Segregation of Duties (SoD) is a fundamental security principle designed to prevent a single individual from having enough power to commit and conceal fraud, errors, or security breaches. It works by dividing a single task or process into multiple parts, with each part requiring a different person to complete it.
Examples
- Financial Processes: The person who authorises a payment should not be the same person who processes the payment request.
- System Administration: The system administrator who creates a new user account should not be the same person who approves the user’s access rights.
- Software Development: The developer who writes the code for a new application should not be the same person who tests the code for security vulnerabilities and deploys it to a production environment.
ISO 27001 Context
The ISO 27001 standard emphasises the importance of implementing segregation of duties as a key control to reduce the risk of fraud and error. This control is primarily found in ISO 27001 Annex A 5.3 Segregation of Duties and is crucial for maintaining the integrity of an organisation’s information and systems.
