Back to all 93 controls
Annex A 5.3
Organizational
A.5.3 Segregation of duties
Prevent fraud and error by separating conflicting duties.
What good looks like
Conflicting duties (e.g. request vs approve vs deploy) are split across people or compensating controls exist.
Evidence an auditor will ask for
Role matrix, SoD analysis, approval workflows, sample tickets.
Put this control into practice
Check whether your organisation already meets Annex A 5.3 with the free Gap Analysis tool, or get implementation-ready templates for every Annex A control with the Document Pack.