Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019.

This equipment makes up the spine of the company infrastructure.

Let's say it's definitely IN EVERYONE'S BEST INTEREST to go ahead and upgrade this year, but higher-ups aren't convinced that we need it.

Is it a requirement of SOX to make sure every single piece of information technology within an organization is still receiving security patches?

Is it an automatic fail if so? Or can defense in depth/compensating controls help maintain a compliant posture?

Thanks guys.


I will avoid going into detail about the nature of SOX as that info is widely available. However, I will say the following: SOX is not a control framework.

  • The answer is no, having EOL elements as part of Production is not a problem (under the umbrella of SOX). Best practice/security/etc-wise is another topic. Further, "every piece of technology" would not fall under SOX; only financially significant systems (and ancillary ones) are "in scope" (management and the audit team determines this).

Did your companies audit team bring this up? Asking as auditors don't think or communicate clearly most of the time and they may be trying to allude to something tangental.

My background: Part of my CV include 6 years as an IT Auditor for BIG 4 public accounting firms.

  • Hey welcome! This is good information to know. To answer your question - this was not brought up by an audit team. My company had recently gone public and there were concerns from within the IT group about compliance and the age of some of our devices. So would a piece of production equipment be considered in scope if it transports data to and from financially significant systems? – beansbeans Oct 17 '18 at 19:03
  • 1
    -Yes, a piece of production equipment could be in scope if it transports data to and from financially significant systems. However, the EOL would still have no impact. Let me get some info together for you and I'll post it here within the next few days. – steedygonzalez Oct 18 '18 at 22:16
  • Thank you, that makes perfect sense. Though it is in scope, being an EOL device is not a compliance violation. Thank you very much for taking the time to share your knowledge. – beansbeans Oct 23 '18 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.