TravisDBA (11/28/2012)
It's not just unencrypted data that auditors ding you on nowadays. Wearing many hats at once and doing things outside your job description can definitely get you dinged as well. SarBox standards are very picky on this nowadays..For example, we had an IT guy once caught moving furniture around in his cube and the auditors jumped all over that with managment and the man was reprimanded over it. Not in his job description, don't do it again. If you are a little shop you can still get away with a "Jack-of-all-trades" guy (I don't know for how long though), but that is no longer permitted at most larger shops or government agencies that fall under the strict auditing standards of today. Heck, the auditors dinged us for having our production clusters on the second node, left there after a failover!!!!! Picky, picky...:-D
My impression is that most "auditors" have no idea what they are doing, and just make things up like "no moving furniture if it isn't in your job description".