A corporate lifetime ago policies and procedures were a nuisance put in place by management as a way to standardize business practices and attempt to use a single set of rules for everything everywhere they did business. And it was a drag. I have clear memories of my formative years on Wall Street with a seemingly endless row of binders on my cubicle shelf that appeared best suited to gather dust rather than provide anyone direction because in the end, well, all they did was gather dust. So the irony isn’t lost on me that here I am a decade or two later standing on my soapbox explaining why having things documented is a good thing.
Twenty years ago there really weren’t enforceable regulatory standards such as SOX or GLBA. Frameworks and assessment guidelines such as CobIT and NIST and ISO 17799 were either in their infancy or not yet developed. And so outside of a very few pockets of industry there wasn’t a whole lot of good reason to have to put down on paper what you did, why you did it and how you got it done. Sure there were the auditors that came around every now and again but things were simpler in those days and much of what they needed could either be found in the occasional dusty binder or grabbed from the data center operations library.
Today we live in a different world. There are a seemingly endless number of regulations in place that are tested monthly, quarterly, semi-annually and annually. There are rules as to how you must configure your network, your applications, your data (electronic and hard-copy), secure your facilities, your desktops, your laptops, your handheld’s. The only thing left is the kitchen sink and technically even that’s covered if the kitchen is located within the secured perimeter of a data center. The amount of work that must be done to be in compliance, to properly configure and secure your infrastructure is maddening.