SOX · GLBA Safeguards Rule · Financial Services · ITGC

One rule asks who approved the change. The other asks what your program says. Neither asks how your code is written.

Thirteen other standards on this site reach your JavaScript indirectly, and these two do as well. What earns them a page is a specific and very common mistake: the Safeguards Rule requires customer information to be encrypted, this engine ships an option called Encrypt Strings, and the two have nothing to do with each other. Answering the first with the second is the fastest way to turn a routine questionnaire into a finding.

The Short Version

Change control and wording

Four contact points, and the sharpest one is a vocabulary problem rather than an engineering one.

Encryption is not the option nameEncrypt Strings is a transformation of your source, not a cipher over customer data.
Provenance is what auditors takeA reproducible build, a manifest and a release record answer the change-control question.
Scope by data flowMost front-end code never touches the financial reporting boundary. Say which parts do, and why.
What These Rules Actually Govern

A control objective and a written program

These are two different kinds of instrument aimed at two different audiences, and they reach software by different routes. Knowing which one a question comes from is most of the work of answering it well, because the acceptable evidence is not the same.

Sarbanes-Oxley and reporting controls

The obligation is that management assesses, and the auditor attests to, internal control over financial reporting. Software is reached indirectly through the general controls that keep those systems trustworthy: change management, logical access, and operations. The recurring question is whether the thing running in production is the thing that was reviewed and approved.

The GLBA Safeguards Rule

A written information security program with named elements: a qualified individual accountable for it, a risk assessment, access controls, an inventory of data and systems, encryption of customer information, secure development practices, multi-factor authentication, logging and monitoring, testing, training, service-provider oversight, an incident response plan and periodic reporting. It is a programme standard, so the evidence is documentation plus proof of operation.

Who each one reaches

Sarbanes-Oxley applies to public companies and reaches their suppliers through contract and through service-organisation reporting. The Safeguards Rule reaches non-bank financial institutions under the relevant regulator, a category considerably broader than most engineers expect, taking in lenders, brokers, advisers and a range of businesses that arrange or service consumer finance.

Scope First

Most of your front end is not a financial reporting system

The single cheapest thing you can do in this area is to draw the boundary before anyone asks you to, because an unscoped application invites every question to be asked about all of it.

Scope by data flow, not by repository

The systems that matter are the ones that create, alter or transport figures that end up in the financial statements. A component that renders a total the server computed is a display of a number rather than a source of one. A component that initiates a transaction, determines an amount, or creates a record feeding revenue recognition is a different matter. Draw the line along the flow of data and record the reasoning, because the question after in or out is always why.

Write the boundary down once

A short scoping memo that lists the in-scope applications, the reason each is in scope, and the reason the rest are not, does more work than any technical control in this area. It converts a recurring argument into a document you maintain. It also tells your own engineers which pipelines need the heavier evidence, which is the difference between applying change-management rigour where it counts and applying it nowhere.

Contact Point One

Change management, where a build pipeline produces real evidence

This is where a protected build has something honest to contribute, and it is not the transformation. It is the ability to show that a specific artifact came from a specific approved change and can be reproduced on demand.

A build you can reproduce

Identifier generation is randomised per build by default, which means two builds of the same source do not match and cannot be compared. Recording a fixed seed makes the output deterministic, so a released artifact can be rebuilt later and compared against what you shipped. See reproducible builds.

A manifest tying source to output

The build can emit a manifest recording a hash of each input file and each output file. That is the artifact-to-source link a change-management control is really asking for, and it is stronger than a signed release note because a reviewer can check it rather than believe it.

A release record with the approval

Tie the manifest to the commit, the review, the approval and the deployment log. Four artifacts produced by the pipeline answer the control objective more convincingly than any statement produced by a person, which is why auditors keep asking for them.

Contact Point Two

Secure development practices, the element that names your build

One element of the Safeguards Rule comes closer to your pipeline than anything in either instrument. It asks for a practice you follow and can describe, applied to applications that handle customer information.

What the element actually asks

Secure development practices for in-house applications used to transmit, access or store customer information, plus procedures for evaluating the security of externally developed applications you rely on. Read plainly, it is asking whether you have a way of building software that considers security, not whether any particular tool is present. A transformation step satisfies none of that by itself.

