{
  "node_id": "sox-it-controls",
  "title": "SOX IT Controls - Sarbanes-Oxley IT Compliance",
  "domain": "Banking & Global Finance",
  "version": "1.1.0",
  "last_updated": "2026-04-10",
  "bluf": "The Sarbanes-Oxley Act of 2002 (SOX) - enacted in response to Enron, WorldCom, and other financial scandals - imposes mandatory internal controls over financial reporting (ICFR) requirements on all US public companies (SEC registrants) and foreign private issuers listed on US exchanges. Section 302 requires the CEO and CFO to personally certify in each quarterly and annual filing that they have reviewed the report, it contains no material misstatements, and they have disclosed all significant deficiencies and material weaknesses in internal controls. Section 404(a) requires management's annual assessment of ICFR effectiveness as of fiscal year-end, with disclosure of any material weaknesses. Section 404(b) requires external auditor attestation for accelerated filers (>$75M public float). IT General Controls (ITGCs) are the foundational IT controls that support the reliability of financially significant systems and are subject to SOX testing. The four ITGC domains: (1) Logical Access Controls - who can access financially significant systems; (2) Change Management - how changes to financial systems are authorized and tested; (3) Computer Operations - batch job monitoring, backup, incident management; (4) System Development - SDLC controls for new implementations. The COSO Internal Control - Integrated Framework (2013) and COSO ERM framework are the primary control assessment frameworks referenced by external auditors. Material weaknesses are the highest severity - the auditor must issue an adverse opinion on ICFR effectiveness, severely damaging share price and regulatory standing.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "ai_overlay_2026",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "cyber-nist-csf-2",
    "nist-sp-800-162-abac",
    "nist-sp-800-39-managing-risk",
    "nist-800-61-incident-resp",
    "sec-reg-s-k-106"
  ],
  "primary_citations_count": 6
}