← Crosswalk explorer
SOC 2 ↔ SOX (Sarbanes-Oxley) Section 404
25 canonical controls in Keel’s library satisfy clauses of both SOC 2 and SOX (Sarbanes-Oxley) Section 404. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
25 shared controls
SOC 2 · 2017 TSC (rev. 2022): 27 in library
SOX (Sarbanes-Oxley) Section 404 · Act of 2002 §404; COSO 2013 framework, 17 principles: 30 in library
Controls that satisfy both
| Canonical control | SOC 2 clauses | SOX (Sarbanes-Oxley) Section 404 clauses |
|---|---|---|
|
Information security policy
A board-approved information security policy set, reviewed at least annually and communicated to the workforce.
|
CC5.3 | P12 |
|
Risk assessment & treatment
A documented process to identify, analyze, evaluate, and treat information security risks on a defined cadence.
|
CC3.1, CC3.2 | P6, P7, P9 |
|
Access control policy
Rules for granting, reviewing, and revoking access to systems and data based on business need and least privilege.
|
CC6.1, CC6.3 | P11 |
|
User provisioning & deprovisioning
Joiner/mover/leaver process to grant, change, and promptly remove access across systems.
|
CC6.2, CC6.3 | P11 |
|
Multi-factor authentication
MFA enforced for remote access, administrative access, and access to sensitive systems and data.
|
CC6.1 | P11 |
|
Encryption in transit & at rest
Strong cryptography protects sensitive data in transit over public networks and at rest in storage.
|
CC6.7 | P11 |
|
Logging & monitoring
Security-relevant events are logged, protected, retained, and reviewed for anomalies.
|
CC7.2 | P11, P13 |
|
Vulnerability management
Regular scanning, prioritization, and remediation of vulnerabilities across systems and applications.
|
CC7.1 | P11 |
|
Backups
Regular, tested backups of critical data and systems with defined retention.
|
A1.2 | P11 |
|
Business continuity & disaster recovery
BC/DR plans with defined RTO/RPO, tested periodically, to restore service after disruption.
|
A1.2, A1.3 | P11 |
|
Incident response
A documented, tested plan to detect, triage, contain, remediate, and communicate security incidents.
|
CC7.3, CC7.4 | P11 |
|
Change management
Changes to systems and software are requested, reviewed, tested, approved, and tracked.
|
CC8.1 | P9, P11 |
|
Third-party / vendor risk management
Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data.
|
CC9.2 | P11, P15 |
|
Security awareness training
Ongoing security awareness training for all personnel, with completion tracking.
|
CC1.4 | P4, P14 |
|
Asset inventory
An inventory of hardware, software, and information assets with assigned owners.
|
CC6.1 | P11 |
|
Physical security
Physical access to facilities and equipment holding sensitive data is restricted and monitored.
|
CC6.4 | P11 |
|
Secure software development
Secure coding, review, and testing practices across the development lifecycle.
|
CC8.1 | P11 |
|
Network security controls
Firewalls/segmentation and network controls restrict traffic to and from sensitive environments.
|
CC6.6 | P11 |
|
Data retention & secure disposal
Data is retained per policy and securely destroyed when no longer needed.
|
C1.2 | P13 |
|
Personnel security (HR)
Background screening, confidentiality agreements, and onboarding/offboarding security steps.
|
CC1.4 | P4 |
|
Document & records control
Documented information is created, approved, versioned, and controlled; records are retained and protected.
|
CC5.3 | P12, P13 |
|
Internal audit program
A risk-based internal audit program evaluates conformity and effectiveness at planned intervals.
|
CC4.1 | P16 |
|
Management review
Leadership reviews management-system performance at planned intervals and drives improvement decisions.
|
CC4.1 | P2, P16, P17 |
|
Delegation of authority & segregation of duties
Approval authority and spending limits are defined, assigned to named roles, reviewed as the organization changes, and enforced in the systems that execute transactions - so no one person can initiate, approve, record and reconcile the same transaction.
|
CC1.3, CC1.5 | P3, P5, P10 |
|
Fraud risk assessment
A periodic assessment of how fraud could occur here - fraudulent reporting, misappropriation, corruption, and management override of controls - naming the specific schemes considered and the control responding to each.
|
CC3.3 | P8 |
Clause identifiers (SOC 2 and SOX (Sarbanes-Oxley) Section 404) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel’s own; a framework’s full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, SOX (Sarbanes-Oxley) Section 404 mostly lights up controls you already built for SOC 2. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.