I'm a long time Salesforce user brought into a company that is very much traditional SDLC with legacy home built systems. I am trying to get them to understand that a Salesforce developer must have access to production (Not kosher in traditional SDLC because they have too much power). I've explained that there is an audit trail (only 6 months, but we can download periodically) as well as change sets (again only live for 6 months, shows all pieces changed). They need more than a year of audit records for compliance purposes (so they've stated).
This isn't the first public institution I've worked for; however, it's the first that has been in this state of transition. I was wondering if anyone has any additional recommendations on ways that I can educate the business that SFDC does not exactly fit into traditional SDLC. For example, I think I'm finally getting across to them that there isn't a concept of Builds in SFDC (I had a QA person read me the riot act for adding a custom field to a page layout because I wasn't authorized to do a new build sigh).
Does anyone have any insite that they can provide or better yet any white papers that aren't from consulting agencies trying to sell us on why they're the best to "help us" become SOX complaint by paying them a truck load of money?