Dear Mike, <vendor>
Your question has merit. The essence of one response was:
"but what if you get hit by a bus?"
Even the bus scenario doesn't demand that very small shops implement a
robust software change and configuration management (SCCM) system. If
your company has one version of mods on a single operating system level,
one LPAR on one box, a modest pace of change, no contract programmers,
and deployment in just one nation, it's probably not a wise decision to buy a
SCCM product. Better to put a fraction of those $ into a robustly designed
insurance strategy. Then if a bus accident does happen, the company has the
cash to retain high-quality (read "same nation") contractors to sustain
operations after the accident.
Based on the one-person shops we are familiar with, A+ usage of a SCCM
product would stretch a ~55 hour work week into a 60-65+ hour work week.
The converse of your question also has merit.
It's amazing that so many large organizations could only find the will to
improve internal controls based on a SOX compliance rationale. Even when SOX
compliance is doing the pushing, the internal control enhancements we've
witnessed tend to be at the de minimis end of the scale .... just enough to
appease the auditors.
Three pertinent links:
"NoExcuses" (tm) HelpLine Support services for i/iSeries.
http://www.unbeatenpath.com/up-a-notch/noexcuses.pdf
This service is used by our one-person-shop customers as a bus accident
insurance policy. It's pay-as-you-go with a money-back-guarantee that
each support episode has high quality.
"up a notch" (tm) Vulnerability Assessment & Mitigation services:
http://www.unbeatenpath.com/up-a-notch/compliance/complianceservices.pdf
Opinion piece: "What shareholders should know about the exploding
responsibility for data integrity" --- >
http://www.unbeatenpath.com/OpinonatedArticles/DebrisCloud.pdf
This article was written in 2004 as the SOX compliance scramble was in full
flower; it's surprising what a large % of the content remains in the
middle of the target today.
Warm regards and peace to you,
Milt Habeck
Unbeaten Path International
www.unbeatenpath.com/compass
(888) 874-8008
</vendor>
From: Mike Cunningham
To: 'midrange-l@xxxxxxxxxxxx'
Sent: Wednesday, May 27, 2009 3:17 PM
Subject: RE: Source Code management - Migrating packages
I would agree on all of this if you have to comply with SOX but if you were non-SOX regulated, were writing software for use only by your company, and were the only programmer in your shop, would you still do this?
"five-minute changes" are not always bad. Say you have a values clause on a screen that prevents someone from entering some value you are not expecting and they need to be able to enter one new value. The field is only used in that one app to control how the data is sorted. You just need to change the values clause and the sort and the change is done, the user (who happens to be the head of the department that needs this changed made and has full authority to request and approve the change) goes away happy. Would you send this through 5 layers of process and approval just to make that change and add the cost of all that process to your company?
midrange.com
