Sarbanes-Oxley
Compliance Auditing Tools
The audit spotlight now shines on IT. After years of regulation and embarrassing data breaches, the highest levels of management now comfortably discuss IT controls and audit results. However, their quality expectations are rising. Where IT once performed audits annually, many now support quarterly, monthly, and ad hoc exercises. Each audit expands the scope of the technologies assessed, measured, and proven compliant. Broader scope means more complexity and more work. With the Sarbanes Oxley Compliance Kit you can increase timeliness and accuracy of audit data while reducing IT audit effort, disruption, and cost.
Sarbanes-Oxley challenges the Information Technology function with requirements that impact day-to-day activities.
SOX compliance monitoring and auditing tools put in place the infrastructure that every enterprise that must comply with the requirements of this and other mandated security needs addresses. Each of the components in this tool kit are easy to implement and meets the most stringent needs that you face.
-
Security Audit Program - Contains over 400 unique tasks divided into 11 areas of audit focus which are the divided into 38 separate task groupings. The audit program is one that either an external auditor, internal auditor can use to validate the compliance of the Information Technology and the enterprise to ISO 27000, Sarbanes-Oxley, HIPAA, and PCI-DSS.
The results are posted to a 22 page Excel worksheet that graphically summarizes the strengths and weaknesses of the enterprises security and compliance to best security practices. (Read on...)
-
Job Descriptions - Director Sarbanes-Oxley Compliance and Manager Sarbanes-Oxley Compliance job descriptions.
Sarbanes Oxley Auditing News
Security and DRP play a role in CIO Infrastructure Design
Designing
IT Infrastructure requires CIOs to consider the globalized world they are now
in. It is necessary and valuable for CIOs to understand the fundamental trends
that are pushing businesses to redesign their operations around this new
reality. Factors they need to
consider are:
-
Security - With the growing importance of digital applications and data, the sources of threats to enterprise data have multiplied dramatically. Everything from natural disasters to criminals to corrupt sources within the company might try to steal or corrupt data. While businesses do everything that they can to stop these threats in the first place, they still must be prepared to recover from these threats as quickly as possible.
-
Business Continuity and Disaster Planning - As businesses have expanded the need for anytime, anywhere application access has become a requirement. At the same time, follow the sun (global 24/7) operations have shrinking maintenance windows and a need for applications to be running at all times. Delay or loss of data for any reason system failure, natural disasters has a domino-like effect across the entire organization, at any time of the day or night.
-
Flexibility - Most businesses now operate across international borders and CIOs must be able to respond to opportunities and challenges faster than ever before. CIOs are usually battling well-resourced organizations that may be based where the opportunity originated, or another globalizing company that is reaching out for new opportunities. In order to compete, a business has to be faster to deliver a product or service as good, or better, than that of potentially any other company in the world.
-
Simplicity - Increases in technology have typically led to increased complexity. While per unit costs of technology are always decreasing, in aggregate companies see an increase in cost. With the pressure on IT to act less as a cost center and more as a way to increase the profitability of business units, just adding more storage, more bandwidth, or additional technologies throughout the organization is no longer an acceptable approach to managing information technology. Successful CIOs are investing in numerous technologies including; continuous data protection, virtualization, and wireless connectivity. They are trying slim down ITs footprint while increasing their businesss competitive advantages. The CIO is typically in a difficult position, assessing where to try and cut costs while still moving forward with a plan to continually enhance IT services to the business.
Nature can distroy anything that man can make
Nothing man-made can withstand the forces of nature. In certain regions of the country, natural disasters are not a question of if, but of when. The main headquarters of many companies are located in North Carolina, right in the heart of Hurricane Alley. In addition, Southern California is earthquake and brush fire central.
They know a hurricane, earthquake, or brush fire is going to be coming along at some point; it is inevitable. At the worst, you are looking at physical damage to facilities and systems, or flooding. At minimum, it will knock out power and your network circuit. Even if power and network stay up, just the fact that you do not have physical access to your system may prevent you from doing a crucial operational task.
