With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for any software used within the enterprise? If that is true, does that disqualify nearly all open source software?
The reason for asking is that I firmly believe that there is no relevance whatsoever. Yet our IT department frequently vetoes requests for open source software on the basis that without a support contract it doesn't comply with J-SOX requirements. To my knowledge J-SOX has no bearing on whether you have a support contract for software you use. What does seem to matter is anything having to do with financial reporting. Which most of the time doesn't come into play within the realm of open source software.
Is there a foundation for these rejections on the basis of J-SOX*? Or is our IT department just being lazy and trying to get out of supporting software they don't understand?
*I understand that there is an argument to be made that the IT department doesn't have resources to support such software, but blanketing that rejection under J-SOX seems preposterous to me.
Note: This is more of an IT Governance type question than that of security, but I figured that IT Security is more related than Stack Overflow, Super User, etc. Please migrate to the correct site if this is incorrect.