How do you make sure that in your environment, you have proper controls of your source code. For example, before deployment of any application, there must be approval from the boss and other parties. Do you have some products or solutions you can recommend to make this automatic? I also understand that sometimes, audit need to see hard copies of change control process. So in your opinion, is it still better to use hard copy change control, ie using paper signature etc? thanks
So version control is your best friend. Git is a good solution, and it allows authors to "sign" their commits digitally with a pgp key. Using a branch->commit->merge-to-master workflow keeps the code rot down. Plus, the audit team can look at the git repository and see what happened every step of the way. I don't know how hard copy change control would fit in, seeing as you could replace it with PGP signatures (much harder to forge).