For a major software company

Case study : Sarbanes-Oxley Audit

We have performed a pre-certification Sarbanes-Oxley Control Campagns. The objectif was to define the level to reach for the main certification.
We have defined the accurate testing methods with the customer's teams. Then, we have performed the tests and give a feedback with detailed technical recommandations for the certification.

The IT Sox Controls :

Password management
Local network study
Antivirus and patch management
Corporate disaster recovery plan
ERP Applications
Laptop management
Backup
Logs & audits
Physical security
Building and goods security
Vulnerabilities

Instance: ERP security is a key point of Sarbanes Oxley law

Restricted Acces controls : the rights and permissions are attributed to the users of differents ressources.
Use of strong and long passwords and the authentication is verified every 15 minutes when the application is not used.
Only Autorized users can access to the datas.
Performant tracability system : "Where, Who, What?".