Search for SOX log retention requirements and you will read the same line again and again: the Sarbanes-Oxley Act (SOX) makes you keep logs for seven years. It does not. The seven-year rule is real, but it binds your outside audit firm, and it covers the firm’s own workpapers. Your logs still matter a great deal, because auditors test the information technology (IT) controls behind your financial statements and logs are much of the proof. This guide separates what the law says from what auditors actually ask for, and ends with a retention plan you can defend.
The short answer: The Sarbanes-Oxley Act sets no retention period for system or security logs. The word “log” does not appear in it. The seven years people quote comes from Securities and Exchange Commission (SEC) Rule 2-06 of Regulation S-X (17 CFR 210.2-06) and Public Company Accounting Oversight Board (PCAOB) standard AS 1215, which tell the auditor to keep its audit records for seven years. Companies still need logs because Section 404 requires a yearly assessment of internal control over financial reporting, and auditors test the IT general controls behind it: access to programs and data, program changes and computer operations. A sound plan keeps logs from financial systems for the whole fiscal year under audit plus the months until the annual report is filed, protects them from changes, and never deletes them once an investigation is likely.
Where the seven-year number really comes from
The Act itself has only two retention rules, and both are about auditors. Section 103 tells the PCAOB to make audit firms keep audit work papers for at least seven years. Section 802 added 18 U.S.C. 1520, which tells auditors of public companies to keep audit and review workpapers for five years, and orders the SEC to write a rule on the details. The SEC did, in January 2003, and chose seven years instead of five “to coordinate with forthcoming auditing standards.” The PCAOB then set seven years in AS 1215.
| Rule | Who it binds | What must be kept | How long |
|---|---|---|---|
| SOX Section 103 (15 U.S.C. 7213) | Audit firms, through PCAOB rules | Audit work papers for each audit report | At least 7 years |
| SOX Section 802 (18 U.S.C. 1520(a)(1)) | Accountants who audit public companies | Audit and review workpapers | 5 years from the end of the fiscal period in which the audit concluded |
| SEC Rule 2-06 (17 CFR 210.2-06) | The auditor | Workpapers, memos, correspondence and electronic records that hold conclusions, opinions, analyses or financial data from the audit | 7 years after the audit or review ends |
| PCAOB AS 1215.14 | Registered audit firms | Audit documentation | 7 years from the report release date |
| 18 U.S.C. 1519, added by SOX Section 802 | Everyone | Any record, document or tangible object | No period, but destroying or altering it to obstruct a federal investigation, even one not yet opened, can bring up to 20 years in prison |
| SEC Rule 17a-4 (17 CFR 240.17a-4) | Broker-dealers only, not SOX | Listed business records and communications | 6 or 3 years, the first 2 easily accessible |
None of these rules tells a public company how long to keep its own system logs. Rule 17a-4 is often mixed into SOX articles, but it comes from the Securities Exchange Act of 1934 and applies to broker-dealers.
Who the seven-year rule actually binds
Retention duties under SOX and the rules written to carry it out
Why logs still matter for SOX
SOX did not need to mention logs to make them important. Three parts of the Act pull them in.
- Section 404(a). Every annual report must include management’s assessment of internal control over financial reporting as of the end of the fiscal year (17 CFR 240.13a-15(c)).
- Section 404(b). The outside auditor must attest to that assessment. Non-accelerated filers (exempted by the Dodd-Frank Act in 2010) and emerging growth companies (exempted by the Jumpstart Our Business Startups Act in 2012) do not need this step.
- Sections 302 and 906. The chief executive and chief financial officers certify each annual and quarterly report. Under 18 U.S.C. 1350, willfully certifying a report they know does not comply can bring a fine of up to $5 million and up to 20 years in prison.
Financial reporting runs on software, so the controls include IT controls. The SEC’s 2007 guidance for management says automated controls “often” depend on effective IT general controls. It names four example areas: “program development, program changes, computer operations, and access to programs and data.” It also says management only needs to evaluate the IT general controls that support controls over financial reporting risk, not every IT process.
Auditors follow the PCAOB standards. AS 2201.47 says an automated control is generally lower risk “if relevant information technology general controls are effective.” AS 2110.B4 lists the IT risks the auditor must understand, including unauthorized access to data, IT staff with access privileges beyond those needed, and unauthorized changes to systems or programs.
That is where logs come in. A policy says only approved people can change the general ledger. A log shows who actually did, every day of the year.
