Email this page

Compliance Overview Key Benefits Sarbanes-Oxley (SOX) HIPAA

The Sarbanes-Oxley (SOX) Act of 2002, in response to several major corporate scandal incidents, set forth rules and regulations that financial institutions must adhere to or face severe fines and penalties, up to and including prison time. According to the law, several areas relating to internal accounting, record retention, record retrieval, and data destruction and recovery are under strict scrutiny.

With CRC Data Protection you can be assured that your custom solution will be fully SOX-compliant. CRC Data Protection engineers, in conjunction with our legal consultants, will review your business model and data protection needs to custom-tailor a set of retention, archiving, and disaster recovery rules that allow you to operate legally-compliant.

Concept	Section(s)	CRC Data Protection Solution
Length of Record Retention	Section 103(a)(2)(A)(i) Prepare and maintain, for a period of not less than 7 years, audit work papers and other information related to any audit report, in sufficient detail to support the conclusions reached in such report. Sec. 802(a)(1) Any accountant who conducts an audit of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 (15 U.S.C 78j-1(a)) applies, shall maintain all audit or review work papers for a period of 5 years from the end of the fiscal period in which the audit or review was concluded.	CRC Data Protection allows for archiving of audit-related report documents and materials through a multi-tiered Backup Lifecycle Management system.
Type of Business Records and Electronic Communications Requiring Storage	Sec. 802(a)(2) The Securities and Exchange Commission shall promulgate, within 180 days, such rules and regulations, as are reasonably necessary, relating to the retention of relevant records such as work papers, documents that form the basis of an audit or review, memoranda, correspondence, communications, other documents, and records (including electronic records) which are created, sent, or received in connection with an audit or review and contain conclusions, opinions, analyses, or financial data relating to such an audit or review.	With CRC Data Protection solutions, all required file types can be backed up, archived, and restored.  Utilizing the agentless MLR (Message Level Restore), you can archive and restore down to the single message level for emails.
Production of Records	Section 105(b)(2)(B)Require the production of audit work papers and any other document or information in the possession of a registered public accounting firm or any associated person thereof, wherever domiciled, that the Board considers relevant or material to the investigation, and may inspect the books and records of such firm or associated person to verify the accuracy of any documents or information supplied.	With CDP (Continuous Data Protection) you can be confident that these electronic financial records will be current, backed up, and available at the touch of a button.
Retention of Complaints	Section 301(4)(A) The receipt, retention, and treatment of complaints received -by the issuer regarding accounting, internal accounting controls, or auditing matters.	CRC Data Protection provides for the retention of those relevant records contained on file/database servers.
Internal Controls	Section 404(a)(1) State the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting.	One of the key responsibilities of the IT manager is to ensure that the right data is backed up at the right time, securely, and with the ability to recover information that has been lost, destroyed, or corrupted.  CRC Data Protection facilitates every step in this process, to maintain business continuity even in the wake of a disaster.
Record Alteration or Destruction	Section 802(a) Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both	With CRC Data Protection’s BLM, digital certificates are created for data deleted from the database, allowing an audit trail for data manipulation.  In addition, data access is controlled by centrally managed policies, so only authorized individuals have access to sensitive data.