The document proposes a framework for mapping policies and their relationships to risks, vulnerabilities, compliance standards, security controls, and systems in Jira. This framework includes issue types for policies, risks, vulnerabilities, standards like GDPR and PCI, and systems. It defines relationship types like "mitigates", "is mitigated by", and "complies to" to link these issue types and represent how policies, controls, and standards address risks. Policies will be linked to the single source of truth in the G-Drive repository.

1. GDPR Mapping framework built into security mapping (being refined)
IT System VULN
RISK
Security
Control
Data
Journey
Data Touches Has VULN
Has RISK
Risk Reduced By
Data Source
Threat
Model
Security
Goal
meets
Business
Goal
Helps meet
Project
Mitigates
Has RISK
Used in
identifies

2. Proposed Policy Relationship Schema in Jira
ISO27001*
Policy
RISK
Vuln
GDPR*
mitigates
PCI*
Brand GRC*
IT System
Brand
GRC*
Brand
GRC*
Brand
GRC*
Ismitigatedby
Compliancemetby
Compliesto
Group GRC*
Has policy
Policy covers
Covers
Is covered by
Policy issuetype links via hyperlink to G-Drive policy repository as single ‘source of truth’. Confluence also linked via hyperlink to G-Drive for policies for consistency
* Issuetypes to be yet created.

3. Proposed Policy Relationship Schema in Jira v2
ISO27001*
Policy
RISK
Vuln
GDPR*
mitigates
PCI*
IT System
Is mitigated by
Compliance met by
Complies to
Policy issuetype links via hyperlink to G-Drive policy repository as single ‘source of truth’. Confluence also linked via hyperlink to G-Drive for policies for consistency
* Issuetypes to be yet created.
Security
Control
Meets
Is met by
Security
Goal
Meets
Is met by