Jira, CUI, and FedRAMP: Which Environment Actually Holds the Certification

By Michael Branson

When the tracker was chosen before the data class was known

If your program’s engineers picked Jira years ago, before any of the program’s work touched controlled unclassified information, the question now on your desk is narrow and uncomfortable: is the tool you already run authorized for the work you have just been handed? That question tends to arrive with a new contract, a new data classification, or an auditor’s question. What makes it hard to answer is one vendor sentence that is true of one Atlassian environment and easy to read as true of yours.

The sections below set out which Atlassian environment holds which certification class, in FedRAMP’s and Atlassian’s own current words, what separates your tenant from that environment, and how to take the question, with the contract clause that raised it, to the person who decides it. Every source cited here was read on September 20, 2026. If what you need is a feature comparison between two trackers, Agile Project Management with Jira and Azure DevOps covers it; this guide stays on authorization.

What Atlassian’s own pages say, and about which environment

If you have been handed Atlassian’s trust-page sentence as the answer, read it next to the page it leaves out.

Atlassian’s FedRAMP trust page says “Jira, Confluence, and Jira Service Management have achieved FedRAMP Certification (formerly known as FedRAMP Moderate Authorization, now Certification Class C)”, and the environment that sentence describes, Atlassian Government Cloud, is not named on that trust page at all. Read on its own, the sentence names products and leaves the environment out, which is where the misreading starts.

On its government cloud page, Atlassian supplies the missing half. That page states that “Atlassian Government Cloud is built in a separate environment from our commercial cloud apps.” Asked whether a customer on commercial Atlassian Cloud apps gets FedRAMP Moderate compliance, the same page answers: “No, commercial Atlassian Cloud apps are not FedRAMP Moderate compliant.” The page adds that a customer on a commercial plan such as Standard, Premium, or Enterprise “will have to migrate your data to Atlassian Government Cloud to get FedRAMP Moderate compliance.”

FedRAMP’s own record agrees with the vendor. The Atlassian service offering listed on the FedRAMP marketplace is named “Atlassian Government Cloud”, with status FedRAMP Certified, certification class Class C, and impact level Moderate. Eligibility is restricted as well: Atlassian states that “the purchase and adoption of this offering is restricted to US government agencies, or organizations that work with the US government and will use the environment for government-related work.”

Put together, Atlassian Government Cloud and a commercial Atlassian Cloud tenant are separate environments, and on both the vendor’s record and FedRAMP’s, the certification sits with the government environment.

What “Certification Class C” replaced

If your security officer’s documents still say “FedRAMP Moderate”, the vocabulary has moved underneath them. FedRAMP’s changelog entry for May 4, 2026 records that FedRAMP “Changed all designations from ‘FedRAMP Authorization’ to ‘FedRAMP Certification’, and all designations of impact levels to certification classes A, B, C, and D.” FedRAMP’s Notice 0004 sets out what each class holds: “Class A will be a new pilot baseline, Class B will include the current Li-Saas and Low baselines, Class C will include the current Moderate baseline, and Class D will include the current High baseline.”

So Class C carries the Moderate baseline under FedRAMP’s new name, and Class D carries High. A contract document that asks for FedRAMP High is asking for the baseline FedRAMP now files under Class D.

What Atlassian has shipped beyond Class C, and what it has not

If someone on your team has pointed at Atlassian Isolated Cloud, or at Atlassian’s FedRAMP High plans, as the answer, those are two different offerings answering different questions.

Atlassian Isolated Cloud is shipped and purchasable. The Atlassian Isolated Cloud page says the product “currently supports core apps, including Jira, Confluence, Jira Service Management and Guard Standard,” and names its audience as “large enterprise organizations who have strict data isolation requirements that prevent the adoption of Atlassian’s shared commercial cloud.” Isolated Cloud is a data isolation offering. Its page makes no FedRAMP certification claim for the product, and the FedRAMP marketplace record carries no listing under that name, so it is not evidence of a federal certification class.

