Hello Carolyn and Kenneth,

Documenting OS/400 vulnerabilities and security threats
is a very challenging technical exercise. It's also a non-technical
 subject because non-compliance consequences will be discussed
 at the Board of Directors / CEO / CFO / CIO level. 

If your enterprise can't provide documentation on OS/400 security
 that fits the PCAOB "objective source" standard to your SOX auditors,  
they will be very, very happy to do the work for you. That's a 3-week, 
one-command-line-entry-at-a-time process billed as high as US$600/hour.

"Bill of Health" software was invented to comply with SOX/PCAOB
requirements on OS/400 security documentation. It also provides a
commentary on each discovered vulnerability and a prescription on
how to mitigate each risk. Here's more information:

  >> A description of OS/400 security vulnerabilities written in plain
        English for a non-technical audience:

  >> An overview about the "Bill of Health" product:

  >> A sample "Bill of Health" assessment report --- don't go here
        unless you want 40 pages of technically challenging content:

  >> Information about SOX and PCAOB, the official standard for
        interpreting the Sarbanes-Oxley Act. PCAOB makes it clear that
        OS/400 security documentation generated by employees will not
        be viewed as "objective" for SOX audit purposes. .

God bless,

Milt Habeck
Unbeaten Path International
North America: (888) 874-8008
International: (262) 681-3151
European contact: (44) 1-737-824248

++++++  ++++++  ++++++  ++++++  ++++++  ++++++  ++++++  ++++++
From: Graap, Ken
To: 'Midrange Systems Technical Discussion'
Sent: Monday, August 23, 2004 12:24 PM
Subject: RE: Sarbanes & Oxley

I would have to agree with Carolyn.... SOX is a "technical issue" we have
been working on all year long! In fact, it is our #1 technical issue this


++++++  ++++++  ++++++  ++++++  ++++++  ++++++  ++++++  ++++++
From: Burns, Carolyn
To: Midrange Systems Technical Discussion
Sent: Monday, August 23, 2004 11:42 AM
Subject: RE: Sarbanes & Oxley

This is a technical issue regarding documentation and gaps in systems.  If
your year end is prior to October 15th 2004 you do not have to be compliant
until your 2005 year end.  I have consultants who specialize in this area in
IT and have been working with it quite a bit.  Hope this helps.

Best Regards,
Business Development Manager
1230 Rosecrans Avenue Suite 425
Manhattan Beach, CA 90266
Telephone: 310-727-3272
Cellular Phone:  310-989-0481
Facsimile:  310/727-1920

As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2022 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.