Speeding SOX Audits with Automated Data Protection Tools

Data Protection and
Sarbanes-Oxley
Speeding SOX Audits with
Automated Data Protection Tools
June 2005Table of Contents
. Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3. About Sarbanes-Oxley . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3. About SOX Frameworks, IT and Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4. Aligning Key Data Protection Processes with SOX Internal Controls . . . . . . . . . . . . . . . . . . . . . . . . 5. Addressing Both the Spirit and the Letter of the Law for Data Protection . . . . . . . . . . . . . . . . . . 6. Following the Spirit of the Law: Lessons Learned from Real-World Compliance Efforts and Actual SOX Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7. Automated vs. Manual: How Data Protection Management Software Can Speed SOX Compliance and Improve Effectiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8. What to Look For: Important SOX-Related Functions Involved in Data Protection Management Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10. About Bocada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Data Protection and Sarbanes-OxleySpeeding SOX Audits with Automated Data Protection ToolsBocada, Inc. 2Overview
This white paper focuses specifically on Sarbanes-Oxley Act (SOX) regulations relevant to data protection, anddescribes both best practices and automated tools used by today's leading storage managers and backup/recoveryteams to meet the mandates of SOX. Information has been drawn from real-world SOX audit experiences anddemonstrates how leading companies are benefiting from the use of data protection management software tostreamline compliance-related testing and demonstrate documented control over data protection. A specific set oftests to determine if your data protection processes can meet a SOX audit is also provided herein. The paper con-cludes by outlining key features in data protection management software that can automate aspects of complianceand reduce the cost for both internal and external SOX audits.
About Sarbanes-Oxley
Much has already been written about the Sarbanes-Oxley Act of 2002 and its intent to hold public company execu-tives accountable for the accuracy of their company's financial reporting processes. Sarbanes-Oxley was enacted inan effort to avoid the corporate malfeasance and much-publicized accounting scandals of U.S. companies like Enron,WorldCom and HealthSouth. It holds companies to a high standard of corporate governance, risk management, com-munications and compliance. This set of standards is commonly referred to as GRC (governance, risk managementand compliance).
A recent global report of leading CEOs by PriceWaterhouseCoopers describes GRC as:"More than simply a responseto burgeoning laws and regulations, GRC is becoming a value-adding principle that is being embraced by an ever-1growing number of leading organizations throughout the global business community."
While SOX is applicable only to publicly traded companies, speculation is widespread that SOX and its implied, higherstandards of GRC will eventually be extended to private sector companies, including those seeking venture capital ortraditional financing, poised to go public and facing acquisition or merger.
Section 404 of the SOX legislation is most relevant to IT organizations, including the storage management and dataprotection teams, as it requires corporate management (executives and a financial officer) to take:
"responsibility for establishing and maintaining adequate internal control over financial re... [download for more]