|
You are referring to Section 404 of the Sarbanes-Oxley Act or "SOX 404." SOX 404 calls for the improvement of internal controls over the gathering and reporting of financial information, but it is vague on how to implement these controls for the IT systems that process it. Additionally, while it doesn't explicitly call for the control you describe, the requirement may have come from your auditors, who review your SOX 404 implementation with your executive or senior management.
When it comes to IT controls, auditors look to see if policies and procedures are in place to protect sensitive customer and financial data. Proof of these controls is enshrined in documentation outlining IT security policies, procedures and how data is protected. These safeguards could include access control, encryption, firewall architectures and virus protection. Your auditors are probably concerned that using the Administrator account is a weak form of server access control. They probably think these servers contain sensitive financial information that, if not properly secured, could be compromised.
Auditors love paper, and the best way to change the policy you described is to perform a thorough risk analysis of your servers and the data they host. If you can prove to the auditors -- and document it with the risk analysis -- that the data isn't sensitive and there's a low risk of exposure, you may be able to keep using the Administrator account, but plan carefully. Ask yourself the following questions: What data do these servers host? How sensitive is it? Is it confidential customer information, insider financial reports or harmless marketing data for projecting sales? Is use of the servers limited to a small group or widespread throughout your enterprise?
Again, auditors love paper, so whatever you do, document it.
More information
Attend our SOX Security School to learn how to meet SOX's on-going demands.
Read this book chapter to review basic approaches to risk analysis.
|
