Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.
This equipment makes up the spine of the company infrastructure.
Let's say it's definitely IN EVERYONE'S BEST INTEREST to go ahead and upgrade this year, but higher-ups aren't convinced that we need it.
Is it a requirement of SOX to make sure every single piece of information technology within an organization is still receiving security patches?
Is it an automatic fail if so? Or can defense in depth/compensating controls help maintain a compliant posture?