Duties and areas of responsibility that conflict with each other are to be kept apart. Purpose: cut the chance of fraud, mistakes and circumvention of security controls. Guidance: the aim is that no single person can carry out conflicting steps on their own, so the organization decides which duties need separating. Typical candidates are raising, authorizing and carrying out a change; requesting, authorizing and provisioning access; designing, writing and reviewing code; building software versus running production; using an application versus administering it or its database; and designing security controls versus auditing and assuring them. Collusion should be factored into the design. Where the organization is small and full separation is not realistic, the principle is still applied as far as practical and compensating measures such as activity monitoring, audit trails and management oversight are used. With role-based access control, care is needed so nobody receives conflicting roles; large role sets may call for automated conflict detection and cleanup, and roles should be defined so that removing or reassigning one does not cause access problems.
This control maps to 40 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
You are reading one control. How much of ISO 27002:2022 have you already done?
ISO 27002:2022 5.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.