WIXLIB

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DSection 1: Assessment InformationInstructions for SubmissionThis document must be completed as a declaration of the results of the me chan self-assessment with thePayment Card Industry Data Security Standard Requirements and Security Assessment Procedures (PCIDSS). Complete all sections: The merchant is responsible for ensuring that each section is completed by therelevant parties, as applicable. Contact acquirer (merchant bank) or the payment brands to determine reportingand submission procedures.Part 1. Merchant and Qualified Security Assessor InformationPart 1a. Merchant Organization InformationCompany Name:Atlassian Corporation PLCDBA (doingbusiness as):Atlassian TrelloContact Name:Guy HerbertTitle:Head of IT Risk andComplianceE-mail:gherbert@atlassian.comCity:San FranciscoTelephone:Business Address:350 Bush oftware/trelloCountry:USAZip:94104Part 1b. Qualified Security Assessor Company Information (if applicable)Company Name:Optus Cyber Security Pty LimitedLead QSA Contact Name:Craig SearleTitle:Director, Cyber SecurityConsultingTelephone: 61 s Address:Level 1, 195 Little Collins .trustwave.comCountry:Zip:3000Part 2. Executive SummaryPart 2a. Type of Merchant Business (check all that apply)RetailerTelecommunicationGrocery and SupermarketsPetroleumE-CommerceMail order/telephone order (MOTO)Others (please specify):What types of payment channels does your businessserve?Which payment channels are covered by this SAQ?Mail order/telephone order (MOTO)Mail order/telephone order (MOTO)E-CommerceE-CommerceCard-present (face-to-face)Card-present (face-to-face)Note: If your organization has a payment channel or process that is not covered by this SAQ, consult youracquirer or payment brand about validation for the other channels.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 1: Assessment Information 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 1

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DPart 2. Executive Summary (continued)Part 2b. Description of Payment Card BusinessHow and in what capacity does your businessstore, process and/or transmit cardholder data?The Atlassian Trello accepts credit card payments via athird party provider - Braintree. Payments are submittedvia an SAQ A-compliant iFrame. No credit card detailsare stored, processed or transmitted by Atlassian Trello.Part 2c. LocationsList types of facilities (for example, retail outlets, corporate offices, data centers, call centers, etc.) and asummary of locations included in the PCI DSS review.Number of facilitiesof this typeType of facilityLocation(s) of facility (city, country)Example: Retail outlets3Boston, MA, USATrello online payment portal1N/A - eCommerce onlyPart 2d. Payment ApplicationDoes the organization use one or more Payment Applications?YesNoProvide the following information regarding the Payment Applications your organization uses:Payment ApplicationNameVersionNumberApplicationVendorIs applicationPA-DSS Listed?YesNoYesNoYesNoYesNoYesNoPA-DSS Listing Expirydate (if applicable)Part 2e. Description of EnvironmentProvide a high-level description of the environment covered bythis assessment.For example:Connections into and out of the cardholder data environment(CDE).Critical system components within the CDE, such as POSdevices, databases, web servers, etc., and any othernecessary payment components, as applicable.Trello online customer store. All creditcard payments are processed by a thirdparty provider, Braintree, via a SAQ Acompliant iFrame embedded within theonline customer store. No credit carddata is stored, processed or transmittedby Trello. All payment pages delivered tothe customer b o e o igina e di ec lfrom Braintree.Does your business use network segmentation to affect the scope of your PCI DSSenvironment?PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 1: Assessment Information 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.YesNoJune 2018Page 2

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9D(Refer to Network Segmentation section of PCI DSS for guidance on networksegmentation.)Part 2. Executive Summary (continued)Part 2f. Third-Party Service ProvidersDoes your company use a Qualified Integrator & Reseller (QIR)?YesNoYesNoIf Yes:Name of QIR Company:QIR Individual Name:Description of services provided by QIR:Does your company share cardholder data with any third-party service providers (forexample, Qualified Integrator & Resellers (QIR), gateways, payment processors, paymentservice providers (PSP), web-hosting companies, airline booking agents, loyalty programagents, etc.)?If Yes:Name of service provider:Description of services provided:BraintreeCredit card processing via an iFrame embedded in the TrelloeCommerce site.Note: Requirement 12.8 applies to all entities in this list.Part 2g. Eligibility to Complete SAQ AMerchant certifies eligibility to complete this shortened version of the Self-Assessment Questionnairebecause, for this payment channel:Merchant accepts only card-not-present (e-commerce or mail/telephone-order) transactions);All processing of cardholder data is entirely outsourced to PCI DSS validated third-party serviceproviders;Merchant does not electronically store, process, or transmit any cardholder data on merchant systemsor premises, but relies entirely on a third party(s) to handle all these functions;Merchant has confirmed that all third party(s) handling storage, processing, and/or transmission ofcardholder data are PCI DSS compliant; andAny cardholder data the merchant retains is on paper (for example, printed reports or receipts), andthese documents are not received electronically.Additionally, for e-commerce channels:PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 1: Assessment Information 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 3

