You probably want to look at an automated deployment solution and you are going to need a formal change control process. We use anthill pro. It can track what version and when it was deployed.
To satify sox we had a weekly meeting of what was getting deployed when. It had to be approved by compliance manager and each deployment needed to have a form filled out explaining what, why and how something was being changed. Once the form was filled out a third person had to be involved (not the person requesting or approving, neither of them can have access to the production environment, because of the seperation of duties rule you have to follow) to make the change and the change was based off of what was in the "change document" no outside communication from the person making the request. Once deployed, all people had to sign off that it was done and when.
发布评论
评论（3）
您可能想要查看自动化部署解决方案，并且需要正式的变更控制流程。 我们使用anthill pro。 它可以跟踪部署的版本和时间。
为了让红袜满意，我们每周召开一次会议，讨论何时部署什么。 它必须得到合规经理的批准，并且每个部署都需要填写一份表格，解释更改的内容、原因和方式。 填写表格后，必须有第三方参与（不是请求或批准的人，他们都无法访问生产环境，因为您必须遵循职责分离规则）来进行更改和变更是基于“变更文件”中的内容，没有来自提出请求的人的外部通信。 部署完成后，所有人都必须签字确认已完成以及何时完成。
You probably want to look at an automated deployment solution and you are going to need a formal change control process. We use anthill pro. It can track what version and when it was deployed.
To satify sox we had a weekly meeting of what was getting deployed when. It had to be approved by compliance manager and each deployment needed to have a form filled out explaining what, why and how something was being changed. Once the form was filled out a third person had to be involved (not the person requesting or approving, neither of them can have access to the production environment, because of the seperation of duties rule you have to follow) to make the change and the change was based off of what was in the "change document" no outside communication from the person making the request. Once deployed, all people had to sign off that it was done and when.
满足要求应该不会太难，可能需要对您的开发流程进行一些更改，但这绝对是可能的。
您需要的是：
还要开启审核、定期运行安全测试并记录几乎所有内容。
所有这一切都可以通过许多系统实现，最大的变化是内部流程的变化。
It shouldn't be too hard to meet the requirements, it might require some changes to your development processes but it's definately possible.
What you need is:
Also turn on auditing, run regular security tests, and document almost everything.
All of this is possible with a number of systems, the biggest change is the changes to your internal processes.
您可能想了解一下 NTFS 提供的审核功能。
You might want to take a look at the auditing features provided by NTFS.