8. If I Were You: The Next 90 Days

The single most important thing

Get 3–5 audited Jira teams to pay for a hand-made change-control evidence pack before you build the app.

Segment: Jira Cloud sites of 30–500 users at companies with a SOC 2, ISO 27001 or SOX audit in the next 6 months.
Job: "Show my auditor that every sampled production change was approved by someone other than the person who did it, and tell me about the exceptions before they do."
How: a concierge pack. The customer's admin runs your JQL and exports the history (or you both do it on a call). You build the pack in a spreadsheet template: approvals, self-approvals, skipped steps, time in approval, a seeded sample. Charge $200–500 per pack. Automate only what you've done by hand at least 5 times.

The plan works at ~15 hrs/week. Full-time, compress weeks 5–10 by about a third and use the time for content.

Week-by-week

Weeks	Goal	Exit criteria
1–2	Discovery. 12–15 calls with Jira admins and engineering or compliance leads at audited companies. Ask for their last auditor request list, how long the Jira evidence took, and what they use today (screenshots, JQL, SaaSJet, Vanta or Drata). Check what Vanta and Drata already pull from Jira. Check the name (trademark, domain, Marketplace).	You can write the top 3 evidence requests in the buyers' words, with the hours each one took. You know whether compliance platforms already cover it.
3–4	Concierge packs. Offer 5–8 of them a paid evidence pack for their current or last audit period. Create the Forge developer account and a "hello changelog" app in parallel.	3+ paid packs. If fewer than 2 will pay, the pain isn't real at this price. Change the segment (JSM SLA evidence) or the job, not the pitch.
5–8	Build the thin v1 on Forge (Forge UI, no Connect, no egress). Event capture into Forge SQL, a slow resumable backfill, a required-path setting per project, the exceptions report, a seeded sample, and XLSX and PDF export with a hash. Private installs for design partners.	Design partners generate a pack themselves in under 15 minutes. Backfill of a 20k-issue project finishes without `429` errors.
9–10	List it. Marketplace listing: audit-first copy, screenshots of the exceptions report, docs, privacy statement, pricing tiers. Submit for approval (allow 1–3 weeks; approval time not verified). Publish 3 guides: "SOC 2 change management evidence from Jira", "Segregation of duties in Jira", "How auditors sample Jira changes".	Listing approved, with the "Runs on Atlassian" badge. Design partners moved to paid Marketplace subscriptions.
11–12	Measure and decide.	Listed, 3–5 paying sites, 20–30 trials, first exception shown within 24 hours for ≥70% of trials. Hit it: keep going with the monthly control check. Miss it: go back to discovery.

Kill criteria (write these down now)

If at day 90 you have fewer than 2 paying sites and fewer than 10 trials, or design partners don't use the pack in their actual audit, the wedge is wrong. Don't respond by adding reports. Respond by changing the buyer or the job, once. If it misses again, stop.

The one thing to stop doing

Stop planning a general "reporting suite" (time in status + SLA + roll-ups + audit) for "admins and PMOs".

It's four crowded categories, one of them led by a free app with ~10.5k installs. It's a year of building before the first sale, and the listing can't rank for any of the four. Every week spent on roll-up charts is a week not spent finding out whether an audited team will pay for evidence.

A close second: stop thinking of time in status as the product. It's a table inside the evidence pack.

What stays on the long-term roadmap (only after proof)

Monthly control check delivered to a Confluence page (retention).
SLA and approval-time evidence for audited service desks (the second revenue line).
Emergency-change handling and linked-evidence checks (PR, deploy, test).
Security self-assessment and SOC 2 for the app itself, once there are 50 paying sites.
Then, only if Jira customers ask, a Confluence or JSM app on the same evidence engine.