Lacre guide

Lacre adds to every Jira Cloud issue a panel with the project's checklist and buttons that seal the evidence: who checked and approved the change, when (in UTC) and a SHA-256 hash of the state of the issue and the checklist. This guide explains how to use it, from installation to the export for the auditor.

Lacre is under development and cannot be installed from the Atlassian Marketplace yet: this guide describes the version that will be published, and screenshots will be added once it is available.

Getting started

• Getting started: where the panel appears, what Lacre does with no configuration and the five minutes of settings worth reviewing before the first seal.

For people who check and approve changes

• Sealing and approving: ticking the checklist, choosing the risk, sealing the check and adding the approval, including prior approval for high-risk changes.
• Alterations and verification: what happens if someone edits the issue after the seal, the seal history and the "Verify" button.

For project administrators

• Administration: the Lacre settings page of the project (checklist, roles, fields, language), the export of the seals, the evidence sheet of a seal, the activity log and data deletion.
• The default checklist: the eight items every project starts with, and which measure of Spain's Esquema Nacional de Seguridad and which ISO/IEC 27002 control each one comes from.

For the auditor

• How a seal is verified: what goes into the hash and how to recompute it without Lacre or Jira.

Lacre provides evidence of how each change was checked and approved, but it does not decide whether an organisation complies with a standard: that is for its auditor to assess.