Guidance · GRC and assurance
If you check that security works
Your value is independence: you test, sample and report, and you never approve what you then check.
The decisions you'll be asked to make
Who decides…
Who should test our controls when the team is too small to be independent?Keep the rule that no one tests a control they own, perform, manage or wrote, and look outside the team: a colleague who already checks records, a swap between people or teams, internal audit, then a contracted tester or a peer.
Who decides…
Who should assess our security practices when the team is too small to be independent?Keep the rule that no one rates a practice they own or run, and change where you look for the assessor: a colleague from another function, a swap, a reciprocal peer, then a contracted assessor.
If…, then how…
If a control test finds an exception, has the control failed?Not always. One exception in a manual control whose population is at least twice the sample lets you test the same number again; if none of those fails, the control is Effective and the exception is still named.
When do we…
When does a deviation from policy need a formal exception?Request a formal exception whenever a written security requirement is not met, or will not be met by the date it applies.
Is it…
Is this a risk acceptance or a security exception?Ask whether a specific rule in a policy or standard is not being met. If it is, request a time-limited security exception.
What you own and what you hand on
From the Exception & SoD Responsibility Matrix P02-A09, in Security Exception, Waiver & Segregation of Duties.
The independent reviewer's column. Your right to check rests on not having taken part in what you check.
You answer for it 2
EX-A19 Check a sample of decisions, renewals and closures against the Standard
Your side Independent reviewer answers for it and does it
Also involved: Information security (consulted), Executive management (told)
The rule, EX-11Every exception, from request to closure, is recorded in the Security Exception Register, including refused requests. Information security reviews the whole register monthly: expiry dates, overdue remediation plans, whether compensating controls are still in place and working, and whether any score should change.
The rule, EX-12Information security reports to e.g. Executive Committee or its risk committee quarterly, using the Exception Ageing & Expiry Dashboard. The report gives at least the four headline measures below, lists every High and Critical exception and every chronic exception by name, and states any decisions management needs to take.
In the matrix Independent review findings
SD-A09 Check independently that conflicts are detected, decided and reviewed as the Standard requires
Your side Independent reviewer answers for it and does it
Also involved: Information security (consulted), Executive management (told)
The rule, SD-01No one person may hold a combination of duties that would let them make, approve and conceal an unauthorised change, payment or access grant. This applies to business roles and to access rights in the finance, payroll, procurement, identity and production systems listed in the Segregation of Duties Conflict Matrix, to IT administration, and to the security function itself: the people who operate a control do not audit it.
The rule, SD-05Every accepted conflict, and the evidence that its compensating control was performed, is reviewed by someone without the conflict: quarterly for a High conflict, every six months for a Medium conflict, and at the annual review of the matrix for a Low conflict. A High conflict with no compensating control recorded and reviewed in the last quarter is reported as unmitigated.
In the matrix Independent review findings
You do it, someone else answers for it 1
SD-A07 Review each use of emergency or privileged access after the event
Your side Independent reviewer does it. Answers for it Information security
Also involved: Risk owner (told), IT service desk (consulted)
The rule, SD-06Privileged and emergency ("break-glass") access is granted for a stated purpose and a limited time, logged, and reviewed after use by someone other than the user, within 1 working day. Administrators do not review the logs of their own activity. Standing privileged access that combines conflicting duties is a conflict under SD-04.
In the matrix Review within 1 working day, by someone other than the user; administrators never review their own logs
Hand it on: you are consulted or told 1
SD-A10 Decide an accepted structural conflict for at most 365 days, name its control reviewer, and decide it again at the end of the term
Your side Independent reviewer is consulted. Answers for it Risk owner
Also involved: Requester (does it), Control owner (consulted), Information security (does it), Executive management (told)
The rule, SD-08A segregation-of-duties conflict that cannot be separated while the team stays this size may be recorded as an accepted structural conflict instead of a renewing exception, if all of these hold: it is rated High or Medium in the matrix; at least one compensating control is in place and tested (SD-04, EX-07); the risk owner and the approver for its band sign, in writing; a named control reviewer who does not hold the conflict, does not report to the person who does, and is not employed by a provider whose staff hold it, performs the control and reviews it at the SD-05 frequency; and the term is no longer than 365 days from approval. At the end of the term it is decided again as a new request with a fresh score. It is not counted against the renewal limit and is not a chronic exception, but every one is named in each quarterly report (EX-12), and it ends the day the duties can be separated. It applies only to a combination of duties (SD-01), never to a requirement of a policy or standard, and it can never be used to move an exception that has reached its renewal limit.
In the matrix Row in the Security Exception Register of type Accepted structural SoD conflict; signed by the band's approver and the risk owner. Named in every management report; never counted as chronic
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.