Does Sarbanes-Oxley (SOX) require an organization to maintain the capability to produce all the data that the law requires be secured, even if the only way we can access some of that sensitive data anymore is by re-loading old software that we no longer use (thus, no longer have access to the data on a day-to-day basis)?