GRC for Jira Release Notes

Filters on issue panels
Your filters are now remembered. They stay as you left them when you switch tabs or reload, and if you clear them, they stay cleared.
A filter change made just before you navigate away is no longer lost.
When a filter matches nothing, the filter bar stays on screen so you can adjust or clear it. The message now tells you no results matched, instead of suggesting nothing is linked to the item.
Generating controls
Creating several controls at once now shows all of them immediately, rather than some appearing only after a refresh.
Added "Hide duplicates" switch to filter out possibly duplicated contols.

Custom user groups. You can now grant GRC permissions to your own Jira groups, not just the built-in GRC groups.

On Settings → Permissions, use Add group to link any existing Jira group, search for it, and optionally copy another group's permissions as a starting point. The linked group appears as a new column in the permission matrix where you can tick permissions like any other group, and can be removed again at any time (removing it discards only its GRC permissions; the Jira group itself is never created, renamed or deleted by GRC). Permissions follow the group even if you rename it in Jira, and a group deleted in Jira is flagged in the matrix rather than silently dropped. Note that custom groups control what users see and can do in the GRC UI; saving settings still requires site admin, org admin or Configuration Managers membership.

Read more Custom user groups

Control Deficiency and Exception work item registration form fields now inherit the required field setting from the corresponding Jira field configuration.

1. Dashboard report widgets now have a per-widget "⋮" menu to toggle chart data labels and export the widget's data to CSV (UTF-8, Excel-ready), respecting the active field selection and filters. CSV export is governed by a new Reporting → "Dashboard widgets data export to CSV" permission, granted by default to Compliance Officer, Configuration Manager, and Risk Manager.

2. A new Compliance Settings section lets admins configure a default Owner for each GRC work item type; the selected user pre-fills both the Owner and Assignee when items of that type are created.

3. The Controls, Control Deficiencies, Risks, Incidents, and Exceptions widgets gain an opt-in Business Entity filter that, since these items aren't linked to Business Entities directly, resolves the Entities linked to the selected Business Entities and narrows results to items under them. The filter appears only when the Business Entity module is enabled.

This release introduces a new advanced scheduling field type to support more flexible recurrence rules for control assessment automation, enabling richer schedule definitions and more precise timing behavior across scheduled generation workflows.

Introduced a configurable Compliance Rollup Engine in settings, allowing admins to define control test results, map resolutions to those results, configure entity compliance ratings, and manage rollup rules, with legacy behavior preserved as the default baseline.

Continuous Control Assessment

Compliance Rollup Configuration

This release introduces two certification types to support different review needs across governance and compliance work.

1. Periodic Review Certification
   Use this when you need to run a recurring review of records, ownership, or access decisions.
   It helps teams confirm that assigned owners still match current responsibilities and that records remain valid over time.

2. Control Effectiveness Attestation
   Use this when you need owners to attest whether controls are operating effectively.
   It helps organizations document control health, capture follow-up actions where needed, and support audit and compliance evidence.

Together, these two certification options support both operational hygiene (regular record reviews) and assurance activities (control effectiveness confirmation).

Certifications

Periodic Reviews

Control Effectiveness Attestation

We’ve expanded the table widget capabilities to make it easier to tailor views to your own Jira configuration and workflows.

The table widget filter now supports additional, customer-specific Jira fields. You can refine table using your own custom fields instead of being limited to a fixed, built‑in set.

The table widget can now display Jira fields from the selected issue type, including custom fields, as optional columns.

Columns in the table widget can now be reordered via drag-and-drop on the column headers.

Implemented Forge SQL storage for persisted application data used by reporting and history-based views, reducing reliance on large live Jira REST API payloads.

• Added a new Exception Management module to create and maintain exception records with common fields (category, duration, start/end dates, owner/assignee, status).

• Exceptions can be linked to and reviewed in context of Controls, Entities, Risks, and Compliance Requirements, with the same exception list available from those work item views.

• Exception lists support day-to-day review workflows: add/link, unlink (permission-based), refresh, column selection, filtering, and paging.

