Note This law applies to U.S. customers only. Customers should rely on appropriate legal counsel and outside auditors for interpretation of the act’s requirements. Suggestions in this document are not to be construed as a substitute for legal advice or a definitive list of all possible legal considerations.
The Sarbanes-Oxley Act of 2002 is a federal law enacted in response to a number of accounting scandals involving major U.S. corporations. A key requirement of the act is that public companies evaluate and disclose the effectiveness of their internal controls as they relate to financial reporting. One major area of internal control consists of information technology controls. As a result, the Sarbanes-Oxley Act holds chief information officers responsible for the security, accuracy and the reliability of the systems that manage and report the financial data.
To the extent that a company uses data collected or transmitted by Messaging as part of its overall cost or revenue reporting and financial management, the company can use security-related features of Messaging to secure the data. Use of these features can further demonstrate the company’s good faith data management and reporting.
Messaging security features also help prevent unauthorized access to the customer’s network, in general.
The following table lists the features related to data security:
| Feature | How related to Sarbanes-Oxley | Where documented |
|---|---|---|
| Encryption | Transmitted data is protected from packet-sniffing and eavesdropping | |
| Access control | Access to data is protected from unauthorized personnel | |
| Authentication | Access to the system is restricted by login/password. | |
| Logging | Security-related events are logged | |
| Backup of data | Data saved on backup media or backup server. Protected by encryption and key. |