Sarbanes-Oxley cybersecurity requirements come from the fact that nearly every number in a public company’s financial statements is generated, stored, or moved by a computer system. The Sarbanes-Oxley Act (SOX) does not name specific technologies, but it demands accurate financial reporting and effective internal controls, and those obligations land squarely on the IT systems that produce the reports. In practice, that means public companies must control access to financial data, manage changes to financial systems, keep those systems recoverable, retain electronic records in tamper-resistant form, have executives personally certify the results, and now, under newer SEC rules, disclose material cyber incidents and describe their cyber governance in annual filings.
Who These Requirements Cover
SOX applies to any company with securities registered under the Securities Exchange Act of 1934, which includes every company listed on a U.S. stock exchange and subsidiaries whose financial data rolls up into the parent’s consolidated statements.1Office of the Law Revision Counsel. 15 USC 7241 – Issuer’s Responsibility for Financial Reports Foreign issuers listing shares on American exchanges are generally covered on the same terms, though the SEC can grant exemptions where doing so is consistent with investor protection.2U.S. Securities and Exchange Commission. Securities Exchange Act of 1934 Section 12 Audits of these companies are supervised by the Public Company Accounting Oversight Board (PCAOB), which sets the auditing standards that dictate how internal controls, including IT controls, get tested.3Public Company Accounting Oversight Board. Standards
The IT Controls Section 404 Actually Demands
Section 404 requires every annual report to include management’s own assessment of whether internal controls over financial reporting are effective, and for most filers, an outside auditor must issue its own opinion on that same assessment.4Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls Auditors evaluating those controls under PCAOB standards focus on three IT areas: access to programs and data, program change management, and computer operations.5Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting If those Information Technology General Controls fail, the auditor cannot rely on the automated processes producing the numbers, and the entire opinion is at risk.
Access Controls
Access controls restrict who can view, modify, or extract financial data. Auditors expect role-based permissions, prompt removal of terminated employees, tight management of privileged accounts, logging of access attempts, and separation of duties so that no single person can both initiate and approve a financial transaction. Weak access controls are one of the most common deficiencies flagged during a SOX audit.
Change Management
Every change to software, database structures, or infrastructure that touches financial data has to move through a documented approval workflow. Auditors want a clear trail: who requested the change, who approved it, who implemented it, and evidence that an independent party tested the result. Undocumented changes to financial systems can support a material weakness finding on their own.
Computer Operations and Recovery
Systems must keep producing reliable financial data when something goes wrong. That means backup and recovery procedures that have actually been tested, monitoring of batch processing, and incident response plans that address data integrity, not just availability. A backup nobody has restored in two years does not satisfy this requirement.
The Frameworks Auditors Expect
Most companies structure their Section 404 work around the COSO Internal Control–Integrated Framework, often with COBIT layered on top to map IT processes to control objectives. Neither is legally mandated, but auditors expect a recognized methodology rather than ad hoc controls.
Executive Certification Under Section 302
Section 302 puts the CEO and CFO’s names on every quarterly and annual report. They must certify that they have reviewed the filing, that it contains no material misstatements, that the financial statements fairly present the company’s condition, and that they have evaluated the effectiveness of internal controls within the 90 days before filing. They also have to disclose any significant deficiencies, material weaknesses, or fraud involving employees who work with those controls to the auditors and the audit committee.1Office of the Law Revision Counsel. 15 USC 7241 – Issuer’s Responsibility for Financial Reports
For security teams, this creates a direct pipeline from the IT floor to the boardroom. When executives sign, they are vouching for the reliability of the systems producing the numbers. A security gap that lets someone manipulate financial data becomes a personal legal problem for the officers who certified the report.
SEC Cybersecurity Disclosure Rules
Starting in late 2023, the SEC added cybersecurity-specific disclosure rules that operate alongside SOX rather than replacing it.
Four-Day Incident Reporting
Once a company determines that a cybersecurity incident is material, it has four business days to file a Form 8-K under Item 1.05 describing the nature, scope, and timing of the incident and its material impact or reasonably likely material impact.6U.S. Securities and Exchange Commission. SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure The clock runs from the materiality determination, not the incident itself. If the full impact is still unclear at the filing deadline, the company reports what it knows and amends later.7U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material The only delay available is a written determination from the U.S. Attorney General that immediate disclosure would threaten national security or public safety.
Annual Governance Disclosure
Regulation S-K Item 106 requires the annual 10-K to describe how the company identifies, assesses, and manages material cybersecurity risks, whether those processes are integrated into overall risk management, and whether outside assessors are used. The filing must also describe board oversight of cyber risk and identify the management positions responsible for cybersecurity, including their relevant expertise.8eCFR. 17 CFR 229.106 – Item 106 Cybersecurity
Record Retention and How It Shapes Storage
SOX imposes overlapping retention duties that dictate how electronic records get stored. SEC rules under Section 802 require that records relevant to an audit or review be kept for seven years after the auditor concludes the engagement.9Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews The underlying statute sets a five-year floor for audit workpapers, with penalties of up to 10 years in prison for knowing and willful violations.10Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records A broader criminal statute makes it a federal crime to alter, destroy, or conceal any record with intent to obstruct a federal investigation, punishable by up to 20 years in prison, and it reaches beyond financial records to things like server logs and email archives.11Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
The technical consequences are specific. Electronic records need to sit in formats that prevent tampering, with audit trails showing access. Many organizations use Write Once, Read Many (WORM) storage or equivalent immutable systems. Archives also have to be searchable and producible on request; raw database dumps on unlabeled tapes will not qualify. And because the clock runs for the better part of a decade, storage chosen today has to stay readable years from now.
Whistleblower Protection for IT and Security Staff
Section 806 protects employees who report conduct they reasonably believe constitutes securities fraud, an SEC violation, or a violation of federal law relating to shareholder fraud. Reports to a supervisor, a federal agency, or a member of Congress all count as protected activity, and retaliation is prohibited by public companies, their subsidiaries, and their contractors. An employee who faces retaliation has 180 days from becoming aware of it to file a complaint with the Department of Labor. If the Department does not resolve the matter within 180 days, the employee can sue in federal court, with remedies including reinstatement, back pay with interest, and litigation costs and attorney fees.12Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases For the analyst who spots someone tampering with access logs or bypassing change controls, that legal cover matters.
Criminal Penalties
Under Section 906, a CEO or CFO who certifies a financial report knowing it does not comply faces up to $1,000,000 in fines and up to 10 years in prison. If the false certification is willful, the maximums rise to $5,000,000 and 20 years.13Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Record destruction is punished separately: up to 20 years for knowingly destroying or falsifying records to obstruct a federal investigation, and up to 10 years for willfully destroying audit workpapers.11Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations These penalties reach individuals, not just the company. An administrator who deletes logs at a manager’s direction during an investigation is personally exposed.