Exceptions Management

The dashboard table widgets now support configurable, multi-field filtering so you can narrow results by project, status, text search, user picker, linked issues, and select/custom fields. Filters update the underlying query automatically as you type or change selections, show an accurate active-filter count, and retain your chosen filter fields and values for each widget so your report view stays consistent between sessions.

Open

Table widget expandable filter panel

The number of search results returned by the API to table widgets is now limited to 100 work items.

Additionally, we delivered a fix for sorting issues in dashboard table report widgets.

As part of this update, we added new Risk learning content focused on the end-to-end workflow around approvals and execution—specifically the Risk Assessment Approval Workflow (approve an assessment and initiate downstream work) plus the Risk Response Submit Workflow and Risk Response Approve Workflow, which walk users through opening response tasks, submitting them for review, and approving the final response to complete the risk response lifecycle.

See Learning Center - User Guide

We’ve introduced a new in-app setup wizard that guides administrators through the initial configuration of GRC for Jira in a single, streamlined flow. All required setup information, such as installation language and initial GRC project details, is collected upfront, and the system provisions the GRC scheme and project as part of one continuous process. The new GRC Overview page clearly reflects the setup state and guides administrators through completion and access assignment.

GRC for Jira now includes a Learning Center that provides role-based, guided learning paths for key workflows. Learning paths help users understand how to configure compliance frameworks, manage entities and controls, perform assessments, and work with risks step by step. The Learning Center is accessible at any time from the app menu, supports progress tracking and resuming, and complements in-app guidance and documentation.

See Learning Center - User Guide

Control Assessment Creation Settings

• Added configuration to define the target project for control assessments created by monitoring automation. If not configured, assessments are created in the same project as the parent Control.

• Introduced an option to select the source field for the Control Assessment description, allowing it to be populated from either the parent Control’s Test Steps or Description field.

We're excited to introduce interactive dependency graph visualization for all GRC work items! You can now see the complete relationship network of any work item at a glance, making it easy to understand how risks, controls, requirements, and other GRC items connect together. The visual graph shows all linked work items with their type, priority, and assignee information, helping you quickly grasp the full context without clicking through individual links one by one.

Access the dependency graph directly from the work item activity panel on any GRC work item page, or use the new "View Dependencies" action in table dropdown menus.

The graph is fully interactive - filter by work item type to focus on specific relationships, adjust the depth to see more or fewer levels, switch between vertical and horizontal layouts, and even click "Focus Here" on any work item to re-center the graph around it. Whether you're tracking control deficiencies linked to remediation tasks, exploring risks, or mapping compliance requirements to controls, the dependency graph gives you a clear, navigable view of your GRC relationships.

Find more details about Work Item Dependency Graph here Work Item Dependency Graph

Open

Added the ability to show or hide questionnaire questions and groups based on the current Jira issue's status. When configuring visibility conditions in assessment or control templates, users can now choose between question-based conditions (existing functionality) or the new issue status-based conditions. This allows questions to automatically appear or disappear as issues move through different workflow statuses, enabling more dynamic and context-aware questionnaires. Multiple conditions can be combined using ALL/ANY logic, and the feature maintains full backward compatibility with existing templates.

This release introduces improvements to the risk assessment configuration and visibility:

• Risk managers can now design risk assessment templates that include only the control effectiveness assessment, without requiring inherent, residual, or target risk scoring. This provides additional flexibility for methodologies focused solely on control performance.

• A new column displaying the calculated Control Factor Score has been added to the risk item records, enabling quicker evaluation of control influence directly from the risk overview.

UI/UX improvements and fixes:

• Improved dashboard widget layouts for better readability and alignment.

• Fixed sorting issues affecting certain dashboard widgets and search dialogs.

• Added an Entity column to widgets displaying Controls and Risks lists.

A new permissions management system enables organizations to implement role-based access control across all GRC functionality. Administrators can now customize permissions for 7 predefined user groups, granting or revoking access to specific operations and features based on organizational roles and responsibilities. This allows organizations to enforce segregation of duties, meet compliance requirements for access control, and ensure users only have the minimum necessary permissions to perform their job functions. The system tracks all permission changes and provides clear visibility into which permissions deviate from defaults, enabling easier security audits and governance oversight.

