SESK: Stuff Everyone Should Know · sesk.info/secplus-separation-of-duties
Splitting a sensitive task, like creating and approving payments, among different people is called what?
Separation of duties, which reduces the risk of abuse without collusion.
- Job rotation
- Separation of duties ✔
- Least functionality
Why: If one person can do every step, fraud is easier. Dividing duties means two or more people must work together to cause harm. NIST SP 800-53 control AC-5 covers it.
Huh, didn't know that: NIST says people who administer access control should not also administer audit functions.
In our company, one person writes the checks and another signs them. The accountant calls it duty-free shopping.
Like this card?
References
Answer: Separation of duties. If one person can do every step, fraud is easier. Dividing duties means two or more people must work together to cause harm. NIST SP 800-53 control AC-5 covers it.
- NIST SP 800-53 Rev. 5, Security and Privacy Controls nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion.
Checked 2026-10-10. - NIST SP 800-53 Rev. 5, Security and Privacy Controls nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
ensuring that security personnel who administer access control functions do not also administer audit functions
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyWhich list names all six functions of NIST Cybersecurity Framework 2.0?Security & PrivacyWhich governance document gives detailed, step-by-step instructions for carrying out a security task?Security & PrivacyBuying cyber insurance to shift financial loss to an insurer is which type of risk response?
That's stuff everyone should know.