I have a client in the financial business and he would like to know if DotNetNuke is Sarbanes-Oxley compliant?

Thanks,

Jason

Hi.
I worked as the IT-Manager for an American Company and therefore had 4 years the "luck" to stay the SOX-Audit. Successful, by the way.

And today i'm working as an consultant regardin IT-Security. Surprise, surprise....

But i must say, that my part was limited to Section 404 (Internal Control Systems, IT-Systems)

However, due to this experience i could say some things:
- your question cannot be answered with YES or NO, i would say: it depends.....
- Normally your systems have to be compliant:
    - if they either store "financial relevant" data, which has a direct impact on the annual report
    - if users loggin onto these systems could gain access to financial relevant data from their or if they could create wrong, misleading, "bad" information or data, which could lead to wrong reports

I would urgently suggest your customer to call a local auditor or consultant from another company than the one which is doing the audit itself (!!!) to have a socalled pre-audit to show any findings and if possible mitigations.

Hope that helps a little.

Cheers

Kai