Jira · v1.0.0 · Planned
ControlDesk
POA&M and control tracking for Jira
Run your Plan of Action and Milestones in Jira — with the deadline maths, evidence trail and export the auditor asks for.
- POA&M workflow
- Severity-based deadlines
- Evidence trail
- Auditor export
The gap it closes
Federal and defence compliance programmes run on a Plan of Action and Milestones: every open finding, its severity, its remediation deadline, who owns it, and the evidence that it was fixed. Almost everyone tracks that in a spreadsheet, separately from the tracker where the actual remediation work happens.
The two drift immediately. The spreadsheet says a control is remediated; the ticket says it is in progress; the auditor asks which is true.
Nothing on the Marketplace closes that gap for these programmes specifically. ControlDesk keeps the finding and the work in one place — and unlike everything else in this portfolio, it needs no external service at all, so it stays entirely inside Atlassian.
How it works
Three steps, then it runs itself.
- 01
Findings become real issues
Each finding carries its control identifier, severity, weakness description, owner and remediation deadline as structured fields — not free text in a description.
- 02
Deadlines calculate themselves
Severity drives the remediation window using the timelines these programmes actually mandate, so a high-severity finding cannot quietly inherit a low-severity due date.
- 03
Evidence stays attached to the finding
Remediation evidence, milestone dates and closure notes live on the issue, so the audit trail is the work record rather than a reconstruction of it.
How it behaves
The decisions that matter.
-
A missed deadline is visible, not silent
Overdue findings are surfaced against their calculated deadline. A compliance tracker whose overdue items look identical to its on-track items is worse than no tracker.
-
Closing a finding requires the evidence field
A finding cannot be marked remediated with an empty evidence trail — that is the exact state an audit is designed to catch.
-
The export is generated from live issues
The auditor-facing export is produced from the current issues at the moment you run it, so it cannot disagree with the tracker.
-
No external service, at all
The app declares no outbound network access. For programmes with data-residency and boundary requirements, that is not a nice-to-have — it is the reason this one is built without any egress.
Where it runs, and what it reaches
Nothing leaves Atlassian.
This app declares no external network access at all. It runs on Atlassian’s own infrastructure and talks to nothing outside it — there is no third-party service in the path to review.
Runs on
Atlassian Forge (runs on Atlassian’s own infrastructure)
Your credentials live in
Forge encrypted secret storage, inside your own installation
Surfaces it adds
Jira admin page, Issue panel, Custom fields, Scheduled trigger
Pricing
Priced per user, billed by Atlassian.
Every paid plan starts with a free 30-day evaluation, arranged by Atlassian. Atlassian collects the payment, handles invoicing and tax, and is the merchant of record — so this app appears on the Atlassian bill you already pay, not a separate one from me. Sites of ten users or fewer pay one flat monthly rate.
Evaluation
Free
Up to 10 users
$20/month
11–100 users
$2.00/user/mo
101+ users
$1.40/user/mo
Indicative pricing for an app that is not listed yet. The rate on the Marketplace listing is the one that applies.
Documentation & data handling
Everything it touches, stated plainly.
Installing & getting started
- Install ControlDesk from the Atlassian Marketplace into your Jira site and review the permissions listed here.
- Open Settings → Apps → ControlDesk and work through the three steps above.
- Your evaluation runs for 30 days with everything switched on, so it can prove itself before you pay for it.
- Stuck? Email [email protected] — one business day response.
Permissions, and why each one
read:jira-work- Read findings to compute deadlines, flag overdue items and build the export.
write:jira-work- Write the calculated deadline and compliance fields back onto the finding.
storage:app- Hold the programme configuration — which severity maps to which remediation window.
What is stored, and where
- Nothing leaves Atlassian. The app declares no external egress, so no finding, control identifier or piece of evidence is transmitted anywhere outside your own site.
- Findings and their evidence are ordinary Jira issues under your own project permissions.
- Only the programme configuration is kept in the app’s own storage inside your installation.
- Uninstalling removes that configuration. Your findings remain as issues.
Technical detail
- Version
- 1.0.0
- Platform
- Atlassian Forge
- Runtime
- Node.js 22 — Forge runtime
- Products
- Jira
- Modules
- Jira admin page, Issue panel, Custom fields, Scheduled trigger
- External connections
- None
- Billing
- Paid through the Atlassian Marketplace
- Support
- [email protected]
- Support SLA
- One business day
- Publisher
- Builds By Luke, Canada
Questions people ask.
Does this make my organisation compliant?
No, and no tool can. It tracks findings, deadlines and evidence in one place so the programme is auditable. The compliance work remains yours.
Does any data leave my Jira site?
No. The app declares no external network access whatsoever — deliberately, because the programmes it serves care about exactly that.
Can I change the remediation windows?
Yes. The severity-to-deadline mapping is configurable, with the standard timelines as the starting point.
ControlDesk is on its way.
It is on the build list for the Atlassian Marketplace. If you want it sooner — or want it to do one specific thing — that is genuinely useful to hear.