- Hello and welcome back to the channel,
I'm Marcus from InfoSec Governance.
And in today's video,
we're gonna be talking about what Sox compliance is
and what controls are associated with it.
Now I have to state that I'm no expert on SOX compliance.
And then this topic, it's not gonna be going
into too much detail about this.
But if you are watching this video and you comply with SOX,
I'd love to hear your thoughts
on what you think it's like for your businesses
and do you have any tips, hints and tips
to make this easy to implement.
Now I have to state that I'm no expert on SOX compliance.
And this topic,
it's not gonna go into too much detail about this.
But if you are watching this video and you comply with SOX,
I'd love to hear your thoughts, and what you think about,
what you think it's like for businesses.
Do you have any hints and tips
to make this easy to implement for people?
Now SOX, is short for the Sarbanes-Oxley Act,
this was passed by the United States Congress
way back in 2002.
The act was named after it's sponsors,
who was Senator Paul Sarbanes
and Representative Michael G. Oxley.
Now people who are watching this video,
and are working in smaller public based companies
or are based outside of the US,
may never have heard of this Act before.
This is because it's primarily brought in,
brought in to protect US based companies
after all the financial scandals
that had happened before the act was released.
For example, when the large corporations
such as Enron, WorldCom and Tyco,
were faced with fraud charges.
Due to these financial related fraud accusations
and WorldCom going bankrupt with over owing $104 million,
a billion dollars even,
enough was enough and things had to change.
This was a time when the dot-com bubble
had just burst around the year 2000,
lots of tech companies were starting up,
funds and investments were being given
to pretty much any company that wanted it.
Between 2001 and 2002,
the US started to investigate
a lot of the larger corporations
and indictments for fraud were starting to be talked about.
Then in 2002 the US Congress passed the Sarbanes-Oxley Act,
which was based around financial oversight of companies.
Congress had woken up to the fact
that they needed to be stricter
and tighter controls which governed,
governed the auditing and internal controls of companies,
as well as ensuring that companies met strict,
strict regulations that were set out.
So that's a little bit about why SOX is around,
but it doesn't really tell you what SOX compliance is,
why should you have to adhere to it, what are the controls,
what are the, what's in place.
This next section will hopefully clear
all these questions up for you.
So what is SOX compliance?
SOX, without having to go into too much detail
and bore everyone to death,
SOX compliance is an Act which states
that any public company is obliged
to provide accurate proof of their financial reporting.
This means that primarily it is only associated
with public companies, although all companies
should really know and adhere to it,
to ensure that they are on the right side
of the playing field.
Companies should ensure that they are keeping data safe
and secure and free of tampering.
They should ensure that they are logging
and tracking all of their information,
any security breaches of their information and/or systems,
and any processes that they have in place
to ensure that lessons are learnt
from any issues that they have.
Logs of everything should be put in place and kept securely,
these should be made readily available
for auditing if and when required.
And they should also be protected
against anyone actually accessing them, removing them,
deleting them, amending them, and things like that.
Companies must also prove their compliance
for the past 3 months, or 90 days.
Now some of the UK or European based
people watching this video may think
some of this sounds quite familiar.
This is because a lot of these controls
and processes are already in place
for the General Data Protection Regulation, or the GDPR.
GDPR although doesn't concentrate around
strict financial regulations and auditing,
but it does concentrate on the protection of data,
which a lot of SOX is for.
So what does achieving SOX compliance for a business mean?
When a SOX audit is performed,
it is usually up to the IT department
to actually prove that the company complies
with all the necessary areas of compliance.
This can be provided,
by providing the necessary documentation
such as logging, access controls, change control
and the list just continues.
This documentation can help show
that the company has met the financial transparency
and data security controls which are required,
although it doesn't have to be primarily the IT departments.
IT department will work on a wide range of business services
to ensure that compliance is met however.
For this to work efficiently however,
the IT department and its staff must all be familiar
with the standard and controls which are set out by the Act.
The IT department must ensure and be aware
that the logs must be kept
for a minimum amount of time, 90 days,
that they must be kept secure and tamper free
and that people, that if people ask for any evidence,
it must be provided and be transparent.
As part of the SOX Act, section 302 states that,
section 302 states that the executive officer
and chief financial officer,
must sign and review their quarterly and annual reports
and agree that they certified the reports
to the best of their knowledge
and that the information is correct
and truly reflects the business financial position,
thereby adhering to SOX compliance.
Section 404 of the SOX Act,
mandates that all public companies
have the necessary systems in place
to ensure that data is available for audits
and meets the necessary controls.
What software can you use to help comply with the SOX Act?
This can be a bit of how long is
a piece of string type question
and it can depend upon a lot of what technologies
the company is already using,
for example what licences do they have access to,
what software and technology
do they already have in place and so forth.
But ensuring that SIEM is in place
to keep track of logs, alerts,
help to analyse trends in systems and events can also help,
this will help identify any breaches
and unauthorised access to information.
Ensuring that you have email archiving in place
and that backups are performed and also checked regularly
will also help you ensure that your deed was kept intact
and if anything happens you can actually recover from that.
Ensuring that least privilege access is in place
and people only have access to what actually need,
this will reduce the chances of tampering here
against files and systems.
Implementing and using data loss prevention software
will also help you ensure that information is kept
within natural companies border or the internal systems
and is not accidentally sent out of the company.
And that's it, that's a quick intro,
I hope this makes sense to you all.
And if anyone does comply with SOX in their company,
I'd love to hear your thoughts and what you use
and why, and why are using it in the comments.
It's always great to have people's words of wisdom in there
and it also helps with the people watching these videos.
And as always it would be great, if you like this video,
so I know that that it actually makes sense for you.
Subscribe to the channel,
get more information and videos like this.
And yep, see you next time.
(electric upbeat music)