This article offers guidance for new GRC for Jira users, streamlining their introduction to the system and facilitating the initiation of compliance operations.

If you are new to the GRC product domain and have no prior experience with our plugin, we recommend starting with a sandbox environment to explore its capabilities.

Atlassian offers the option to create new Jira instances free for up to 10 users, making it an ideal setup for testing and learning about the plugin's functionality. Visit this page to Create a Sandbox Jira Instance

We strongly recommend refraining from renaming any items introduced by the GRC for Jira plugin, such as statuses, issue types, custom fields, roles, or groups. Renaming these items may cause the plugin to malfunction. Please consult with our Support team before making any changes or translations.

Find GRC for Jira on the Atlassian Marketplace and install it to get started.

Then refer to:

Plugin Setup

Configure GRC project

Access Guidelines & Access Matrix

Setting up the Compliance Reference Library is the first step in establishing the Governance domain within GRC for Jira. This library primarily consists of static data configured initially and referenced throughout compliance operations.

The setup includes the configuration of Authority Documents, Compliance Requirements, Control Objectives, Control Templates, and Assessment Templates.

We recommend starting with the creation of an Authority Document. Navigate to Compliance → Reference Library → Authority Documents to begin.

Open

After an Authority Document is created, it should first be transitioned to the GRC REVIEW, and then to the ACTIVE status.

We recommend adding Compliance Requirements directly from the Authority Document issue screen. Use the GRC for Jira component located in the issue panel for this purpose, see detailed documentation.

We recommend adding Control Objectives directly from the Compliance Requirement issue screen. Use the GRC for Jira component located in the issue panel for this purpose, see detailed documentation.

We recommend adding Control Templates directly from the Control Objective issue screen. Use the GRC for Jira component located in the issue panel for this purpose, see detailed documentation.

We recommend adding Control Assessment Templates from the Control Template issue screen. Use the GRC for Jira component located in the issue panel for this purpose, see detailed documentation.

Design your Assessment template using these guidelines.

Entities represent anything you intend to control in accordance with compliance requirements within your organization. These could include software, hardware, databases, departments, people, and more.

More information about Entities you can find here

It is recommended to start with creation of the Entities using Entities → Entities page.

Open

Controls are a crucial part of compliance operations. They define how your Entities should be assessed to ensure compliance with your organization's requirements.

A single Entity may have multiple controls associated with it, and a single Control may govern multiple Entities. The approach you choose depends on your organization's needs and compliance procedures.

It is recommended to define and create your Entities first before proceeding with the creation of Controls.

There are several ways to create Controls for Entities. It is advisable to create Controls using the Entity screen for better alignment, see detailed documentation.

Controls have several statuses in their lifecycle DRAFT → ATTESTATION → MONITORING

Draft stands for the state when you design your Control and define its properties.

Attestation stands for initial Control Assessment when Control design is verified.

* By default, the plugin is configurated to automatically create Attestation Control Assessment issue upon Control transitioning to ATTESTATION status

Monitoring stands for the state when your Control's design is approved and you need to run periodical Control Assessments to ensure that related Entities are compliant.

More information about Control Lifecycle you can find here

When your Control is being designed, you can configure it to enable Continuous Control Monitoring.

System will automatically create new Control Assessessment issues and assign them to respective Control owners.

See details here.

Control Assessments represent testing activities based on the test steps defined for the control.

Control assessments can be executed across different scopes:

Attestation, when Control design is reviewed

Monitoring, when Control is regularly assessed

Audit, when Control assessment is requested by auditors to confirm that control is properly designed and is in place.

It is recommended to create Control Assessments from the Control issue screen, see detailed documentation.

If properly configured, Control Assessment could utilize a standardized questionnaire, see detailed documentation.

If any issues are identified during a control assessment, you can register Control Deficiencies, which represent tasks to be resolved by the Control owner in order to ensure the Entity's compliance, see detailed documentation.