How one log entry becomes SOX evidence
An illustration of a single access control, not real data
- EventA user is added to the group that can post journal entries
- CollectedThe event is copied off the server within minutes, out of reach of local administrators
- ReviewedThe quarterly access review matches it to an approved request
- TestedThe auditor samples changes from the year and checks each had approval
Which logs SOX auditors ask for
Scope comes from your risk assessment: the applications, databases, operating systems and network devices that support financial reporting. For those systems, the logs map to the IT general control areas named in the SEC’s guidance.
| IT general control area | What auditors test | Logs that prove it |
|---|---|---|
| Access to programs and data | New access was approved, leavers lost access on time, privileged access is limited, access reviews happened | Directory account creation and removal, group and role changes, administrator sign-ins on financial servers and databases, user changes inside the financial application |
| Program changes | Changes were approved and tested, and moved to production by someone other than the developer | Code repository and pipeline logs, deployment records, production configuration changes, matched to change tickets |
| Program development | New systems were tested and approved before go-live | Repository and pipeline logs; most evidence is project documents |
| Computer operations | Scheduled jobs and interfaces ran completely, failures were handled, backups worked | Job scheduler logs, interface error logs, backup job results, incident tickets |
| The logs themselves | Evidence is complete and unaltered | Log cleared events, audit services stopped, sources that went silent |
The last row is not one of the SEC’s four areas, but every other row depends on it.
On Windows, the access row rests on events such as 4720 (account created), 4726 (account deleted), 4728 and 4732 (member added to a security group) and 1102 (Security log cleared). See Windows event log analysis and our Active Directory detection guide.
How long to keep logs for SOX
No law gives a number, so the period belongs in your record retention policy, agreed with legal counsel, internal audit and, ideally, your outside auditor. Work out the floor from the audit itself.
Management assesses controls as of fiscal year end, but auditors usually test whether controls worked over the year, so samples can come from any month. The annual report on Form 10-K is due 60 days after year end for large accelerated filers, 75 days for accelerated filers and 90 days for everyone else. Until the report is out, the year’s logs are live evidence.
The log window one SOX audit needs
A calendar-year company, fiscal year 2026
- January 1, 2026Fiscal year startsControls must work from the first day; auditors can sample any month
- December 31, 2026Fiscal year endsManagement's Section 404(a) assessment is as of this date
- March 1 to 31, 2027Annual report filed60, 75 or 90 days after year end, by filer size
- Within 14 days of the audit reportAuditor archives its fileAS 1215.15, cut from 45 days by a 2024 PCAOB amendment
- 7 years after the audit reportAuditor may discard its workpapersAS 1215.14 and 17 CFR 210.2-06
A practical plan:
- Keep at least 15 months searchable for in-scope systems: the fiscal year plus the filing window.
- Round up to two years so last year’s records are on hand when the auditor compares one year with the next, or when a deficiency needs a look back.
- Apply longer rules that also bind you. Payment Card Industry Data Security Standard (PCI DSS) Requirement 10.5.1 asks for one year of audit logs. The New York State Department of Financial Services (NYDFS) asks covered companies for three years of cybersecurity audit trails. The longest rule wins.
- Stop deletion when a legal hold starts. An investigation, a lawsuit or a regulator’s inquiry overrides the schedule.
Retention periods that get mistaken for SOX
Minimum years, from the rules each period really comes from
For the detail on the other rules, see PCI DSS logging requirements and NYDFS logging requirements. Public banks also face examiners; our guide to FFIEC logging requirements covers what they check. To estimate the storage two years of logs needs, use our sizing calculator.
Protect logs from the people they record
Retention is half the job. The other half is making sure nobody can quietly change what was kept. Section 802 made it a crime to alter or destroy records to obstruct a federal investigation (18 U.S.C. 1519), and Section 1102 did the same for official proceedings (18 U.S.C. 1512(c)). Both carry up to 20 years. Neither needs an investigation to have started.
In practice:
- Send logs off the host quickly. A database administrator should not be able to erase the record of their own changes.
- Separate duties. The people who run financial systems should not administer the log platform.
- Alert on tampering. Cleared logs, stopped audit services and sources that go quiet should raise an alert, not just a gap.
- Document your deletion jobs. Auditors and lawyers will ask what deleted old data, and who approved it.
Do you need a SIEM for SOX?
No law requires one. A security information and event management (SIEM) system collects logs in one place, keeps them searchable, alerts on suspicious events and produces reports. For SOX, that makes year-long evidence from many systems far easier to hold and to show. Smaller teams can meet the same need with a well-run central log platform.
There is a second reason. Since December 18, 2023 (June 15, 2024 for smaller reporting companies), public companies must file a Form 8-K under Item 1.05 within four business days after determining that a cybersecurity incident is material, and that determination must be made “without unreasonable delay after discovery.” Without central logs, sizing an incident quickly is hard. A May 2025 petition from banking and securities trade groups asks the SEC to rescind Item 1.05. As of November 2026, the SEC has not acted on it, and the rule stands.
