Going to bed now...

[bjarvis]

After my haircut this morning, I dashed into one of my employer's downtown offices to print off the completed policy documents, 199 pages in all. God willing, on Monday I get a tonne of signatures on these papers from various corporate directors and that particular portion of my Sarbanes-Oxley death march (SODM) will be completed.

Which takes me to the second step of my SODM. sigh

A policy describes the legalize about various practices within my department. Standards describe a specific implementation of the policy so every standard needs to be (a) written and (b) linked back to its relevant parent policy document. Operating guidelines list considerations for a given UNIX platform in support of the standard. Procedures are precise, line-by-line instructions on how a task is conducted such that a trained chimp an intern could do it successfully.

The hierarchy looks something like this:
policy -> standard -> operating guideline -> procedures

Some policies were already 99% assembled but they needed links to policies. I've finished that small task tonight, as well as updated my spreadsheet tracking all of these little pieces. I can sleep now.

Tomorrow, I have to revise my tracking spreadsheet further, ensuring that I have a to-do list of standards which must yet be written to comply with my freshly minted policies. Whee. And on Monday, I get to start writing those missing standards.

I don't even want to think about the procedures and operating guidelines documentation yet.

Comments

[ciddyguy.livejournal.com]

Don't cha love love legalese speak? It takes 3 sentences to say what really should be said in one. :-)

Makes for a boring as shit read if you ask me.

[bjarvis.livejournal.com]

More like 10 sentences to say what should be done with one.

I refer to these as "write-only" documents: no real human being will ever read these pieces again. The sole reason they exist and are designed in this fashion is to please auditors. The folks who actually do things with our servers require much shorter & concise documents, and fewer of them so that we can find the key information quickly. When a server is down, I don't care who authorized the document or why they wrote it: I just want enough info to get the server back up asap.

[ciddyguy.livejournal.com]

When a server is down, I don't care who authorized the document or why they wrote it: I just want enough info to get the server back up asap

Exactly.