CMMC AC.3.017 - Separate Individual Duties

CMMC AC.3.017 - Separate Individual Duties

Requirement text: AC.3.017: Separate the duties of individuals to reduce the risk of malevolent activity
without collusion. 

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Separation of duties addresses the potential for abuse of authorized privileges and helps to
reduce the risk of malevolent activity without collusion. Separation of duties includes
dividing mission functions and system support functions among different individuals or
roles; conducting system support functions with different individuals (e.g., configuration
management, quality assurance and testing, system management, programming, and
network security); and ensuring that security personnel administering access control
functions do not also administer audit functions. Because separation of duty violations can
span systems and application domains, organizations consider the entirety of organizational
systems and system components when developing policy on separation of duties.

CMMC CLARIFICATION
A company must avoid situations in which conflicts of interest or even lack of knowledge can
create security problems. This can be accomplished by splitting important duties and tasks
between employees in order to reduce intentional or unintentional execution of malicious
activities, when those involved are not colluding. This allows the organization to minimize
employees' fraud, abuse and errors. Summarizing, no one person should be in charge of an
entire critical task from beginning to end.

Example
You are responsible for designing and implementing security solutions in your organization.
The same person should not test security mechanisms, conduct security audits, and release
software for delivery. Policy is created and implemented so that the development team does
not do testing and the test team does not do development. This eliminates your ability to
intentionally or unintentionally develop a weak security solution that is not identified
through testing or is released prematurely before unit, integration, regression, operational
and security testing are complete.

References
​​• NIST SP 800-171 Rev 1 3.1.4
• NIST CSF v1.1 PR.AC-4
• NIST SP 800-53 Rev 4 AC-5

    • Related Articles

    • Access Control: SP 800-171 Security Family 3.1

      Access is the ability to make use of any system resource. Access control is the process of granting or denying requests to:       • use information,       • use information processing services, and       • enter company facilities.  System-based ...

    • CMMC PS.2.127 - Screen Individual for System Access

      Requirement text: PS.2.127: Screen individuals prior to authorizing access to organizational systems containing CUI. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Personnel security screening (vetting) activities involve the evaluation/assessment ...

    • CMMC SI.5.223 - Monitor Individual and Systems for Anomalous Behavior

      Requirement text: SI.5.223: Monitor individuals and system components on an ongoing basis for anomalous or suspicious behavior. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171B Monitoring is used to identify unusual or unauthorized activities or ...

    • CMMC AC.2.008 - Use Non-Privilege Accounts

      Requirement text: AC.2.008: Use non-privileged accounts or roles when accessing non-security functions. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2  This requirement limits exposure when operating from within privileged accounts or roles. The ...

    • CMMC AC.2.007 - Employ Least Privilege

      Requirement text: AC.2.007: Employ the principle of least privilege, including for specific security functions and privileged accounts. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Organizations employ the principle of least privilege for ...