.webp)
Atlassian Moved Impact Level 5 Up Six Months. The Word Doing the Work Is "Submission."
Atlassian's September 23 public sector announcement contains three dates, and only one of them is a deadline. Impact Level 5 gets a submission in July 2028. FedRAMP High gets a submission in January 2029. Data Center reaches end of life on March 28, 2029. The first two are things Atlassian will do. The third is a thing that will happen to you.
That distinction is the whole article, so I will say it plainly up front: a submission starts a government review, and Atlassian does not control how long that review takes. Atlassian says so itself, in writing, on its Data Center end-of-life page. Public sector customers who need Impact Level 5 or FedRAMP High should read the September announcement as good news about engineering commitment, and then plan the next three years around the sentence Atlassian published months earlier.
What Atlassian actually announced on September 23
The announcement came from Vikram Rao, Atlassian's Chief Technology Officer for Enterprise and Chief Trust Officer, alongside a press release the same day. The commitments, in Atlassian's own terms:
- Atlassian will submit for Department of Defense Impact Level 5 (IL5) authorization in July 2028, six months earlier than its previous plan.
- A FedRAMP High submission follows in January 2029.
- At launch, those environments will include Jira, Confluence, Jira Service Management, Rovo, and Guard.
- Atlassian has stood up a dedicated public sector organization with its own leadership, resources, and accountability. The press release names Jen Beatley as Global Head of Public Sector, working alongside Rao and Ken Exner, Atlassian's Chief Product Officer for Enterprise and Emerging.
- For workloads at Impact Level 6 and above, Atlassian is committed to a fully disconnected, air-gapped deployment of its core platform. It describes that work as being in technical design with strategic United States government partners. No date was given.
- In Europe, Atlassian is working with the European cloud provider community to develop potential sovereign cloud offerings and is recruiting early design partners. Also no date.
Read the release-state words carefully. “Submission” is a verb with a calendar attached. “Committed,” “technical design,” and “potential offerings” are not. All three are honest phrasings, and all three mean different things for a migration plan.
Submission is where the government's clock starts
The Federal Risk and Authorization Management Program (FedRAMP) changed shape this year, and the changes matter for reading Atlassian's dates. Under FedRAMP's Consolidated Rules for 2026, published in June, the Low, Moderate, and High labels are being retired in favor of lettered classes: Class B replaces Low, Class C replaces Moderate, and Class D replaces High. Atlassian's own FedRAMP compliance page already uses the new vocabulary and describes the existing Atlassian Government Cloud approval as Class C, the former Moderate. Assessment by an independent third-party assessment organization is still required, and the technical review now sits with federal experts inside the FedRAMP Program Management Office. FedRAMP also opened a request for comment on September 9 covering development tracks for the automated FedRAMP 20x path at Class D, which tells you the faster track for High-equivalent services is still being built.
Impact Level 5 is a separate approval on top of that. The Defense Information Systems Agency's Cloud Service Provider Security Requirements Guide describes Impact Levels 5 and 6 as the FedRAMP High baseline supplemented with Department of Defense “FedRAMP+” controls, and the Department issues its own provisional authorization. Atlassian's plan is to submit the Impact Level 5 package first, in July 2028, and the FedRAMP High package six months later. That ordering is worth a direct question to your account team: the two efforts share a control foundation, and you want to understand how one depends on the other.
None of this is a criticism of Atlassian. Building environments to those baselines is a multi-year engineering program, and pulling the first submission forward by six months is a real commitment of money and people. It simply means the date a public sector customer can plan around is whenever a sponsoring agency and the Department of Defense finish their reviews, and nobody has published that date because nobody can.
The sentence Atlassian already published
Here is the part I would want every government platform owner to read twice. Atlassian's Data Center end-of-life page says it will have FedRAMP High and Impact Level 5 environments built and ready for submission before Data Center reaches end of life, that it cannot control the timeline of government authorization, and that it commits to supporting customers who must comply with those regulations within their current Atlassian environment until an authorized cloud solution exists. The same page says multi-year Data Center extensions beyond March 28, 2029 are available to some customers by exception only.
Put the September dates next to that sentence and the plan writes itself. A January 2029 FedRAMP High submission lands somewhere between two and three months before Data Center goes read-only. For anyone whose workloads require High or Impact Level 5, the by-exception extension is not a contingency. It is the plan of record. In our earlier read on why March 2029 arrives sooner than it looks, the argument was that March 30, 2028 is the deadline that actually bites, because it is the last day existing customers can buy new Data Center subscriptions, expansions, or Marketplace apps. For an organization planning to run Data Center into 2029 and beyond, that date matters even more: as far as Atlassian has published, whatever you are licensed for on March 30, 2028 is what you will be running until an authorized environment exists. Atlassian has not published what an extension includes, so assume nothing beyond what is written and get your specifics in writing.
What is available to public sector customers today
The announcement is about 2028 and 2029. The 2026 options are already documented, and they cover more ground than the headline suggests.
