SAS-70 won't meet all Sarbanes-Oxley 404 security requirements

The key point I took from the article is that even with the overlapping standards, you can't rely on SAS 70 meeting SOX 404 compliancy needs completely (and vise-versa). Additionally, companies that take Information Security seriously shouldn't have too much difficulty with SOX 404. Most likely you're satisifying both sufficiently where there are unique items that aren't in common with both.

 http://www.cfo.com/article.cfm/8344746/c_8317584?f=home_todayinfinance

QUOTE: To be sure, it's clear that SAS 70 calls for a comprehensive report detailing the design, assessment, and effectiveness of a vendor’s internal controls and how they affect financial reporting for clients of the outsourcing services vendor.

But there are widespread misperceptions about the standard's purpose, particularly about what an audit covers in terms of technology activities, some say. "A SAS 70 is intended to be a service-auditor-to-client auditor communication tool. But some [information technology] people think it affirms privacy and security. It doesn’t," says Everett Johnson, president of the Information Systems Audit and Control Association.