Tests and continuous monitoring

What the screen is for#

The "Continuous monitoring of the controls" takes measurements every day, in Jira and in the app, to know whether controls hold over time. Each measurement is a "monitor" whose result is "Compliant", "Failing", "Unknown" or "Never evaluated". The app keeps only counts (how many tickets), never their keys or titles.

Current monitors cover, for example, approved changes, incidents resolved within their deadline, late corrective actions, vulnerabilities fixed in time, control tasks closed with evidence, the access review of the last 90 days, and the year's internal audit.

Link with controls#

A monitor is the test of one or more common controls: when its latest result is "Failing", an implemented control goes to "Test failing", which outranks missing evidence. An "Unknown" result is not a failure. A monitor remains one result per day: tests do not yet have their own owner, deadline or history.

Who can do what#

Step by step#

Choose what is measured#

1. Click "Show the settings".
2. In "Projects watched", enter the project keys, separated by commas (for example SEC, OPS). If left empty, monitoring takes the action-plan tickets project. Without a project, nothing can be measured.
3. Fill in the ticket types (changes, incidents, vulnerabilities, corrective actions), the name of the resolution SLA, the critical and high priorities, the fix deadlines in days and the "Period measured".
4. Under "Monitors turned on", tick those the daily evaluation should measure.
5. If you wish, tick "Create a Jira ticket when a control starts failing". At most one ticket per control, in the tasks' tickets project. It is off by default.
6. Under "E-mail reminders", tick if you wish "Remind of overdue tasks" and "Remind of evidence to renew" (see below). They are off by default.
7. Click "Save the settings". If a field is refused, the screen names it.

E-mail reminders#

An overdue task or evidence to renew is seen only if someone opens the app. With reminders, the daily run asks Jira to send an e-mail:

• to the person assigned to the task's Jira ticket (a task with no ticket, or whose ticket has no assignee, gets no reminder);
• at most once every 7 days for the same task and the same type of reminder, and at most 50 reminders a day;
• with the task title, its due date or the date of its latest evidence, and a link to the app, in the installation's language. The e-mail is sent by Jira: the app sees neither the recipient's address nor their account.

The rules for "overdue" and "evidence to renew" are those of the dashboard. Access reviews have no reminders.

Read the results#

1. The "Monitoring summary" counts the monitors "Tracked", "Compliant", "Failing" and "Inconnus", and gives the date of the last evaluation.
2. In the list, open a monitor's "Detail": the measurement, the reason for the result, the linked requirements, the source (Jira, Jira Service Management, this app) and the "Last ticket".
3. The "Trend" summarises the latest evaluations.

Evaluate now#

Click "Évaluer maintenant". If an evaluation took place less than a minute ago, or if another is running, the screen tells you. A monitor can be "put off" to the next run for lack of time.

Understand why a test fails Edition: Advanced#

In the drawer of a failing or overdue test, "Explain the failure" asks the assistant for the probable cause and the steps to take in Jira (the query or screen to check, the ticket to open, the role that must handle it, how to run the test again). It starts from the test's last result (status, reason code, measure) and the date since when it fails; it changes nothing. What goes to the model: AI assistant.

What the auditor will take from it#

Proof of operation over time, not only at a date: the latest result of each monitor (suivi.csv of the audit pack) and the trend history. Setting changes and tickets created by monitoring are in the audit log.

Known limits#

• The evaluation runs once a day. The time of the run varies from one installation to another.
• The asset inventory monitor ("asset-inventory-reviewed") is wired to the Assets tab but off by default. Two monitors remain "Not tracked yet": they wait for the policy review and the copy of the Jira audit log. They will be measured when those sources exist in the app (planned). The screen still names the inventory among them: that text lags behind the code.
• If Jira refuses a query or a right is missing, the result is "Inconnu", with the reason.
• An empty or refused project setting prevents the query from being built: nothing is then sent to Jira.
• The daily run uses the app's identity, not yours, and reads only the projects you chose.