Segregation of duties

What the requirement asks

Duties and areas of responsibility that conflict with each other are to be kept apart. Purpose: cut the chance of fraud, mistakes and circumvention of security controls. Guidance: the aim is that no single person can carry out conflicting steps on their own, so the organization decides which duties need separating. Typical candidates are raising, authorizing and carrying out a change; requesting, authorizing and provisioning access; designing, writing and reviewing code; building software versus running production; using an application versus administering it or its database; and designing security controls versus auditing and assuring them. Collusion should be factored into the design. Where the organization is small and full separation is not realistic, the principle is still applied as far as practical and compensating measures such as activity monitoring, audit trails and management oversight are used. With role-based access control, care is needed so nobody receives conflicting roles; large role sets may call for automated conflict detection and cleanup, and roles should be defined so that removing or reassigning one does not cause access problems. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Segregation of duties is a design decision. The guidance asks where conflicting duties exist, how they are separated and what compensating control applies when separation is not practical. The evidence is the matrix, not the intention.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A segregation of duties matrix identifying which conflicting duties the organization has chosen to separate and one live sample together.

Evidence an assessor asks for

• Segregation of dutiesA segregation of duties matrix identifying which conflicting duties the organization has chosen to separate
• Segregation of dutiesRole definitions and a role conflict ruleset in the identity or ERP system
• Segregation of dutiesOutput of automated or periodic conflict analysis and records of conflicts removed
• Segregation of dutiesChange and access request records showing requester, approver and implementer are different people
• Segregation of dutiesWhere separation is impractical, documented compensating controls such as activity monitoring, audit trail review and supervisory sign-off
• Segregation of dutiesEvidence that collusion scenarios were considered when designing the separation

The question an assessor will ask

An assessor will ask for A segregation of duties matrix identifying which conflicting duties the organization has chosen to separate, then trace it to the system it protects. For A.5.3 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Developers retain standing write access to production
• Conflict rules exist on paper but are not enforced in the access management tooling
• Small teams claim segregation is impossible and record no compensating control
• Role reassignments leave individuals holding both old and new conflicting roles

Before the next audit

Before the next audit, check one live sample for this gap: developers retain standing write access to production.