ISO 27001 Annex A 5.3 Segregation of duties
What it says
Conflicting duties and conflicting areas of responsibility shall be segregated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure no one person can perform conflicting duties alone to prevent misuse.
Segregation of duties means dividing tasks and responsibilities among different people to prevent any one person from having too much control or power. This matters because if one person can approve and execute their own actions, there's a higher risk of mistakes or even fraud, like someone paying fake invoices to themselves or approving their own access changes.
Free. Save your status, tasks and notes.
Why it matters
Without segregation of duties, fraud, unauthorised transactions or data tampering may occur and go undetected due to reduced independent oversight.
How to implement
The IT Manager should identify areas where conflicting duties exist.
This involves listing tasks that, if done by one person, could lead to problems, like one person both designing and deploying software changes. Use guidance from ISO 27002:2022 to categorise duties that need separation.
HR should ensure role descriptions clearly separate conflicting duties.
Write job roles so that tasks like 'approving' and 'executing' are done by different people. This can also involve training managers to understand the importance of keeping duties separate.
The Board should set policies for segregation of duties.
Policy should state that conflicting roles must be separated and explain why this is important, referring to the Privacy Act 1988 and other relevant regulations. Review these policies annually.
Procurement should use checks and balances in the purchasing process.
For instance, separate someone requesting an order from someone approving the payment. This ensures that no single person has full control over purchasing decisions.
IT should implement software tools to monitor role assignments.
Use tools that alert managers if one person is assigned tasks that conflict, ensuring they only provide access to roles that should not overlap, in line with CPS 234 and the ASD Essential Eight.
Keep it running
Review role/duty assignments for conflicts, enforce dual approval for high-risk actions, and monitor audit logs for signs of unauthorised activity.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the organisation chart and job descriptions.
Look at
Check if job descriptions and the organisation chart clearly show that tasks are separated.
Good evidence
Good is when descriptions show clear, separate duties and the organisation chart supports these separations.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the records of access rights approvals.
Look at
Look at whether the approver is a different person from the requestor.
Good evidence
Good evidence is when approvals have a clear separation between requestor and approver.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the latest policy on segregation of duties.
Look at
Check for explicit statements about preventing conflicts and roles that should be separate.
Good evidence
Good looks like a policy with clear rules about separating duties and mention of relevant standards or laws.
- Check 4 of 5What an auditor asks for
Ask for
Ask for a sample of change management logs.
Look at
Verify that those who initiated changes are not the same as those approving changes.
Good evidence
Good is a clear log showing different names under initiator and approver.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the training materials used to educate staff on their roles and responsibilities.
Look at
Review the content for explanations about why segregation of duties is important.
Good evidence
Good materials explain the risks and real-world examples of why duties must be segregated.
Mappings
Closest match in ASD Essential Eight: E8-RB-ML2.1, Prevent privileged user accounts from accessing others' backups, which this control covers in full and more.
ASD Essential Eight: 2 mappings
This control is broader than E8-RB-ML2.1.
E8-RB-ML2.1 requires separating duties so privileged accounts (other than backup administrators) cannot access other accounts' backups. ISO/IEC 27001:2022 Annex A 5.3 supports this by mandating segregation of conflicting duties, which underpins the organisational design of separating backup administration from general privileged administration. Annex A 5.3 is higher-level and does not specify backup access enforcement mechanisms, whereas E8-RB-ML2.1 is an explicit technical access restriction for backups.
This control supports E8-RA-ML3.1.
Annex A 5.3 requires organisations to segregate conflicting duties and responsibilities so no single person can complete an end-to-end high-risk activity unchecked. E8-RA-ML3.1 supports this by limiting privileged access to only what is necessary for assigned duties, which helps prevent users from accumulating permissions that enable conflicting functions. However, least privilege alone does not ensure separation between roles (e.g. requester/approver), so it is an enabling control rather than a full implementation of segregation of duties.
ASD Information Security Manual: 7 mappings
This control is broader than ISM-0616.
ISM-0616 requires separation of duties when performing administrative activities for gateways, so that no single administrator controls all gateway functions. This is a specific application of Annex A 5.3, which requires conflicting duties and conflicting areas of responsibility to be segregated. Annex A 5.3 applies across the whole organisation, while ISM-0616 is limited to gateway administration.
This control partially overlaps ISM-0047.
Annex A 5.3 requires segregation of conflicting responsibilities to reduce the risk of unauthorised or inappropriate actions going unchecked. ISM-0047 relates by separating approval authority for organisational cyber security documentation (CISO) from system-specific documentation (authorising officer), which is a governance form of segregation of duties. ISM-0047 is limited to documentation approval pathways, while Annex A 5.3 applies to any conflicting duties across operations, development, access administration and assurance.
This control partially overlaps ISM-0445.
Annex A 5.3 requires segregation of conflicting duties so a person cannot perform incompatible activities without detection or independent oversight. ISM-0445 relates by requiring privileged users to use separate dedicated privileged accounts for privileged activities, which helps separate day-to-day user actions from administrative actions and improves accountability. ISM-0445 is a specific identity/account design control, while Annex A 5.3 is broader and also includes process separations such as change requester vs change implementer.
This control partially overlaps ISM-1705.
Annex A 5.3 requires segregation of duties to prevent a single role from having conflicting capabilities that enable concealment or misuse. ISM-1705 relates by preventing privileged user accounts from accessing other users' backups (except backup administrators), separating system administration from backup data access. ISM-1705 is narrowly about backup access boundaries, while Annex A 5.3 also addresses broader conflicts such as administrators vs auditors or developers vs production operators.
This control partially overlaps ISM-1706.
Annex A 5.3 requires segregation of conflicting duties to reduce the risk of misuse and cover-up by a single individual. ISM-1706 relates by preventing privileged user accounts from accessing their own backups (except backup administrators), reducing the ability to tamper with or recover sensitive data in a way that bypasses oversight. ISM-1706 is a specific technical enforcement in the backup domain, while Annex A 5.3 is broader and covers segregation across all business processes and systems.
This control supports ISM-1255.
Annex A 5.3 requires conflicting duties and areas of responsibility to be segregated to prevent misuse of authority. ISM-1255 supports this by restricting database abilities (read/insert/modify/remove) based on work duties, which can enforce separation between roles such as data entry, approval and administration. ISM-1255 focuses on database permission design, whereas Annex A 5.3 extends to all organisational functions and may require independent review or dual control beyond access permissions.
This control supports ISM-2048.
Annex A 5.3 requires segregation of conflicting duties so users cannot combine roles that enable misuse or bypass of oversight. ISM-2048 supports this by preventing non-administrative users from altering their own permissions, which helps maintain separation between request/approval/provisioning and self-service privilege escalation. ISM-2048 focuses on a specific application/role capability (self-modification of privileges), whereas Annex A 5.3 also covers broader organisational separation such as initiator/approver and operator/auditor splits.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.