SOX (Sarbanes-Oxley Act)

The Sarbanes-Oxley Act of 2002 is a U.S. federal law that established stringent financial reporting and corporate governance requirements for publicly traded companies to protect investors from fraudulent accounting practices.

Access Control Implementation

# PowerShell script for quarterly access review
$ReviewDate = Get-Date -Format "yyyy-MM-dd"
$Users = Get-ADUser -Filter * -Properties LastLogonDate, MemberOf

foreach ($User in $Users) {
    $Groups = $User.MemberOf | ForEach-Object {
        (Get-ADGroup $_).Name
    }
    
    [PSCustomObject]@{
        Username = $User.SamAccountName
        LastLogon = $User.LastLogonDate
        Groups = $Groups -join "; "
        ReviewDate = $ReviewDate
        Status = if ($User.LastLogonDate -lt (Get-Date).AddDays(-90)) {
            "Review Required"
        } else {
            "Active"
        }
    }
} | Export-Csv "Access_Review_$ReviewDate.csv"

-- SQL Server audit for financial data changes
CREATE SERVER AUDIT SOX_Audit
TO FILE (FILEPATH = 'C:\Audit\')
WITH (ON_FAILURE = CONTINUE);

CREATE DATABASE AUDIT SPECIFICATION SOX_Database_Audit
FOR SERVER AUDIT SOX_Audit
ADD (SELECT, INSERT, UPDATE, DELETE 
     ON financial_data 
     BY public);

-- Enable the audit
ALTER SERVER AUDIT SOX_Audit WITH (STATE = ON);
ALTER DATABASE AUDIT SPECIFICATION SOX_Database_Audit 
WITH (STATE = ON);

Change Management Control

# Git hook for SOX change control
#!/bin/bash
# pre-receive hook for production deployments

while read oldrev newrev refname; do
    # Check if deployment to production branch
    if [[ $refname == "refs/heads/production" ]]; then
        # Verify change request approval
        CHANGE_ID=$(git log --format=%B $newrev | grep -o 'CHG-[0-9]*' | head -1)
        
        if [[ -z $CHANGE_ID ]]; then
            echo "Error: Production deployment requires change request ID"
            exit 1
        fi
        
        # Verify approval status (integrate with change management system)
        APPROVAL_STATUS=$(curl -s "https://changmgmt.company.com/api/change/$CHANGE_ID/status")
        
        if [[ $APPROVAL_STATUS != "APPROVED" ]]; then
            echo "Error: Change request $CHANGE_ID not approved"
            exit 1
        fi
        
        # Log the deployment for SOX audit trail
        echo "$(date): Production deployment - Change ID: $CHANGE_ID, User: $USER" >> /var/log/sox-deployments.log
    fi
done