Control A.5.3Segregation of duties
Conflicting duties and conflicting areas of responsibility must be segregated.
The purpose is to reduce the opportunity for unauthorised or unintentional modification or misuse — one person being able to initiate, approve and conceal the same action. The classic pairs are familiar: requesting and approving access, developing and deploying to production, administering a system and reviewing its logs.
Segregation is a design decision, not a policy statement. It is implemented in how the systems actually enforce roles, and it is tested by asking whether a single individual could complete a sensitive sequence unaided.
The honest difficulty is size. Many organisations genuinely cannot segregate fully, and the answer is not to claim segregation that does not exist: it is to identify the conflicts that remain, compensate with detective controls and independent review, and record the decision. An auditor is far more comfortable with a documented compensating arrangement than with an implausible claim.
How to put this in place
Some combinations of duties let one person make a damaging change and hide it. The ISMS project should find those combinations and split them, or add a check where the team is too small to do so.
- List the duty pairs that matter, such as requesting and approving access, or writing and releasing code.
- Split each pair between two people or two roles.
- Where that is not possible, define an after-the-event check by someone independent and approve it as an exception.
- Compare access listings against the matrix to confirm conflicting rights are not held together.
- Review the matrix and the exceptions at least once a year.
Evidence an auditor usually looks for: the conflict matrix, access listings showing conflicting rights are separated, and records that the compensating checks were actually performed.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.