<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on What the Sarbanes-Oxley Act means for IT managers ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/14-122478/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-21T13:59:53-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Email is just the start]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-3490657]]></link>
        <description><![CDATA[The title of this post was a bit misleading. Email retention is just a small, and I mean SMALL part of the work required to stay compliant with SOX.  From account procurement procedures, operations manuals for IT employees, environmental controls verification to security controls, the amount of work required to stay compliant is daunting.  Just thought I would throw that out there so nobody reading this thought SOX was just about saving email. As an IT Director, my team has been audited every year for the last 8 years on our SOX compliance and it is quite a lot of work.  It is also mostly good IT governance practice.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-3490657]]></guid>
        <dc:creator><![CDATA[colleyryan]]></dc:creator>
        <pubDate>Thu, 01 Sep 2011 14:45:41 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[better to be safe than sorry]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1831846]]></link>
        <description><![CDATA[We have decided to be safe than Sorry and backup everything. We use a company called www.stornet.net there excellent and I highly recommend them. They will store everything for you. I hear they are also going into document storage as well. It's expensive to do all this archiving on your own. My advice is outsource.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1831846]]></guid>
        <dc:creator><![CDATA[techevar@...]]></dc:creator>
        <pubDate>Wed, 17 Aug 2005 07:03:02 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[No Backup]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1517416]]></link>
        <description><![CDATA[As a company policy (unwritten, currently) no email on the exchange server is backed. Will that policy hold up in litigation if it becomes a written and distributed policy?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1517416]]></guid>
        <dc:creator><![CDATA[dcameron@...]]></dc:creator>
        <pubDate>Mon, 25 Aug 2003 14:42:50 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Protection?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1515925]]></link>
        <description><![CDATA[The article is interesting as far as it goes.  My concern is that, no matter what the retention policy of the company and no matter how well educated the staff are there are still some significant questions.The article indicated that tape rotation could be an issue.  What are the alternatives?  We are all aware of how files disappear.  It is created today and deleted today and never made it to the backup.  The act applies to files and email and both can be stymied by the tools that we use.  Most mail systems use a database of some sort and log the transactions: are these sufficient for the act?  The alternative is every backup kept for the defined retention period or 7 years whichever comes first.There are a few tools appearing on the horizon that should make administrators lives simpler and may be able to help aggregate the information and the changes made but are they ready??]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-1515925]]></guid>
        <dc:creator><![CDATA[gyamamoto]]></dc:creator>
        <pubDate>Thu, 21 Aug 2003 05:39:20 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Link to Sarbanes-Oxley Act overview]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-802258]]></link>
        <description><![CDATA[I found the following overview after reading this article: http://www.arma.org/news/08_06_2002.cfm  I have been in the IT industry since 1988 but I have little experience seeing &quot;where the rubber meets the road&quot; with congressional legislation applying to IT operations.  However, after I read this TR article discussing e-mail retention and then the Sarbanes-Oxley Act overview I provided a link too, I cannot see the implications of this act to corporate e-mail retention.  I am wondering if this is simply a case where the legislation doesn't say it excludes electronic communication (such as e-mail) so the article's authoer assumes it is included.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-802258]]></guid>
        <dc:creator><![CDATA[robdg]]></dc:creator>
        <pubDate>Wed, 23 Jul 2003 03:57:02 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[See Article]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-783873]]></link>
        <description><![CDATA[Right you are, but this particular article focused on the email aspects.While there will be a need for IT involvement, I remain concerned that it may be treated as an IT initiative rather than a business issue.  Before IT begins proposing solutions I highly recommend that every company determine their business objectives and business requirements (accounting and legal) before looking at technology approaches.Would you expect facilities to determine the type of building for office and factory, or would you want the department heads and production superitendents to define the needs?  Do you have your fleet mechanics decide what transportation to use and what routes to drive?  Does your print shop define content to marketing material?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-783873]]></guid>
        <dc:creator><![CDATA[Oldefar]]></dc:creator>
        <pubDate>Fri, 13 Jun 2003 12:37:33 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[It's more than just records!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-783821]]></link>
        <description><![CDATA[If you read the regulations, this might be the most significant issue to face IT since Y2K. Records retention is but a very small piece.Section 404, for example, mandates that internal controls be open and complete, that they be documented completely, that they be executed, that management evaluates ALL of those controls in a quaterly manner, that issues be reported within a very short time limit, and hardest of all, that your external auditor certifies that all of this stuff happened.The impact on IT is that 1.  Additional internal controls will be placed in the management of IT and Projects2.  IT Mgmt will have to evaluate those controls.3.  Since all of the requirements of that section deal with information or processes, IT should be involved.4.  Breaking those requirements down, you need tools in place (one or more) to:    a. Document those controls    b. Execute those controls (if you want it automated)    c. Document the execution of those controls    d. Reminders to control executors and management to execute controls    e. Evaluate those controls (and document the evaluation)    f. Report issues that are material around the execution of the control or the control itself.    g. Fix the issues with the controls    h. Provide all this information in a format that makes sense to your external auditor.By the way, your external auditor cannot help you with this issue.If this problem is not already in your lap, you need to go find it,to make sure that you have the time required to provide the right solution.There are more, but 404 is the most significant.This is one huge issue, and it might be one huge project.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-783821]]></guid>
