Segregation of Duties

Segregation of duties (SoD) is a fundamental internal control principle that reduces the risk of error, fraud, and unauthorized actions by ensuring that no single individual has end-to-end control over a critical process. The concept originates from financial controls but applies broadly to information security. Classic examples include separating the ability to approve purchases from the ability to make payments, ensuring that developers cannot deploy their own code to production without independent review, and requiring that access provisioning requests are approved by someone other than the requester.

ISO 27001 Annex A control A.5.3 specifically requires segregation of duties, stating that conflicting duties and conflicting areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization's assets. SOC 2's requirements for logical access controls and change management inherently require appropriate segregation. NIS2's governance requirements for cybersecurity risk management measures benefit from SoD principles in ensuring that security decisions receive appropriate oversight. In technology due diligence, assessors evaluate whether development, testing, and production environments are appropriately separated and whether change management includes independent review and approval.

Implementing SoD in practice requires identifying critical processes and the key functions within them (authorization, execution, custody, recording, reconciliation), designing roles that distribute these functions among different individuals, and implementing technical controls (such as role-based access control) that enforce the segregation. In smaller organizations where personnel constraints make full segregation challenging, compensating controls such as detailed logging, regular management review of activities, and automated monitoring can partially mitigate the risk. SoD conflicts should be documented in the risk register, with compensating controls clearly identified. CI/CD pipelines, version control systems with branch protection rules, and approval workflows in ticketing systems are practical technical implementations of SoD in modern software organizations.