During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?
Trap 1: The ISSMP personally reviewing every SQL script.
The ISSMP should provide governance oversight, not perform operational tasks, which creates a conflict of interest.
Trap 2: Allowing the automated CI/CD tool to deploy without human review.
Automation is excellent but requires human oversight to satisfy audit requirements for production changes.
Trap 3: Having the DBA perform the deployment in staging and production.
This violates separation of duties by allowing the developer to manage the deployment.
- A
The ISSMP personally reviewing every SQL script.
Why wrong: The ISSMP should provide governance oversight, not perform operational tasks, which creates a conflict of interest.
- B
Allowing the automated CI/CD tool to deploy without human review.
Why wrong: Automation is excellent but requires human oversight to satisfy audit requirements for production changes.
- C
Having the DBA perform the deployment in staging and production.
Why wrong: This violates separation of duties by allowing the developer to manage the deployment.
- D
Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).
This ensures that development, approval, and deployment are performed by different entities.