Control A.5.3Segregation of duties
What it means in practice
Conflicting duties and conflicting areas of responsibility must be segregated.
The purpose is to reduce the opportunity for unauthorised or unintentional modification or misuse — one person being able to initiate, approve and conceal the same action. The classic pairs are familiar: requesting and approving access, developing and deploying to production, administering a system and reviewing its logs.
Segregation is a design decision, not a policy statement. It is implemented in how the systems actually enforce roles, and it is tested by asking whether a single individual could complete a sensitive sequence unaided.
The honest difficulty is size. Many organisations genuinely cannot segregate fully, and the answer is not to claim segregation that does not exist: it is to identify the conflicts that remain, compensate with detective controls and independent review, and record the decision. An auditor is far more comfortable with a documented compensating arrangement than with an implausible claim.
How to put this in place
Some combinations of duties let one person make a damaging change and hide it. The ISMS project should find those combinations and split them, or add a check where the team is too small to do so.
- List the duty pairs that matter, such as requesting and approving access, or writing and releasing code.
- Split each pair between two people or two roles.
- Where that is not possible, define an after-the-event check by someone independent and approve it as an exception.
- Compare access listings against the matrix to confirm conflicting rights are not held together.
- Review the matrix and the exceptions at least once a year.
Evidence an auditor usually looks for: the conflict matrix, access listings showing conflicting rights are separated, and records that the compensating checks were actually performed.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Security Exception & Waiver Standard
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: SD-01 to SD-07. - Excel
Segregation of Duties Conflict Matrix
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Conflict Catalogue, Duty Grid, Our Assessment. - Word
SoD Conflict Review & Compensating Control Procedure
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: Whole procedure. - Excel
Exception & SoD Responsibility Matrix
in Security Exception, Waiver & Segregation of DutiesIts Framework References list this control. Supported by: SoD activities; Role Combinations; Combined Roles Check. - Word
Access Review Methodology
in User Access ReviewIts Framework References list this control. Supported by: Segregation-of-duties conflicts found in review (AR-08). - Word
Access Control Policy
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Conflicts of duties; nobody approves their own access (JML-05, JML-06). - Word
Joiner-Mover-Leaver Operating Procedure
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Checking resulting access against the conflict matrix. - Word
Access Request & Approval Form
in Joiner-Mover-Leaver & Access ProvisioningIts Framework References list this control. Supported by: Part B: resulting access checked against the conflict matrix; Part C: independence. - Excel
Administrative Tier Model & Separation Matrix
in Privileged Access ManagementIts Framework References list this control. Supported by: Separation matrix and rules: administration of each tier kept apart so one credential cannot reach every system.