When it comes to IT controls, auditors look to see if policies and procedures are in place to protect sensitive
customer and financial data. Proof of these controls is enshrined in documentation outlining IT security policies, procedures and how data is protected. These safeguards could include access control, encryption, firewall architectures and virus protection. Your auditors are probably concerned that using the Administrator account is a weak form of server access control. They probably think these servers contain sensitive financial information that, if not properly secured, could be compromised.
Auditors love paper, and the best way to change the policy you described is to perform a thorough risk analysis of your servers and the data they host. If you can prove to the auditors -- and document it with the risk analysis -- that the data isn't sensitive and there's a low risk of exposure, you may be able to keep using the Administrator account, but plan carefully. Ask yourself the following questions: What data do these servers host? How sensitive is it? Is it confidential customer information, insider financial reports or harmless marketing data for projecting sales? Is use of the servers limited to a small group or widespread throughout your enterprise?
Again, auditors love paper, so whatever you do, document it.
Dig deeper on Sarbanes-Oxley Act
Related Q&A from Joel Dubin, past SearchSecurity.com expert
The security of RFID chips and smart cards may not be fully mature, but there are best practices to keep facilities safe. Identity and access ...continue reading
Picture passwords for mobile device security aren't a new idea, but they have been recently improved. Identity and access management expert Joel ...continue reading
Hacked smart cards are a large potential threat to enterprises that utilize them. Learn how to thwart smart card hackers.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.