First steps

This page assumes the app is installed. Plan one first session; you do not need to finish in one sitting, the app saves as you go.

Grant the compliance manager role#

The app knows twelve roles. By default, everyone who opens the app is a reader; Jira administrators have every right. Until someone holds an editing role, only administrators can edit. The detail is in Roles.

1. Open the Settings page (its entry only appears to Jira administrators). From the statement of applicability, the "Open the settings" link leads there.
2. Open the "Access" tab, then click "Grant a role".
3. In "Role", choose "Compliance manager"; for a person, type two letters of their name in "Search for a person" and pick them. Only active people of your Jira are offered.
4. Click "Grant". The person can act from their next click.

To remove the role, click "Remove" next to their name.

Choose the Jira project for tickets#

Each action-plan task can have its own Jira ticket. You first need to say which project to create them in.

1. Open the "Action plan" tab. The "Jira tickets" block says "No Jira project is chosen".
2. Click "Choose a project", pick a project from the list, then "Save". The list shows only projects where you can create tickets.

You can change the project later. Tickets already created stay in their original project; only the following ones go to the new one. Details are in Action plan.

Run the first assessment#

1. Open the "Assessment" tab.
2. Tick the frameworks to assess (ISO 27001, SOC 2).
3. Answer the questions: "Yes", "Partly", "No" or "Not applicable". You can add a note.
4. Click "Save the assessment". Each gap becomes a task in the action plan.

You do not have to answer everything at once, but you must answer at least one question. You can re-run the assessment at any time: work already started is kept. See Assessment.

Move on to the action plan#

1. Click "See the action plan" in the message that confirms the assessment.
2. Tasks are sorted by urgency. Change their status as work progresses.
3. If a project is chosen, create the Jira tickets.
4. In each task's "Detail", add your evidence: a reference, a file, or a frozen Jira query.

What next#

• Fill in the Statement of Applicability and approve it.
• Record your risks and keep the asset inventory.
• Plan an internal audit and an access review.
• Turn on monitoring and, if you wish, the e-mail reminders (off by default).
• Before the certification audit, generate the audit pack from the audit log tab (Advanced edition).