Re: Separation of Duties...

Can they, on the other hand, give a compelling reason why they should be separate functions from a control or security standpoint? If not (and I can't come up with one), it sounds like they are used to dealing with Windows or mainframe shops where the workload is simply too much for (normally) one person to deal with.

Admittedly ours is a small shop even though we have two [2] i5's, but I am the DBA, SA, operator, programmer, etc. for both of them. Upon occasion I suppose it does get a little rushed, but generally that's the way it's done in i5 shops (with variations depending upon size). On the other hand, we're a privately held company so SOX doesn't apply to us. We (IT) do get audited though every year, but they're Windows guys and, since they send a new one out each year, I have to explain the ground rules (the i5) over each time.
* Jerry C. Adams
*IBM System i Programmer/Analyst
B&W Wholesale Distributors, Inc.* *
voice
615.995.7024
fax
615.995.1201
email
jerry@xxxxxxxxxxxxxxx <mailto:jerry@xxxxxxxxxxxxxxx>



Graap, Kenneth wrote:

We are in the middle of an IS Audit and the auditor is asking us why we
don't separate the duties of DB Administrator and System Administrator
on our System i platform.

.Historically we have always combined these duties on the System i but
we are now being pressured to come up with a way to separate them.

As anyone else had to do this and if so, how did you define these duties
and set up system security to enforce it?

or ... can anyone share a compelling argument for not separating these
duties?

Kenneth

****************************************
Kenneth E. Graap
IBM Certified Specialist iSeries Multiple System Administrator
NW Natural (Gas Services)
keg@xxxxxxxxxxxxx
Phone: 503-226-4211 x5537
FAX: 503-721-2518
****************************************