Open

Permissions management in GRC for Jira

Find out more information about permissions management here:

Access Guidelines & Access Matrix

This update includes minor improvements to enhance usability. We’ve added a toggle feature to the control search in the deficiency registration dialog, allowing users to filter controls by the entities they have already selected. This streamlines the process of finding and linking the correct controls. Additionally, we’ve optimized the handling of larger questionnaires with improved compression techniques and fixed visibility issues to ensure dependent items are hidden correctly when their parent items are invisible. These changes improve reliability, relevance, and efficiency.

More details on these updates are provided below.

Added a toggle feature to the control search in the deficiency registration dialog, allowing users to filter controls by the entities they have already selected. When enabled, the toggle limits search results to controls linked to the selected entities, improving relevance and efficiency. The toggle is disabled by default, hidden when no entities are selected, and its state is saved to user-specific preferences for a seamless experience. This enhancement streamlines the process of finding and linking the correct controls within the scope of selected entities.

• Introduced an enhancement to handle larger questionnaires more efficiently by implementing advanced data compression techniques. This improvement ensures that even extensive questionnaires can be stored and processed seamlessly, reducing storage requirements while maintaining data integrity. As a result, users can work with detailed and complex questionnaires without encountering size limitations, ensuring a smoother and more reliable experience.

• Implemented a fix to ensure that the visibility of questionnaire items is handled correctly, even in complex scenarios with multiple levels of dependencies. Now, if a parent item becomes invisible, all its dependent items, regardless of their own conditions, are automatically hidden as well. This ensures that the visibility logic is consistent and accurately reflects the intended behavior, providing a more intuitive and reliable user experience.

Added functionality to export risk assessments and control assessments in both PDF and Word (.docx) formats.

We have introduced a new Custom Translations page, allowing you to override default translations provided by GRC for Jira with your own wording.

With this feature, you can:

• Select the language you want to customize.

• Search for a specific phrase in that language.

• Enter and save a custom phrase to replace the original.

Once defined, your custom phrase will automatically appear in the application instead of the original translation, allowing you to tailor the language to your organization’s terminology, tone, or compliance requirements.

This is especially useful if your team uses specific terminology or needs to align the interface language with existing internal standards.

We’ve added a new option that allows risk managers to plan the next risk assessment either by selecting a standard assessment period (e.g., every 1 or 3 months) or by choosing a specific date.

What’s new:

• A pre-filled dropdown lets users choose how often assessments should occur.

• The calculated next assessment date is shown automatically based on today’s date and the selected period.

• A toggle enables manual scheduling: switch it on to pick a custom date instead.

• Any changes to the period or date are automatically saved or passed to the system.

This update helps teams plan assessments with greater flexibility and alignment to internal processes.

You can now create GRC Entities in Jira directly from Jira Service Management (JSM) Assets.

Key highlights:

• Select eligible asset object types from a tree view.

• Choose between creating one entity per asset or a single entity referencing multiple assets.

• Entity fields like Owner, Criticality, Sensitivity, and Entity Type can be filled during creation.

• Requires admin configuration of the “JSM Assets” custom field and eligible asset types.

See feature documentation JSM CMDB (Assets) Integration

Released improvement to External Assessments, enabling copying all attachments from JSM request to the Risk Assessment.
Fixed issue causing blocking behavior when creating a new JSM request.

This release introduces several enhancements to our GRC platform, focusing on improving functionality, user experience, and system performance. Below are the key updates included in this version.

• Controls Scope Tab Added to GRC Audit Issue Panel
  Auditors can now define a list of Control Templates to be used as a filter on the Controls tab, simplifying the generation of Audit control assessments. Additionally, the Controls Scope tab provides a comparison of GRC Entity controls coverage relative to the defined scope.

• Redesigned NIST Controls Bundle Import
  The NIST controls bundle import process has been re-designed to include an Advanced Selection mode, allowing for more granular selection of controls and enhancements. A new Security/Privacy baseline filter has also been added to streamline the selection process.

• Entities Tab Added to GRC Control’s Issue Panel
  Multiple GRC Entities can now be associated with a single GRC Control, enhancing flexibility and accuracy in control management.

