Table of contents
ISO 27001 Segregation of Duties
I am going to show you what ISO 27001 Annex A 5.3 Segregation of Duties is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.
I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.
What is it?
ISO 27001 Annex A 5.3 Segregation of Duties is an ISO 27001 control that requires an organisation to separate and segregate conflicting information security roles and responsibilities.
Purpose
The purpose of Annex A 5.3 is to reduce the risk of fraud, error and bypassing of information security controls.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.3 as:
Conflicting duties and conflicting areas of responsibility should be segregated.
ISO 27001:2022 Annex A 5.3 Segregation of Duties
DO IT YOURSELF ISO 27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Watch
Watch How to implement ISO 27001 Annex A 5.3 Segregation of Duty
Implementation Guide
You are going to have to
- define your roles and responsibilities as covered in ISO 27001 Annex A 5.2 Information Security Roles And Responsibilities
- identify where there are conflicts and remove them
- implement role based access controls
- regularly review the access
The absolute best way to do this is download the ISO 27001 Templates Toolkit. It includes bonus materials on role based access control with guides on how to do it and templates to make it happen. If that is outside your reach then the ISO 27001 Roles and Responsibilities Template as a stand alone is a good start.
Remove conflict in duties
You are looking to work out where there may be a conflict in duties and to remove that conflict so that one individual cannot exploit it for their own gain.
Let us consider an example.
If a person could request a pay rise, then approve that pay rise and make the payment – would that be a conflict of interest?
The answer if you are struggling, is yes.
A person should not be able to request something, authorise it and then execute it.
Think about it.
In basic terms what would be point in the process?
The person may as well just go to the last step and pay themselves what they want.
Consider Role Based Access
Role based access is a great way to implement segregation of duties. You spend a little time up front to work out what the various roles are that people have on systems. You define the role, paying particular attention to remove any conflicts. It is then just a matter of allocating people to roles. It isn’t just people that can be included in role based access though. You can also use it for service and technical accounts. By considering a role based access approach there is consistency in the way access is implemented rather than doing it per individual and it makes both the management and the review of access rights a lot more straightforward. The management of a change in access rights when a person moves job or role or leaves becomes a breeze.
Access reviews
One of the checks and balances and good governance is to implement access reviews. Access reviews should be conducted regularly. You will define what this means but best practice is every month. The access review will be conducted by the asset owner, be that a system owner or a data owner. They will review the accounts that have access, the level of access and if that is still required and appropriate. Where it isn’t they will address it through continual improvement. In this process you will be looking to ensure that segregation of duties is still in place and effective.
ISO 27001 Templates
I have included everything you need for segregation of duty, including role based access in the ISO 27001 toolkit. You could save months of effort with these ISO 27001 templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.
DO IT YOURSELF ISO 27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
How to comply
To comply with ISO 27001 Annex A 5.3 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to
- Write your roles and responsibilities to satisfy ISO 20001 Annex A 5.2
- List out the systems that people use and have a systems inventory
- For each system define the roles people have within those systems
- For the roles you define you are going to document what levels of access those roles have
- Then you are going to allocate those roles to people
- The allocation, change and removal of roles is going to be documented in your access control process
- Plan to review access to your systems at least monthly or if significant change occurs
- Keep records of your review and audit trails of the access control process
How to pass an audit
To pass an audit of ISO 27001 Annex A 5.3 you are going to make sure that you have followed the steps above in how to comply.
You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.
What the auditor will check
The audit is going to check a number of areas. Lets go through them
1. They will check the processes that Annex A 5.3 has defined as needing segregation
The standard has already pre defined processes that it thinks you should have segregation in so either make sure you do or have a compelling reason why you do not that you can justify to the auditor.
- a) initiating, approving and executing a change;
- b) requesting, approving and implementing access rights;
- c) designing, implementing and reviewing code;
- d) developing software and administering production systems;
- e) using and administering applications;
- f) using applications and administering databases;
- g) designing, auditing and assuring information security controls.
