Skip to content
Documentation

Atlassian

What this guide covers

How to actually buy Atlassian (Jira, Confluence, Jira Service Management) for a Maryland agency — which statewide vehicle you ride, which reseller fulfills the order, the FedRAMP/ATO path through Atlassian Government Cloud, and the functionality gates to clear before you sign.

Who it’s for

Engineering leads, program staff, and procurement officers at a Maryland State agency or education entity who have decided they need Atlassian for issue tracking, agile delivery, documentation, or service management (or are comparing it against self-hosted alternatives) and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, contract catalogs, and BPO numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the Carahsoft Atlassian contracts page, and the DoIT Statewide Contracts hub before relying on it. Atlassian Government Cloud’s boundary scope — particularly whether Jira Align is included — should be confirmed directly with Atlassian (see below).

TL;DR

  • Category: DevOps & collaboration — Jira, Confluence, Jira Service Management; Jira Align for enterprise agile planning.
  • Maryland vehicle: COTS 2012, BPO 060B2490021, via Carahsoft (Atlassian is on the Carahsoft MD COTS publisher list).
  • Reseller: Carahsoft is the primary public-sector aggregator.
  • Authorization: Atlassian Government Cloud is FedRAMP Moderate (authorized 2025-03-14), covering Jira, Confluence, and Jira Service Management. It also holds GovRAMP Moderate.
  • The ATO trap: FedRAMP/GovRAMP Moderate covers Atlassian Government Cloud only — standard Atlassian Cloud and Data Center are outside the boundary. Jira Align’s inclusion is unverified — confirm with Atlassian before relying on it for CUI.

What This Tool Is

Atlassian is a suite of SaaS collaboration and delivery tools — Jira (issue and project tracking), Confluence (wiki and documentation), Jira Service Management (ITSM / service desk), and Jira Align (enterprise agile planning). In this stack it is the managed choice for issue tracking, team wiki, and service management; self-hostable alternatives exist, but Atlassian Government Cloud is the managed, FedRAMP-authorized path and is the reason agencies pick Atlassian over rolling their own. Reaching for the suite turns a self-hosted option into a procurement-and-ATO exercise. This page is that exercise.

Which Maryland Vehicle

Atlassian appears on the Carahsoft MD COTS publisher catalog, so the primary path is the statewide COTS software vehicle fulfilled by Carahsoft.

VehicleBPOHow Atlassian rides it
COTS 2012060B2490021The primary path. Atlassian appears on Carahsoft’s Maryland COTS publisher catalog; you issue an order against the COTS master contract and Carahsoft fulfills it.
NASPO ValuePoint Cloud SolutionsMaryland participating addendum (Carahsoft)A cloud/SaaS alternative the State extended into Maryland. Compare ceiling pricing against COTS before choosing.

The same publisher can be reachable through more than one Carahsoft vehicle, and which one you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits.

Resellers and Pricing Path

Carahsoft is Atlassian’s primary public-sector aggregator and the reseller holding the Maryland awards. You do not buy a “Carahsoft contract” — Carahsoft fulfills your order against the COTS master contract (or the NASPO addendum). Request a quote referencing the Maryland COTS BPO 060B2490021 so the order is priced against the statewide ceiling rather than commercial list price. Atlassian is seat-licensed per product and tier (Jira, Confluence, JSM, and Jira Align are priced separately, and Atlassian Government Cloud carries its own pricing distinct from commercial Cloud), so size your seat counts per product before you ask.

Authorization and ATO

AttributeValue
Authorized offeringAtlassian Government Cloud (Jira, Confluence, Jira Service Management)
FedRAMP statusAuthorized — Moderate, authorized 2025-03-14
Marketplace IDFR2412062433
GovRAMP (StateRAMP)GovRAMP Moderate held — confirm current status on the GovRAMP product list
Jira Align in boundary?Unverified — confirm with Atlassian before relying on it for CUI
FedRAMP High / DoD IL5Roadmap, not current — do not represent as authorized
Out of boundaryStandard Atlassian Cloud and Data Center are not in the authorized boundary

The single thing to get right for the ATO: purchase and provision Atlassian Government Cloud, not standard Atlassian Cloud or Data Center. The FedRAMP Moderate (and GovRAMP Moderate) authorization attaches only to the Government Cloud boundary and covers Jira, Confluence, and Jira Service Management. Jira Align’s inclusion in that boundary is unverified — confirm it with Atlassian before relying on it for CUI. FedRAMP High and DoD IL5 are roadmap items, not current authorizations; do not represent them as authorized in your security package. An order that lands you on commercial Cloud or Data Center gives you no FedRAMP boundary to inherit. Re-verify the current baseline and boundary scope on the Marketplace listing before you commit.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateAtlassian-specific note
SSO (SAML/OIDC) + SCIMSupported via Atlassian Guard (formerly Access); confirm SCIM de-provisioning is included for the Government Cloud tier.
Audit logsAvailable; confirm retention and export meet your records policy.
RBACProject/space roles and global permissions supported; map them to least-privilege before rollout.
Data residency / FedRAMP boundaryAtlassian Government Cloud is the boundary answer for Jira/Confluence/JSM — confirm Jira Align is in scope (see above).
Accessibility (VPAT/ACR)Request Atlassian’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPARequired if any tracked content could carry PII/PHI; confirm availability for Atlassian Government Cloud.

Procurement Steps

  1. Confirm the need over the OSS alternative. Self-hostable issue-tracking, wiki, and service-desk tools exist ($0 license), but Atlassian Government Cloud is the managed, FedRAMP-authorized path. Document why managed Atlassian is worth the spend — that rationale is the core of the budget justification.
  2. Confirm the boundary scope. Government Cloud covers Jira, Confluence, and JSM at Moderate; verify Jira Align is in the boundary with Atlassian if your program depends on it for CUI.
  3. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  4. Pick the vehicle. Default to COTS 060B2490021; compare the NASPO Cloud addendum if cloud terms suit you better.
  5. Get a Carahsoft quote referencing the BPO, sized to your per-product seat counts, for the Atlassian Government Cloud offering.
  6. Check the threshold. The order’s dollar value drives the method — purchasing card, small procurement, or BPW review. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  7. Run the ATO package. Inherit the FedRAMP/GovRAMP Moderate controls for the Government Cloud boundary; document the rest. Confirm boundary scope first.
  8. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
Atlassian Government Cloud FedRAMP Moderate listing (authorized 2025-03-14)FedRAMP Marketplace — FR2412062433
Atlassian Government Cloud offering and coverageAtlassian — Atlassian Government Cloud announcement
GovRAMP Moderate authorizationAtlassian — GovRAMP
Public-sector reseller pathCarahsoft — Atlassian contracts
Atlassian on the Maryland COTS catalogCarahsoft — Maryland State Contracts

Atlassian Government Cloud’s FedRAMP Moderate covers Jira, Confluence, and JSM only. Jira Align’s inclusion, and any FedRAMP High / DoD IL5 status, must be re-verified with Atlassian and the Marketplace before relying on any figure here.