ISO 27001:2022 Annex A Control 5.3

What Is The Purpose of ISO 27001:2022 Annex A 5.3?

In ISO 27001, Control 5.3 Segregation of Duties aims to separate conflicting duties. This reduces the risk of fraud and error and bypasses information security controls.

Annex A Control 5.3 Explained

In accordance with ISO 27001, Annex A Control 5.3 describes the implementation guidelines for segregating organisational tasks and duties.

By delegating sub-tasks to different individuals, this principle creates a system of checks and balances that can reduce the likelihood of errors and fraud occurring.

The control is designed to prevent a single person from being able to commit, conceal, and justify improper actions, thereby reducing the risk of fraud and error. It also prevents a single person from overriding information security controls.

In cases where one employee has all the rights required for the task, fraud and errors are more likely to occur. This is because one person can perform everything without any checks and balances. There is, however, a reduced risk of significant harm or financial loss from an employee when no single person has all the access rights required for a particular task.

What’s Involved and Requirements of Annex A 5.3

In the absence of proper separation of duties and responsibilities, fraud, misuse, unauthorised access, and other security issues may arise.

Additionally, segregation of duties is required to mitigate the risks of collaboration between individuals. These risks are increased when insufficient controls prevent or detect collusion.

As part of ISO 27001:2022, the organisation should determine which duties and responsibilities need to be separated and implement actionable separation controls.

Whenever such controls are not possible, particularly for small organisations with a limited number of employees, activity monitoring, audit trails, and management supervision can be used. Using automated tools, larger organisations can identify and segregate roles to prevent conflicting roles from being assigned.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022’s Annex A control 5.3 Segregation of Duties is a revised version of ISO 27001:2013’s Annex A control 6.1.2 Segregation of Duties.

Annex A 5.3 ISO 27001:2022 and Annex A 6.1.2 ISO 27001:2013 describe the same basic characteristics of the control “Segregation of duties”. However, the most recent version defines a number of activities that require segregation during implementation.

Among these activities are:

a) initiating, approving and executing a change;

b) requesting, approving and implementing access rights;

c) designing, implementing and reviewing code;

d) developing software and administering production systems;

e) using and administering applications;

f) using applications and administering databases;

g) designing, auditing and assuring information security controls.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

Who Has Ownership of Annex A 5.3?

Several individuals are responsible for the segregation of duties in ISO 27001, beginning with a senior management team member. This individual is responsible for ensuring that the initial risk assessment has taken place.

As a result, other groups of qualified employees should be assigned processes that apply to different parts of the organisation. Order to prevent rogue employees from undermining company security is usually done by assigning tasks to other work units and departmentalising IT-related operations and maintenance activities.

The separation of duties cannot be established correctly without an effective risk management strategy, an appropriate control environment, and an appropriate IT audit programme.

Use ISMS.online to Your Advantage

ISO 27001:2022 only requires you to update your ISMS processes to reflect the improved Annex A controls, and if your team can’t manage this, ISMS.online can.

In addition to DPIA and other related personal data assessments, like LIAs, ISMS.online provides simple, practical frameworks and templates for information security.

With ISMS.online, you can document information security management system procedures and checklists to ensure compliance with ISO 27001, automating the implementation process.

ISMS.online lets you:

• Create an ISMS that is compatible with ISO 27001 standards.
• Perform tasks and submit proof indicating they have met the standard’s requirements.
• Allocate tasks and track progress toward compliance with the law.
• Get access to a specialised team of advisors to assist you throughout your path towards compliance.

By using our cloud-based platform, you can centrally manage checklists, interact with colleagues, and use a comprehensive set of tools to help your organisation create and maintain an ISMS.

Get in touch today to book a demo.