[steve.pearl]

Does anyone know if there is a "template" or other info on configuring the IT policy on the BES to conform to Sarbanes-Oxley?

[Stinsonddog]

What do you mean by your question. I am familiar with SO. What are you trying to achieve?

[steve.pearl]

I work for a government agency with very strict security standards. We are piloting a blackberry solution and our Security division will not allow it into production with out meeting official standards ie. S-O. I need to provide them with documentation that shows the IT policy I send to the handhelds meet this standard. Thanks for any help.

[steve.pearl]

BTW, if not S-O, any formal accepted standard would be a good start.

[marco616]

I would print the default IT policy with one change. disable PIN to PIN

if the default is not acceptable you can make changes accordingly


good luck

[jibi]

Give them the IT Policies and let them decide. IMO, security of any system, including these handheld policies, should be dicated by Information Security and implemented by the Systems Administrator/Engineer.

Are you looking at BES 4.0 or 4.1? Which mail environment (Exchange, Domino, Groupwise)?

[steve.pearl]

I agree with who should be responsible. We are a GroupWise shop. I have used another federal govt policy as a template and locked them down very tight. In the end the biggest security risk is with the user (as always) and not the system itself.

[robemorr]

What about the FIPS 140-2 certification? Would that be enough?