ISO 27001 A.5.3: Segregation of duties

Identify your critical business processes and IT operations where a conflict of interest could arise. Map out the process flows and look for spots where one person could abuse their access or authority. Focus on the high-risk areas first: financial transactions, access management, change management, and data handling. Build a segregation of duties matrix that lists incompatible roles. Common separations include development vs. production operations, access request vs. access approval, transaction initiation vs. transaction authorisation, security admin vs. security audit, and backup operations vs. restoration testing. Enforce segregation technically wherever you can. Use role-based access control in your systems to block users from holding conflicting roles. Configure your change management and ticketing tools to require a different approver than the requestor. Set up dual-control mechanisms for sensitive operations like cryptographic key management. For smaller teams where full segregation is not realistic, document your compensating controls. Think mandatory holiday policies, job rotation, detailed activity logging with regular review, management spot-checks, and independent periodic audits. Make sure these controls are proportionate to the risk. Review access rights and role assignments regularly to ensure segregation holds as people move around. Include segregation of duties checks in your internal audit programme. Train managers to spot and flag potential conflicts when assigning tasks.