Also, the lack of definitive regulations has delayed much of the current enforcement; SOX requirements may be loosened...
in the near term. It seems, too, that the SEC is giving public companies the room to fix problems that are identified during examinations.
Implementing strong financial controls requires a change in process, culture and technology. This shift takes time, and the SEC hasn't gotten around to chasing folks yet.
To be clear, examinations are happening every day, and not many folks are "passing." In many cases, it has very little to do with security controls. The burden of financial controls and ensuring the integrity of financial reporting is stymieing many organizations, especially the small ones. "Passing" is also still somewhat subjective, meaning your grade may depend on your examiner and probably what side of the bed he/she woke up on that day. A lot of the industry has agreed on COBIT as an acceptable framework for Sarbanes-Oxley compliance.
Regulations are in place to make sure that organizations do the right thing. Whether SOX is enforced or not, it's probably a good idea for a company to have tight financial controls in place. An organization should also make efforts to protect customers' private data, regardless of HIPAA, GLBA or PCI.
Dig Deeper on Security audit, compliance and standards
Related Q&A from Mike Rothman
Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property. Continue Reading
While liaison officer responsibilities vary depending on the company they work for, their strong organizational and communications skills make them ... Continue Reading
The CISSP certification can be a challenge to obtain. Mike Rothman unveils how to get on the right education and career tracks in order to get CISSP ... Continue Reading