我可以使用 Git 进行源代码控制并且仍然符合 SOX 要求吗？
我想考虑从 Subversion 迁移到 Git 来进行源代码控制，但我的公司受到 SOX 合规性的约束。
是否有人在符合 SOX 的环境中成功实施了 Git？如果是，您能详细说明一下潜在的陷阱吗？
谢谢
保罗
I'd like to consider migrating from Subversion to Git for my source control but my company is bound by SOX compliance.
Has anyone successfully implemented Git in a SOX compliant environment and if so could you elaborate on any of the potential pitfalls?
Thanks
Paul
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
只有您的组织及其流程才能符合 SOX。如果您询问 Git 是否可用于实现符合 SOX 的版本控制/软件开发流程，您应该澄清您的问题并提供合规性方面的链接/信息（我假设您指的是安全/如果可能的话，您有兴趣建立访问控制）。
话虽如此，由于 Git 使用安全协议 (SSH) 进行操作，因此您对存储库内容的完整性具有高度的信心（由于提交和树 SHA1 哈希值），并且可以实现精细的访问控制（例如使用 < a href="https://github.com/sitaramc/gitolite" rel="nofollow">Gitolite)，您的问题的答案很可能是“是”
Only your organisation and its processes can be SOX-compliant. If you're asking whether Git can be used to implement a version control/software development process which is SOX-compliant, you should clarify your question and provide links/information to the aspects of compliance (I assume you're referring to security/access control) which you're interested in instituting, if possible.
That having been said, since Git operates using a secure protocol (SSH), gives you a high degree of confidence in the integrity of a repo's contents (due to commit and tree SHA1 hashes), and can implement granular access controls (using e.g. Gitolite), the answer to your question is most likely ‘yes’
市场上有一些产品（即 http://GitEnterprise.com）有助于提供额外的审计跟踪功能。尽管这些还不足以生成完全符合 SOX 的报告，但它提供了需要遵守 SOX 的公司（即金融、银行、从事支付的行业）所需的最低 ICT 安全要求。
请参阅 https://gitent-scm.com/gitent/doc/GitEnterprise/Auditing。 html
希望这有帮助。
卢卡.
There are products on the market (i.e. http://GitEnterprise.com) that helps in providing additional audit-trail capabilities. Even though those are not enough for producing a fully compliant SOX report, it provides the minimal ICT Security requirements needed by Companies that requires SOX compliance (i.e. Finance, Banks, Industries working on payments).
See https://gitent-scm.com/gitent/doc/GitEnterprise/Auditing.html
Hope this helps.
Luca.
我不明白为什么不，它们都可以配置为通过相同的协议（SSH）发送和接收数据。
I don't see why not, they both can be configure to send and receive data via the same protocol (SSH).