Separation of Duties
Certification criterion
To prevent potential damage caused by abuse or misuse of privileges, the organization shall establish and apply separation-of-duties criteria. However, where separation of duties is unavoidably difficult, the organization shall establish and implement separate compensating measures.
Key checkpoints
- To prevent potential damage caused by abuse or misuse of privileges, are separation-of-duties criteria established and applied?
- Where separation of duties is difficult, are compensating controls in place, such as mutual review among duty holders, periodic monitoring and approval of changes by senior managers, and measures to ensure accountability?
Detailed explanation
To prevent potential damage caused by abuse or misuse of privileges, the organization shall establish and apply separation-of-duties criteria as follows.
- Separation of development and operations duties
- Separation of the duties of the information security officer / personal information handlers from the information security and personal information monitoring duty
- Separation of operations duties among information systems and personal information processing systems (servers, databases, etc.)
- Separation of information security and personal information protection management duties from information security and personal information protection audit duties
- Separation of personal information protection management from personal information processing system operations duties
- Separation of personal information protection management from personal information processing system development duties, etc.
- Prohibition on granting external outsourcing company staff the authority to register/delete (deactivate) user accounts and to configure the registration/change/deletion of access privileges (where unavoidable, apply compensating controls)
Where separation of duties is unavoidably difficult due to a small organizational size or insufficient human resources, the organization shall establish compensating controls, such as mutual review among duty holders and ensuring accountability of duty holders.
- Manage to prevent abuse/misuse through means such as mutual review among duty holders and senior manager approval
- Ensure accountability through the use of individual accounts, log recording, and auditing/monitoring, etc.
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Guidelines related to separation of duties (personnel security guidelines, etc.)
- Job descriptions (system operations/management, development/operations, etc.)
- Status of compensating controls where duties are not separated
Nonconformity examples
- Where the organization's size and staffing are sufficient to allow separation of duties among individual responsible persons, but the organization does not comply with the separation-of-duties criteria set in its internal regulations, citing only work convenience as the reason
- Where, given the organization's characteristics, development and operations duties are performed concurrently after obtaining management approval, but compensating control procedures are not in place, such as mutual review among duty holders, periodic monitoring of duty performance and review/approval of changes by senior managers, and measures to ensure accountability of duty holders