Project permissions for sensitive information

[SKellam]

I have an IT team that would like to move their work into Jira - they often work with sensitive employee information. We are currently set up with all users to be able to browse projects, and want to keep it that way, with the exception of this new IT team - what is the best way to approach?

[Kristin Lyons]

You could also configure issue security schemes - https://support.atlassian.com/jira-cloud-administration/docs/configure-issue-security-schemes/ This would only allow certain users to view the issues and the data within them, while all users can still view the project (if that's a requirement)

[Joe Pitt]

Create a new permission scheme and apply it to that project

[SKellam]

But wouldnt the rest of the users with 'browse' still be able to view work items?

[Joe Pitt]

In the new permission scheme only give people needing to work with the issues permission. You need to use project roles (I suggest) or have the Jira admin create a group (only admin can modify groups) to give just these people permission 

Out of the box Jira gives everyone who can logon permissions to everything (very bad model IMO)