Satisfying External Auditor requests for software deployment using JIRA

[John Parchman, CCSP]

We at a least annually get an audit requests such as the following:

1. Provide a system-generated listing of {insert major application here} code changes deployed to the production information system since {insert date here}.
2. Provide a system-generated listing of {insert major application here} database changes deployed to the production information system since {insert date here}.

We have some thoughts on how to accomplish this but I wanted to get the community's  thoughts as well regarding transitions, hooks back from GitLab to Jira, Jira Workflows, etc. to satisfy these audit requests.

[John Price]

It depends on whether your deployments are automated or manual, but you can accommodate both I think.   Normally I don't suggest a lot of customized Issue Types, but in this case it may be warranted for ease of auditing and clarity.  Something like:

• Create a Software Release issue type and add whatever fields are needed for auditing.  Try to limit custom fields if the description will do.  Maybe just
  • Select list of Deployment Environments
  • Select list of Products 
  • ??
• For manual releases you can create a Software Release issue and populate as needed.
• For automated pipelines, you can have a standard/templated deployment action or step that creates an issue in Jira (push model).  You'd have to think about how to permission that.

One downside is that it won't scale nicely if your app consists of microservices or a lot of tiny bits.  You also probably don't want to execute this for lower environments.  "Hey , I pushed the shipping calculator service to QA for the 80th time today!"