Sarbanes-Oxley, a set of rules that were put in place to combat corporate scandals, fraud, and improper financial reporting, has had a big impact on how corporations do business, and the impact reaches all the way across the board. While SOX is targeted at the money guys on the top floor, ultimately, it’s the IT guys in the back office that are responsible for implementing it and keeping the suits on the straight and narrow.

The most relevant part of SOX is the internal controls requirement, which mandates that several controls be put in place with regard to how financial reporting is done. At first glance, it would seem that email doesn’t pertain, but in reality, it does: SOX isn’t just about how financial data is stored, it’s also about how it’s transmitted–and a good Sarbanes-Oxley audit will almost always suggest security enhancements to the email infrastrucure to include encryption, and more rigorous adherence to policy and good practices. IT is mostly concerned with section 404 of the Sarbanes-Oxley Act, which deals with internal controls and how they are enforced.

Continue reading Sarbanes-Oxley and email security

One important areas of the Sarbanes-Oxley Act (“SOX”) of 2002 is to protect whistle blowers who speak out against a company not performing due diligence with document management and email archiving compliance. Section 1107 of SOX states:

“Whoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing to a law enforcement officer any truthful information relating to the commission or possible commission of any federal offence, shall be fined under this title, imprisoned not more than 10 years, or both.”

Continue reading Sarbanes Oxley Protects the Whistle Blowers