Navigate

AC-5

AC-5: Separation of Duties

The organization:

a: Separates [organization-defined duties of individuals];

b: Documents separation of duties of individuals; and

c: Defines information system access authorizations to support separation of duties.

Supplemental

Separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion. Separation of duties includes, for example: (i) dividing mission functions and information system support functions among different individuals and/or roles; (ii) conducting information system support functions with different individuals (e.g., system management, programming, configuration management, quality assurance and testing, and network security); and (iii) ensuring security personnel administering access control functions do not also administer audit functions.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Classified, Cross Domain (Access), Cross Domain (Multilevel), Cross Domain (Transfer), Int-A, Int-B, Int-C, Privacy (High), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.AC-4, PR.DS-5

Related Controls

The controls below (if any) were marked by NIST as being related to AC-5.

Control	Description
AC-3	The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.
PE-4	The organization controls physical access to [organization-defined information system distribution and transmission lines] within organizational facilities using [organization-defined security safeguards].
PS-2	The organization: a: Assigns a risk designation to all organizational positions; b: Establishes screening criteria for individuals filling those positions; and c: Reviews and updates position risk designations [organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of AC-5.

Control	Description
No controls

Related CCIs

The CCIs below are tied to AC-5.

CCI	Definition
CCI-000036	The organization separates organization-defined duties of individuals.
CCI-001380	The organization documents separation of duties of individuals.
CCI-002219	Defines the duties of individuals requiring separation.
CCI-002220	Define system access authorizations to support separation of duties.