• Page Size Selector Component Added to All Grids
  Users can now select the number of items displayed per page across all grids, providing more control over their data display.

• Refresh Button Added to Issue Panels and Widget Grids
  A Refresh button has been added to all issue panels and issue widget grids, allowing users to quickly update displayed information.

• The https://ecosystem.atlassian.net/browse/AMS-30381 issue has been resolved

• Various minor bugs have been fixed to enhance overall usability.

• Performance enhancements have been made to ensure faster and smoother operations.

• All widgets configurations are saved to local storage and are restored on the next page load

• JSM configuration fix

• Minor bug fixes

• Integration with Jira Service Management – JSM Integration

• NIST SP 800-53 controls bundle import – NIST SP 800-53

• Setup stability improvements

• Addressed issues raised by Atlassian:

  • https://ecosystem.atlassian.net/browse/AMS-28771

  • https://ecosystem.atlassian.net/browse/AMS-28772

• GRC schema updated to v2.3.7

Please ensure to run the plugin setup to upgrade the GRC schema to version 2.3.7.

A hotfix release to address the customer support request:
https://justgrc.atlassian.net/browse/JGS-10

We are excited to introduce a significant update in the latest version of the GRC for Jira plugin, offering a data transfer feature designed exclusively for Jira administrators. This new functionality enhances collaboration and continuity across different Jira instances by enabling the secure and efficient transfer of GRC project data.

This feature is available under the Settings menu, introducing two new options: Data Export and Data Import. Access to these functionalities is restricted to Jira administrators to ensure secure handling of project data.

Administrators can now easily export GRC project data from their Jira instance. To perform a data export:

1. Navigate to the Settings menu and select Data Export.

2. Choose the GRC project you wish to export.

3. The system will generate a downloadable JSON file containing the project data.

The JSON file serves as a comprehensive snapshot of your project, ready to be imported into another Jira instance.

Importing GRC project data into your Jira instance is straightforward. To import data:

1. Go to the Settings menu and select Data Import.

2. Upload the JSON file you obtained from the data export process.

3. Select the target GRC project within your Jira instance where the data will be imported.

4. Assign a default issue owner/assignee for the imported data. This step is crucial as certain user-related fields from the source data will not be transferred.

Upon completing these steps, the issues will be created in the selected project. All issue fields will preserve their values, ensuring a seamless transition of data. Additionally, issues will be linked according to the source data, maintaining the integrity and relationships of your GRC data.

• User Fields: Please note that values of the assignee, reporter, and owner fields from the source data are not transferred.

• Attachments: Are not transferred.

• Supported GRC Issue Types: This feature supports the transfer of specific GRC issue types, including:

  • Authority Documents

  • Assessment Criteria

  • Compliance Requirements

  • Control Objectives

  • Control Templates

  • Assessment Templates

  • Risk Frameworks

  • Risk Statements

This data transfer feature is designed to enhance your GRC management process by enabling data migration and project continuity across different Jira instances.

Note for Admin: We’ve applied some changes to GRC issue types. Once you’ve installed this version from the marketplace, please ensure running upgrade script to v2.3.4 on the Settings / Setup page.

We have added the Compliance Statistics widget to the Compliance / Summary page.
This new widget is also available for adding under the Compliance category when your dashboard is in edit mode. It offers a comprehensive overview of key compliance metrics, providing you with instant insights into your compliance status, including controls implementation, assessment, and control deficiency resolution.

We have added the Risks Statistics widget to the Risks / Summary page.
This new widget is also available for adding under the Risk category when your dashboard is in edit mode. It offers a comprehensive overview of key risk metrics, providing you with instant insights into your risk status, including risk design, assessment, and response.

We've introduced a Preview button to the Risk Assessment Template designer. This new feature allows users to instantly preview the assessment template as it will appear to the end-user, providing a real-time glimpse into the user experience before finalization.

• Enabled read-only mode for Control Assessment questionnaire when the issue is in status Review or Done

• Installation procedure improvements

• Updated open source npm packages to address the following issues:

  • https://ecosystem.atlassian.net/browse/AMS-27320

  • https://ecosystem.atlassian.net/browse/AMS-27321