Guy_duxncx Atlassian Team

@Pavol Harvanka We looked at turning this into a product and as an org decided against it. This has sort of reached the limit of my technical knowledge - I will see if I can find someone that can help with screens/transitions and fields to help you.

Atlassian Access is a subscription that is deeply integrated into the identity system that is used across all our products and services, so it is implicitly covered in all audits of our products. At the moment there are no plans to do a separate SOC2 specifically for Access.

DevOps vs. Compliance: A Guide to Having it All

@Shuichi Sakai We built an app internally - I think that there are a couple on the app store that do the same thing.

@jimmi.handoko reach out to me directly - guy@atlassian.com and let's talk - might be a good idea to get your Jira admin on the call as well.

@jimmi.handoko It takes about a half a day for an experienced Jira admin to set up the fields, flows and screens. After that the work is in creating your obligations and objectives - and spending time with the teams to understand their control activities. But you will have to do that with any tool that you purchase (even…

I wish that we had a way to template this - we are working on it. In the meantime - sorry but that is all we have. For the mapping of fields to screens - will find out what we can generate and let you know. And I am working on the other blogs (have had some risk and compliance work to do as well). 

Nesia - absolutely - we love to share. email me at guy@atlassian.com

Part 2 has all the information about the fields, workflows etc.

Something that is really important and I am not sure that I have highlighted - when you bring in a new compliance obligation DON'T create a whole new set of control objectives. Bring it in as a compliance obligation and then work out which existing control objectives map to the new obligation. For obligations not covered…

Everyone - thanks for the questions - I know that I have been a bit quiet - but lets fix that. Andrew - We created a set of fairly generic risks - if you get too specific on these you end up with a million risks and people saying - no, my risk is a bit different to that. The risk drivers were a way for us to look closer at…

Will do a couple of posts in the new year to talk about the general background of how we manage risk and compliance and how we report what we have in the data. Great feedback and thanks

We have our asset repository in another Jira project and we link to those where we think it is appropriate. At the moment we don't have a strong linkage between them - the risks are higher level than that in the GRC project. We do more at the team level and the control activities for that team.

This is what our project looks like in Jira - https://community.atlassian.com/t5/Agile-articles/How-Atlassian-uses-Jira-to-manage-risks-and-compliance/ba-p/896891

Thanks for pointing that out - fixed

It is a Jira project. We are currently pulling together the information on the project and will be posting to the community space this week. This will include the fields, workflows and screen information so that you can use that for your own project. Happy to share what we have done.

If you swipe left on the checklist name it gives you the option to hide completed items or delete. This also works on the iphone app.