IT Employment

http://www.aicpa.org/info/sarbanes_oxley_summary.htm

The deadline for financial firms to comply with the policies put forth concerning email security, storage, and retention is quickly aproaching, April 15th. I was wondering what the IT departments of other financial firms were doing to ensure they meet the requirements of this act. I have had trouble finding a solid definition of the IT requirements, does anyone know of a good checklist? What methods are people using to store email conversations and keep them retrievable in a "timely manner"? What products are you using to ensure the integrity of external email?