Banking Compliance SOX and Password Issuance

[dspsyssts]

Anyone know anything about SOX compliance with regard to the requesting and distribution of passwords within a financial organization?

EG should a change request ticket documenting the problem specify the server and userid password being requested?

Should passwords be distributed encrypted or via two emails so the server name and password and separate etc?

Any links or hints gratefully received....I appreciate this probably isn't the best forum but maybe someone knows?

[thunderlizard]

The Sarbanes Oxley act is nowhere near that specific. Read it- only 1 paragraph is related to IT, and only because it mentions "adequate internal controls". How you interpret that is to be agreed between you and the nominated finance people.