InfoSec - data retention in Jira

[Mark Wheeler]

An auditor's findings from a recent ISO 27001 infosec audit was that we needed to more actively manage the data and files held on Jira in terms of data retention.

Does anyone else have experience of managing data retention in Jira or are there any plugins to help with this?

Ideally I'd like to keep my Jira issues forever for historic analysis SLA, billing, workload etc, but I don't need attachments and the data in certain fields. 

I guess I could use the bulk update functionality to select old issues and then obfusicate or clear data from certain fields.  Is there a way to remove all attachments from an issues as well?

Anyone know of any slick strategies or tools for managing data retention in Jira?

Cheers

Mark

[Fabio Racobaldo _Herzum_]

Hi @Mark Wheeler ,

Data will be keep in JIRA with no time limit.

A project, after a while, could be archived (https://support.atlassian.com/jira-cloud-administration/docs/archive-a-project/). After doing that you could archive related attachments through the following approach https://confluence.atlassian.com/jirakb/how-to-archive-attachments-of-archived-projects-1047559418.html or delete them just updating the script.

Hope this answer helps you.

Fabio