SOX ITGC

Sarbanes-Oxley IT General Controls: change management, software inventory, supplier accountability.


Short name	SOX
Region	Americas
Country or scope	United States
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SOX

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for SOX.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for SOX and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SOX-404-INV` Inventory of Financially Relevant Software	Assessing internal control over financial reporting requires identifying the software components that make up in-scope financial systems (SOX §404; ITGC scoping practice)	Scan
`SOX-ITGC-CM` Change Management Evidence	ITGC change management requires that changes to in-scope software are tracked and auditable, which depends on known versions for every component (SOX §404 ITGC: change management domain)	Scan
`SOX-ITGC-SPEC` Deterministic Deployments	Reliable financial processing requires deterministic, reproducible software configurations: no floating or unspecified component versions (SOX §404 ITGC, change management / operations)	Scan
`SOX-ITGC-VEN` Supplier Accountability	Controls over third-party software used in financial reporting require knowing which vendor supplies each component so vendor controls (e.g. SOC reports) can be mapped (SOX §404 ITGC: third-party/vendor management practice)	Scan
`SOX-302-DOC` Auditable System Records	Officer certifications of internal control presuppose reliable, dated documentation of the systems in scope; an identified, timestamped SBOM supplies that record for software composition (SOX §302 certification duty)	Scan
`SOX-ITGC-INT` Program Integrity	ITGCs must provide assurance that financial application code is not altered without authorization, supported by integrity hashes on deployed components (SOX §404 ITGC: program change / operations integrity)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ITGC.AC.1`	Control User Access to Financial Systems
`ITGC.AC.2`	Control Privileged and Administrative Access
`ITGC.AC.3`	Segregate Incompatible Duties
`ITGC.CM.1`	Manage and Document Application Changes
`ITGC.CM.2`	Segregate Development from Production Environments
`ITGC.CM.3`	Control Infrastructure and Configuration Changes
`ITGC.OP.1`	Perform Data Backups and Verify Restorability
`ITGC.OP.2`	Monitor and Alert on IT Operations
`ITGC.OP.3`	Implement Incident Management Procedures
`ITGC.BC.1`	Establish Business Continuity and Disaster Recovery Plans
`ITGC.CM.4`	Maintain Program Change Audit Trail
`ITGC.AC.4`	Perform Periodic User Access Reviews
`ITGC.CM.5`	Implement Source Code Management and Version Control
`ITGC.OP.4`	Manage Third-Party IT Service Provider Risk

Policy templates

Written for SOX:

SOX ITGC Access Control Policy for Financial Systems
SOX ITGC Change Management Policy
SOX ITGC IT Operations and Data Backup Policy
SOX ITGC Third-Party IT Service Provider Policy

And 22 from the standard set, adapted to SOX.