Segregation of Duties (SoD) is a fundamental security principle designed to prevent a single individual from having enough power to commit and conceal fraud, errors, or security breaches. It works by dividing a single task or process into multiple parts, with each part requiring a different person to complete it.
Examples
- Financial Processes: The person who authorises a payment should not be the same person who processes the payment request.
- System Administration: The system administrator who creates a new user account should not be the same person who approves the user’s access rights.
- Software Development: The developer who writes the code for a new application should not be the same person who tests the code for security vulnerabilities and deploys it to a production environment.
ISO 27001 Context
The ISO 27001 standard emphasises the importance of implementing segregation of duties as a key control to reduce the risk of fraud and error. This control is primarily found in ISO 27001 Annex A 5.3 Segregation of Duties and is crucial for maintaining the integrity of an organisation’s information and systems.
Stuart Barker
Stuart Barker is a qualified ISO 27001 Lead Auditor and veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
He is the founder of High Table and the Lead Consultant driving the world’s number 1 dedicated ISO 27001 Consultancy.