Atlassian Government Cloud is Atlassian's FedRAMP Moderate environment, now Class C in the new vocabulary, covering Jira, Confluence, and Jira Service Management. It is a government community cloud, so purchase is restricted to United States government agencies and organizations doing government work. According to Atlassian, it is priced about 25 percent above the Cloud Enterprise plan, user tiers start at 201 users for Jira and Confluence and 26 agents for Jira Service Management, and migration tooling exists from both Data Center and commercial Atlassian Cloud. Purchasing runs through Carahsoft, Atlassian's government aggregator. Two caveats from Atlassian's own pages: commercial Atlassian Cloud is not FedRAMP Moderate compliant, so a move into Government Cloud is a real migration rather than a plan upgrade, and as of Atlassian's June 29 announcement with Amazon Web Services, AI capabilities were listed as coming soon to Government Cloud rather than available. Check the current roadmap before promising Rovo to anyone.
Atlassian Isolated Cloud is a dedicated environment with its own compute, storage, and networking. Atlassian lists it as currently supporting Jira, Confluence, Jira Service Management, Guard Standard, and the platform apps, with Guard Premium and customer-managed keys as paid add-ons, and it prices the offering at a premium. It answers a tenancy requirement, not a FedRAMP requirement; Atlassian's own Isolated Cloud page points government buyers to Government Cloud for FedRAMP. If your blocker is “no shared infrastructure,” Isolated Cloud is the conversation. If your blocker is “no FedRAMP Moderate,” it is not.
The useful move for most government organizations is workload triage rather than a single decision. Agencies categorize their own systems, and Atlassian's FedRAMP page notes that FedRAMP does not decide a system's security category on an agency's behalf. Most Atlassian estates in government carry a mix: program tracking, knowledge bases, and internal service desks that sit comfortably at Moderate, alongside a smaller set of systems that require High or Impact Level 5. The first group has a landing zone today. The second group has a written commitment and a calendar. Treating them as one migration means the second group's timeline governs the first group's outcome, which is the slowest possible plan.
Who should care, and who probably should not
If you are a federal civilian agency with Moderate-categorized systems, the September announcement changes nothing about your options. Government Cloud already exists, and the real work is the migration assessment, the unglamorous part where Atlassian's cloud transition tooling has been steadily improving. If you are in the Department of Defense orbit or operate unclassified national security systems, this is your announcement, and the extension conversation should start this quarter. If you are a state or local government that treats FedRAMP Moderate as its bar, Government Cloud is the relevant product, and Impact Level 5 is a federal defense story. Contractors whose eligibility comes from doing government work should confirm that eligibility with Atlassian rather than assume it.
Commercial buying rules deserve a mention too. Government Cloud runs through Carahsoft, so the purchasing conversation differs from the enterprise motion Atlassian has been reworking elsewhere, including the Flex commercial model it introduced for large enterprises. Ask early how Government Cloud, an eventual High or Impact Level 5 environment, and an extended Data Center term would be quoted together, because a three-year plan spread across three contract vehicles is where budgets go to get surprised.
What to do next
- Classify workloads by required baseline, in writing. Moderate, High, or Impact Level 5, using your own categorization decisions and your authorizing official's view rather than the vendor's. This list is the foundation for everything below.
- Open the extension conversation now. Atlassian offers post-2029 Data Center terms by exception, and the government commitment on its end-of-life page is your opening line. Ask what an extension includes: support scope, security fixes, connectors to cloud, and whether expansions remain possible after March 30, 2028.
- Size Data Center for the whole extension period before March 30, 2028. That is the last published date for existing customers to buy expansions and Marketplace apps. Headcount growth in 2029 is a 2028 procurement problem.
- Move the Moderate-eligible estate to Government Cloud on its own timeline. Run the assessment first, inventory Marketplace apps, and assume the app catalog inside a government boundary is narrower than the commercial one until each vendor confirms otherwise.
- Prepare for AI inside a compliance boundary. Rovo and Guard are in Atlassian's launch scope for the new environments. Agents inherit whatever permission model you bring with you, which is why a permissions audit before the agents arrive costs less than one after.
- Ask the two questions that decide the architecture. Will Impact Level 5 and FedRAMP High be one environment or two, and will data move from Government Cloud into either of them? The answers determine whether a Moderate migration today is a step forward or a detour.
The Avaratak Take
I like this announcement more than most vendor roadmap posts, and the reason is the word “submission.” Atlassian could have written “authorized by 2029” and let the reader supply the optimism. It did not. It gave dates for the part it controls, said out loud that it does not control the rest, and put the customer commitment in a licensing FAQ where procurement people will actually find it. That is how a vendor earns the benefit of the doubt on the parts that have no date yet, like the air-gapped deployment.
The trap is on the customer side. A six-month pull-forward is easy to hear as “we can wait.” The calendar says the opposite. If your organization needs High or Impact Level 5, you have a Data Center extension to negotiate, a 2028 sizing decision to make, and a Moderate-eligible estate that could be in cloud a year or more before the High environment is even submitted. The organizations that come out of 2029 cleanly will be the ones that split the estate, moved what could move, and treated the extension as a contract rather than a hope. The rest will spend early 2029 discovering that “by exception” comes with paperwork.
Avaratak's senior consultants are all United States-based, and we are happy to be a second set of eyes on the workload triage or the extension conversation. Book a discovery conversation whenever it is useful.