Run an access review

Role: Compliance manager Role: Approver An access review proves that rights are checked at regular intervals (ISO 27001 A.5.18, SOC 2 CC6.2 and CC6.3). Screen details are in Access reviews.

Before you start: choose the scope (projects, Jira groups), the reviewers (at least one per project and for groups) and the due date. You must see the roles of the projects in scope: a campaign never reveals more than your rights.

1. Start the campaign#

Role: Compliance manager Screen: Access reviews.

1. "New campaign", "Project keys", "Jira groups", "Period reviewed", "Due date of the decisions", "Reviewers".
2. "Start the campaign"; do not close the panel, reading resumes if interrupted. A campaign holds 5,000 accesses at most.

Screenshot to come

2. Have people decide#

Role: Approver Each reviewer opens their campaign, filters by "Decision" and picks "Keep" or "Remove" for each access, with an optional comment.

3. Close#

1. When everything is decided, "Close the campaign".
2. The "Accesses to remove in Jira" section lists what to remove.
3. Remove them by hand in Jira. The app changes no access.
4. "Export as CSV" to keep the campaign and its decisions.

4. The proof#

The revues-acces.csv file of the audit pack holds scope, period, reviewers, and decisions with author and date. Every step is in the audit log.

What the app does not do#

• It removes no access and does not check that you did.
• It does not remind reviewers by e-mail.
• It covers Jira only, not other systems.
• If two reviewers decide the same access at the same moment, the last one wins.