Glossary

Annex A. The list of 93 security controls of ISO/IEC 27001:2022, on which the statement of applicability rests.

Audit pack. A zip to hand to the auditor: data as CSV, report, Excel workbook and a manifest of fingerprints. See Audit pack.

Audit log. The chained history of what was changed, by whom and when. See Audit log.

Campaign (access review). A review of the accesses to a Jira project or group, with its reviewers and decisions. See Access reviews.

Common control. A measure that answers several requirements of several frameworks, and to which you attach its evidence, tests, tasks and risks once. See Concepts.

Compliance manager. The role an administrator grants, which allows managing every domain except settings and roles. See Roles.

Edition. Standard or Advanced, carried by the installation's Atlassian licence. See Editions and licensing.

Fingerprint. The result of a calculation (SHA-256) that changes as soon as the content is modified: it is used to prove that a log entry or a file has not been altered.

Forge. Atlassian's platform on which the app runs: it executes inside your Jira site.

Framework. A compliance framework: ISO 27001, SOC 2, NIS2, and so on. See The frameworks covered.

Monitor. A daily measurement in Jira or in the app (for example "overdue security tickets") that feeds a control's test. See Tests and continuous monitoring.

Readiness. The score that says what share of applicable requirements is held by controls in place. See The readiness score.

Requirement. An obligation of a framework, for example a clause of ISO 27001 or a SOC 2 criterion.

Stale (evidence). Evidence older than the expected frequency: it no longer counts. See Evidence.

Statement of applicability. For each Annex A control: applicable or not, why, and where implementation stands.

Task. An action of the action plan, born of a gap in the assessment, with its status, owner, evidence and, if you wish, its Jira ticket.