Understanding Sarbanes-Oxley, What Is Different After January 2015

According to the National Initiative for Cybersecurity Careers and Studies (NICCS), cybersecurity is the activity or process, ability or capability, or state whereby information and communications systems and the information contained therein are protected from and/or defended against damage, unauthorized use or modification, or exploitation.

We have an interesting extended definition: Strategy, policy, and standards regarding the security of and operations in cyberspace, and encompass[ing] the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as they relate to the security and stability of the global information and communications infrastructure.

According to the Sarbanes-Oxley Act, many stakeholders may need to know who used a system, when they logged in and out, what accesses or modifications were made to what files, and what authorizations were in effect.

Almost 13 years after the enactment of the Sarbanes Oxley Act, cybersecurity has become a major problem.

Sarbanes Oxley experts can assist their organizations, as they understand the need for a good control environment, risk identification and risk assessment, the design and the implementation of internal controls, information, communication and reporting.

Today we will try to understand better where we are.