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DAll elements of the payment page(s) deli e ed o he confrom a PCI DSS validated third-party service provider(s).mePCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 1: Assessment Information 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.boe o igina e only and directlyJune 2018Page 4

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DSection 2: Self-Assessment Questionnaire ANote: The following questions are numbered according to PCI DSS requirements and testing procedures, as defined in the PCI DSSRequirements and Security Assessment Procedures document.Self-assessment completion date: 25/09/2020Build and Maintain a Secure Network and SystemsRequirement 2: Do not use vendor-supplied defaults for system passwords and other security parametersResponsePCI DSS QuestionExpected Testing(Check one response for each question)Yes2.1(a) Are vendor-supplied defaults always changedbefore installing a system on the network?Review policies and procedures.This applies to ALL default passwords, including butnot limited to those used by operating systems,software that provides security services, applicationand system accounts, point-of-sale (POS) terminals,payment applications, Simple Network ManagementProtocol (SNMP) community strings, etc.).Observe system configurations andaccount settings.(b) Are unnecessary default accounts removed ordisabled before installing a system on thenetwork?Review policies and procedures.Yes withCCWNoN/AExamine vendor documentation.Interview personnel.Review vendor documentation.Examine system configurations andaccount settings.Interview personnel.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 5

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DMaintain a Vulnerability Management ProgramRequirement 6: Develop and maintain secure systems and applicationsResponsePCI DSS QuestionExpected Testing(Check one response for each question)Yes6.2(a) Are all system components and software protectedfrom known vulnerabilities by installing applicablevendor-supplied security patches?Review policies and procedures.(b) Are critical security patches installed within onemonth of release?Review policies and procedures.Examine system components.Compare list of security patchesinstalled to recent vendor patch lists.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Yes withCCWNoN/AJune 2018Page 6

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DImplement Strong Access Control MeasuresRequirement 8: Identify and authenticate access to system componentsResponsePCI DSS QuestionExpected Testing(Check one response for each question)Yes8.1.18.1.3Are all users assigned a unique ID before allowingthem to access system components or cardholderdata?Review password procedures.Is access for any terminated users immediatelydeactivated or removed?Review password procedures.Yes withCCWNoN/AInterview personnel.Examine terminated users accounts.Review current access lists.Observe returned physicalauthentication devices.In addition to assigning a unique ID, is one or more ofthe following methods employed to authenticate allusers?8.2Review password procedures.Observe authentication processes.Something you know, such as a password orpassphraseSomething you have, such as a token device orsmart cardSomething you are, such as a biometric8.2.3(a) Are user password parameters configured torequire passwords/passphrases meet thefollowing?Examine system configuration settingsto verify password parameters.A minimum password length of at leastseven charactersContain both numeric and alphabeticcharactersAlternatively, the passwords/passphrases must havecomplexity and strength at least equivalent to theparameters specified above.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 7

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DResponsePCI DSS QuestionExpected Testing(Check one response for each question)YesAre group, shared, or generic accounts, passwords, orother authentication methods prohibited as follows:8.5Generic user IDs and accounts are disabled orremoved;Yes withCCWNoN/AReview policies and procedures.Examine user ID lists.Interview personnel.Shared user IDs for system administrationactivities and other critical functions do not exist;andShared and generic user IDs are not used toadminister any system components?Requirement 9: Restrict physical access to cardholder dataResponsePCI DSS QuestionExpected Testing(Check one response for each question)YesAre all media physically secured (including but notlimited to computers, removable electronic media,paper receipts, paper reports, and faxes)?9.5Yes withCCWNoN/AReview policies and procedures forphysically securing media.Interview personnel.For purposes of Requirement 9, media refers to allpaper and electronic media containing cardholderdata.(a) Is strict control maintained over the internal orexternal distribution of any kind of media?9.6Review policies and procedures fordistribution of media.(b) Do controls include the following:9.6.1Is media classified so the sensitivity of the data can bedetermined?Review policies and procedures formedia classification.Interview security personnel.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 8

