Re: Journal Receiver Retention for SOX...

I have to echo John's interpretation - Auditors are simply the
interpreters of SOX (especially section 404) and their interpretation is
subject to debate.

If an Auditor "tells you" that something must be just so, understand
that their interpretation is subject to debate.  If they say you must
hold on to data for 7 years (as a title company this could be
legitimate), you have to respond to their request.  But you don't
necessarily have to tow the line.

If I were you, I would simply do the preliminary design of a system that
could store and hold 7 years of audit journal data.  You will have to be
able to restore it to your systems (which would argue for saving the
receivers with storage free'd rather than deleting the old receivers),
process a typical request, and produce the reports in a readable
fashion.  Don't try and do it on the cheap, because if you say that you
will be able to do it, you can expect people to hold you to that
commitment.   Just lay out the costs, time, resources, and other
requirements and then let the business leaders make a judgment on what
this level of SOX compliance is worth to them.

jte




--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl-Ua2wos9bJ7y1Z/[email protected]
www.powertech.com 
Celebrating our 10th Anniversary Year!
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of
> Jones, John (US)
> Sent: Wednesday, August 23, 2006 7:01 AM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Journal Receiver Retention for
> SOX...
> 
> Well, I'm our IT Security guy and the iSeries admin.
> However, we're
> large enough that we have a project manager who does SOX &
> other
> compliance basically full-time.  I work with her a lot on
> these issues
> and get to sit in on the audit reviews.
> 
> If you have a few minutes, go read SOX section 404.  This
> is what's
> driving all the IT work yet you'll find IT is barely
> mentioned.  Almost
> everything is left to interpretation.
> 
> 
> John A. Jones, CISSP
> Americas Information Security Officer
> Jones Lang LaSalle, Inc.
> V: +1-630-455-2787 F: +1-312-601-1782
> john.jones-4kQQZ61tH+/[email protected]
> 
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Dan
> Sent: Wednesday, August 23, 2006 7:52 AM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Journal Receiver Retention for
> SOX...
> 
> On 8/23/06, Turnidge, Dave
> <DTurnidge-2D/YCkXdwQd1Kpd7S6KoolaTQe2KTcn/@public.gmane.org> wrote:
> >
> > Thank you Dan. I've gotten messages kicked out of other
> sites, so
> > guess I'm getting gun-shy...
> 
> 
> Uh, well, given the responses you've gotten here, I think
> *I* was the
> one who got "told" (implicitly) on this thread!  ;-)
> 
> Maybe the people who "do" SOX as part of their jobs can
> confirm.  Does
> the responsibility for the IT part of SOX always/usually
> fall on the IT
> security admin?
> 
> - Dan
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
> (Security400)
> mailing list To post a message email:
> Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To
> subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting,
> please take a
> moment to review the archives at
> http://archive.midrange.com/security400.
> 
> 
> This email is for the use of the intended recipient(s)
> only.  If you have received this email in error, please
> notify the sender immediately and then delete it.  If you
> are not the intended recipient, you must not keep, use,
> disclose, copy or distribute this email without the
> author's prior permission.  We have taken precautions to
> minimize the risk of transmitting software viruses, but we
> advise you to carry out your own virus checks on any
> attachment to this message.  We cannot accept liability
> for any loss or damage caused by software viruses.  The
> information contained in this communication may be
> confidential and may be subject to the attorney-client
> privilege. If you are the intended recipient and you do
> not wish to receive similar electronic messages from us in
> future then please respond to the sender to this effect.
> 
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
> (Security400) mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/security400.
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.