Many of you in the US probably are familiar with Sarbanes-Oxley, Sarbox, by now.
Our external Sarbox auditors have told us we need to keep IT staff completely out of production databases. They have told us that we will need a “Fire ID” if we need to fix something in production.
A Fire ID is an ID/password that will be provided to a developer by calling the help desk - supposedly with a expiration time about 6 hours after its issued.
We can do this easily in a typical client/server or mainframe environment. But to me, the problem is how Notes ID files get distributed. I don’t know how we’d expire an ID/password.
We can’t just keep issuing new userids because they might need to update code in production. The issue then becomes keeping the ECL up-to-date.
We find ourselves in a bit of a conundrum 
So - have you had to deal with Sarbox auditors, and what solutions have you developed that make them happy?
Thanks in advance!
Dan