SOX gave us a start to prepare for what was to come. As mentioned by all above, we now have the law on our side when we ask for controls, and the time and materials to implement them.

The regional bank I work for was hit by eastern European hackers a year ago. SOX helped in two ways:

1) We were partially prepared for the intrusion, and as such the actual damage to customer data was limited. Law enforcement gave us a huge P/R boost in assuring our customers that we had been well prepared.

2) Many staff were prepared to respond quickly and appropriately, by having done many of the steps in lesser intensity over the last five years.