SOX refers to the Sarbanes-Oxley Act, a US law that lays out requirements to ensure the integrity of source data pertaining to financial transactions and disclosures. Introduced in response to the financial scandals of the early 2000s, it aims to help shield investors from fraudulent or misleading financial reports.
So what is this topic doing on a site about cyber threats and security? Here’s the deal, SOX has provisions that are designed to improve data security. Sections 302 and 404, in particular, layout crucial guidelines for data safeguarding, safeguards testing, security breach detection, and proper threat and incident disclosure.
Section 404, which is about the management assessment of internal controls, is said to be the most complicated and expensive SOX provision to implement. It prescribes technical controls and a continuous audit on access protocols to make sure that data reliability is maintained.
While some regard SOX compliance as an unnecessary added burden, others welcome the rules it imposes because they supposedly create advantages particularly when it comes to data security and integrity. However, there are also pundits who say that compliance does not necessarily mean security.
For one, cloud security expert Jay Chaudhry, in a Forbes Technology Council post, asserts that compliance should not be mistaken for security. Citing the cyber-attacks suffered by Capital One, Arizona Beverages, Equifax, and Radisson, Chaudhry argues that even high-profile SOX complaint companies are still prone to ..
Support the originator by clicking the read the rest link below.
