Separation of Duties AC-5
Access Control · Moderate baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds AC-5 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Access Control family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
AC-5 (Separation of Duties) splits sensitive tasks so no single person can carry one out start to finish - for example separating who requests access from who approves it, or who writes code from who deploys it. It reduces fraud and error, and applies at the Moderate baseline.
What good looks like
- Identify the duties that must be separated and write them down.
- Document the division of responsibilities across distinct roles.
- Enforce the split through access authorizations, so one account cannot hold both sides of a sensitive process.
- Separate day-to-day operational duties from security administration.
Framework mapping
- NIST CSF 2.0 — PR.AA-05 — Access permissions are managed to enforce separation and least privilege
- CIS Controls v8 — Control 6 — Access Control Management - role-based assignment of access rights
How to move it toward Implemented
- This is not yet met on VM 607: a single BLUEADMIN account holds blanket sudo (§1a) and the runbook creates no role-separated accounts, so one person can do everything.
- auditd gives accountability for privileged actions (§2a), but that is AC-6 and audit coverage - it does not divide the duties themselves, so no part of AC-5 is satisfied.
- Create distinct roles - for example a normal operator account for routine tasks and a separate admin identity for privilege and config changes - and scope each in sudoers so neither can silently assume the other.
- Record this as a Plan of Action and Milestones (POA&M) item naming AC-5, then attach the role definitions as evidence once the split is in place.