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DResponsePCI DSS QuestionExpected Testing(Check one response for each question)YesIs media sent by secured courier or other deliverymethod that can be accurately tracked?Interview personnel.Is management approval obtained prior to moving themedia (especially when media is distributed toindividuals)?Interview personnel.9.7Is strict control maintained over the storage andaccessibility of media?Review policies and procedures.9.8(a) Is all media destroyed when it is no longer neededfor business or legal reasons?Review periodic media destructionpolicies and procedures.9.6.29.6.3Yes withCCWNoN/AExamine media distribution trackinglogs and documentation.Examine media distribution trackinglogs and documentation.(c) Is media destruction performed as follows:9.8.1(a) Are hardcopy materials cross-cut shredded,incinerated, or pulped so that cardholder datacannot be reconstructed?Review periodic media destructionpolicies and procedures.Interview personnel.Observe processes.(b) Are storage containers used for materials thatcontain information to be destroyed secured toprevent access to the contents?Examine security of storagecontainers.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 9

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DMaintain an Information Security PolicyRequirement 12:Maintain a policy that addresses information security for all personnelNote: For the purposes of Requirement 12, personnel refers to full-time part-time employees, temporary employees and personnel, andcontractors and consultants ho are resident on the entit s site or other ise ha e access to the compan s site cardholder data environment.ResponsePCI DSS QuestionExpected Testing(Check one response for each question)Yes12.812.8.1Yes withCCWNoN/AAre policies and procedures maintained andimplemented to manage service providers with whomcardholder data is shared, or that could affect thesecurity of cardholder data, as follows:Is a list of service providers maintained, including adescription of the service(s) provided?Review policies and procedures.Observe processes.Review list of service providers.12.8.2Is a written agreement maintained that includes anacknowledgement that the service providers areresponsible for the security of cardholder data theservice providers possess or otherwise store, process,or transmit on behalf of the customer, or to the extentha he co ld im ac he ec i of he c omecardholder data environment?Observe written agreements.Review policies and procedures.Note: The exact wording of an acknowledgement willdepend on the agreement between the two parties, thedetails of the service being provided, and theresponsibilities assigned to each party. Theacknowledgement does not have to include the exactwording provided in this requirement.12.8.3Is there an established process for engaging serviceproviders, including proper due diligence prior toengagement?Observe processes.Review policies and procedures andsupporting documentation.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 10

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DResponsePCI DSS QuestionExpected Testing(Check one response for each question)Yes12.8.412.8.512.10.1I a og am main ained o moni o e ice o idePCI DSS compliance status at least annually?Observe processes.Is information maintained about which PCI DSSrequirements are managed by each service provider,and which are managed by the entity?Observe processes.(a) Has an incident response plan been created to beimplemented in the event of system breach?Review the incident response plan.Yes withCCWNoN/AReview policies and procedures andsupporting documentation.Review policies and procedures andsupporting documentation.Review incident response planprocedures.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 11

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DAppendix A: Additional PCI DSS RequirementsAppendix A1:Additional PCI DSS Requirements for Shared Hosting ProvidersThis appendix is not used for merchant assessments.Appendix A2:Additional PCI DSS Requirements for Entities using SSL/early TLS forCard-Present POS POI Terminal ConnectionsThis appendix is not used for SAQ A merchant assessmentsAppendix A3:Designated Entities Supplemental Validation (DESV)This Appendix applies only to entities designated by a payment brand(s) or acquirer as requiringadditional validation of existing PCI DSS requirements. Entities required to validate to this Appendixshould use the DESV Supplemental Reporting Template and Supplemental Attestation of Compliance forreporting, and consult with the applicable payment brand and/or acquirer for submission procedures.PCI DSS v3.2.1 SAQ A, Rev. 1.0 – Section 2: Self-Assessment Questionnaire 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.June 2018Page 12

DocuSign Envelope ID: 5054DDD7-2C96-44A7-84D6-80A28DBC5B9DAppendix B: Compensating Controls WorksheetUse this orksheet to define compensating controls for an requirementchecked.here YES with CCWasNote: Only companies that have undertaken a risk analysis and have legitimate technological ordocumented business constraints can consider the use of compensating controls to achieve compliance.Refer to Appendices B, C, and D of PCI DSS

All processing of cardholder data is entirely outsourced to PCI DSS validated third-party service providers; Your company does not electronically store, process, or transmit any cardholder data on your . be PCI DSS compliant. Note: For this SAQ, . Payment Card Industry Data Security Standard Requirements and Security Assessment Procedures (PCI