<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SOX IT Controls Audit — API Reference

## Access Review Commands

```bash
# AWS IAM credential report
aws iam generate-credential-report
aws iam get-credential-report --output text --query 'Content' | base64 -d

# Find users without MFA
aws iam get-credential-report --output text --query 'Content' | \
  base64 -d | awk -F, '$4=="true" && $8=="false" {print $1}'

# Local active users
awk -F: '$7 !~ /nologin|false/ {print $1, $3, $7}' /etc/passwd

# Privileged group membership
getent group sudo wheel adm root

# Password aging policy
grep -E "^PASS_(MAX|MIN|WARN)_AGE" /etc/login.defs
chage -l <username>
```

## Change Management Evidence

```bash
# Git commit history (quarterly)
git log --since="3 months ago" --format="%H|%an|%ad|%s" --date=short

# PR approval evidence
gh pr list --state merged --limit 100 --json number,reviews,mergedAt

# Branch protection rules
gh api repos/{owner}/{repo}/branches/main/protection

# Deployment history
gh run list --workflow deploy.yml --limit 50 --json conclusion,createdAt,event
```

## Computer Operations Checks

```bash
# Verify backup service running
systemctl is-active cron restic-backup.timer

# Check last successful backup
restic snapshots --latest 1 --json | jq '.[0].time'

# Verify monitoring agent
systemctl is-active prometheus-node-exporter datadog-agent

# System uptime
uptime -p
```

## PCAOB Sampling Guidance

| Control Frequency | Minimum Sample Size |
|---|---|
| Annual | 1 |
| Quarterly | 2 |
| Monthly | 2–5 |
| Weekly | 5–15 |
| Daily | 25+ |
| Multiple per day | 25–40 |
| Automated/IT-dependent | 1 (with ITGC reliance) |
