+AC-05 [M] Separation of Duties

AC-05 [M] Separation of Duties

Control

  1. Identify and document [Assignement: duties of individuals] ; and
  2. Define system access authorizations to support separation of duties.

Discussion

Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes dividing mission or business functions and support functions among different individuals or roles, conducting system support functions with different individuals, and ensuring that security personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of systems and system components when developing policy on separation of duties. Separation of duties is enforced through the account management activities in [AC-2](#ac-2) , access control mechanisms in [AC-3](#ac-3) , and identity management activities in [IA-2](#ia-2), [IA-4](#ia-4) , and [IA-12](#ia-12).

Assessment Objective

  1. [Assignement: duties of individuals] are identified and documented;
  2. system access authorizations to support separation of duties are defined.

Assessment Method

Examine

Access control policy procedures addressing divisions of responsibility and separation of duties system configuration settings and associated documentation list of divisions of responsibility and separation of duties system access authorizations system audit records system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties organizational personnel with information security responsibilities system/network administrators

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by AC-05 [M] Separation of Duties – Assessment Procedure
is blocked by Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS)
is blocked by Separation of Duties (SoD)
is blocked by Safeguarding Data Over Open Networks
is blocked by Input Data Validation