Security exception approval template
For teams that need to deviate from a security policy. The risk owner documents the risk and compensating controls, a security architect reviews them, and in stage 3 the CISO or delegate accepts the residual risk with a review date at most 12 months out.
- App: Approval Flow for Jira
- Category: Security and access
- Edition: Needs a paid licence (approval policies are a paid feature)
- Sign-offs: 4, 4 required, in sequential stages
Sign-offs
#| Sign-off | Required | Approvers needed | Stage |
|---|---|---|---|
| Risk owner describes the risk and compensating controls | Required | 1 | 1 |
| Security architect reviews the controls | Required | 1 | 2 |
| CISO or delegate accepts the residual risk | Required | 1 | 3 |
| Review date set (at most 12 months) | Required | 1 | 3 |
A stage opens only when every lower stage is signed off. Sign-offs without a stage can be given at any time.
Use it
#A Jira administrator opens Jira settings, Apps, Approval Flow settings, tab Templates, and clicks Install next to the template in the Template library section. It becomes an ordinary approval policy: apply it to a work item from the panel, or map it to an issue type. Approvers are people, so templates never contain any: assign them on the work item or with an approval rule.
Related
#- Approval Flow for Jira documentation
- Jira approval templates: all 24 templates