Vouchline by RETEKMapping to ISO/IEC 27001:2022 and NIS2
Every finding carries the requirements it relates to. They are shown on the Rules tab, on each review item, in the report and in Items (CSV).
Read this first
The mapping is an aid, not a certificate. Vouchline supports the evidence for the requirements below; it does not make an organisation compliant with them. Which requirements apply to you, and whether an access review in Jira is sufficient evidence for them, is decided by your auditor or by the person responsible for your ISMS — not by a tool. The report repeats this statement.
Vouchline covers access to Jira Cloud only. A control such as A.5.18 applies to all your systems; a review in Vouchline is evidence for the Jira part of it.
Rules and requirements
| Rule | What it reports | Requirements |
|---|---|---|
| R1 | Permission actor with no access to any Jira product | ISO 27001 A.5.16, A.5.18 · NIS2 21(2)(i) |
| R2 | Permission granted directly to a user, bypassing roles and groups | ISO 27001 A.5.15 · CIR 11.2 |
| R3 | Group whose members × project roles exceed a threshold | ISO 27001 A.5.15 · CIR 11.2 |
| R4 | Project without an accountable human owner | ISO 27001 A.5.9 |
| R5 | Permission scheme not assigned to any project | ISO 27001 A.5.15 |
| R6 | Project lead who is also a subject of the review in that project | ISO 27001 A.5.3 · CIR 11.2 |
| R7 | App account in a project role outside the system add-on role | ISO 27001 A.8.2 |
| R8 | Service account registered as a regular user account | ISO 27001 A.8.2, A.5.16 |
| R9 | One person leading many projects | ISO 27001 A.5.3, A.5.18 · CIR 11.2 |
| R10 | Inactive app account still holding a role | ISO 27001 A.5.18, A.8.2 |
| R11 | Group with members but no Jira grant found | ISO 27001 A.5.15 |
| R12 | Privileged permission granted to every user | ISO 27001 A.8.2, A.5.15 · NIS2 21(2)(i) · CIR 11.3 |
| R13 | Deactivated account that still holds access | ISO 27001 A.5.18, A.5.16 · NIS2 21(2)(i) · CIR 11.2 |
| R14 | Account holding site or Jira administration | ISO 27001 A.8.2, A.5.18 · NIS2 21(2)(i) · CIR 11.3 |
Thresholds for R3 and R9, the name patterns for R8 and the list of privileged permissions for R12 are set on the Settings tab. The values in force when a review is created are recorded with it and printed in its report.
The requirements
| Code | Source | Title |
|---|---|---|
| ISO27001:A.5.3 | ISO/IEC 27001:2022, Annex A | Segregation of duties |
| ISO27001:A.5.9 | ISO/IEC 27001:2022, Annex A | Inventory of information and other associated assets |
| ISO27001:A.5.15 | ISO/IEC 27001:2022, Annex A | Access control |
| ISO27001:A.5.16 | ISO/IEC 27001:2022, Annex A | Identity management |
| ISO27001:A.5.18 | ISO/IEC 27001:2022, Annex A | Access rights (provisioning, review, removal) |
| ISO27001:A.8.2 | ISO/IEC 27001:2022, Annex A | Privileged access rights |
| NIS2:21.2.i | Directive (EU) 2022/2555, Art. 21(2)(i) | Human resources security, access control policies and asset management |
| CIR:11.2 | Implementing Regulation (EU) 2024/2690, Annex 11.2 | Granting, changing and revoking access rights |
| CIR:11.3 | Implementing Regulation (EU) 2024/2690, Annex 11.3 | Privileged and administrative access rights |
Who the Implementing Regulation binds
Regulation (EU) 2024/2690 does not apply to every NIS2 entity. It is binding only on the entity types listed in its Article 1: cloud computing, DNS and TLD registries, data centres, content delivery networks, managed service and managed security providers, online marketplaces, search engines, social networking platforms and trust service providers. Other NIS2 entities are bound by Art. 21(2) of the directive and its national transposition instead. The CIR codes are relevant to you only if you are one of the listed types.
What the review itself is evidence of
Independently of any single rule, a closed review shows that:
- the state of access was captured at a known moment, with a checksum;
- each finding was assigned to a named person, with the reason recorded;
- that person decided and wrote a justification, at a recorded time;
- decisions marked "to revoke" or "deferred" are followed up in the next review, which reports whether the access is still in place;
- nothing was changed after closing — which anyone can check, see Verify an evidence package without Vouchline.
This is the periodic review that ISO/IEC 27001:2022 A.5.18 expects for access rights. Vouchline records that the review happened and what was decided; acting on the decisions remains with your administrators.
Switching a rule off
A rule that is switched off is not silently dropped. Every report lists it as not evaluated, and the Rules tab warns when switching rules off leaves a requirement with no rule at all.