Yes I have looked it up and you obviously have no clue what you're talking about. The law is the law, and regardless of what nonsense some random corporate trainer might have fed you, SOX compliance requirements haven't expanded in recent years. Go read the actual law instead of spreading misinformation.
Some businesses do require their partners to have additional controls on PII handling. But that's purely a business issue and has no relationship to SOX.