- more infoHow a CIO should chose a backup site
Disasters cost money, interrupt business operations and
may cause the enterprise or government agency to fail, which makes planning a
business continuity issue. Disasters can interfere with or even terminate IT and
communications services. It does not matter whether the disaster affects the
enterprise, government or service provider. Floods, fire, volcanoes, earthquakes
and other events can destroy a primary and backup site if they are too close
together.
Telecom service providers can offer expert advice on where to locate a backup facility and should position themselves with CIOs to offer both consulting and services. After all, they have experience planning for their own primary and backup facilities, as well.
A CIO's selection of the backup site location will always have risks and liabilities attached to the decision. Adequate and reliable communications to the backup site and communications between the primary and backup sites are what most service providers can successfully offer to the CIO.
In choosing a backup site, CIO's must first determine how big a disaster plan for and budget for it. The level of disaster planning increases as you goes down the following list:
-
Building closed/evacuated
-
Loss of power
-
Loss of communications
-
Facility damaged/destroyed
-
Community disaster (10-to-30 mile range)
-
Regional disaster (30-to100 mile range)
Successful Disaster Planning and Business Continuity Planning Processes
The success of most business depends
on Information Technology. However, business and technology environments are
becoming more complex. Being prepared to respond to non-typical events - both
planned and unexpected - that threaten to disrupt essential business systems and
processes, is a major corporate concern.
A recent survey found that disaster recovery planning is a priority
for many organizations. Eighty-six percent of IT executives said they have a
disaster recovery plan in place at their organization. While the economy has
affected IT budgets overall, 43 percent of IT respondents indicated the economy
has not affected their disaster recovery investment (including planning) - with
another 33 percent, saying investment in disaster recovery has become more
important.
Organizations cannot control whether or not they will be affected
by a natural disaster, power outage or other unplanned incident, but they can
work to help ensure their business is prepared to respond to and recover from
these events with minimal impact. Disaster recovery planning is an
organizational requirement that can help reduce risk and help companies
effectively respond to situations that threaten to disrupt essential business
processes.
Janco Associates has found that enterprises that are
successful:
-
Focus on employee safety. Every disaster recovery plan needs to begin by addressing the physical safety and psychological well-being of employees. That means the plan must include alternative locations where employees can go if a primary work site is unavailable, as well as incident notification and escalation strategies. In addition, the plan needs to be well communicated throughout the organization so everyone knows how to respond in a disaster situation.
-
Conduct a business and IT impact
analysis. Carry out a thorough analysis of people, information,
application, and other resources to build an understanding of the consequences
- financial and operational - of losing vital components. Take particular care
to uncover interdependencies across the organization that is critical to
staying in business. This analysis will provide a solid foundation for
establishing recovery priorities and timeframes in your plan, allowing you to
make informed decisions on where and how much to invest in disaster
recovery. -
-
Disaster recovery and business continuity planning issues
Disaster recovery and business continuity management and contingency planning are essential especially in these economic times. However, the creation, testing, and updating of a sound disaster recovery and continuity and contingency plan is costly and complex.
For example, initially it is necessary to understand the underlying risks and the potential impacts of disaster. This is the primary building block upon which sensible and cost effective business continuity plan or disaster recovery plan is built. When the plan itself is created, there are the maintenance and testing phases, to ensure that the plan remains current. Even having arranged all these matters there are the external auditors to consider - and of course, there is the not so small matter of ISO 27000, SOX, HIPAA, and PCI-DSS compliance.
The industry standard solution is the Disaster Recovery and Business Continuity Template by Janco Associates. The template includes all of the right tools to assist with business impact analysis and risk analysis. You can quickly create a core plan (some of Janco's clients have created an operational plan in less than thirty days), maintain the plan, audit the DRP BCP, and create a cost effective budget to support the disaster recovery business continuity process.
- more info