• No, SOX is not technology related - it's process related. You need to interpret the Act into a requirement for an application. Then you need to figure out where SQL Server fits into it and the that understanding should give you your requirements.

    Put shortly, you need to understand SOX and the application before you can decide whether the data held on your server is material for compliance the Act.