SOX compliance: cutting through the static.

The Sarbanes-Oxley deadline is finally upon us--and public companies with early fiscal year-ends are feeling the heat. Over the past 3 years, endless headlines have preached about the consequences of not abiding by the Act.

A bit of additional education never hurts. This is not intended as the end-all column on compliance, but rather a piece to examine some of the top SOX storage considerations at a high level. Remember that the best compliance strategy begins with thoroughly studying the Sarbanes-Oxley Act, as well as any other regulations affecting your industry.

Unraveling the SOX Puzzle

The SEC added stringent amendments for financial reporting to the Sarbanes-Oxley Act, spurred by the rash of corporate scandals that rocked the Enron era. New provisions call for more comprehensive auditing systems to ensure accuracy within financial reports. For example, companies must now include a management report covering the internal control structure in their annual findings.

Storage strategies come into play because many of the auditing requirements ride on data integrity. The Act makes it illegal for "any person to alter, destroy, mutilate, or conceal any document with the intent to impair the object's integrity or availability for use in an official proceeding ..." In other words, companies must ensure that their data has not been tampered with or altered. Write Once Read Many (WORM) storage technologies (whether in the form of disk, tape or optical) are a natural choice for storage regulated data.

As part of SOX compliance, your company should develop a Document Retention Policy and a Data Classification Scheme. Establishing a strict policy that tracks the lifecycle of data within the company is another important step. This process should also cover the movement of both hardware and software within the IT infrastructure. Any infrastructure change should entail an extensive audit to determine how it may affect compliance.

These activities are a small part to ensuring that regulated data is available when needed. In the event of an audit, companies may have to produce archived data in less than 24 hours. That is an extreme example, but possible. Each audit is taken on a case-by-case basis.

Putting the Compliance Pieces Together

To ensure data integrity, companies are discovering the need to institute new standards for data archiving and availability.

When it comes to archiving basics for compliance, some of the first advice to be offered is for companies to religiously perform backup and archiving jobs based on preset schedules. Many companies will use tape storage with WORM capabilities for the first 7 years, leveraging the very low cost and high streaming speeds of today's "superdrives".

When a backup for archiving is completed, be sure that the job finished successfully, checking the log to verify there were no interruptions. It's imperative that the stored data can be retrieved if an audit takes place. The only way to know for sure is to open an archive file and verify its integrity. If problems are encountered, check the system settings and the soundness of the media. Be sure to document the process in your records.

Once these processes are in place, the real challenge is ensuring that the IT staff understands and upholds the newly implemented procedures. Methodologies should be outlined in detailed reports that are presented to the staff.

Conclusion

IT managers are feeling the pressure to implement compliance processes under a tight deadline. Companies with publicly owned shares worth more than $75 million must comply with Section 404 of the Sarbanes-Oxley Act when they file their 10-K reports for fiscal years ending after November 15, 2004. Smaller companies must comply with reports filed for fiscal years ending after July 15, 2005.

The most important factor for achieving SOX compliance is to do your homework, and seek out one of several industry associations, legal organizations, trade groups, storage vendors or analyst firms available to answer your questions.

Brett Schechter is a senior manager and tape storage expert with the Component and business Solutions Division of Sony Electronics (San Jose, CA)

[e-mail]