Question

List and explain the system activites that are required to be logged to ensure compliance with the Sarbanes Oxley Act of 2002.

this is for an Information Systems Security class required for Accounting major

Answer 1

An organization, in order to ensure compliance with the Sarbanes Oxley Act of 2002 (SOX), has to collect, manage and analyze log data. As per SOX the parameters and conditions that must be monitored, logged and audited are network activity, database activity, login activity (both success and failures), account activity, user activity and information access.

A control framework is required and the purpose of log collection and monitoring systems is to provide an audit trail of all access and activity that are related to sensitive business information.

Systems should be implemented that tracks logins and detects any login attempts that are suspicious in nature. This will help with regards to preventing data tampering. The next aspect is with regards to recording of timelines for key activities and for this systems will have to be implemented that will be in a position to apply timestamps to all financial data and other data that are relevant with regards to SOX provisions. Systems that can receive data from any organizational source should be implemented. This will help to build verifiable controls to track access.