Documentation Question

[J Busch]

We have a new SOX requirement to maintain a log/list of all system changes including shell scripts, backup jobs, configuration changes, software install/remove, new cron jobs, cron job changes and anything else they might think of. What the auditor would like is a log/list of what was changed, why it was changed and who made the change and in some cases who approved the change. The log/list needs to be maintained separate then the Unix server. I want to keep this simple but am having a difficult time figuring something out. I would really like to stay away from another MS excel log/list if possible.

Does anyone have a simple solution they use for recording system changes????

[Marvin Strong]

The change control process itself should be adequate for SOX purposes. Whoever your change management team is should maintain all the change requests and approvals.

That is of course assuming you have a change management process in place.

[Jaime Bolanos Rojas.]

Jim,

Everything depends on how big your production environment is.
Mine was not that big, we used to have forms which we would filled the type of change, requirements, complexity, explanation of change, dates and times, people involved, etc, etc, and once it was ready we would send them to management for aproval, by e-mail of course, at the end we would just save that document in a folder or something bigger in a safe place.

Of course if you got like a big datacenter, you might need a lot of folders :-).

This template was created in word and use it all the time.

Also you can create a small access database that points to date and times that the changes were done and the document in which everything was documented.

Regards,

Jaime.