Automating ISO change requests — a lesson in reducing admin work

At hx we manage weird and wonderful datasets on behalf of our customers every day. Some of the data is highly sensitive (like historic loss data), some of it less so (like weather trends at the Baikonur Cosmodrome). Regardless of the sensitivity we take our responsibility to our customers incredibly seriously so we adhere to (and are regularly audited against) the ISO27001 standard for information security.

One upshot of ISO27001 is that have to maintain an audit trail of changes that we make to customer systems: what, why, who, when, and how. Our MVP process (a manually-completed Word template) has served us well until now (one of our rules is “it’ll do until it doesn’t”) but as our release frequency has increased the admin is starting to annoy us a little.

At hx we try to carve out time for side-projects or ‘extracurriculars’ where we can hack, experiment and play. Adomas (one of our brilliant engineers) decided to see if he could crack the paperwork nut with the biggest hammer he could find: our modelling platform Renew! With a few hours effort (and maybe a stroopwafel or two) he developed a model which generated a fully-populated ISO27001 change request form at the touch of a button — result!

This will help keep the team (and Captain ISO) happy for now, but as we move towards our ‘north star’ of continuous deployment we know we’re going to have to automate more and more of our manual processes.

…Is it weird that we’re really looking forward to doing that? No? We didn’t think so — and if you don’t either you might enjoy working with us.
hx