Sarbanes-Oxley, HIPAA, and CFR 11
Compliance

Recent federal regulations have created a whole new, and difficult, playing field when it comes to compliance. However, with GASP as part of your Software Asset Management program, you can keep this playing field from becoming a mine field.

The Sarbanes-Oxley Act (2002)

• Ensures the performance data of public companies remains timely and accurate.
• Applies to public companies and the companies that do business with them.
• Requires that you can prove the “who, what, where, and when” of created or installed computer programs and files.
• Requires an inventory of assets for a Disaster Recovery Plan.
• Sarbanes–Oxley compliance is a moving target—GASP plays a pivotal role in helping you stay focused.

HIPAA or The Health Insurance Portability and Accountability Act (1996)

• Protects confidentiality, integrity, and availability of private electronic health information.
• Sets strict guidelines for health-related businesses.
• Compliance involves providing a completed and documented list of technology solutions—GASP identifies all applications, even those not in the software Information Database (SID).

CFR 11 or The Food and Drug Administration's (FDA's) 21 Code of Federal Regulations (CFR) Part 11

• Regulates use of electronic signatures/records in FDA-regulated industries, such as drug and pharmaceutical companies, food processing, and medical device manufacturers.
• Requires proof of “who did what, when, where and why” when applying electronic signatures/records.
• GASP helps you keep track of data, so you stay in compliance.