6. ISO27001/BS7799 Certification vs. Sarbox Compliance 1584

ISO27001/BS7799 Certification vs. Sarbox Compliance 1584

  • H

    I was unfamiliar with the ISO27001 international standard and in research found it to be a solid control mechanism.
    Still, Milan offers the best advice of all – check with your external and internal auditors to see if they will approve this as being acceptable for SOX 404 IT compliancy needs 🙂
    Good luck on this.

    0
  • D

    In short, the response to the earlier question is NO.

    1. Bear in mind that the reason we look at IT controls for SOx 404 is to SUPPORT the business process i.e. where we are relying on automated controls within applications then we need to evaluate the general controls around those applications.
    2. In looking at general controls there are a number of areas or domains that you need to consider - and information security is only one of them.
    3. International Standards serve a different purpose from a framework like COBIT, but these pruposes can be complementary.
      As Milan correctly states ISO27001 MIGHT be able to substitute for the security component - but would not help you with other parts.
      Another way of looking at it would be to suggest that ISO27001 certification would almost certainly require you to put in place the processes and controls that satisfy the security control objectives of COBIT - making compliance with that framework straightforward.
    0
  • L

    Thank you all for responding to my question, but asking my auditors is not exactly unbiased. There is money to be lost by US accounting firms if they admit that an ISO27001 certification is consistent with s404 compliance and a suitable substitute for a SAS70.
    I really need an authoritative source, like the SEC or PCAOB to say YES or NO and haven’t been able to get that.

    0
  • H

    Hi Lou – I think Denis hit the nail on the head in his reply … I also went to the SEC’s website and searched for ISO27001 where I got zero hits … I then entered COBIT and got 23 links returned.
    SEC Home - add ‘www’
    sec.gov/search/search.htm
    As some firms have to adhere to multiple standards, you may have to implement both COBIT and ISO27001? For example, we have to be compliant with SAS 70, ISO 9000, SOX, etc … I also understand the reluctance to ask the external Auditor firm on this, as someone commented in another thread that audit fees have doubled in recent years with the advent of SOX 😞
    One idea might be to contact the SEC or PCAOB directly. For example below is SEC Contact Information:
    U.S. Securities and Exchange Commission
    Office of the Chief Accountant
    100 F Street, NE
    Washington, DC 20549
    202-551-5300 Phone
    202-772-9252 Fax
    Again, good luck on this 🙂

    0
  • L

    Thanks Harry and everyone. I’ll keep on plugging away at the SEC and let all know what I find out.

    0
  • C

    Denis that was a real good reply. ISO27001 has some controls which match with COBIT. There is a good guidance document in ISACA for it which gives the control mapping but being complaint with ISO27001 (and the predecessor BS7799) is not sufficient for SOX compliance

    0
  • M

    An insightful presentation that compares COBIT andISO/IEC 17799 /BS 7799-2.
    gammassl.co.uk/bs7799/corporate governance/Is IT Governance Enough V3.pdf
    Be sure to insert www. in front of the link above.
    Please consult with the author of the presentation if used for commercial purposes.
    Hope this further helps.

    0
  • J

    Denis and Milan are right.
    Cobit control model includes more audit areas than just information security.
    Im fact, that’s just the tip of an iceberg.

    • Other areas to consider are: Operations, System Development Life Cycle, Change Management, etc.
      thanks Milan, I was looking for a link just like the one you’ve posted.
    0
  • S

    The clauses of ISO 27001 can directly be mapped to the SOX 404 requirements and effective implementation of security controls. … To conclude, both ISO 27001 and SOX 404 are spoken a lot in the audit world, but they are very different. ISO 27001 is a standard that can be used to comply with the SOX 404 law.
    iso 27001 lead auditor course

    0
  • K

    ISO 27001 Certification is one of the best certifications when to come to security. another name for ISO 27001 is the data security management system.
    ISO 27001 Certification in Malaysia
    ISO Certification in Malaysia

    0
Log in to reply