Screen reference
Context and interested parties
The ten registers of ISO/IEC 27001:2022 clauses 4 to 10, in the same place as your controls.
What the screen is for
| Register | Clause | What goes in it |
|---|---|---|
| Issues | 4.1 | Internal and external factors that bear on the management system |
| Interested parties | 4.2 | Who matters to your security, what they expect, legal or contractual obligations |
| Scope | 4.3 | What the system covers, what it excludes and why |
| Roles | 5.3 | Who is responsible for what |
| Objectives | 6.2 | Measurable objectives: metric, target, current value, progress |
| Competence | 7.2, 7.3 | Required competence and the actions that ensure it |
| Communication | 7.4 | What, to whom, when, through which channel |
| Documented information | 7.5 | Procedures, plans, records, version, location |
| Management reviews | 9.3 | Date, attendees, inputs, decisions |
| Nonconformities | 10.2 | Root cause, corrective action, effectiveness check |
Who can do what
| Action | Reader | Compliance manager | Jira administrator |
|---|---|---|---|
| See the counters at the top of the page | yes | yes | yes |
| Read the register lines | no | yes | yes |
| Add, edit, submit for review, delete a draft | no | yes | yes |
| Approve a line | no | yes, if named approver or if none is named | same |
A reader sees "The registers are restricted": the lines name people and are shown only to those who run the management system.
Step by step
- Read "Registers in use" (out of the ten in the standard) and "Approved lines", then open a register.
- Filter by state (Drafts, In review, Approved, Retired), or search within the register.
- "Add a line": title and owner are required; designated approver and due date are optional. The fields specific to the register (for example metric and target for objectives) follow. The line is created as a draft.
- In the line's drawer: "Submit for review", then "Approve". Only the designated approver approves; with none designated, you do. An approved line is no longer edited: "Back to draft" (its approval lapses) or "Retire".
- Link controls to the line: the register suggests those that fit. A linked control shows where the line serves as evidence.
- For interested parties, "Add the starter list" suggests customers, staff, authorities… It is a suggestion, never a finding: you keep, edit or delete each line.
What the auditor will take from it
The registers show you know your context and that every line has an owner and a dated approval. The app does not say a register is enough for the standard: that is for the auditor to judge.
Known limits
- A write conflict (someone changed the line) overwrites nothing: the page rereads and your input is kept.
- Only a draft can be deleted; the deletion stays in the audit log.
- A document link (documented information) must be the https address of a Confluence Cloud page; the app keeps the link and neither reads nor writes the page.
Was this page helpful?