Hi Folks, I've been lurking on this list for a while but now need some guidance you all may be able to provide. I'm developing a computer network for a 21 CFR Part 11 regulated business. I'm looking for something that describes the Debian auditing process so support the notion that it is viable for managing pharmaceutical industry data.
I've seen the Debian Social Contract, the Debian Policy Manual and the "Security Information" but I don't see anything that describes the update auditing process, or the vulnerability notification process (other than subscribe to the list). So for our operational documents I'm thinking we must follow some third party notification such as OVAL-ID and CVE Name and compare with Debian updates. (Maybe should be done in any event) But what I'm not seeing is a description of the process for updates to go to distribution. There must be a procedure beyond somebody submits a patch and... but I cannot find any description of that procedure. I'll probably have to write debian-security, but since my concern is primarily for 21 CFR Part 11 regulation I thought this list might provide some useful info. For general interest, I'm posting some policy related documents below. Thanks, // George http://www.debian.org/doc/debian-policy/ Debian Policy Manual http://www.debian.org/social_contract Debian Social Contract http://www.debian.org/security/ Security Information http://www.secinf.net/policy_and_standards/Building_Implementing_Security_Policy1228.html Building and Implementing a Successful Information Security Policy -- one of the most comprehensive guides on the design and implementation of an effective security policy for your company. http://www.securitydocs.com/thread/280 Information Security as a Process, By: Mitchell Rowton http://www.securitydocs.com/ http://www.securitydocs.com/Security_Policies/Sample_Policies or follow links... Security Policies > Sample Policies http://www.wiretrip.net/rfp/policy.html Full Disclosure Policy (RFPolicy) v2.0 http://www.sans.org/resources/policies/ The SANS Security Policy Project -- George Georgalis, systems architect, administrator Linux BSD IXOYE http://galis.org/george/ cell:646-331-2027 mailto:[EMAIL PROTECTED]