For a side-by-side view of how other frameworks treat logs, see SIEM compliance requirements. Many SOX companies also hold a System and Organization Controls (SOC 2) report; see SOC 2 logging requirements.
How UTMStack fits
We build UTMStack, so weigh our view accordingly. Here is what it does for SOX log evidence, and where it stops.
- One place for in-scope logs. UTMStack collects from Windows and Linux hosts through agents included in the free Community edition, and from Microsoft 365, Amazon Web Services, Azure, Google Cloud, GitHub, IBM AS/400 and AIX, and common firewalls. Every event is checked against more than 600 detection rules mapped to MITRE ATT&CK as it arrives, before it is stored. See log management.
- Alerts when evidence is tampered with. Built-in rules fire when the Windows Security log is cleared (event 1102), when other Windows logs are cleared or auditing is switched off from the command line, when Linux log files are deleted or the logging service is stopped, when Microsoft 365 audit data is purged, when Google Cloud or Azure logging is disabled, and when IBM AS/400 auditing is turned off.
- Change evidence from code. GitHub audit logs feed 13 built-in rules, including changes to workflow files and code owner lists, and bypassed environment protections. That supports the program change area.
- Access evidence. Windows account creation, deletion, sign-ins and group membership changes are collected and searchable for access reviews. See identity auditing. There are no built-in alert rules for new Windows accounts or privileged group changes, so write custom rules if you want alerts, not just records.
- Retention you choose. Up to five years. Older data moves to cold storage that stays searchable without a restore, so a two-year SOX window is simple.
- No SOX report. UTMStack scores nine frameworks, including SOC 2 and the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, but not SOX. Your auditor decides which reports and log extracts count as evidence. See compliance.
- What it does not do. It is not a governance tool for documenting and testing controls, and it does not track change tickets or approvals. There is no ready-made parser for enterprise resource planning (ERP) or accounting applications, so logs from inside those systems need another path.
- Where it runs. On your own servers, or on UTMStack Cloud, a dedicated instance per customer on OVHcloud.
UTMStack is priced per device, never by log volume, so keeping two years of logs does not double the bill. Ask for a quote or see pricing.
Frequently asked questions
Does SOX require seven years of log retention? No. The seven years in 17 CFR 210.2-06 and PCAOB AS 1215.14 apply to the outside auditor’s workpapers and related records. SOX sets no retention period for a company’s system or security logs.
How long should audit logs be kept for SOX compliance? Long enough to cover the period your auditor tests: the full fiscal year plus the time until the annual report is filed, about 15 months for a calendar-year company. Two years is a safer target, and longer rules such as NYDFS or legal holds take priority.
Does SOX apply to private companies? Sections 302 and 404 apply to public companies that file reports with the SEC. Some criminal provisions added by SOX, such as 18 U.S.C. 1519 on destroying records, apply to anyone.
Does SOX require a SIEM? No. It requires effective internal control over financial reporting. A SIEM is a common way to collect, protect and review the logs that prove IT controls worked.
Will the SEC’s 2026 proposal change SOX audits? On May 19, 2026, the SEC proposed simplifying filer categories, which would exempt many more companies from the auditor attestation in Section 404(b). As of November 2026 it is still a proposal. Management’s own assessment under Section 404(a) would still apply to every public company.
Sources
- Sarbanes-Oxley Act of 2002, Public Law 107-204: Sections 103, 302, 404, 802, 906 and 1102
- 18 U.S.C. 1519, 18 U.S.C. 1520, 18 U.S.C. 1350 and 15 U.S.C. 7262
- 17 CFR 210.2-06, retention of audit and review records, and its adopting release, 68 FR 4862 (January 30, 2003)
- 17 CFR 240.13a-15, 17 CFR 240.12b-2 and 17 CFR 240.17a-4
- SEC, Form 10-K and its general instructions
- SEC, Commission guidance regarding management’s report on internal control over financial reporting, 72 FR 35324 (June 27, 2007)
- PCAOB, Release No. 2007-005A, AS 2201, and Release No. 2010-004, AS 2110
- PCAOB, Release No. 2024-004, amending AS 1215.15, and the SEC approval order
- SEC, Cybersecurity risk management, strategy, governance, and incident disclosure, 88 FR 51896 (August 4, 2023), and the May 2025 petition to rescind Item 1.05
- SEC, Proposed rule on emerging growth company accommodations and filer status, 91 FR 30086 (May 21, 2026)
- PCI DSS v4.0.1, Requirement 10.5.1, from the PCI SSC document library
