new subscription requests.

Requestor to complete

Please don't merge this update before the Business Systems Analysts have reviewed and approved. Please make sure to complete the privacy review issue as soon as possible as we won't be able to merge until that is completed.

Please answer the questions below:

1. Is this system replacing an existing system in our tech stack?

   • Yes: Please make sure this MR also removes the system from the tech stack and proceed to create a tech stack offboarding issue.
   • No

2. Please link in the comments, or to this MR, a completed and approved Vendor Contract Issue - Coupa Req 1967

3. Has a Privacy Review been completed?:

   • Yes; Link completed DPIA Issue in the MR comments
   • No; Complete Privacy Review issue

4. We deprovision access to all systems in our tech stack when a person leaves GitLab. Can you please indicate whether:

   • All GitLab team members need to be offboarded from this system
     • If this is the case, please create an MR to update the offboarding template and add the system under the correct department and person. Find instructions in the Tech Stack handbook page. Add the MR to the comments.
   • Only certain team members need to be offboarded from this system (if the team members are scattered across too many departments or the system you are responsible for contains red data, please go with option 1)
     • If this is the case, please create an MR to update the offboarding tasks templates per department and add the system under the correct department(s). Find instructions in the Tech Stack handbook page. Add the MR to the comments.

5. Please create an issue to add the provisioners of the tool to the provisioners group. Link the issue to the comments of this MR.

6. Does data from this system need to be integrated into the Enterprise Data Warehouse for reporting and analytics? Please answer with Yes or No. Add your answer here

   • No

Examples for why you would need data integrated into the EDW:

• the data will be used as part of a new Key Performance Indicator or Performance Indicator
• the data needs to be part of lead-to-cash analysis
• the data needs to be joined with Marketo, Salesforce, or NetSuite data for cross-system analysis

Personal Data Requests

If the Add to Personal Data Request template? box is marked as Yes on the Privacy Review issue, your tool will need to be added to our issue templates for Personal Data Requests.

1. Data access requests: Add system to the list of applications in the Personal Data Access Request issue template by opening an MR. Once completed, please paste the link in the comments of this MR.
2. Data Deletion: Add system to the list of applications in the Account Deletion Request issue template by opening an MR. Once completed, please paste the link in the comments of this MR.

Security Risk to complete

• Determine if a BIA has been completed for this system
  • No: Coordinate BIA completion with assigned technical system owner
    • Update data_classification and critical_systems_tier attributes based on BIA response data

Business Technology to complete

To dos before merging (@marc_disabatino)

• Ensure privacy review has been linked
• Ensure all questions above have been answered and all action items have been completed

/cc @lisvinueza @gitlab-com/internal-audit @disla @gitlab-com/gl-security/security-assurance/security-risk-team