Can I use Git for source control and still be SOX compliant?

Question

I'd like to consider migrating from Subversion to Git for my source control but my company is bound by SOX compliance.

Has anyone successfully implemented Git in a SOX compliant environment and if so could you elaborate on any of the potential pitfalls?

Thanks

Paul

Answer 1

Only your organisation and its processes can be SOX-compliant. If you're asking whether Git can be used to implement a version control/software development process which is SOX-compliant, you should clarify your question and provide links/information to the aspects of compliance (I assume you're referring to security/access control) which you're interested in instituting, if possible.

That having been said, since Git operates using a secure protocol (SSH), gives you a high degree of confidence in the integrity of a repo's contents (due to commit and tree SHA1 hashes), and can implement granular access controls (using e.g. Gitolite), the answer to your question is most likely ‘yes’