The documents retention rules are very explicit that destroying or altering records needed for a federal inquiry is against the law.  Any NPO that files a 990 needs to be aware of this rule and have policies in place that will dissuade employees or others from breaking it if an investigation is pending or underway.  More generally, federal contracts would, I believe, impose the same requirements.

The whistleblower rules are equally clearly relevant to a nonprofit.  They focus on the possibility of retaliation, and impose serious penalties when it occurs. Again, the scope is limited to retaliation for good faith reporting of violations of federal laws or other legal requirements. Even if it were wise, it would be difficult to develop a whistleblower policy limited to such events. And, in any case, a whistleblower policy is a good idea.  

In my opinion, the SOx rule looks too closely at the wrong end of the problem.  Organizations that care about stewardship of charitable assets needs a whistleblower policy that clearly and publicly describes an easy way for anyone who suspects misdeeds to report them (a) without risk of retribution or retaliation, and (b) in a way that will result in a careful, fair, and usually confidential investigation to protect the rights of anyone who might be mistakenly or falsely accused and, of course, to avoid potential abuse of the policy in internecine conflict. --P.B. via e-mail.

I agree that there are two provisions of Sarbanes-Oxley that apply to nonprofits as you cite above.  But, like compliance with any other law (such as don't steal, don't obstruct justice, or don't harass), I don't think they require "policies" in the sense that the Form 990 asks about them or the Standards for Excellence envisions them.  The typical document retention policy deals with a whole lot more than not destroying them when you become aware of a federal investigation that might involve them.  The whistleblower policy, as you state, ought to cover state and local laws as well as federal, and also internal policies and procedures.  The anti-harassment policy should include a procedure for complaints, investigations, and correction of improper or unwanted conduct that might not rise to the level of illegal harassment.  If utilized, these can all improve the administration of an organization.  But beyond the "policy" that an organization shall not break the law (which applies to every individual and organization whether or not in a "policy"), these more elaborate policies are not legally required. --Don Kramer