Glossary
Segregation of duties
Segregation of duties means no one person holds enough access to complete a risky action alone. It is also called separation of duties.
What the standards say
NIST’s glossary defines separation of duty, from NIST SP 800-192, as the principle that no user should be given enough privileges to misuse the system on their own. Its example is that the person who authorizes a paycheck should not also be the one who prepares it. In NIST SP 800-53 Rev. 5, control AC-5, an organization identifies and documents the duties that need separating, and defines system access authorizations to support that separation. The SOC 2 trust services criteria, in CC6.3, ask the organization to consider segregation of duties when it grants access.
Why it matters in an access review
It comes up twice. First, in the access itself: the reviewer checks whether one account holds two entitlements that should not go together, such as creating a supplier and approving a payment to that supplier. Second, in the review: nobody reviews their own access, and an administrator does not approve their own roles.
NIST’s guidance on AC-5 adds a point that matters for reviews: violations can span systems and application domains. A person can hold half of a risky pair in one system and the other half in another. A review of one system at a time can miss it.
An example
A company decides that no one may hold both payments-prepare and payments-approve. During the review, a reviewer sees that one account holds both, through two different groups. Neither group looks wrong on its own. The reviewer rejects one of them and writes a note.
Common mistakes
- Having no written list of the pairs that conflict. The pairs are your organization’s to define. A review tool cannot invent them.
- Looking at one system at a time.
- Letting the holder, or the holder’s own administrator, review the access.
- Accepting a conflict without a record of who accepted it and why.