ISO 27001, NIS2 and CRA records in Jira and Confluence.
Security policies approved and acknowledged, awareness training recorded, incidents and product vulnerabilities reported on time, nonconformities closed with proof and security tests signed, where your engineers already work.
Runs on Atlassian Your data stays in your Atlassian site.
One app for each control you have to evidence.
Each app works on its own, on your existing pages and work items. Start with the control your next audit will sample.
- Clearlane Controlled Documents
Approve and review security policies
Named approvers sign with their signing password; the policy becomes effective and receives its next review date. Any later edit is flagged against the approved version.
- Clearlane Read & Understood
Get every policy acknowledged
People confirm the exact version they read, optionally answer comprehension questions and sign. Reminders go out, and a new version asks them again.
- Clearlane Breach & Incident Reporting
Report incidents and breaches on time
NIS2 early warning, notification and final report, GDPR notification within 72 hours, texts ready to paste, each submission recorded, a breach register.
- Clearlane CRA
Handle vulnerabilities in what you ship
Article 14 deadlines, ENISA fields ready to paste, SBOM search per version, support periods and CSAF advisories.
- Clearlane CAPA
Close nonconformities with proof
From an audit finding or an incident work item: root cause, signed plan, actions in Jira, dated effectiveness check.
- Clearlane Tests
Sign your security tests
Test cases linked to requirements, run in campaigns with signed results, coverage per requirement and a PDF report.
Requirement, what the app does, your part.
Control by control, for the evidence your teams already keep in Jira and Confluence.
| Requirement | What Clearlane does | Your part |
|---|---|---|
| ISO/IEC 27001 5.2 and A.5.1 Policies for information security | Controlled Documents: approval by named approvers with e-signatures and periodic review. Read & Understood: acknowledgement per person and page version. | Write the policies; decide who approves them and who must acknowledge them. |
| ISO/IEC 27001 7.5 Documented information | Controlled Documents: review and approval, current revision shown, changes after approval flagged, obsolete versions kept with their history. | Decide which documents your management system needs, and their review periods. |
| ISO/IEC 27001 7.3 and A.6.3 Awareness and training; NIS2 Art. 20(2) and 21(2)(g) | Read & Understood: confirmation per version, optional comprehension questions, reminders, records by person in PDF and CSV. | Define the programme, its audience and its frequency. |
| ISO/IEC 27001 A.5.24 to A.5.26 Incident management; NIS2 Art. 23; GDPR Art. 33 and 34 | Breach & Incident Reporting: qualification signed by the response team, every deadline from awareness, texts ready to paste, submissions recorded, breach register. | Write the incident process and submit through each authority’s channel. |
| ISO/IEC 27001 A.5.27 Learning from incidents; 10.2 Nonconformity and corrective action | CAPA: root cause, signed plan, actions as Jira work items, dated effectiveness check, signed closure, PDF evidence file. | Investigate, decide the actions and judge their effectiveness. |
| Cyber Resilience Act Art. 14 and Annex I Part II (manufacturers) | CRA: 24-hour, 72-hour and final-report deadlines, ENISA fields, SBOM per version, support periods, CSAF advisory. | Assess which products are in scope and submit through ENISA’s single reporting platform. |
| ISO/IEC 27001 A.8.29 Security testing in development and acceptance | Tests: test cases with steps and expected results, linked to requirements, signed runs and closure, PDF report. | Define the security tests and their acceptance criteria. |
ISO/IEC 27001 is cited in its 2022 edition. References are given to help you find the relevant requirement, not as a claim of compliance or certification.
Evidence your auditor can sample.
Policy evidence file
Signatures with name, date, meaning and fingerprint, revisions and acknowledgements.
Acknowledgement record
Who confirmed which version, when, how many tries, and the audit trail.
Incident evidence file
Facts, signed qualification and closure, each text sent with its date and reference.
Test campaign report
Results by step, bugs, signatures with fingerprints and requirement coverage.
Questions, answered.
- Does it replace an ISMS tool?
- No. It covers the records your teams keep in Jira and Confluence: policies, acknowledgements, incidents, corrective actions and tests. It does not hold your risk register, statement of applicability or asset inventory.
- Are we in scope of NIS2 or the CRA?
- That depends on your sector, size and products, and your legal assessment decides. NIS2 covers, among others, cloud, data centre and managed service providers; the CRA covers manufacturers of products with digital elements made available on the EU market.
- Where are our records stored?
- In your Atlassian site, in Atlassian’s Forge storage, following your site’s data residency. Clearlane runs no servers, and the apps never send your content to Clearlane. See our trust center.
- What does it cost?
- Controlled Documents, Read & Understood and Tests are free for up to 10 users. Breach & Incident Reporting, CAPA and CRA are paid from the first user, with a free trial.
Start with your security policies.
Controlled Documents and Read & Understood are free for up to 10 users: approve your policies and get them acknowledged before your next audit.