Skip to content
ControlVerdict
Sign in
AC.L2-3.1.4CMMC Level 2Level 2

Separation of Duties

Submit your own example

Practice statement

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.1.4.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the duties of individuals requiring separation are defined;

    1 example covers this

  2. [b]

    responsibilities for duties that require separation are assigned to separate individuals; and

    1 example covers this

  3. [c]

    access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    AC.L2-3.1.4Separation of Duties
    Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

    • [a]

      the duties of individuals requiring separation are defined;

    • [b]

      responsibilities for duties that require separation are assigned to separate individuals; and

    • [c]

      access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.

    No single person both approves and provisions enclave access

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses all Separation of Duties objectives for enclave IAM and privileged IT functions.

    Conflicting duties. Documented pairs that must not be held by one person: (1) access approver vs provisioner for enclave groups, (2) code deploy vs production break-glass for enclave apps, (3) security policy edit vs audit-log admin on the IdP.

    Technical enforcement. ServiceNow workflows require distinct users for approve and fulfill. Okta admin roles that can change Conditional Access are eligible via PIM-equivalent and cannot be the same standing role as the log-retention admin.

    Maintenance. Quarterly SoD report: export who held both sides of each pair in the last 90 days; exceptions need CISO sign-off.

    Accepted gap. Company of this size cannot fully separate backup-operator from restore-operator overnight. Dual control is enforced by a witnessed restore checklist until a second trained operator is hired.

    What the evidence looks like

    • SoD policy listing conflicting duty pairs
    • ServiceNow workflow config showing dual-user approve/fulfill
    • Quarterly SoD report sample
    • Backup restore witnessed checklist (compensating control)

    Environment

    Mid-size OSC (~300 staff); Okta Workforce; ServiceNow for IAM requests.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.