GitLab Agile Planning for Secure and Air-Gapped Environments
Defense programs, government agencies and regulated enterprises often need their planning data to stay inside a boundary they control, such as a DoD Impact Level 5 (IL5) enclave, a classified network or a disconnected facility. GitLab Self-Managed is built for that. You install and operate it on your own infrastructure, and GitLab supports it in offline, air-gapped networks on every tier.
ReleaseTEAM helps secure-environment teams plan, deploy and migrate to GitLab’s agile planning tools, and we help teams on Jira and Confluence make that decision with clear eyes. This page covers what’s available, which tier it needs, and what to plan for when there’s no internet connection.
The short answer: GitLab’s planning features, including epics, roadmaps, iterations, boards, requirements and analytics, run entirely inside your self-managed instance and work offline. The features that need extra planning in an air-gapped network are the ones that reach outside the instance: security-scanner database updates, inbound email for Service Desk, and GitLab Duo AI, which needs self-hosted models.
A note on IL5. Impact Level authorizations apply to a system and its hosting environment, not to software on its own. When GitLab Self-Managed runs inside your IL5 environment, it operates under that environment’s authorization. For GitLab’s hosted offering, GitLab Dedicated for Government holds a FedRAMP Moderate authorization. On the Atlassian side, Atlassian Government Cloud is FedRAMP Moderate authorized, and Atlassian has stated it is building FedRAMP High and IL5 environments to submit for authorization ahead of Data Center end of life.
1. Portfolio planning and epic hierarchies
- Epics (Premium) and multi-level epics (Ultimate). Organize broad mission capabilities or contract requirements into a nested hierarchy, for example capability, then feature, then sub-epic, with issues and tasks beneath.
- Roadmaps (Premium). A timeline view of epics and milestones across a long planning horizon, for leadership and program reviews.
- OKRs (Ultimate, experimental). GitLab has objectives and key results as an experimental feature. It is disabled by default and not yet recommended for production use, so we plan around it rather than on it.
2. Enterprise agile and day-to-day work tracking
- Issues and tasks (all tiers). Capture requirements as issues, then break them into tasks, each with its own assignee.
- Iterations (Premium) and milestones (all tiers). Run time-boxed sprints with iteration cadences, and track contract deliverables and releases with milestones.
- Scoped labels (Premium). Labels such as
status::in-progressandstatus::in-revieware mutually exclusive, so an item can never hold two conflicting states. That makes workflow audits reliable. - Issue boards. Kanban boards with lists by label, assignee, milestone or iteration, plus epic swimlanes on Premium, for stand-ups and sprint reviews.
3. Traceability, auditing and compliance
- Issue to merge request to deployment. Issues link natively to the merge requests that implement them, the pipelines and security scans that validated those changes, and the environments they were deployed to. That gives you one connected record from requirement to production.
- Compliance frameworks (Premium; policy enforcement on Ultimate). Label groups of projects with a compliance framework, then use it on Ultimate to scope security policies to exactly those projects.
- Pipeline execution policies (Ultimate). Enforce required CI/CD jobs, such as scans or evidence collection, across many projects from one configuration. This is GitLab’s successor to the deprecated compliance pipelines feature.
- Requirements management (Ultimate). Author requirements in GitLab and mark them satisfied from CI test results, linking test execution back to the originating requirement.
4. Metrics and analytics
- Value stream analytics. Measure cycle time from issue creation through to production deployment and find where work waits. Custom stages need Premium.
- DORA metrics (Ultimate). Deployment frequency, lead time for changes, change failure rate and time to restore service, tracked from your own pipeline and deployment data.
At a glance: tier and air-gapped notes
| Capability | GitLab tier | In an air-gapped instance |
|---|---|---|
| Issues, tasks, milestones, boards | Free and above | Fully local |
| Epics, roadmaps, iterations, scoped labels | Premium | Fully local |
| Multi-level epics, requirements | Ultimate | Fully local |
| Compliance frameworks | Premium (policy scoping on Ultimate) | Fully local |
| Pipeline execution policies | Ultimate | Local. Runs on your own runners |
| Value stream analytics, DORA metrics | Custom stages Premium; DORA Ultimate | Fully local |
| Security scanners | Varies by scanner | Needs offline configuration and mirrored vulnerability databases |
| Service Desk | Free and above | Needs incoming email from a mail system inside your boundary |
| GitLab Duo AI | Premium, Ultimate | Needs GitLab Duo Self-Hosted with models on your own GPUs |
What to plan for in an offline environment
Service Desk intake
Service Desk turns incoming emails into issues. On GitLab Self-Managed it relies on incoming email configured through IMAP or the Microsoft Graph API, so in a closed network it has to point at a mail system reachable from inside your boundary, typically your organization’s internal relay, rather than a commercial email service.
GitLab Duo AI features
GitLab Duo’s AI capabilities normally call cloud-hosted models. In an air-gapped network, GitLab Duo Self-Hosted lets you run supported models on your own infrastructure. These include open-weight models from the Mistral, Llama and Qwen families, served on GPU hardware inside your boundary. It is a real deployment project, with its own sizing, serving platform and licensing considerations, and we can help you plan it. See our GitLab Duo Self-Hosted technical brief.
Security scanners
GitLab’s scanners run offline, but their analyzer images and vulnerability databases have to be mirrored into your environment and kept current on a schedule. We build that update process into the plan from day one.
Moving planning work from Jira and Confluence
Many secure-environment teams already run Jira and Confluence, often on Data Center, and they serve those teams well. If you’re weighing whether to stay on Atlassian, move to Atlassian Government Cloud, or consolidate engineering planning into a self-managed GitLab instance, we can help you compare the options fairly. We are an Atlassian Gold Solution Partner and a GitLab Select Partner, and we work with both platforms every day.
If GitLab is the right home, we plan the migration to run inside your boundary. That covers field and workflow mapping, history and attachments, Confluence to wiki conversion, and reconciliation before anything is retired. See Jira and Confluence to GitLab migration services for how we work, or our public sector page for contract vehicles.
Frequently asked questions
Is GitLab IL5 authorized?
Impact Level authorizations apply to a system and its environment. GitLab Self-Managed can be deployed inside an IL5 environment you operate, where it falls under that environment’s authorization. GitLab’s hosted government offering, GitLab Dedicated for Government, holds a FedRAMP Moderate authorization.
Do GitLab’s planning features work fully offline?
Yes. GitLab supports Self-Managed installations in offline environments on every tier, and planning features such as epics, roadmaps, iterations, boards, requirements and analytics run inside your instance. Security scanners, Service Desk email and GitLab Duo need extra configuration.
Which GitLab tier do we need?
Epics, roadmaps, iterations and scoped labels need Premium. Multi-level epics, requirements management, pipeline execution policies and DORA metrics need Ultimate. Most secure-environment programs that need end-to-end traceability choose Ultimate.
Can we use GitLab Duo in an air-gapped network?
Yes, with GitLab Duo Self-Hosted. You run supported models on GPU hardware inside your boundary, and the instance does not connect to GitLab’s cloud AI services. It needs dedicated infrastructure and planning.
Feature, tier and offline details verified 24 September 2026 against GitLab’s documentation and GitLab’s FedRAMP announcement. Atlassian Government Cloud and Data Center details verified against Atlassian’s published pages. GitLab’s packaging changes often, so confirm current terms before you budget.
Planning inside a secure boundary?
Talk to a team that knows both Atlassian and GitLab and has worked in the public sector for decades. We’ll help you choose the right platform, then deploy or migrate it.
Speak With An Expert