The Sarbanes-Oxley (“SOX”) Act of 2002 is a crucial piece of legislation aimed at protecting the confidentiality, integrity, and availability of information that impacts a corporation's stakeholders.

Ensuring ongoing SOX compliance is a fundamental risk management task for any publicly-traded, or even privately-held, company in the United States. Transgressions of the SOX Act can involve hefty penalties at both a company and an individual level (for directors and board members). 

SOX requires organizations to establish security controls that prevent leaks of confidential data, and audit trails that are capable of detecting any form of data tampering. In this way, the Act helps organizations to reduce or eliminate fraud, build public trust, and protect data that is sensitive to stakeholders. 

At Garland Heart we advise that organizations establish IT security policies that will ensure regulatory compliance with SOX, as well as other related legislation. In a nutshell, organizations must implement an effective strategy for fraud prevention, detection and response - identifying vulnerabilities, establishing controls, selecting information security solutions, and ensuring accurate reporting.

For financial services companies, which deal with very sensitive customer and financial data, there are a number of important considerations relating to SOX compliance.

Overall architecture of your organization

By using an established framework for describing and architecting your organization, it becomes easier to control all the “moving parts” within the enterprise, and to ensure IT regulatory compliance. The Open Group Architecture Framework (TOGAF) is such a framework - giving the organization a guide to designing, planning, implementing, and governing an enterprise information technology architecture.

Securing and backing up your data

Implement a tiered data protection approach to preventing unauthorized access (as well as preventing accidental or intentional destruction, infection or corruption). Multiple layers of defense means that sectors of one’s data warehouses and cloud environments can be isolated - minimizing the impact of any breach.

Ensuring the confidentiality of your data

Using multi-factor, strong authentication methods - such as one-time passwords sent via text message - helps to protect access to data. This is combined with permissions-based access so that only the people who need to see and edit content are able to do so.

Detecting and reporting on breaches or vulnerabilities

SOX mandates that any vulnerabilities and breaches are reported in a timely manor to independent auditors. To facilitate this process and to ensure regulatory compliance, one’s security approach needs to incorporate automated and accurate reporting capabilities along with the details of remedial actions that have been taken to patch the problem.

As the pace of digitization accelerates, the nature of cyber-attacks is becoming increasingly sophisticated. Ensuring IT regulatory compliance in this ever-shifting landscape is no easy task.

With the right security consulting partners and information security solutions, organizations can keep one step ahead of the threats while ensuring SOX compliance and sound business governance. Do you know how airtight your current security structure is in your financial instituion? Check out our free assessment tool here. If you have any questions or concerns, feel free to contact us for more help.