SOX ITGC control library

Every control CMDash tracks for SOX ITGC, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.

52 controls4 families0 mapped to other frameworksNo published text extract yet

Families

Access Management · 13 Change Management · 13 Computer Operations · 13 Program Development / SDLC · 13

Access Management · 13

AM-01	New user access to financially relevant systems is requested and approved prior to provisioning
AM-02	Access provisioned matches the access approved (least privilege / role-based)
AM-03	Segregation of duties is enforced within financially relevant applications
AM-04	User access to financially relevant systems is recertified on a periodic basis
AM-05	Privileged/administrator access to financially relevant systems is restricted to authorized personnel
AM-06	Privileged/administrator access is reviewed on a more frequent cadence than standard user access
AM-07	Access for terminated employees and contractors is removed within a defined SLA
AM-08	Access for transferred/role-changed employees is adjusted to reflect the new role
AM-09	Generic, shared, and default vendor accounts are inventoried, restricted, and monitored
AM-10	Password and authentication configuration for financially relevant systems meets the organization’s minimum security standard
AM-11	Direct database access to financially relevant data is restricted and logged
AM-12	Remote and third-party access to financially relevant systems requires multi-factor authentication
AM-13	New or modified access roles are reviewed for segregation-of-duties conflicts before being granted

Change Management · 13

CM-01	A change management policy defines standard, normal, and emergency change categories and their required approvals
CM-02	All changes to financially relevant applications, databases, and infrastructure require a documented change request
CM-03	Changes are reviewed and approved by an individual independent of the developer prior to migration to production
CM-04	Changes are tested in a non-production environment prior to deployment
CM-05	Development, test/QA, and production environments are logically or physically segregated
CM-06	Emergency changes follow a documented emergency-change procedure with required retroactive review and approval
CM-07	A Change Advisory Board (or equivalent) reviews and prioritizes changes affecting financially relevant systems
CM-08	Rollback / back-out procedures are documented and available for each production change
CM-09	Access to migrate code and configuration changes into the production environment is restricted to authorized personnel
CM-10	Segregation of duties is maintained between development and production-deployment functions
CM-11	Configuration changes to infrastructure (operating system, database, network) follow the same change-control process as application changes
CM-12	A post-implementation review confirms the change achieved its intended result without unintended adverse impact
CM-13	Change tickets are reconciled to version-control commits/deployment artifacts for completeness

Computer Operations · 13

CO-01	Changes to batch job scheduling for financially relevant processing are authorized and documented
CO-02	Batch processing failures and exceptions affecting financial data are identified, logged, and resolved in a timely manner
CO-03	System backups of financially relevant data are performed on a defined schedule
CO-04	Backup restoration is periodically tested to confirm data can be recovered
CO-05	System availability and performance of financially relevant systems is monitored, with alerting for anomalies
CO-06	Physical access to data centers and server rooms hosting financially relevant systems is restricted to authorized personnel
CO-07	Environmental controls (power, cooling, fire suppression) are in place for facilities hosting financially relevant systems
CO-08	An incident management process ensures IT incidents affecting financially relevant systems are logged, escalated, and resolved
CO-09	A problem management process identifies and addresses the root cause of recurring incidents
CO-10	Capacity of financially relevant systems is monitored and managed to ensure adequate processing resources
CO-11	Access to job-scheduling and batch-processing tools is restricted to authorized operations personnel
CO-12	System and security event logs for financially relevant systems are retained per policy and protected from unauthorized modification
CO-13	A disaster recovery plan for financially relevant systems is documented and tested at least annually

Program Development / SDLC · 13

PD-01	New system development or acquisition affecting financial reporting requires a documented business case and management approval
PD-02	System requirements are documented and approved prior to development
PD-03	System design is reviewed and approved prior to build
PD-04	Application development follows documented secure coding standards
PD-05	User acceptance testing (UAT) is performed and formally signed off before a new system or major enhancement goes live
PD-06	Data conversion and migration activities are validated for completeness and accuracy prior to cutover
PD-07	Segregation of duties is maintained between system-development and production-support functions
PD-08	A post-implementation review is performed following major system implementations or upgrades
PD-09	System documentation (technical and user) is updated to reflect new or changed functionality
PD-10	Interfaces between financially relevant systems are tested for completeness and accuracy of data transferred
PD-11	A defined project management methodology governs SDLC phases and requires gate approvals before proceeding to the next phase
PD-12	Access to source-code repositories for financially relevant applications is restricted and all changes are version-controlled
PD-13	Decommissioning of legacy financially relevant systems includes data retention and archival per the organization’s records-retention policy

Where this comes from

Control identifiers, families and titles are the rows CMDash’s own seed data writes for SOX ITGC COSO 2013 / PCAOB AS 2201, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.

Track these controls in CMDash

Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.

Start free trial About SOX ITGC