        <dc:creator><![CDATA[Caco]]></dc:creator>
        <pubDate>Fri, 13 Jun 2003 08:34:46 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[POP3 Mail]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-759972]]></link>
        <description><![CDATA[How does such a ruling affect those organizations without an internal email server? Do they need to copy their POP3 mail &quot;just in case&quot;?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-759972]]></guid>
        <dc:creator><![CDATA[helpdesk@...]]></dc:creator>
        <pubDate>Wed, 30 Apr 2003 04:53:27 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Different Retention for Different Materi]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-739024]]></link>
        <description><![CDATA[As an IT Manager / Consultant, I would like to remind folks that not all information has the same retention period. But there is no useful tool out there today to strip out the relevant mail and retain it, and drop the SPAM. Only a corporate procedure for the manual seperation of mail content by users will get the job done at this time.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-739024]]></guid>
        <dc:creator><![CDATA[Dean@...]]></dc:creator>
        <pubDate>Fri, 21 Mar 2003 21:53:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Two retention schedules]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-738150]]></link>
        <description><![CDATA[The article doesn't make clear the difference between a regular retention schedule and a retention schedule modified by ongoing litigation.Obviously, a company which destroys files in the face of litigation is not acting in good faith.On theother hand, a company following its own retention schedule in the regular course of business might very well retain email for a 30 day period or less, and is probably well advised to do so.The crux of the matter is that when litigation is pending, the company needs to put a freeze on document disposal related to that litigation, as otherwise this could become evidence against it.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-738150]]></guid>
        <dc:creator><![CDATA[camb@...]]></dc:creator>
        <pubDate>Thu, 20 Mar 2003 03:29:55 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Appreciate the link]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737674]]></link>
        <description><![CDATA[Having read it, my opinion is that the statements made in the TR article are misleading.  The Act does not seem to be as inclusive as the article indicates regarding email.  While I am no lawyer, it appears that every reference to record retention is directly related to company financial information and outside auditor records and work sheets.This is also why I find it a poor practice to have IT write policy.I would strongly advice every CIO to have his legal department or company legalconsul provide their analysis of just what records need to be maintained and for what duration.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737674]]></guid>
        <dc:creator><![CDATA[Oldefar]]></dc:creator>
        <pubDate>Wed, 19 Mar 2003 09:49:00 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Link to full text of act]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737611]]></link>
        <description><![CDATA[Here's a link to the complete text of Sarbanes-Oxley on the Virginia Society of CPAs site:http://www.vscpa.com/Advocacy/SOtext.htm]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737611]]></guid>
        <dc:creator><![CDATA[kyisauditor@...]]></dc:creator>
        <pubDate>Wed, 19 Mar 2003 07:01:45 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Other sections impact records retention]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737610]]></link>
        <description><![CDATA[Other sections besides section 302 have statements regarding records retention.  Specifically, Title VIII: Corporate and Criminal Fraud Accountability Act of 2002 impacts the records retention requirements for public accounting firms related to the destruction of documents.  (Can you say Arthur Anderson).]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737610]]></guid>
        <dc:creator><![CDATA[kyisauditor@...]]></dc:creator>
        <pubDate>Wed, 19 Mar 2003 06:59:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Interpretation]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737337]]></link>
        <description><![CDATA[I pulled the reference out of the article.  The act itself did not seem specific.I agree that it should apply only to business correspondence, but that is not the way it is interpreted in the article.Regardless, the company policy (objectiveand requirements) should be made by the company leadership.  The business unit managers should deal with interpretation of the company policy.  IT can then deal with the technical aspects of meeting the policy.The real problems come in when IT makes policy, interprets that policy, enforces that policy, and tries to decide how to deal with policy violators.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737337]]></guid>
        <dc:creator><![CDATA[Oldefar]]></dc:creator>
        <pubDate>Tue, 18 Mar 2003 23:45:55 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Rationality and Reasonableness]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737323]]></link>
        <description><![CDATA[Hm. Good point, but I think that the act refers to business communication, not ALL communication.  Thus, bulk mailings and the like would not be considered business communication.If it doesn't, though, what about telephone calls?  Will they all have to be recorded and retained now?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737323]]></guid>
        <dc:creator><![CDATA[Slogmeister]]></dc:creator>
        <pubDate>Tue, 18 Mar 2003 23:30:24 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Test Laws for Reasonableness]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737280]]></link>
        <description><![CDATA[The Sarbanes-Oxley Act is an example of well intended legislation failing to match its objectives to requirements.----The retention period must be reasonable and clearly set in the policy. A good retention policy cannot be selective?all documents should be saved. The policy must be well known and understood by the employees and applied evenly across the company. Also, the storage type may vary as long as one can produce the evidence.----Take the equivelent snail mail situation.  Is there a requirement to save all mail received at a company?  Are all invitations, greeting cards, advertisements, circulars, bulk mailings, catalogs, or personal mail received at the work address required to be archived for 7 years?  With their envelopes?Until a change in the interpretation of this act occurs in the courts, compliance becomes as a business requirement.  This should drive acceptable use policies as well as technical objectives.  An off-shoot of the business requirement shouldbe another to limit received email to valid business correspondance.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/14-122478-737280]]></guid>
        <dc:creator><![CDATA[Oldefar]]></dc:creator>
        <pubDate>Tue, 18 Mar 2003 22:32:54 -0800</pubDate>
    </item>
    </channel>
</rss>

