Audit pack

What the screen is for#

The Audit pack page puts two blocks side by side: the audit pack (a zip to hand to the certification body or the auditor, Advanced edition) and the export of your data (all editions). Three figures at the top say what the pack holds: its files, its generation steps and the tables of the export. You can also reach it from the Reports page.

Who can do what#

The right to generate the pack and to export your data is the right to export the log: auditors, compliance managers and administrators (Jira administrators included). The server checks the edition. Each opening of the pack, by any of these people, is entered in the log ("Audit pack opened": who, when, nothing else). With an inactive licence, the export of your data stays open.

Generate the audit pack#

The audit pack is a zip to hand to the certification body or the auditor.

1. Under "Audit pack", click "Generate the audit pack". This button requires the Advanced edition.
2. Follow the steps: reading each section, "Checking the integrity of the journal…", assembly, then writing the generation to the log.
3. The zip dossier-audit-YYYY-MM-DD.zip is downloaded. It contains:
   • CSV files (raw data): statement of applicability, common controls, mapping between controls and requirements, risks, assets, action plan, evidence, Jira queries (one line per snapshot), access reviews, internal audits, findings, incidents, monitoring, log;
   • in the controls file, the "Comment nous le mettons en œuvre" column (the text written in the control's drawer);
   • rapport.html: a formatted report, to open in a browser and print to PDF;
   • dossier.xlsx: an Excel workbook, one sheet per section;
   • a politiques/ folder: the PDF of each approved policy and procedure, at the version in force (see Download a policy as Word or PDF);
   • manifeste.json: the date, the account, the version, the log verification, the SHA-256 fingerprint of each file and the number of policies included;
   • LISEZMOI.txt: the contents, the format and the command to re-verify the fingerprints.
4. The evidence files themselves are not in the zip: the zip gives their name, size and fingerprint.
5. If the log verification found tampering, the pack is still ready, but the manifest and LISEZMOI.txt say so: have the log examined before handing it over.
6. If the Jira directory did not answer for some sections, the "(nom)" (name) columns there are empty. Regenerate the pack before handing it over if names matter.

To re-verify the fingerprints outside the app, extract the zip, then run the command given in LISEZMOI.txt (shasum -a 256 …) and compare with the manifest.

Export your data#

The "Your data" block gives everything the app keeps for this installation: the right of access to one's data, which is not a paid option.

1. Click "Export my data". The block is open to auditors, compliance managers and administrators, even with an inactive licence.
2. The zip donnees-YYYY-MM-DD.zip holds CSV files (the sections of the audit pack, plus the settings and the dashboard history) and a fingerprint manifest. Evidence files are not in it: they are downloaded in the app.
3. This export is not written to the log.

What the auditor will take from it#

A complete pack they can recount without the app: the fingerprints of each file are in the manifest, and the fingerprint of the manifest itself is written to the audit log (action "Audit pack generated").

Known limits#

• The pack's sections are read one after the other: it is not a single snapshot.
• The generation of the pack is written to the log afterwards: it is therefore not in the pack's log file.
• The evidence files themselves are not in the zip; the zip gives their name, size and fingerprint.