Sarbnes-Oxley in the cloud. Requirements for achieving cloud SOX compliance. While each enterprise has its own unique SOX compliance requirements, this eBook gives a frame work for selecting an accounting system cloud services provider for audit-ready cloud.

1. R O S E A S P M I C R O S O F T D Y N A M I C S H O S T I N G
CONSIDERATIONS FOR AUDIT-READY CLOUD ACCOUNTING
SOX
REQUIREMENTS
CLOUD
www.roseasp.com info@roseasp.com

2. Contents:
Change Management
Logical Access
Physical Security
IT Operations
Backup and Recovery
4
6
8
11
14
© 2016 by RoseASP. Reproduction in whole or part without the
expressed permission of RoseASP is prohibited.
www.roseasp.com

3. I
f your organization is a publicly-traded company or
preparing for an initial public offering, you have substantial
considerations to address before deploying financial data in
the cloud. When evaluating cloud ERP solutions and hosting
environments, it’s important to verify that the provider delivers
cloud services with the necessary security and internal controls
to satisfy the Sarbanes-Oxley Act (SOX) of 2002. This will ensure
the integrity of the financial system and help your organization
avoid noncompliance issues.
Although some cloud providers can ensure the necessary SOC 1
Type II security where data storage is concerned, their response
to SOX compliance often falls short in meeting the process
management and support requirements of publicly traded
companies. At RoseASP, we are dedicated to SOX compliance
and can produce documentation to substantiate that the system
and data are securely maintained, so stakeholders can feel
confident in the integrity of the reporting.
This eBook identifies five critical components of SOX compliance
that need to be addressed to ensure your ERP cloud provider
delivers an audit-ready accounting solution. It also shares
how RoseASP’s internal controls respond to each of these
components to help streamline your audit process and reduce
the risk of noncompliance.
SOX in the Cloud
© 2016 RoseASP

4. CHANGE MANAGEMENT
1
All changes, including adding
and removing users, to a
SOX compliant data system must
be properly approved and then
documented. Changes within the
application like applying upgrades,
patches or adding new modules
need to be performed in a “test”
environment before moving into
a live production environment.
Comprehensive testing ensures the
system is operating as designed
when changes are made.
“
“Choosing a cloud provider that could satisfy SOX and FDA
compliance requirements was key to our operations. We
chose RoseASPbecause their ability to work with regulated
companies gave us a comfort level other providers could
not match.”
Tony Brew Head of IT and Senior Director
Hyperion Therapeutics »
© 2016 RoseASP

5. Audit-Readiness Considerations
CHANGE MANAGEMENT
Is a test environment provided with sufficient time to perform tests
before changes are made in production?
How are changes to the system and the software approved,
documented and tracked?
What controls are in place when adding users or changing existing
user passwords or access levels?
What controls are in place regarding changes within the application
itself, such as upgrades and new modules?
Who can request changes and how is this controlled?
Audit-ready standards for creating or changing user accounts and
system access levels
Upgrades or new module implementations performed in a controlled
test environment
Standardized change request practices
Change management policies strictly maintained, regularly reviewed
Change control documentation available upon request
RoseASP’s Written Change Management Policies:
© 2016 RoseASP

6. LOGICAL ACCESS
2
Protecting and maintaining logical
access to the system ensures
that only the approved users are
accessing the system and helps to
protect data and reporting integrity.
It is the responsibility of your hosting
provider to protect your cloud system
against hacking, viruses and other
unauthorized access through strict
user access controls, firewalls,
encryption and current anti-virus
protection.
Did you know that a cloud provider’s Service Level
Agreement guarantees more than uptime? A cloud hosting
SLA is a critical legal document with direct impact on your
GRC practices.
Learn more about cloud SLAs from RoseASP »
© 2016 RoseASP

7. Audit-Readiness Considerations
LOGICAL ACCESS
What controls and software tools does the cloud provider use to
restrict access and prevent breaches?
How do you document that all changes for user access are
authorized and processed in a timely manner?
What controls and monitoring policies are in place to maintain the
integrity of user passwords, firewalls and encryption?
How are controls maintained around user level access restrictions?
Does the application offer user authentication and audit traceability?
Highest levels of IT monitoring, firewall protection, 256 bit encryption,
90-day password resets and intrusion detection
Standardized user naming schemes and authentication restrictions
Regular review of firewall system logs and database administrators
Security policies exceeding industry requirements
RoseASP’s Written Logical Access Policies:
© 2016 RoseASP

8. PHYSICAL SECURITY
3
Did you know you that your existing Microsoft Dynamics
ERP system can be moved to a secure and audit-ready
cloud environment in 3 steps.
Learn more about ERP cloud migrations »
Public companies and startups that
plan to go public need to produce
SOC 1 Type II certification from
the hosting provider to assure that
financial data is stored in an audit-
ready environment with adequate
data security, availability, processing
integrity, confidentiality and privacy.
© 2016 RoseASP

9. Audit-Readiness Considerations
PHYSICAL SECURITY
Can the hosting organization provide documentation to verify
SOC 1 Type II Certification of the data center?
Is data stored and backed up in state-of-the-art data centers with
multiple co-location centers?
Do physical security measures meet or exceed industry
standards?
All data centers are regularly audited and meet SSAE 16 SOC 1
Type II requirements
Physically separated data and intrusion free ports on boxes
Multi-factor security infrastructure, video surveillance, alarmed
access/egress points, Kevlar impregnated drywall and bulletproof
glass, on site NOC staffing 24/7/365, biometric identification with dual
factor authentication.
RoseASP’s Written Physical Security Policies:
© 2016 RoseASP

