Five years and counting: A SOX data security reality check