I’m working on getting buy-in from internal audit department on using Inspec to ensure systems are compliant.
The auditors are asking that when a server has a misconfiguration (say the web server is not running) to correct it, but I need to open a ticket in our ticketing system for tracking.
Does anyone have experience in doing this (our ticketing system can accept emails), or alternative approaches to appease the auditor?
What the auditors are looking for is history of changes, and then what we did for root cause analysis.