134 lines
5.4 KiB
Markdown
134 lines
5.4 KiB
Markdown
# IT Infrastructure Quality Management System
|
|
|
|
A comprehensive QMS template designed for IT departments, managed service providers, and technology infrastructure teams in regulated industries.
|
|
|
|
## 💻 Designed For
|
|
|
|
- **Healthcare IT Departments** - Hospital and clinic technology teams
|
|
- **Managed Service Providers (MSPs)** - IT service organizations
|
|
- **Data Centers** - Colocation and hosting facilities
|
|
- **Cloud Operations Teams** - AWS, Azure, GCP management
|
|
- **Cybersecurity Teams** - Security operations centers
|
|
- **Research Computing** - HPC and scientific computing
|
|
- **Compliance-Focused IT** - HIPAA, SOC 2, PCI environments
|
|
|
|
## 📋 Regulatory Framework
|
|
|
|
This template supports compliance with:
|
|
|
|
- **ISO 27001** - Information Security Management Systems
|
|
- **SOC 2** - Service Organization Control (Trust Services Criteria)
|
|
- **HIPAA Security Rule** - Healthcare information security
|
|
- **NIST Cybersecurity Framework** - Security controls and practices
|
|
- **PCI DSS** - Payment Card Industry Data Security Standard
|
|
- **GDPR** - Data protection requirements (if applicable)
|
|
- **FISMA** - Federal information security (government)
|
|
- **CIS Controls** - Center for Internet Security benchmarks
|
|
- **ITIL** - IT Service Management best practices
|
|
- **COBIT** - Governance and management of IT
|
|
|
|
## Repository Structure
|
|
|
|
```
|
|
├── SOPs/
|
|
│ ├── Change-Management/ # Change requests, approvals, implementation
|
|
│ ├── Incident-Response/ # Security incidents, outages, escalation
|
|
│ ├── Access-Control/ # User provisioning, authentication, authorization
|
|
│ ├── Backup-Recovery/ # Backups, disaster recovery, business continuity
|
|
│ ├── Security-Operations/ # Vulnerability management, patching, monitoring
|
|
│ └── General/ # Document control, training, CAPA
|
|
├── Forms/
|
|
│ ├── Change-Requests/ # RFC forms, CAB meeting records
|
|
│ ├── Incident-Reports/ # Incident tickets, post-mortems, RCA
|
|
│ ├── Access-Requests/ # User access, privilege escalation forms
|
|
│ ├── Audit-Checklists/ # Security audits, compliance assessments
|
|
│ ├── Asset-Inventory/ # Hardware, software, license tracking
|
|
│ └── Training/ # Security awareness, competency assessments
|
|
├── Policies/ # IT and security policies
|
|
├── Work-Instructions/ # Step-by-step procedures
|
|
└── Templates/ # Document templates
|
|
```
|
|
|
|
## Document Numbering Convention
|
|
|
|
- **POL-XXX**: Policies
|
|
- **SOP-CHG-XXX**: Change Management SOPs
|
|
- **SOP-INC-XXX**: Incident Response SOPs
|
|
- **SOP-ACC-XXX**: Access Control SOPs
|
|
- **SOP-BAK-XXX**: Backup and Recovery SOPs
|
|
- **SOP-SEC-XXX**: Security Operations SOPs
|
|
- **WI-XXX**: Work Instructions
|
|
- **FRM-XXX**: Forms and Records
|
|
|
|
## 🤖 AI-Powered Assistance
|
|
|
|
This repository includes **AtomicAI**, your IT infrastructure QMS assistant. Mention `@atomicai` in any issue or pull request to:
|
|
|
|
- Draft change management and incident response procedures
|
|
- Create access control and user provisioning SOPs
|
|
- Generate backup and disaster recovery plans
|
|
- Develop security policies and procedures
|
|
- Create audit checklists and compliance documentation
|
|
- Review documents for ISO 27001/SOC 2 compliance
|
|
|
|
### Example Prompts
|
|
|
|
- "@atomicai create an SOP for change management with CAB approval workflow"
|
|
- "@atomicai draft a security incident response procedure"
|
|
- "@atomicai write a user access provisioning and deprovisioning SOP"
|
|
- "@atomicai create a disaster recovery plan template"
|
|
- "@atomicai develop a vulnerability management procedure"
|
|
- "@atomicai create a patch management SOP with testing requirements"
|
|
|
|
## Getting Started
|
|
|
|
1. **Establish Governance** - Define IT policies and approval authorities
|
|
2. **Implement Change Management** - Configure RFC and CAB processes
|
|
3. **Set Up Incident Response** - Create escalation procedures and playbooks
|
|
4. **Define Access Controls** - Establish user provisioning workflows
|
|
5. **Train Staff** - Security awareness and procedure training
|
|
|
|
## Key Documents to Create First
|
|
|
|
1. **Change Management SOP** - RFC, approval, and implementation workflow
|
|
2. **Incident Response Procedure** - Detection, containment, recovery, post-mortem
|
|
3. **Access Control Policy** - Least privilege, authentication, authorization
|
|
4. **Backup and Recovery SOP** - Backup schedules, retention, testing
|
|
5. **Vulnerability Management SOP** - Scanning, prioritization, remediation
|
|
6. **Patch Management SOP** - Testing, deployment, rollback procedures
|
|
7. **Business Continuity Plan** - DR procedures and RTO/RPO targets
|
|
|
|
## Special Considerations for IT Infrastructure
|
|
|
|
### Change Management
|
|
- Request for Change (RFC) documentation
|
|
- Change Advisory Board (CAB) process
|
|
- Risk assessment and testing requirements
|
|
- Rollback procedures
|
|
- Post-implementation review
|
|
|
|
### Security Operations
|
|
- Vulnerability scanning and assessment
|
|
- Penetration testing programs
|
|
- Security monitoring and SIEM
|
|
- Threat intelligence integration
|
|
- Incident detection and response
|
|
|
|
### Access Control
|
|
- Identity and access management
|
|
- Privileged access management
|
|
- Multi-factor authentication
|
|
- Access reviews and recertification
|
|
- Termination and offboarding
|
|
|
|
### Business Continuity
|
|
- Disaster recovery planning
|
|
- RTO/RPO definitions
|
|
- Backup verification and testing
|
|
- Failover procedures
|
|
- Communication plans
|
|
|
|
---
|
|
|
|
*This template is maintained by AtomicQMS. For questions, open an issue in this repository.*
|