What satisfies it

A described pipeline: review before merge, dependency scanning and static analysis on the source side, a release process with approval, and a documented decision about each protection option you enabled or deliberately left off. The protection step is a legitimate part of that description. It is simply not the part that answers the element, and a program that presents it as such is inviting a closer look at everything else.

Contact Point Three

The encryption requirement, and the option name that keeps being mistaken for it

Read this section if you read only one. The mistake it describes is common, entirely avoidable, and more damaging to a review than the gap it is trying to cover.

What the requirement is about

Protecting customer information in transit over external networks and at rest. It is answered by your transport security, your storage encryption and your key management, all of which live on infrastructure you control, with keys held somewhere the data subject is not. That is what makes them meaningful, and it is the property a browser cannot offer.

What the build option actually does

The option named Encrypt Strings transforms your source. It permutes characters, and the generated decoder is emitted into the same file as the data it decodes, with the numeric parameter it needs passed as a literal in the same expression. Nothing is withheld, because the output has to run unaided in a page. It raises the cost of reading your own logic, which is genuinely useful, and it protects no customer data at all. Describe it as an obfuscating transformation and it will hold up. Describe it as encryption and it will not. The obfuscation versus encryption article covers why the distinction is structural rather than a matter of strength.

Contact Point Four

Logging, monitoring and the incident response plan

The last contact point is the one teams most often leave on the table, because it is the place where a runtime option produces something a written program can actually use.

Send tamper signals to your own log

If you enable runtime defenses, the useful configuration is the one that reports rather than the one that reacts. A guard that raises an event your code handles gives your monitoring a signal it can record, correlate and act on. A guard that blanks the page gives your support desk an unexplained outage and gives your log nothing. Configure them so the outcome is an entry in the system you already watch. See runtime defense.

Keep the map that makes an incident diagnosable

An incident response plan is worth what it can be executed with. If a fault or an attack is reported against a protected release, you need the symbol map for that exact version, the seed that built it, and a retention period long enough to cover the time between an incident happening and being noticed. Archive them against the release rather than in a build system whose default retention is measured in weeks.

Questions

Frequently asked questions

Does SOX or the Safeguards Rule require us to obfuscate our JavaScript?

No. Neither names the technique, and no assessor will ask whether your bundle is obfuscated. Sarbanes-Oxley reaches software through internal control over financial reporting, which in practice means the general controls around change management, access and operations: who can change what, who approved it, and how you can prove the thing running is the thing that was approved. The Safeguards Rule sets out a written information security program with a list of required elements. The form your source code takes is not an element of either. Where a protection step contributes is to the evidence around the build, not to any control objective in the rules themselves.

Is our customer-facing web application even in scope for SOX?

Usually only a part of it is, and getting that boundary right saves a great deal of argument. Section 404 is about internal control over financial reporting, so the systems in scope are the ones that produce, transport or alter numbers that reach the financial statements. A marketing site is out. A pricing calculator that only renders what the server computed is generally out. The applications that draw attention are the ones where a transaction is initiated, an amount is determined, or a record that feeds revenue recognition is created. Scope the application by data flow rather than by repository, and write the reasoning down, because the second question after in or out is always why.

Which requirement comes closest to naming our development practices?

The Safeguards Rule element on secure development, which asks you to adopt secure development practices for in-house applications used to transmit, access or store customer information, and to have procedures for evaluating externally developed applications. That is the closest any of these rules gets to your build. Notice what it asks for: a practice, applied consistently, that you can describe. A build step that transforms output satisfies none of that on its own. A documented pipeline with code review, dependency scanning before the transformation, and a reproducible release record does, and the transformation can sit inside it as a stated step.

Can we cite the Encrypt Strings option to satisfy an encryption requirement?

No, and this is the single most important thing on this page. The requirement is about protecting customer information in transit over external networks and at rest, and it is answered by your transport security and your storage layer. The build option named Encrypt Strings is a transformation of your source, not a cipher applied to customer data. It works by permuting characters, and the generated decoder is emitted into the same file as the data it decodes, with the numeric parameter it needs passed to it as a literal in the same expression. Nothing is held back, because the output has to run unaided in a browser. Citing it in a questionnaire answer about encryption misdescribes both what it does and what the requirement asks for, and it is the kind of answer that turns one question into ten.