10. “
“Better, consistent fulfillment of compliance
obligations is essential, but so are objectives
such as customer service, revenue growth,
and improved agility in oh-so competitive
markets. (Information Governance) is not
just about getting rid of junk content, it is
more importantly about instilling trust in the
data and communication we use to run our
businesses.”
Forrester Analyst - Cheryl McKinnon
© 2016 RoseASP

11. IT OPERATIONS
4
Internal control policies and
procedures ensure that the
provider’s IT staff is maintaining
the appropriate documentation for
SOX compliance and undergoing
regular training to stay current with
IT trends and developments. Hosting
providers that are committed to SOX
compliance will have their internal
controls documented in policies
which are accessible to customers
and auditors for review. These
controls should be frequently tested
by the hosting provider to ensure
compliance.
“New markets and product lines mean additional regulations
and compliance requirements. You need a solution that
provides audit trails and formal business processes that a
growing business needs to manage and control risk.”
© 2016 RoseASP
Make Technology Your Business Advantage - eBook »

12. Audit-Readiness Considerations
IT OPERATIONS
What controls are in place internally among staff to assure that
application maintenance remains current and SOX policies are
upheld?
Who has access to the system and how is access tracked,
documented and reviewed?
How is accountability for customer support requests tracked among
the hosting firm’s internal IT staff?
What are the hosting firm’s policies around scheduled downtime
and notification?
24/7/365 Customer support
Strict controls around accessing customer data
System monitoring, intrusion detection and notification
Standardized policy for tracking and responding to service requests
Ongoing training of IT team members and unmatched standards of
expertise in cloud, accounting and compliance
RoseASP’s Written IT Policies:
© 2016 RoseASP

13. “Compliance is a collaborative effort of all IT team members.”
RoseASP Chief
Compliance Officer,
Glen Medwid explains
what is required of
a cloud provider
to support SOX
compliance.
© 2016 RoseASP
Go to SOX compliance video »

14. BACKUP AND RECOVERY
5
Along with SSAE 16 SOC 1
Type II certification, a SOX
data center must employ redundant
power and fire suppression systems
to protect against disaster events.
Your software hoster should
provide adequate documentation
of successful backups as well as
periodically providing restore data
from the backup media. This allows
you and your auditors to test and
verify that restore data is accurate and
consistent with data in the production
database and to verify all backups are
occurring according to the terms of
your Service Level Agreement.
“Inmycase,Ihavebankinginformationfromallourfranchisees
and other data for which I could have serious liability. I trust
RoseASP and Microsoft to encrypt the data and host it in a
secure way. Quite frankly, that’s a main reason I’m planning
to stay in a hosted environment.”
Michael Jensrud, CFO, BRIX Holdings »
© 2016 RoseASP

15. Audit-Readiness Considerations
BACKUP AND RECOVERY
How frequently are test restores performed?
How are backups scheduled?
What are data ownership policies?
What is included in backup procedures?
Are redundant backups performed in separate locations to protect
your data against disaster events?
Is a copy of the backup retained off site from the data center?
Strict daily, weekly, monthly and annual backup schedule
Tailorable backup plan to fit customer needs
Regular “test” restores to validate backup plan
Recovery policies ensuring data integrity and standardizing
ownership and responsibility during force majeure events
RoseASP’s Written Backup & Recovery Policies:
© 2016 RoseASP

16. W
ith sufficient due diligence, leveraging a cloud based
accounting system does not mean an organization has
to risk the integrity of the financial data and reporting.
If you are a CFO or CIO considering cloud based accounting
for a public company, it is important that a hosting provider is
able to work closely with auditors to provide documentation
on internal controls and the operational effectiveness of those
controls. If any control issues or exceptions are noted during
preliminary audit procedures SOX compliant hosting providers
will remediate those exceptions quickly so controls can be
retested prior to year-end.
Whether your organization is already publicly traded, preparing
for an initial public offering or a start-up with an eye on the
future, you can save time and avoid problems down the road
by deploying an ERP cloud solution through a hosting firm that
supports all compliance needs and responds quickly to requests
for audit support and SOX documentation.
Takeaways
A growing company uses
the cloud to support SOX
compliance.
Read a SOX Cloud Story »
Everything you need to know
about SLAs for cloud based
accounting software.
Learn What’s in an SLA? »
© 2016 RoseASP

17. How much does a SOX
audit-ready cloud
solution cost?
Get a Quote

18. SOX Compliant Microsoft Dynamics Cloud
RoseASP works closely with clients to provide a
comprehensive service level agreement that meets
the needs of your business and provides assurance
that compliance, performance and system availability
requirements will be met.
RoseASP has a proven record of helping customers
streamline auditing and reporting procedures to reduce
the cost and risks associated with SOX. We offer highly
secure, audit-ready environments and services for
Microsoft Dynamics AX, GP, NAV, SL and CRM.
With 24/7/365 support for any connectivity, backup,
restore, password reset or other application readiness
issues, RoseASP is committed to personalized service
and responds quickly to any documentation requests.
We work closely with customers and Dynamics Partners
to ensure that Dynamics ERP customers get the
application support they need with internal controls and
backstops to support requirements for SOX, HIPAA and
FDA compliance.
About RoseASP
8 5 8 - 7 9 4 - 9 4 0 3
s a l e s @ r o s e a s p . c o m
w w w . R o s e A S P . c o m