Information Security

Abstract

There are many approaches to building a satisfactory reference framework when considering how best to manage compliance. A framework that is gaining wide acceptance is the ISO 17799 standard.¹ Although its focus is on information security, it has a number of synergies with the concerns raised by the Sarbanes-Oxley Act:

• It stresses the importance of documenting compliance activities.

• It has an emphasis on the confidentiality, integrity, and availability of information.

• It stresses a structured approach to compliance, based on senior management authorization and a comprehensive acceptance of the need for all staff to be aware of and involved in the compliance effort.