Simplifying SOX Compliance in DevOps

SOX is a vague piece of legislation with some crystal-clear penalties. Figuring out where you fit and how to be compliant can be a confusing journey, especially when there are processes already in place which claim to cover you. But how compliant are you really? And how are these processes influencing the way you work?

Grant Fritchey explores how IT Teams fit into this story and how to best protect your company and customers. Being compliant shouldn’t have to result in restricting your own work or slowing down your release time.

Some of the questions we answer include:
• How does SOX directly relate to DB DevOps?
• How can I be certain I am compliant?
• What are your options to ensure compliance without impacting work flow?

Grant Fritchey is a Microsoft Data Platform MVP with over 20 years’ experience in IT, including time spent in support and development. Grant is also President of the Professional Association of SQL Server Users (PASS).

****CHAPTERS****
00:00 Welcome & how to get in touch with Grant for questions
01:43 How DevOps can help with SOX
03:52 Caveats
06:07 What is Sarbanes-Oxley?
08:58 SOX and private companies
11:20 Four areas for tech folks
14:15 Adapting our methodology to DevOps
16:10 Three capabilities we must have
18:36 Provisioning databases
22:07 Data classification
26:30 Processes and documentation
28:00 Steps for DevOps Provisioning for SOX
32:50 Managing Deployments
35:36 Monitoring for prod and non-prod
38:30 Conclusions

[GardenOpus]

Interesting summary but there's nothing "vague" about SOX & DevOps/IT, so I will move on to a different presentation

[activefun]

1 - I'm not totally following why you need to be so careful with auditing non-production environments. The spirit of SOX seems to be to prevent bad financial reporting. Someone could write wildly inflated financial data to non-prod all they want. As long as it doesn't make it into fiscal reports does it matter?

2 - What happens if you haven't been following these processes for a while and can't provide documentation? Does that just mean your company may get fined?