it-infrastructure/README.md

IT Infrastructure Quality Management System

A comprehensive QMS template designed for IT departments, managed service providers, and technology infrastructure teams in regulated industries.

💻 Designed For

• Healthcare IT Departments - Hospital and clinic technology teams
• Managed Service Providers (MSPs) - IT service organizations
• Data Centers - Colocation and hosting facilities
• Cloud Operations Teams - AWS, Azure, GCP management
• Cybersecurity Teams - Security operations centers
• Research Computing - HPC and scientific computing
• Compliance-Focused IT - HIPAA, SOC 2, PCI environments

📋 Regulatory Framework

This template supports compliance with:

• ISO 27001 - Information Security Management Systems
• SOC 2 - Service Organization Control (Trust Services Criteria)
• HIPAA Security Rule - Healthcare information security
• NIST Cybersecurity Framework - Security controls and practices
• PCI DSS - Payment Card Industry Data Security Standard
• GDPR - Data protection requirements (if applicable)
• FISMA - Federal information security (government)
• CIS Controls - Center for Internet Security benchmarks
• ITIL - IT Service Management best practices
• COBIT - Governance and management of IT

Repository Structure

├── SOPs/
│   ├── Change-Management/     # Change requests, approvals, implementation
│   ├── Incident-Response/     # Security incidents, outages, escalation
│   ├── Access-Control/        # User provisioning, authentication, authorization
│   ├── Backup-Recovery/       # Backups, disaster recovery, business continuity
│   ├── Security-Operations/   # Vulnerability management, patching, monitoring
│   └── General/               # Document control, training, CAPA
├── Forms/
│   ├── Change-Requests/       # RFC forms, CAB meeting records
│   ├── Incident-Reports/      # Incident tickets, post-mortems, RCA
│   ├── Access-Requests/       # User access, privilege escalation forms
│   ├── Audit-Checklists/      # Security audits, compliance assessments
│   ├── Asset-Inventory/       # Hardware, software, license tracking
│   └── Training/              # Security awareness, competency assessments
├── Policies/                  # IT and security policies
├── Work-Instructions/         # Step-by-step procedures
└── Templates/                 # Document templates

Document Numbering Convention

• POL-XXX: Policies
• SOP-CHG-XXX: Change Management SOPs
• SOP-INC-XXX: Incident Response SOPs
• SOP-ACC-XXX: Access Control SOPs
• SOP-BAK-XXX: Backup and Recovery SOPs
• SOP-SEC-XXX: Security Operations SOPs
• WI-XXX: Work Instructions
• FRM-XXX: Forms and Records

🤖 AI-Powered Assistance

This repository includes AtomicAI, your IT infrastructure QMS assistant. Mention @atomicai in any issue or pull request to:

• Draft change management and incident response procedures
• Create access control and user provisioning SOPs
• Generate backup and disaster recovery plans
• Develop security policies and procedures
• Create audit checklists and compliance documentation
• Review documents for ISO 27001/SOC 2 compliance

Example Prompts

• "@atomicai create an SOP for change management with CAB approval workflow"
• "@atomicai draft a security incident response procedure"
• "@atomicai write a user access provisioning and deprovisioning SOP"
• "@atomicai create a disaster recovery plan template"
• "@atomicai develop a vulnerability management procedure"
• "@atomicai create a patch management SOP with testing requirements"

Getting Started

1. Establish Governance - Define IT policies and approval authorities
2. Implement Change Management - Configure RFC and CAB processes
3. Set Up Incident Response - Create escalation procedures and playbooks
4. Define Access Controls - Establish user provisioning workflows
5. Train Staff - Security awareness and procedure training

Key Documents to Create First

1. Change Management SOP - RFC, approval, and implementation workflow
2. Incident Response Procedure - Detection, containment, recovery, post-mortem
3. Access Control Policy - Least privilege, authentication, authorization
4. Backup and Recovery SOP - Backup schedules, retention, testing
5. Vulnerability Management SOP - Scanning, prioritization, remediation
6. Patch Management SOP - Testing, deployment, rollback procedures
7. Business Continuity Plan - DR procedures and RTO/RPO targets

Special Considerations for IT Infrastructure

Change Management

• Request for Change (RFC) documentation
• Change Advisory Board (CAB) process
• Risk assessment and testing requirements
• Rollback procedures
• Post-implementation review

Security Operations

• Vulnerability scanning and assessment
• Penetration testing programs
• Security monitoring and SIEM
• Threat intelligence integration
• Incident detection and response

Access Control

• Identity and access management
• Privileged access management
• Multi-factor authentication
• Access reviews and recertification
• Termination and offboarding

Business Continuity

• Disaster recovery planning
• RTO/RPO definitions
• Backup verification and testing
• Failover procedures
• Communication plans

---

This template is maintained by AtomicQMS. For questions, open an issue in this repository.