Keeper Supports Sarbanes-Oxley(SOX) Compliance
DATASHEETSOX Compliance

The Sarbanes-Oxley Act (SOX), which was enacted into U.S. federal
law in 2002, established a set of anti-fraud controls that apply topublic companies and companies that are considering a potential
initial public offering (IPO). SOX or Sarbox also applies to whollyowned subsidiaries and foreign companies that are publicly tradedand do business in the United States, as well as accounting firmsthat perform SOX compliance audits.
The goals of SOX are to ensure the accuracy and transparency ofcorporate disclosures and to protect enterprise shareholders andthe general public from accounting errors and fraudulent practices.

Automation is Crucial to SOX Compliance in the RemoteWork Era
The COVID-19 pandemic touched off a worldwide increase incyberattacks that INTERPOL called “alarming.” Cybercriminals
are taking advantage of increased security vulnerabilities asorganizations rapidly deploy technologies to enable large numbersof remote workers.
In this high-risk environment, SOX compliance professionals areseeking to make changes to their existing compliance technologies
and processes.
SOX audits require organizations to provide voluminous
documentation providing that they have established internal
controls spanning five key areas, and that these controls areworking effectively:
1.

Control Environment

2.

Risk Assessment

3.

Control Activities

4.

Information and Communication

5.

Monitoring

While SOX audit reports are produced annually, organizations must
prove that their controls are operating continuously, year-round.
This means that audit-related activities take place throughout theyear, placing additional burdens on already-overworked IT staff.
It is crucial that organizations automate as many SOX complianceprocesses as possible.

Using Keeper to Support SOX Compliance
The protection of credentials and access to financial systems isessential for organizations to comply with SOX financial reportingand disclosure requirements. Every user within an enterprisenetwork is a potential risk factor, making it critical to ensure risk
mitigation and data protection for every employee, subcontractor,
and vendor, on every device that accesses the organizational
network.
Keeper simplifies SOX compliance monitoring and reporting bygiving IT administrators full visibility and control over employee
password usage and role-based systems access throughout
their data environments, with customizable audit logs and event
reporting. Keeper supports robust internal controls throughdelegated administration, enforcement policies, event tracking,monitoring, and reporting.

IT Admin InsightEvery employee is provided with a secure digital vault. A security
dashboard in the Admin Console provides an overview of weakpasswords, password reuse, and 2FA enforcement, along with rolebased-access-controls (RBAC) to enforce least privilege policies.
Administration may be delegated according to department or byteam leader, and folders and records can be securely shared andrevoked. If an administrator or employee leaves the company, theirvault can be automatically locked and securely transferred. Accesslogs to Keeper vaults can be audited for compliance or forensics.

SOX Audit Reporting
The Keeper Commander SDK enables administrators andauthorized end-users to run reports relevant to meeting SOX
compliance requirements, including:Shared Access Report - The share-report command provides abreakdown of which users within the organization have accessto records within the vault. This report is generated based on thespecific user currently logged into Commander.

© 2021 Keeper Security, Inc.

DATASHEETSOX Compliance

Keeper Security’s Advanced Reporting & Alerts module (ARAM)
empowers IT administrators to monitor any size user population;
receive focused, summary trend data and real-time notificationsof risky or unusual behaviors; and run customized reports. For
example, the audit-report command provides detailed event-based
reporting at the user, record, or overall system level.
Keeper enables administrators to easily define custom SOX
reports that include detailed events related to sharing information
including who the information has been shared with and any
permission changes related to access. For more information onARAM, please reference the Keeper ARAM datasheet.

Email Auto-Provisioning
Easily and quickly provision Keeper vaults to tens or thousandsof users, with a domain match on email addresses. With minimum
administration, large-scale deployment can be accomplished using
an existing email channel or portal.

Flexible Provisioning
Keeper supports the ability to seamlessly provision users andteams from Microsoft Azure AD or other identity platforms using
the SCIM protocol. Keeper also supports API-based, commandline provisioning through the use of Keeper Commander SDK.
The Keeper Commander SDK is open-source Python code that isavailable for download from Keeper’s Github repository.

Secure File Storage
In addition to securing employee passwords, Keeper helps
companies prevent data loss by allowing them to store sensitive
files, documents, digital certificates, private keys, photos, andvideos in a highly secure, encrypted digital vault. Employees cansecurely share files with colleagues with confidence, knowing that
only the intended recipients can access the shared files.
Keeper uses PBKDF2 to derive authentication keys based on theuser’s Master Password, then generates individual record-level
AES-256 encryption keys locally on the device to encrypt eachstored file. Keeper’s cloud only holds the encrypted ciphertext ofeach file. Sharing between users is performed using PKI to ensurethat only the recipient of a shared file can decrypt it. Keeper’s
zero-knowledge encryption methods ensure that only the user canaccess and decrypt their stored files.

keepersecurity.com | sales@keepersecurity.com

Defense Against Third-Party Vendor Breaches
Even if your password security is solid, your firm could becompromised through one of your vendors. With remote
workforces having rapidly expanded, cybercriminals are taking
advantage of the myriad of SaaS solutions that businesses aredeploying to enable their remote workforces. Keeper supports
granular controls that allow an administrator to restrict third
party vendor access to information and critical systems, while
requiring strict access control and account monitoring. Custom
alerts and reports can be configured to monitor, track, and notify
administrators of any risky behavior. Administrators can thentake action which may include locking these third party vendor
accounts.
Keeper BreachWatchTM for business protects your organization,
including third-party vendor accounts, against breaches
caused by compromised credentials. BreachWatch for businessdoesn’t depend on public breach notifications. It scans Dark Web
forums and notifies organizations in real-time if any employee
passwords have been compromised. This allows IT administrators
to force password resets right away, minimizing the risk ofcybercriminals using them to breach company systems.

About Keeper Security, Inc.
Keeper Security, Inc. (Keeper) is the market-leading, top-rated
cybersecurity platform for preventing password-related data
breaches and cyberthreats. Keeper’s zero-knowledge security andencryption software is trusted by millions of people and thousandsof businesses across the globe to mitigate the risk of cybertheft,boost employee productivity and meet compliance standards.
Keeper has been named PC Magazine’s Best Password Managerof the Year & Editors’ Choice, PCWorld’s Editors’ Choice and is thewinner of four G2 Best Software Awards. Keeper is SOC-2 andISO 27001 Certified and is also listed for use by the U.S. federal
government through the System for Award Management (SAM).
Learn more at https://keepersecurity.com/enterprise.html.

© 2021 Keeper Security, Inc.