2. They will check Conflicting Roles
This is obvious but they are going to look for conflicts and they are coming at this with fresh eyes.
3. Documentation
They are going to look at audit trails and all your documentation. They are looking that the roles and responsibilities are defined, that the role based access is defined, that you have a process for access control and they are going to look for evidence of operation ( that you have done it ). They want to see documentation of regular reviews.
Top 3 Mistakes People Make
The top 3 Mistakes People Make For ISO 27001 Annex A 5.3 are
1. You don’t have enough staff to segregate duties
You get stressed because you do not have enough staff to implementation segregation of duty but you do nothing to compensate. It is ok to have conflicts if you cannot avoid it but you should have additional controls in place such as logging and monitoring of activity that IS handled and managed by someone else.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Have access reviews taken place? Do people actually have the level of access that is documented in your role based access document or has someone gone and changed the actual access on the systems.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 5.3 FAQ
For ISO 27001 Annex A 5.3 Segregation of Duties you will need the ISO 27001 Access Control Policy
ISO 27001 Annex A 5.3 Segregation of Duties is important because if one person can do everything then there is significant risk. That could be financial risk right down to just plain devilment. Staff are not always happy campers. There are well known cases of people committing crimes and because they have access to logs they cover their tracks. Disgruntled employees causing untold harm.
You trust people right now. You think nothing can go wrong. You shouldn’t. And it can.
An example of segregation of duty would be that the person that submits their company expenses should not be the person that approves the expenses or makes the payment for the expenses. This prevents fraudulent expense claims being submitted and is a check and balance for errors that might occur.
If you cannot implement segregation of duty then you should consider alternate compensating controls for checks and balances. Examples of this would be management oversight, enhanced system monitoring, logging. There are many ways to tackle the problem so do not worry if you are a small team and cannot implement full segregation of duty. Manage it via risk management and alternate compensating controls to reduce the risk.
There are templates for ISO 27001 Annex A 5.3 located in the ISO 27001 Toolkit.
ISO 27001 Annex A 5.3 Sample PDF in the ISO 27001 Toolkit.
Yes. Whilst the ISO 27001 Annex A clauses are for consideration to be included in your Statement of Applicability there is no reason we can think of that would allow you to exclude ISO 27001 Annex A 5.3. Segregating duties and removing conflicts are a fundamental part of any information security defence and control. They are a fundamental part of any information security management system. They are explicitly required for ISO 27001.
Yes. You can write the policies for ISO 27001 Annex A 5.3 yourself. You will need a copy of the standard and approximately 3 months of time to do it. It would be advantageous to have a background in information security management systems. There are a number of documents you will require as well as the policy for role based access control. Alternatively you can download them in the ISO 27001 Toolkit.
ISO 27001 templates for ISO 27001 Annex A 5.3 are located in the ISO 27001 Toolkit.
ISO 27001 Annex A 5.3 is not particularly hard. It can take a lot of time if you are doing it yourself but it is not technically very hard. You are going to identify your systems, define role with the access those roles have and then allocate your people to those roles. Fairly straightforward. We would recommend templates to fast track your implementation.
ISO 27001 Annex A 5.3 will take approximately 3 months to complete if you are starting from nothing and doing it yourself. With an ISO 27001 Template Toolkit it should take you less than 1 day.
The cost of ISO 27001 Annex A 5.3 will depend how you go about it. If you do it yourself it will be free but will take you about 3 months so the cost is lost opportunity cost as you tie up resource doing something that can easily be downloaded. If you download an ISO 27001 Policy Template toolkit then you are looking at a couple of hundred pounds / dollars.
Yes, there is an online ISO 27001 at ISO 27001 Online.
Get the Help of the ISO 27001 Ninja
Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Governance | Governance and Ecosystem |
| Integrity | Identity and access management | |||
| Availability |