So what is Encrypt Strings genuinely good for?

Raising the cost of reading your own logic, which is a real benefit in the right place and an unrelated one to the encryption requirement. Searching a bundle for a literal such as a rule name, an internal endpoint or a plan identifier stops being a shortcut, and an analyst has to run or reimplement the decoder to recover the values. That is worth having on code paths where the content of the string is the asset. It is worth avoiding on hot paths, because values are rebuilt on every read. Describe it in your documentation as what it is, an obfuscating transformation, and the description will hold up under questioning.

What evidence do auditors actually accept about a build?

Evidence that ties a running artifact back to an approved change, which is a provenance question rather than a code-quality one. The strongest package is a release record naming the commit and the approval, a build that can be reproduced from a recorded seed so the artifact can be rebuilt and compared, a manifest carrying a hash of every input and every output file, and a deployment log showing what was published and when. Those four together answer the question a change-management control exists to ask. They are also produced by the pipeline rather than asserted by a person, which is why they carry more weight than a signed statement.

Does protection interfere with the vulnerability scanning these programs require?

It does if you run the scanners in the wrong order, and the fix is ordering rather than configuration. Composition analysis and static analysis work by recognising code, and transformed output is much harder to recognise, so a scanner pointed at a protected bundle will under-report and hand you a falsely clean result. Run dependency scanning, static analysis and inventory generation against the source side of the build, before the protection step, and attach their output to the same release record. The rule generalises: everything that works by reading code runs before the step that makes code harder to read.

Our program requires multi-factor authentication. Does any of this touch that?

Not in the browser, and it is worth being blunt about why. Authentication is a statement about who verified the party, and the verification has to happen somewhere the party does not control. Code running in a page is delivered to the person it is meant to be evaluating, so a check written there is advisory. Multi-factor authentication is satisfied by your identity provider and your server enforcing it, and no build setting changes that. What protection can do here is make the client-side path harder to read and casually modify once the enforcement is somewhere else. That is a supporting measure and should be written down as one.

How should we describe the protection step in the written program?

In one short paragraph, positioned accurately. State that a protection step is applied to specified front-end bundles as the final stage of the build, that it is an obfuscating transformation intended to raise the cost of reading and casually modifying delivered code, and that it is not relied upon as the control for any requirement in the program. Then list the controls that do satisfy those requirements, and attach the build evidence separately. Reviewers are comfortable with a measure that is described modestly and evidenced well. They react badly to one that is described as security and cannot be shown to be.

What should we fix this week if we do only one thing?

Find every place your written program, questionnaire responses or vendor answers use the word encryption about a build option, and correct the wording. It is the most common defect in this area, it is cheap to fix, and it is the one that damages credibility furthest when a reviewer looks into it. While the file is open, check the ordering of your scanners against the protection step, because an under-reporting inventory is the second most common finding and has the same one-line fix.

Related Guides

Other standards and delivery models

CCPA, CPRA and client-side JavaScript

The California privacy regime, where cross-context behavioural advertising is its own category and an automated browser signal counts as a request.

PCI DSS and payment pages

The neighbouring regime for the same teams, and the one that does reach the page your customer types a card number into.

DORA and financial entities

The European counterpart aimed at operational resilience, where the obligations attach to the entity rather than to the code.

GDPR and personal data

The privacy regime that asks what your page collects rather than how your code was written.

Reproducible builds

How a recorded seed turns a randomised build into an artifact you can rebuild and compare byte for byte.

ISO 27001 and SOC 2

Why neither standard names obfuscation, and why writing a protection step into your Statement of Applicability creates a population an auditor will sample.

Next Step

Correct the wording, then attach the evidence

Two short tasks close most of this topic. First, search your written program, your questionnaire responses and your vendor answers for the word encryption used about a build option, and correct it to describe an obfuscating transformation. Second, attach the evidence that is genuinely produced by your pipeline rather than asserted by a person: the release record naming commit and approval, the reproducible build seed, the per-file manifest, and the dependency inventory generated before the protection step.