Where SOX IT general controls meet cybersecurity: which security controls are in SOX scope, how incidents affect ICFR, and how the SEC's 2023 cybersecurity disclosure rules relate to SOX programs.
How Regulation S-K Item 106 and Form 8-K Item 1.05 relate to an existing SOX ITGC program: annual risk management and governance disclosure, the four-business-day incident filing, compliance dates, and reusing ITGC evidence.
Which security controls auditors test as ITGCs and which sit outside SOX: the financial reporting test in SEC guidance, IT risks PCAOB standards name, and how disclosure controls connect security incidents to Section 302 certifications.
What a breach or ransomware event means for SOX: evaluating whether IT general controls failed, whether data or processing was affected, quarterly change disclosure, officer certifications and the separate Form 8-K materiality decision.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.