FedRAMP High and Impact Level 5 are a stated commitment. Asked whether it plans to offer FedRAMP High or IL5, Atlassian’s government cloud page answers that Atlassian “will have FedRAMP High and Impact Level 5 environments built and ready to be submitted for authorization prior to the end of life for Data Center.” The FedRAMP marketplace record read on September 20, 2026 shows no listing with Atlassian as the provider at Class D or High. A plan to submit is not a listing your security officer can cite. The same record does carry third-party providers describing Atlassian products hosted inside their own FedRAMP environments; those certifications belong to the hosting provider, not to Atlassian, and this guide does not assess them.

Three paths, each judged against your own requirement

Once the environment picture is clear, the choice narrows to three paths. The three are not ranked here, because the requirement your contracting officer confirms is what chooses among them.

1. Stay on the commercial tenant. This path holds up where your contracting officer confirms that the tracking data is outside the CUI scope, or that your obligation names no FedRAMP certification class for the tool that holds it. Atlassian’s own answer places its commercial cloud apps outside FedRAMP Moderate, so this path depends on that confirmation.
2. Migrate into Atlassian Government Cloud. This is the Atlassian path to price when the confirmed requirement names Class C, or Moderate, and nothing higher, and your organization meets Atlassian’s eligibility terms. Atlassian says “migration tooling for Data Center to Atlassian Government Cloud and Atlassian (commercial) Cloud to Atlassian Government Cloud migrations is available.”
3. Move the CUI- or ITAR-scoped slice of the work into a Microsoft Azure Government environment. This is the path to evaluate when the confirmed requirement names FedRAMP High today. The FedRAMP marketplace lists “Azure Government (includes Dynamics 365)” as FedRAMP Certified at Class D, impact level High. Whether FedRAMP High is required at all for a contractor’s application is worked through on Is FedRAMP High Required to Build Government Contractor Applications?, and how to vet a firm for that work is on Hire a Firm for FedRAMP High and DoD IL4 Compliance in Azure: How to Vet One.

One limit stands on its own. Azure DevOps has no listing of its own in the FedRAMP marketplace record, so its certification class cannot be read from that record, and this guide states none for it.

What this means for a CUI or ITAR-scoped decision

If your program’s Jira, Confluence, or Jira Service Management runs on a commercial Atlassian Cloud plan, FedRAMP’s marketplace record shows no certification for it at any class, and Atlassian Government Cloud, a separate environment reached by migration, is the Atlassian environment that holds Certification Class C.

Which class, if any, your CUI or ITAR obligation requires is set by your contract and its clauses, and a vendor listing does not decide it. Atlassian’s own trust page notes that “FedRAMP does not make that determination on behalf of an agency.” Confirm the requirement with your contracting officer or facility security officer before treating either environment as sufficient, or insufficient, for your program.

When the inputs disagree, for example an engineering team that wants to stay put and a contract clause that names a class the commercial tenant does not hold, the confirmed contract requirement settles it. Team preference and migration effort shape how you meet the requirement, not whether it applies.

Three records make that conversation short: the contract clause or data classification memo that raised the question, the Atlassian plan your tenant is subscribed to, which your Atlassian site administrator can confirm, and the FedRAMP marketplace listing for any environment you are weighing. For the Microsoft 365 side of a CUI estate, GCC vs GCC High vs Commercial Microsoft 365 for CUI: An Evaluation Matrix covers the tenant choice, and Redesigning an ITAR Export-Control Compliance Program to Be Efficient, Not Just Compliant covers the ITAR program design.

Honest counter-case: when staying on the commercial tenant is the right call

If your program’s tracking data turns out to sit outside the CUI scope, moving a working program off its tracker has a real cost and buys nothing. Where the contracting officer’s answer is that the data in question is not CUI, or that your obligation names no certification class for the tracker, staying on the commercial tenant is a position you can defend, and a migration would spend budget and goodwill on a requirement you do not have.

