Segregation of duties
A.5.3
-
Last updated
Applicable
Catalog reference
Split conflicting tasks across different people so no single person can both perform and conceal a fraud, error, or unauthorised action. Where organisation size makes this impractical, compensate with monitoring or review.
Narrative — how we satisfy this requirement
An engineer who prepares a change cannot approve it: the Change Manager signs off, and the platform team applies it.