Access Guidelines & Access Matrix

When utilizing the GRC for Jira plugin, it is imperative to ensure that users are assigned appropriate permissions, reflecting their responsibilities within the GRC processes. This ensures both smooth workflow transitions and the security of sensitive GRC data.

The GRC for Jira plugin provides a comprehensive role-based access control system with seven predefined user groups. Administrators can customize permissions for each group to align with organizational security policies and compliance requirements.

GRC User Groups

Administrators with Org Admin privileges can now customize permissions for each user group through the Settings → Permissions interface. This enables organizations to:

• Enforce Segregation of Duties: Grant or revoke specific permissions to ensure proper separation between roles (e.g., separating risk assessment from risk response responsibilities)

• Meet Compliance Requirements: Customize access controls to satisfy regulatory requirements for least privilege access and role-based security

• Support Organizational Structure: Adapt default permissions to match your organization's unique governance model and reporting relationships

• Maintain Audit Trail: Track permission changes and identify deviations from default configurations for security audits and compliance reviews

The system provides granular permissions across 8 functional categories (Menu, Compliance Operations, Risk Operations, Entity Operations, Control Assessment Operations, Certification Operations, Audit Operations, and Settings). Administrators can modify individual permissions while the system clearly indicates which permissions are defaults, custom grants (+), or revocations (−).

Open

Permissions management interface

In addition to the seven predefined GRC groups, administrators can link their organization's own Jira groups into the GRC permission model. This is useful when a group already exists in Jira (for example a departmental or regional team) and you want to grant it GRC access without moving every member into a jira-grc-* group.

1. Go to Settings → Permissions and select Add group.

2. Start typing to search your Jira groups and select one. Groups that are already linked, or that are built-in GRC groups, appear disabled.

3. Optionally choose Copy permissions from an existing group to use its permissions as a starting point. Leave it empty to start with no permissions.

4. Select Add group. The group appears as a new column in the permission matrix, where permissions are granted exactly as for the predefined groups.

Hover over the group's column header and select the remove icon, then confirm. This removes the group and its GRC permissions from the plugin only. The Jira group itself is not deleted, and it can be linked again later. A relinked group starts with no permissions.

Important: custom groups are not part of the GRC security scheme, which grants issue visibility only to the seven predefined jira-grc-* groups. On sites where issue security is enforced (paid Jira plans), members of a custom group must also belong to a GRC group, or the security level must be extended to include the custom group, in order to view GRC work items.

• The Jira group must already exist. GRC never creates, renames or deletes Jira groups, including during uninstall.

• If a linked group is renamed in Jira, its GRC permissions follow it automatically. If it is deleted in Jira, it is flagged in the matrix rather than silently removed.

• Users who belong to several groups receive the combined permissions of all of them.

• Reset all to defaults clears the permissions of custom groups but keeps them linked.

• Custom groups control what users can see and do in the GRC interface. Saving plugin settings still requires membership of site administrators, organization administrators or jira-grc-configuration-managers, and workflow transition validations continue to check the predefined GRC groups.

Framework Management: Accountable for governing compliance framework components, including:

• Authority Documents

• Compliance Requirements

• Control Objectives

• Control Templates

• Control Assessment Templates

• Control Assessment Criteria

Operational Control: Oversee operational GRC processes, which involves evaluating control design, attestation, testing, as well as the registration and resolution of control deficiencies.

Audit Management: Responsible for outlining the scope of audits and their effective management.

Entity Management: Oversee and manage the entities they own.

Control Design: Craft appropriate controls for their entities.

Testing & Resolution: Undertake control assessments within the scope of audit, attestation, and monitoring, and address control deficiencies.

Testing Controls: Execute control assessments as per the control designs within the scopes of audit, attestation, and monitoring.

Documentation & Registration: Offer insights into testing results, supply evidence, and record control deficiencies when identified.

Framework Management: Accountable for governing the components of the risk framework, including:

• Risk Frameworks

• Risk Statements

• Risk Assessment Templates

• Risk Assessment Criteria

Operational Control: Oversees the operational risk management processes, involving the identification of risks, performance of risk assessments, risk response, and the design of risk mitigation controls.

Entity Management: Oversees and manages the risks they own.

Risk Assessment: Responsible for performing risk assessments for inherent, residual, and target risks, defining and implementing risk responses, and designing and implementing mitigation controls.

Audit Execution and Compliance Review: Responsible for conducting independent audits and reviewing compliance and control frameworks. Auditors can view and assess controls, register control deficiencies during audits, execute control assessments within audit scope, add entities to audits, generate control assessments for audit purposes, and manage control templates within audit context. They have read access to entities, business entities, incidents, and compliance data to support comprehensive audit activities, while maintaining independence by not having permissions to modify underlying compliance frameworks or control designs.

Users assigned to this role gain access to the Compliance settings and Risk settings pages, enabling them to perform key configuration tasks for the plugin. If a user holds both the GRC Configuration Manager role and the GRC Compliance Officer role, they are also granted access to the Compliance Bundles import functionality, streamlining compliance data management and import processes.

The assignment of users to these groups is exclusively carried out by the Jira administrator through standard Jira group management. Users are mapped to their respective groups based on their assigned role in the GRC process.

GRC project roles should be used only when the user has access to the application restricted while being able to work with GRC work items and perform workflow transitions.

To ensure that only authorized users can transition GRC issues through specific phases, the GRC for Jira plugin has set validations. These validations check if the user trying to move the issue from one status to another belongs to the necessary user group and has appropriate permissions.

All the access groups are bound to Jira GRC security scheme. This ensures only those users that belong to at least one GRC group have permission to view issues inside the GRC projects.

Notice: Security scheme assignment to the GRC project works only when a paid Jira subscription plan is used.

Consistent and accurate role assignment, combined with appropriate permissions configuration, is crucial to the efficient and secure operation of the GRC for Jira plugin. Administrators should:

1. Assign users to appropriate GRC groups based on their responsibilities

2. Review and customize default permissions to match organizational security policies

3. Regularly audit permission configurations to ensure compliance with regulatory requirements

4. Document any deviations from default permissions for security and compliance purposes

The permissions management system provides the flexibility needed to adapt the plugin to your organization's governance requirements while maintaining a secure and compliant GRC environment.