Using document control

Purpose

Controlled documents are a core part of every ISMS: a policy is only valid once it has been approved — and it only takes effect once the people concerned have read it. Document control maps exactly that, right on the Confluence page: Approval (by defined people/groups) and Read confirmation, enabled per page individually or together, with an audit-proof log.

Where you work with it

Who may do what

Setting up control (owner/space admin)

1. Open the page and click Dokumentenlenkung · Document control below the title. For you, the dialog has the tabs Status, Settings and Log.
2. In the Settings tab, enable the blocks you need: Approval and/or Read confirmation (each section has an Enabled toggle).
3. Under People & groups, pick the participants (search field “Search names or groups…”). Groups are resolved when a round starts (snapshot) — later group changes apply from the next round. Atlassian Teams cannot be selected; use the group behind the team.
4. Approval only: choose the Approval rule — One approval is enough, Everyone must approve or Majority (more than 50%); the dialog does the maths: “With 5 approvers: 3 approval(s) needed.”
5. Optional: set Due within (days, 0 = none) and Remind every (days, 0 = off); with both blocks active, Start read confirmation only after approval is granted (default: on) ensures the approved version is what gets confirmed.
6. Choose the behaviour On a new page version: Ask (default, recommended), Always or Never.
7. Optional: Check reachability shows before starting how many recipients would receive no e-mail (no Jira access).
8. Click Save — or Save & start round to begin immediately. Later, steer rounds via Start new round and Withdraw round.

Approving or confirming (all participants)

1. Open the page (link from the e-mail or from My tasks) and click the document-control entry below the title.
2. Approvers: in the section “Your approval is requested”, optionally add a comment (“Comment (optional, recommended when rejecting)”) and click ✓ Approve or ✕ Reject.
3. Read confirmation: tick “I have read and understood this document.” and click Confirm now.

Result: your decision is recorded immediately with name, timestamp and document version (“You approved/confirmed this version.”). Owners see the complete log in the Log tab; entries are never changed or deleted.

New page version

If a controlled page is deleted or moved to the trash, the control is suspended and open rounds are closed — the log is kept in full.

Notifications and Jira evidence

• Participants receive a personal e-mail per round via Jira — with instructions and a link to the page. Deciding always happens on the page itself; the e-mail deliberately contains no decision buttons.
• Platform limit: the e-mail only reaches accounts with access to the ISMS project (Jira licence). Confluence-only users get no e-mail — they see their task below the page title and in My tasks. The breakdown shows each person’s delivery state (Delivered / No email / Failed).
• Reminders run daily at the configured interval; overdue rounds are escalated once to the page owner.
• Per controlled document the app keeps one Jira collector issue (type Document) and per round one subtask (type Control Round, e.g. “Freigabe · Information security policy · v3”) as an audit-proof record — please do not delete them. The Jira issues tab shows both; the document-control values are authoritative, the Jira status is supplementary.
• The site-wide switch sits in Setup (card Document control — notifications, toggle “Send notifications (mentions + approval emails)”; default: on). With it off, everything keeps working — tasks then appear only in Confluence.

Licence

Reading always stays possible. Without a valid licence the dialog shows: “No valid licence is active for document control. Existing data stays visible, but changes and new approval/confirmation rounds are blocked.”

Related pages

• Installing the Confluence space
• Roles and permissions
• Privacy and data erasure