Sarbanes-Oxley Act

In 2002, the United States federal government passed the Sarbanes-Oxley Act (SOX) which establishes laws and standards for U.S. public company boards, management, and accounting firms. Provisions include a requirement that public companies evaluate, disclose and qualify (by independent auditor) the effectiveness of internal controls for financial reporting, a ban on personal loans to any executive or director, prohibition on insider trading during certain periods and accelerated reporting of insider trading, protections for whistle blowers and increased penalties for security violations. Because financial reporting in most companies is supported by electronic systems, IT is a large part of internal control.

SOX and Disaster Recovery Planning

Section 404, Management Assessment of Internal Controls pertains to disaster recovery requirements, stipulating that an organization should:
● State the responsibility of management for establishing and maintaining an adequate internal control structure.
● Contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. Translated, DR planning for SOX has two primary parts: implementing systems that completely protect all financial and other data required for reporting regulations3 and providing data on-demand, and clearly documenting those procedures so auditors can readily see that the plan protects regulated data as required.
 

Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act (GLBA) governs consolidation of financial institutions and implements financial privacy rules and safeguards. The GLBA governs how customers' personal information is collected and disclosed and requires safeguards to protect this information. The regulations also apply to any company that receives this information, even if they are not financial institutions.

GLBA and DR Planning

The Safeguards Rule contained in the Gramm-Leach-Bliley Act requires regulated institutions to:
● Insure the security and confidentiality of customer records and information.
● Protect against any anticipated threats or hazards to the security or integrity of such records.
● To protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.