Is your enterprise following rules?
The bulk of financial information in many companies is created, stored and transmitted electronically, maintained by IT and controlled via information integrity procedures and practices. For these reasons, compliance with federal requirements such as Sarbanes-Oxley Act (SOX) is heavily dependent on IT. Companies that must comply with SOX are U.S. public companies, foreign filers in U.S. markets and privately held companies with public debt. Ultimately accountable for SOX compliance are corporate CEO and CFO, who will depend on company finance operations and IT to provide critical support when they comply with SOX requirement to report on effectiveness of internal control over financial reporting.
Sound practices include corporate-wide information security policies and enforced implementation of those policies for employees at all levels. Information security policies should govern network security, access controls, authentication, encryption, logging, monitoring and alerting, pre-planned coordinated incident response, and forensics. These components enable information integrity and data retention, while enabling IT audits and business continuity.
Complying with Sarbanes-Oxley The changes required to ensure SOX compliance reach across nearly all areas of a corporation. In fact, Gartner Research went so far as to call Act “the most sweeping legislation to affect publicly traded companies since reforms during Great Depression.” Since bulk of information in most companies is created, stored, transmitted and maintained electronically, one could logically conclude that IT shoulders a lion’s share of responsibility for SOX compliance. Enterprise IT departments are responsible for ensuring that sound practices, including corporate-wide information security policies and enforced implementation of those policies, are in place for employees at all levels. Information security policies should govern:
- Network security
- Access controls
- Monitoring and alerting
- Pre-planning coordinated incident response
These components enable information integrity and data retention, while enabling IT audits and business continuity.
In order to comply with Sarbanes-Oxley, companies must be able to show conclusively that:
- They have reviewed quarterly and annual financial reports;
- The information is complete and accurate;
- Effective disclosure controls and procedures are in place and maintained to ensure that material information about company is made known to them.
Sarbanes-Oxley Section 404 Section 404 regulates enforcement of internal controls, requiring management to show that it has established an effective internal control structure and procedures for accurate and complete financial reporting. In addition, company must produce documented evidence of an annual assessment of internal control structure’s effectiveness, validated by a registered public accounting firm. By instituting effective email controls, organizations are not only ensuring compliance with Sarbanes-Oxley Section 404; they are also taking a giant step in right direction with regards to overall email security.
Effective Email Controls Email has evolved into a business-critical application unlike any other. Unfortunately, it is also one of most exposed areas of a technology infrastructure. Enterprises must install a solution that actively enforces policy, stops offending mail both inbound and outbound and halts threats before internal controls are compromised, as opposed to passively noting violations as they occur.