I want to have Altassian host a Confluence server for me. However, I can't tell if it is secure enough for:
- ITAR sensitive information
- EAR sensitive information
- Intellectual Property / Trade Secret
I've heard all the usual arguments that IT security is better to outsource and it is more secure than on-premises. I've heard all the arguments that if it is good enough for (fill in the blank) company it must be good enough for you.
When it comes down to ITAR / EAR, you are personally liable. That means, you go to jail, not the company.
When you post a customer's Confidential Information, your NDA / CDA specifies that you are responsible and can be sued.
Atlassian did not respond to the question above. So, I'm left to my own devices to figure out if it is secure enough.
What is the best way to resolve this issue?
Is there a government / private organization that sets a standard for security that warrants whether certain cloud services are sufficient for ITAR / EAR / IP? Can I rely upon this in a court of (U.S.) law?