Re: Journal Receiver Retention for SOX...

If it were me, I would just show them my company's written security policy
that states we only keep log/journal files for X number of years.  As long
as you have implemented that, their beef is with the owners of the policy,
not the person that implements it (i.e. you).

And I'm sure your company has a written security policy and that it does
address data retention. Right?    :-)

Patrick Botz
Senior Technical Staff Member
IBM Lab Services, Rochester
Security Architecture & Consulting, i5/OS Security Architect
(507) 253-0917, T/L 553-0917
CTC Fax # 507-253-2070
email: botz-r/[email protected]

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services


security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] wrote on 08/23/2006 01:16:02 PM:

> I have to echo John's interpretation - Auditors are simply the
> interpreters of SOX (especially section 404) and their interpretation is
> subject to debate.
>
> If an Auditor "tells you" that something must be just so, understand
> that their interpretation is subject to debate.  If they say you must
> hold on to data for 7 years (as a title company this could be
> legitimate), you have to respond to their request.  But you don't
> necessarily have to tow the line.
>
> If I were you, I would simply do the preliminary design of a system that
> could store and hold 7 years of audit journal data.  You will have to be
> able to restore it to your systems (which would argue for saving the
> receivers with storage free'd rather than deleting the old receivers),
> process a typical request, and produce the reports in a readable
> fashion.  Don't try and do it on the cheap, because if you say that you
> will be able to do it, you can expect people to hold you to that
> commitment.   Just lay out the costs, time, resources, and other
> requirements and then let the business leaders make a judgment on what
> this level of SOX compliance is worth to them.
>
> jte
>
>
>
>
> --
> John Earl | Chief Technology Officer
> The PowerTech Group
> 19426 68th Ave. S
> Seattle, WA 98032
> (253) 872-7788 ext. 302
> john.earl-Ua2wos9bJ7y1Z/[email protected]
> www.powertech.com
> Celebrating our 10th Anniversary Year!

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.