I am not well versed on SOX, so could you point me to a resource that shows where it says we have to save e-mails, because it would directly affect one of our company policies.

Hey Andy,

The management of email is a fundamental element of SOX compliance. You don't have to actually SAVE all email, but you have to know what NOT to delete.

A good starter point would be the SOX cheatsheet which is here: http://www.silicon.com/research/specialreports/compliance/0,3800003180,39121223,00.htm

Remember that SOX has the largest impact on public companies. If you are still private, you still have some protections against the Act (unless of course you partner with a company that falls under SOX and requires you have the same safeguards)

Remember, SOX is US legislation, so only directly affects companies on the US stock exchange.....for now, though Canada is drafting similar legislation. The fun part is all the 3rd party vendors that are indirectly affected. Every 3rd party vendor that we deal with also has to comply.

We just finished our audit at my company and boy was it fun! We passed, but it doesn't feel like we do work any more. We spend more than half our time making sure the appropriate paper work is filled out and signed off by the appropriate parties before we can actually do the work, like change someones password, add an account, etc.... I feel more like an accountant now than a computer professional.

Thanks I will check that out because we have a policy for our managers and up concerning how long they can keep any given e-mail that is probably way out of compliance and I need to bring it up to my boss if it is. We are a public US company and we are the largest of our kind so I want to make sure our market is doing the right thing. Thanks again.

I just found out from my boss that very quitely over the last few months they have dropped millions into assuring our compliance. Although our local pst files etc are cleared every 30 days, they are archived for 7 years to a bunch of servers at corporate before they are cleared. That way our loacl exchange servers don't bog down yet we stay in compliance. It kind of cool hwo they did it with zero disruption to our daily work.