July 12, 2005

REPORT: The multimillion-dollar cost of successfully complying with the Sarbanes-Oxley Act is channeling Internet security spending away from protecting against other security threats, according to a new report.

The Information Security Forum, an international security association, said Monday that it calculates that many of its members expect to spend more than $10 million on information security controls to comply with regulations laid down by Sarbanes-Oxley.

U.S. members of the ISF include MetLife, CitiGroup, Electronic Data Systems and Safeway.

.... Advertisement ....

ISF consultant Andy Jones said that though SOX was designed to improve corporate governance and accountability, it has proved difficult to interpret for information security professionals.

"As neither the legislation nor the official guidance specifically mentions the words 'information security,' the impact on security policy and the security controls that need to be put into place must be determined by each individual organization in the context of their business," he said.

Previous Next The ISF warns that SOX ignores security issues that are extremely important when dealing with risks to information, such as business continuity and disaster recovery. This makes it important to integrate compliance into a wider IT security and corporate governance strategy, it said.

Jones also warned that SOX could divert attention from more-pressing security risks: "For organizations whose business is not primarily financial, for example the manufacturing or product-service industries, the diversion of information security attention from other risk areas to SOX compliance may lead to important business risks being neglected."

"It is important that Sarbanes-Oxley does not push organizations into following a compliance-based approach rather than a risk-based approach that may compromise information security," he added.

Source: C-Net News

Save Internet Security.ca's URL to the list of your favorite web sites in your Web browser by clicking here.

Become an authorized reseller of Proxy Sentinel™ and Firewall Sentinel™. Do like the rest of our authorized resellers and have your clients benefit the important security features of our products and solutions, while increasing your sales at the same time. Click here for all the details.

You can link to the Internet Security web site as much as you like. Read our section on how your company can participate in our reciprocal link exchange program and increase your rankings in the major search engines such as
Google and all the others.