SOX section 404 does not mean ops and dev can’t write code or deploy to prod respectively. It means there should be clear roles and oversight and insight into a

SOX section 404 does not mean ops and dev can’t write code or deploy to prod respectively. It means there should be clear roles and oversight and insight into authoritative sources. If there’s an incident in prod that requires code changes that ops knows how to fix, it doesn’t mean to wake up developers while waiting for a new build either. As long as it’s auditable, defensible to support the business, and there’s clear oversight it’s ok. For example, you may be able to temporarily assume a limited access role after recording that you have a business need to perform an action and the process can enforce another party that this taking place and provide temporary, time-sensitive credentials. Most shops that are bad or less mature at security processes don’t get this far and have code czars and prod czars.