Sarbanes-Oxley Act

Data centers must maintain infrastructure and controls that enable executives to certify, with reasonable assurance, that financial records are accurate and complete.

This requires documented IT controls demonstrating that only authorized personnel can modify financial data, that changes are logged with timestamps, and that segregation of duties prevents any single individual from initiating, approving, and recording transactions.

Data centers must implement and evidence controls over database servers, financial application servers, and storage systems that maintain these records.

Data center operators must facilitate annual testing and documentation of IT general controls that support the overall control environment for financial reporting.

This includes demonstrating that access controls function as designed, change management processes prevent unauthorized modifications, system monitoring detects anomalies, and audit logs remain intact and tamper-evident.

Data centers must retain evidence of testing activities, remediation of control gaps, and management sign-off that controls operated effectively throughout the fiscal period.

Data center infrastructure must guarantee that financial records and supporting documentation are retained for minimum 7-year periods with complete, unalterable audit trails.

This requires immutable storage technologies, write-once-read-many (WORM) storage configurations, or cryptographically signed log files that prevent deletion or modification.

Data centers must implement backup and archival strategies that maintain data integrity throughout retention periods and enable rapid retrieval for regulatory examinations or litigation.

Data centers must enforce technical controls preventing single individuals from performing incompatible functions such as system administration, change approval, and audit log review.

This requires role-based access control (RBAC) systems, dual-control procedures for privileged operations, and monitoring that alerts when segregation of duty violations are attempted.

Financial application systems must be isolated on separate infrastructure with distinct access credentials and approval workflows from operational systems.

Data center change management must implement documented, enforceable processes requiring pre-approval for all modifications to systems processing financial data, with testing in isolated environments before production deployment.

Every change must include business justification, technical specifications, rollback procedures, and evidence of authorization from appropriate personnel.

Data centers must maintain immutable records of all changes with timestamps, operator identifications, and approval chain documentation for 7-year retention.

Data center infrastructure supporting financial applications must enforce multi-factor authentication, strong password policies (minimum complexity and rotation requirements), and automated session timeouts.

Access must be provisioned based on documented job requirements, reviewed quarterly for continued appropriateness, and immediately revoked upon employee termination.

Data centers must maintain and evidence user access matrices demonstrating least-privilege principles and must audit access changes for both creation and removal of user accounts.

Data centers must implement centralized logging and monitoring systems that detect and alert on unauthorized access attempts, privilege escalation, unusual data access patterns, and system configuration changes.

Monitoring must occur in real-time for critical systems with logs retained for minimum 90 days online and extended periods offline.

Data centers must document the frequency of review, personnel responsible for monitoring, and actions taken in response to detected anomalies.

Data center operators must demonstrate that disaster recovery plans for systems supporting financial reporting have been tested annually and can restore operations within documented recovery time objectives (RTOs).

Testing must include data validation that financial records are recovered completely and accurately, with audit trails intact.

Documentation must evidence that recovery procedures were executed successfully, that data integrity was verified post-recovery, and that no financial records were lost or corrupted.