|
Checking IBM i OS and PTF Level Status for Sarbanes-Oxley Documentation
Published: September 5, 2012
Hey, Joe:
I have to write a quarterly procedure for our Sarbanes-Oxley manual that details how we make sure our IBM i operating system and PTFs are current. Our auditors want us to prove that we are up to date on upgrades and fixes. Any ideas on how we can do that? I'm on i 6.1.1.
--Bill
Here are my thoughts for doing this on a 6.1.1 system. Note: The process I'm describing here can be used to provide operating system and PTF review documentation for any auditing requirements, not just SOX.
Review your PTF and upgrade status at least twice yearly to ensure that you don't get too far behind in your PTFs and system upgrades. I like the idea of doing it quarterly because you can check your levels during your SOX quarterly audits. Going through this procedure isn't that difficult and it will help you stay up to date on your PTFs and operating system upgrades.
Here's how to do it.
First, document the current operating system version on your machine. You can easily view your current OS version by running the Work with Licensed Information (WRKLICINF) command on a green screen.
WRKLICINF
(Click graphic to enlarge.)
For i 6.1.1, the operating system level is the license term shown on this screen for the 5761SS1 product.
Print and date the WRKLICINF screen for inclusion with your Sarbanes-Oxley documentation.
Next, investigate and document that your operating system isn't going off support. The best place to do this is to go to IBM's Upgrade Planning: Operating Systems Release website. This is where IBM provides the historical and upcoming milestone dates for all current and past IBM i releases, including the End of Program support date for each release, which is the date when IBM will officially stop providing fixes and patches for the operating system. Print and date this page as documentation for what the expected supported life of your operating system is.
(Click graphic to enlarge.)
From this page, check your OS version against IBM's End of Program Support date for that operating system. If IBM has recently announced that your operating system is going off support (as it did with i5/OS V5R4Mx), you can note it on your documentation and create a project in your project management system for upgrade evaluation.
Regarding PTF evaluation, you can get a list of all your current PTF groups by using the Work with PTF Group (WRKPTFGRP) command to produce the following screen.
WRKPTFGRP
(Click graphic to enlarge.)
Print and date this screen shot for Sarbanes-Oxley documentation. Note that there isn't an option in i 6.1.x to output the WRKPTFGRP screen to a spooled file, so you'll have to perform multiple print screen commands to print the information.
Look closely at the PTF group(s) that you see marked as SF99610. These are your cumulative PTF groups. If more than one SF99610 PTF group exists, take the highest PTF group level number belonging to SF99610. That will be your current cumulative PTF level.
Once you have your PTF group levels, you can compare them against the System i PTF Guide, which is compiled by DLB Associates and published on the IT Jungle website. This guide contains the most up-to-date information about PTF releases that I've seen almost anywhere on the Internet. Here's a sample of what the guide looks like.
(Click graphic to enlarge.)
Print and date this PTF guide for your SOX documentation.
From here, it's again a simple matter to compare the PTF group level list you retrieved from the WRKPTFGRP command against the PTF guide. Highlight any PTF group that is higher (newer) than the PTF level on your WRKPTFGRP list. Those highlighted PTF groups are your download list for PTFs that aren't applied on your system.
Review this list with management, decide whether to download and install these PTF groups this quarter, document the decision, and create a project for PTF application in your project management system, if necessary. The management reviewer can even sign and date the list to designate whether there's a go or no-go decision for PTF application. The WRKPTFGRP list can be the key document for determining whether and which PTF groups need to be applied to the system.
Once you have your approved list of PTF groups to order, you can order the groups from IBM and schedule a date to apply them on your systems.
So between these four printouts--the WRKLICINF printout; the IBM Upgrade Planning Document; the WRKPTFGRP list; and the System i PTF guide--you have all the documentation to determine whether you need to plan for an OS upgrade and whether and what PTF groups to download for installation. You can then write up a SOX procedure that guides you through these steps and use the printouts as documentation each quarter for your operating system and PTF group review procedure.
HTH
--Joe
RELATED STORIES
Four Simple Rules For IBM i PTF Management
Big Blue Puts Out New Hardware PTF Group For IBM i 6.1 And 7.1
 Post this story to del.icio.us
 Post this story to Digg
 Post this story to Slashdot
|
