Segregation of duties

What the control asks

Duties and areas of responsibility that conflict with each other are to be kept apart. Purpose: cut the chance of fraud, mistakes and circumvention of security controls. Guidance: the aim is that no single person can carry out conflicting steps on their own, so the organization decides which duties need separating. Typical candidates are raising, authorizing and carrying out a change; requesting, authorizing and provisioning access; designing, writing and reviewing code; building software versus running production; using an application versus administering it or its database; and designing security controls versus auditing and assuring them. Collusion should be factored into the design. Where the organization is small and full separation is not realistic, the principle is still applied as far as practical and compensating measures such as activity monitoring, audit trails and management oversight are used. With role-based access control, care is needed so nobody receives conflicting roles; large role sets may call for automated conflict detection and cleanup, and roles should be defined so that removing or reassigning one does not cause access problems.

Purpose in the standard’s terms, in our words: Reduces the risk of fraud, error and circumvention of information security controls.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Governance, Identity and access management; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A segregation of duties matrix identifying which conflicting duties the organization has chosen to separate
• Role definitions and a role conflict ruleset in the identity or ERP system
• Output of automated or periodic conflict analysis and records of conflicts removed
• Change and access request records showing requester, approver and implementer are different people
• Where separation is impractical, documented compensating controls such as activity monitoring, audit trail review and supervisory sign-off
• Evidence that collusion scenarios were considered when designing the separation

Where audits commonly find gaps

• Developers retain standing write access to production
• Conflict rules exist on paper but are not enforced in the access management tooling
• Small teams claim segregation is impossible and record no compensating control
• Role reassignments leave individuals holding both old and new conflicting roles

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (06.1.2) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.37 Documented operating procedures
• 5.8 Information security in project management
• 5.1 Policies for information security

Read the five attributes All 93 controls