Screen reference
Access reviews
Review who has access to what in Jira: campaigns, reviewers, decisions and the list of accesses to remove.
What the screen is for
An access review proves that rights are checked at regular intervals (ISO 27001 A.5.18, SOC 2 CC6.2 and CC6.3). Each "campaign" lists accounts and their accesses in Jira projects and groups. Reviewers keep or remove each access, then the campaign is closed.
Who can do what
| Action | Reader | Campaign reviewer | Compliance manager or Jira administrator |
|---|---|---|---|
| See the list of campaigns (dates, scope, progress) | yes | yes | yes |
| Open a campaign | no | yes, their own | yes |
| Decide an access ("Keep" or "Remove") | no | yes, within their scope | yes |
| "New campaign", "Close the campaign" | no | no | yes |
A campaign names people and their accesses: it is open only to its reviewers and to compliance managers.
Step by step
Start a campaign
- Click "Nouvelle campagne".
- Under "Scope", enter the "Project keys" (separated by a comma or a space, for example SEC, OPS) and the "Jira groups" (one per line). Jira shows only what you are allowed to see: a campaign cannot reveal more than your own rights.
- Enter the "Period reviewed" ("From", "To") and the "Due date of the decisions".
- Under "Reviewers", choose at least one reviewer per project, and for the groups. They are the ones who decide.
- Click "Start the campaign". The app reads the accesses in Jira, step by step. Do not close the panel. If the reading is interrupted, start again: it resumes where it stopped.
- If a project or group cannot be read (misspelled group, project whose roles you do not administer), the campaign is not created. Fix or remove that part.
The app leaves aside application accounts, portal customers and inactive accounts: they are not people whose access is reviewed. It gives their count. A campaign holds 5,000 accesses at most.
Decide the accesses
- Open the campaign. Filter by "Reviewer", "Decision" ("To decide", "Kept", "To remove") or "Project".
- For each row, click "Garder" or "Retirer". You can add a comment (optional).
- The row shows who decided and when. If someone has already decided that access, the screen reloads the campaign.
Close the campaign
- When everything is decided, click "Clore la campagne" and confirm. While accesses remain to be decided, the button says how many.
- The "Accesses to remove in Jira" section lists, by project or group, what must be removed.
- Remove those accesses by hand in Jira, one by one. The app does not change any access.
- Click "Export as CSV" to keep the campaign and its decisions.
What the auditor will take from it
The proof of a review: the scope, the period, the reviewers, each decision with its author and date, and the list of what
was removed. The revues-acces.csv file of the audit pack reproduces it. Every step is in the audit log
(reviewers' comments are not in it).
Known limits
- The app removes no access: removal is manual in Jira.
- Two reviewers deciding the same access at the same moment: the last to arrive wins.
- Reading accesses depends on Jira: if Jira does not answer, nothing is lost, try again.
- A campaign covers only Jira. Other systems are planned.
- Reviewers get no reminders: the e-mail reminders cover tasks and evidence only.
Was this page helpful?