Assessment

What the screen is for#

The assessment is a questionnaire. Each gap your answers reveal becomes a task in the action plan, linked to the requirements of the chosen frameworks. Questions are grouped by theme.

Who can do what#

A reader sees the message: only Jira administrators and compliance managers can save the assessment.

Step by step#

1. Under "Frameworks assessed", tick ISO 27001 and/or SOC 2. The questions adapt. Ticking one more framework adds its questions. Unticking one removes the tasks that have no work started. You must keep at least one.
2. Answer each question with "Yes", "Partly", "No" or "Not applicable". Each question shows its importance ("Importance 3 sur 5", Importance 3 out of 5). "Why this question" and "Evidence expected" help you answer.
3. Add a "Note (optional)" if needed.
4. Follow the "Assessment progress" and the completeness of each theme ("Complet", Complete).
5. Click "Save the assessment". You need at least one answer and one framework.
6. An "Assessment saved" message says how many tasks were created, kept, removed or set aside. Click "See the action plan".

Saving replaces the previous answers with those on screen. Your draft stays on screen until you save: nothing is sent before the button.

If saving is interrupted#

If the screen says saving may not have completed, press "Save the assessment" again without changing anything. The operation finishes without starting over.

Re-run the assessment#

You can re-run it at any time. Work already started (status, evidence, ticket) is kept. A closed gap that carries work is "set aside" and stays visible in the plan with the note "Gap closed, work kept".

What your answer changes on the controls#

An answer acts on the common controls the question targets, and so on every requirement they cover in each chosen framework:

• "Yes" sets those controls to "implemented";
• "Partly" or "No" sets them to "not implemented" and creates the tasks;
• "Not applicable" changes nothing: whether a control applies is decided on the control;
• when several questions target one control, the most prudent answer wins;
• a verified task counts as work done, so re-running the assessment does not undo it. If the task is reopened later (in the app or behind its Jira ticket) the control goes back to "not implemented" and the log says so.

An "implemented" control is "up to date" only if it has its expected evidence, recent, and no failing test. The readiness shown is the version 2 score: a requirement whose controls are in place but that still lacks a piece of evidence earns half. The screen shows how many pieces of evidence are still to bring.

Where to see the result#

The state of each control touched is read in the controls library (Evidence to provide, Test failing, In place). The getting started guide counts "Answer the assessment" as one of its eleven tasks.

What the auditor will take from it#

The assessment is the starting point of the plan. The auditor sees "Assessment started" and "Assessment completed" in the log, with the author and the date. The readiness shown ("Readiness") is computed from the state of the common controls.

Known limits#

• Questions and tasks are, for now, written in English: they are the texts of the content catalogue. The screen labels are in French.
• Two assessments saved at the same moment by two people can create two tasks for the same question.
• The frameworks offered are ISO 27001 and SOC 2. Another framework is planned.
• Many questions have no link to a control yet: their answer creates or keeps tasks but does not move the score.
• The theme is shown with a label derived from its key, without French translation.