A.5.3 Organizational
Segregation of duties
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (9)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-5fullcovers — Both controls require the explicit separation of duties that could enable a single individual to subvert security controls or commit fraud.
- AC-6mostlyaligns with — Segregation of duties is a direct mechanism for enforcing least privilege by ensuring no individual accumulates conflicting privileges.
- AC-2partialaligns with — Both address the need to manage role assignments so that conflicting privileges are not granted to the same account.
- AU-6partialaligns with — When full segregation is impractical, both controls rely on monitoring, audit trails, and supervisory review to detect improper actions.
Aligned NIST CSF 2.0 outcomes (8)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- GV.RR-02mostlyaligns with — By requiring the organization to determine which duties must be segregated and to assign responsibilities accordingly, the control helps establish and communicate clear roles and authorities for cybersecurity risk management.
- PR.AA-05mostlyaligns with — The ISO control's focus on separating conflicting duties and preventing single-person execution of high-risk actions directly supports the CSF outcome of defining, managing, and enforcing access permissions and authorizations.
- ID.AM-05partialaligns with — The control's emphasis on identifying duties that require separation contributes to prioritizing assets and functions based on the impact of potential conflicts or misuse.
- PR.PS-01partialaligns with — Segregation of duties is a foundational configuration practice that the control applies to roles and responsibilities to reduce the risk of unauthorized or erroneous actions.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V8.2.1partialaligns with — The ISO control's requirement to separate conflicting duties such as requesting versus approving access rights directly supports the ASVS mandate that function-level access be restricted to consumers with explicit permissions.
- V8.2.2partialaligns with — Segregating duties like using versus administering databases or applications aligns with the ASVS requirement that data-specific access be granted only to consumers with explicit permissions for those items.
- V8.3.1partialaligns with — By insisting that authorization decisions be enforced at a trusted service layer rather than by untrusted consumers, the ASVS requirement mirrors the ISO guidance to avoid granting a single individual conflicting roles.
- V8.4.2partialaligns with — The ISO emphasis on layered controls and management supervision for high-risk duties such as administering production systems aligns with the ASVS requirement for multiple security layers around administrative interfaces.
Related weaknesses / CWE (12)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-268mostlyprevents — Segregation of duties reduces the chance that two distinct privileges can be combined to perform unsafe actions.
- CWE-250partialmitigates — Forcing distinct roles for initiating versus executing changes reduces the chance that an individual will run with unnecessary privileges to perform both steps.
- CWE-266partialmitigates — Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
- CWE-267partialmitigates — Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
- CWE-269partialmitigates — Separating duties such as developing software from administering production systems prevents any one person from accumulating excessive privileges that would constitute improper privilege management.
- CWE-284partialmitigates — By requiring that conflicting actions such as requesting and approving access rights be performed by separate individuals, the control directly blocks a single actor from unilaterally exercising improper access control.
- CWE-653partialprevents — Segregation of duties directly enforces separation of privilege levels and functions.
- CWE-732partialmitigates — Requiring separate individuals to request, approve, and implement access rights limits the likelihood that critical resources will be assigned overly permissive or incorrect permissions.
- CWE-842partialmitigates — Segregation of duties may be undermined by wrong group membership but does not itself prevent the placement error.
- CWE-862partialmitigates — Segregating the approval of access rights from their implementation provides an independent check that reduces the impact of missing authorization checks in the resulting system configuration.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1078partialmitigates — Segregation of duties prevents a single account from both requesting and approving elevated privileges, reducing the ability of an attacker to maintain long-term access through compromised valid accounts.
- T1098partialmitigates — By separating the roles that create or modify accounts from those that approve them, the control limits an adversary’s ability to establish persistence via unauthorized account manipulation.
- T1136partialmitigates — Requiring distinct individuals to request, approve, and implement new accounts makes it harder for an attacker to create hidden local or domain accounts for persistence.
- T1505partialmitigates — Segregating code development from production administration limits an attacker’s ability to plant web shells or other server components that provide ongoing access.
- T1543partialmitigates — Separating duties between software development and production-system administration reduces the chance that a single compromised identity can install or modify system services for persistence.
- T1556partialmitigates — Requiring separate roles for designing versus reviewing authentication changes makes it harder for an adversary to alter authentication processes without detection.
Prevented OWASP Web Top 10 (2025) risks (3)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A01partialmitigates — By ensuring no single person can both request and approve access rights or administer systems they also use, the control stops unauthorized privilege escalation paths that would otherwise allow broken access control.
- A02partialprevents — Separating the duties of designing, implementing, and reviewing code or changes reduces the chance that insecure defaults or misconfigurations are introduced and left unchecked.
- A06partialprevents — Requiring distinct individuals to design, implement, and review security controls forces early detection of flawed or insecure design decisions before they reach production.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.