July 11, 2005 12:52 PM PDT
Report: Sarbanes-Oxley could threaten security
- Related Stories
-
Sarbanes-Oxley cheat sheet
November 23, 2004
The Information Security Forum, an international security association, said Monday that it calculates that many of its members expect to spend more than $10 million on information security controls to comply with regulations laid down by Sarbanes-Oxley.
U.S. members of the ISF include MetLife, CitiGroup, Electronic Data Systems and Safeway.
ISF consultant Andy Jones said that though SOX was designed to improve corporate governance and accountability, it has proved difficult to interpret for information security professionals.
"As neither the legislation nor the official guidance specifically mentions the words 'information security,' the impact on security policy and the security controls that need to be put into place must be determined by each individual organization in the context of their business," he said.
Jones also warned that SOX could divert attention from more-pressing security risks: "For organizations whose business is not primarily financial, for example the manufacturing or product-service industries, the diversion of information security attention from other risk areas to SOX compliance may lead to important business risks being neglected."
"It is important that Sarbanes-Oxley does not push organizations into following a compliance-based approach rather than a risk-based approach that may compromise information security," he added.
See more CNET content tagged:
Sarbanes-Oxley Act,
information security,
corporate governance,
compliance,
risk
- Whatweva
- Considering the billions of dollars government is throwing around I'm sure the government can throw another couple million in these business's direction. You can't tell me that a government that is near 8 trillion dollars in debt doesn't enjoy blowing cash. The money's going somewhere. I wish I could say it was going in my pocket.
- Reply to this comment
- ISF Credibility Suffers from Bogus SOX Comments
- I'm not sure why CNET runs an unsubstantiated blurb like the one ISF put out on SOX 'harming' the security effort. It was obviously written by someone with no knowledge on the subject. Risk is an integral part of the assessment of internal controls for IT and no contrary information was provided. The SOX bottom line is only 'prove it' don't just tell Management you have good security.
- Reply to this comment






