The federal Sarbanes-Oxley Act was passed in 2002 and has come to be known as SOX in business environments. SOX addresses fraudulent financial activity in publicly traded companies and provides some specific protection for those who report such activity.
SOX protections extend to employees of publicly traded companies. They also cover contractors and subcontractors who are working with or for such companies as well as agencies of those companies. The type of reporting protected under SOX is fairly broad. You might be protected whether you make a report to a federal agency or to a law enforcement agency. Reporting to your supervisor or through internal compliance channels is also protected.