Test once, satisfy many
The same access-review, change-management and backup controls are tested for SOX, SOC 2 and ISO 27001. Running them as one hub means the evidence is collected once and cross-mapped to each framework.
The IT controls that make every audit's automated controls and reports trustworthy.
IT General Controls (ITGC) are the foundational controls over your systems — access, change management, operations and development — that make automated application controls and system-generated reports reliable. Compliance One ships ITGC as a dedicated, framework-neutral hub: test your IT controls once and have the evidence count across SOX, SOC 2 and ISO 27001.
The standard
IT General Controls (ITGC) — COBIT 2019-aligned IT-control hub
Who needs it
Any organisation whose financial or service systems are audited — public companies preparing for SOX, service providers pursuing SOC 2, and anyone certifying ISO 27001 — plus IT and security teams who want one place to manage access reviews, change management and operations controls instead of re-evidencing them per framework.
48
IT general controls, one hub
The basics
ITGC covers four core domains — Access to Programs & Data (provisioning, access reviews, privileged access, authentication), Change Management (request, test, approve, segregate dev/test/prod), Computer Operations (jobs, backups, restore testing, incidents) and Program Development (new systems, data conversion, go-live) — plus application controls, the completeness and accuracy of key reports (IPE), and segregation of duties.
ITGCs are not an end in themselves: they exist so an automated control can be trusted with a single test and a report used in a control can be relied on. They recur in almost every framework — SOX ICFR, SOC 2 (CC6/CC7/CC8) and ISO 27001 (Annex A) all test the same access, change and operations controls — which is exactly why running them as one shared hub removes duplicated work.
Why it matters
The same access-review, change-management and backup controls are tested for SOX, SOC 2 and ISO 27001. Running them as one hub means the evidence is collected once and cross-mapped to each framework.
Auditors rely on an automated control or a system report only when the IT general controls behind it are effective. Weak ITGCs collapse reliance on every dependent control — so they are the highest-leverage controls you own.
COBIT is carried as a reference tag, not baked into the control content — so when COBIT 7 arrives it is a metadata refresh, not a re-implementation.
Provisioning, modification and timely deprovisioning, periodic access reviews, privileged access, authentication and MFA, and segregation of duties — per system and per layer.
Change request, testing, approval and dev/test/prod segregation, plus the SDLC controls for new systems, data conversion and go-live.
Job scheduling and monitoring, backups with tested restoration, and incident and problem management.
Completeness-and-accuracy validation of the reports (IPE) that controls depend on, and a segregation-of-duties conflict matrix built from real entitlements.
Most teams re-document the same IT controls three times — once for SOX, once for SOC 2, once for ISO — chasing access-review screenshots, change tickets and backup logs across tools and re-proving them for each audit. That duplicated evidence-gathering is precisely what a shared control hub should eliminate.
Do it once, reuse it everywhere. Evidence you collect for ITGC is automatically mapped to every other framework whose controls it also satisfies — and since these standards overlap heavily, most of that work isn't repeated.
See exactly how Compliance One maps ITGC to your environment in a 30-minute walkthrough — and how much of it we handle for you.