On 31 Dec 2005 00:21:24 GMT, Dave Hinz
wrote:

On Fri, 30 Dec 2005 16:34:10 -0600, George Shouse wrote:

I work for one of the top 100 corporations in the world that
happens to be a bank. Their policy is the same in large part
due to SOX & OCC requirements. Open Source including Linux can
be used for non-monetary and non-reporting applications like
analytics or campaign management. If it is mission critical,
customer facing, handles monetary transactions or participates
in external reporting there must be a vendor support agreement
in place.

You say those two things like they're related somehow? Of course you
can get a support contract for Linux. Anyone saying otherwise is
spreading FUD, either through ignorance, or due to an agenda.

You snipped a little too much. Odinn typed "won't allow us to
use Linux unless we pay for support" which is true for us,too.
We actually have some Linux supported by IBM.

Smaller banks within a single state and especially community
banks can play a lot faster and looser.

The company I work for (for the next two weeks; just gave notice) is,
let's say, a large name in the mortgage insurance business. We've got
the same governmental requirements, and were temporarily delayed on
several Linux projects by the whole SCO idiocy thing, but I stand by my
statement that the SOX and other folks want to know about recordkeeping
and policies and procedures, how vulerabilities are handled, and all
that, more than what type of Unix we're running.

I've been audited by OCC, PwC, E&Y, and the 2 internal groups.
All but the internal groups are interested in the supportability
of the OS and all other software as a SOX control point. I
suppose that it might be possible to argue that the necessary
support exists within the organization but I've generally heard
from other bank IT guys that the path of least resistance with
the highest level of CYOA is hire that control point out. I've
always gotten away with convincing them that we are purely
analytic.