The same reasoning applies when only part of the work is in scope. Keeping general engineering work where it is and moving only the scoped slice is an option for your security officer to weigh. The error to avoid runs the other way: assuming a commercial tenant inherits the certification Atlassian Government Cloud holds. Atlassian’s government cloud page takes up that question directly, and its reply is no.

Where i3solutions fits

If your confirmed requirement points toward the Microsoft side of the three paths, here is what i3solutions does there. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. The wider governance practice is described on Embedding Governance into How the Enterprise Operates and Scales.

Where a contract, a classification memo, or an audit question has put your tracker’s authorization on the table, and you want the confirmed requirement, the three paths and the Microsoft side set side by side before anyone commits budget, Schedule an Assessment.

Key Takeaways

• Atlassian Government Cloud holds FedRAMP Certification Class C for Jira, Confluence, and Jira Service Management; Class C is the baseline formerly called Moderate.
• A commercial Atlassian Cloud tenant does not carry that certification. Atlassian’s route from a commercial plan is a data migration, and eligibility is restricted to US government agencies and organizations doing government-related work.
• FedRAMP now files the old High baseline under Class D. As of the September 20, 2026 read, FedRAMP lists Atlassian as a provider at Class C only, and Atlassian presents FedRAMP High and Impact Level 5 as a commitment.
• Atlassian Isolated Cloud is a shipped data isolation offering, and nothing on its page claims a FedRAMP certification for it.
• Your contract decides which class your CUI or ITAR obligation requires, confirmed with your contracting officer. That confirmed requirement then picks among staying put, migrating to Atlassian Government Cloud, and moving the CUI- or ITAR-scoped work to Microsoft Azure Government.

Frequently Asked Questions

Is Jira FedRAMP authorized?

If your team runs Jira on a commercial Atlassian Cloud plan, it is not, by Atlassian’s own answer on its government cloud page. FedRAMP Certification Class C, the designation that replaced FedRAMP Moderate, is held by Atlassian Government Cloud, which Atlassian runs apart from its commercial cloud, and it covers Jira, Confluence, and Jira Service Management there. A customer on a commercial plan reaches that environment by migrating its data.

Can Jira hold CUI?

If a contract has just put CUI into your program’s tracking data, a vendor listing cannot settle the question, because which certification class, if any, your CUI obligation requires is a contract- and clause-specific determination for your contracting officer. What the listings do settle is the environment picture. Atlassian Government Cloud is the Atlassian environment certified at Class C, covering Jira, Confluence, and Jira Service Management, and Atlassian answers that its commercial cloud apps do not have FedRAMP Moderate compliance. Confirm the requirement first, then match it to an environment.

What is FedRAMP Certification Class C?

If your documents still say FedRAMP Moderate, Class C is where that baseline now sits. FedRAMP changed its designations from authorization to certification on May 4, 2026, and its Notice 0004 places the current Moderate baseline in Class C and the current High baseline in Class D.

Does Atlassian offer FedRAMP High for Jira?

If your requirement names FedRAMP High, Atlassian does not hold it today. As read on September 20, 2026, FedRAMP’s marketplace lists Atlassian Government Cloud at Class C, Moderate, and no offering with Atlassian as the provider at High, and Atlassian’s government cloud page describes environments for FedRAMP High and Impact Level 5 as ones it will have built and ready to submit for authorization before Data Center reaches end of life. A program that needs High now cannot cite that commitment as a certification.

Should we move off Jira for a CUI program?

If a CUI requirement has just landed on a program that runs on Jira, moving off Jira is one of three paths, and the confirmed requirement picks the path. Staying on the commercial tenant is defensible where the contracting officer has confirmed that the tracker needs no certification class. Migrating into Atlassian Government Cloud, certified at Class C, is the Atlassian path where the requirement stops at Class C. Moving the scoped slice of work to a Microsoft Azure Government environment, which FedRAMP lists at Class D, High, is the path where the requirement names High today.