03.01.04 – Separation of Duties (NIST 800-171 Rev. 3)

2025-05-29

Welcome to our breakdown of 03.01.04 – Separation of Duties, part of the Access Control family in NIST SP 800-171 Revision 3.

This control isn’t about the systems you build — it’s about the people who operate them.
And it’s all about ensuring that no single person has too much power over sensitive operations.

03.01.04 – Separation of Duties

Separation of Duties is designed to reduce risk — especially the risk of:

• Fraud
• Misuse of privileges
• Unauthorized actions or cover-ups

By dividing key responsibilities across different roles, organizations can prevent any one person from compromising the system unchecked.

Example:

The person who grants access to systems should not be the one reviewing audit logs.

03.01.04 – Key Requirement

There are two core requirements:

• Identify which duties must be separated
• Define and enforce access rules to maintain that separation

In other words:

• Know where risks exist when duties overlap
• Implement technical and procedural controls to prevent it

03.01.04 – Implementation Tips

Here’s how to implement this control effectively:

• Document all key roles in your organization
• Identify conflicts — such as admin + audit access in one account
• Use access control lists (ACLs) to enforce separation
• Ensure no one person can both initiate and approve sensitive operations
• Conduct periodic access reviews and adjust assignments accordingly

🛑 Important:
This separation must be enforced in both policy and practice.
Writing it down isn’t enough — your systems need to reflect and support the separation, and your team must adhere to it.

03.01.04 – Evidence

Auditors may ask for:

• Role definitions and separation policies
• System access authorizations showing divided duties
• Policy documents enforcing role boundaries
• Audit logs or change records showing duties were reviewed and adjusted
• How separation of duties is represented in your System Security Plan (SSP)

Include in your SSP

You should document:

• How your organization defines and separates roles
• Technical controls that prevent overlapping permissions
• Review processes that ensure duties remain appropriately divided

---

Why it matters..

Without proper separation of duties, a single user can make, approve, and hide unauthorized changes.
This control ensures your system has checks and balances, reducing the risk of internal abuse and human error.

Just like in accounting or software releases, having a second set of eyes can prevent a disaster.

---

• Role-based dashboards and assignments
• System-linked access records and evidence
• Conflict-of-interest warnings on user permissions
• SSP support directly tied to role enforcement

---

Next up in this NIST 800-171 Rev. 3 series:
03.01.05 – Least Privilege
We’ll explain how keeping permissions minimal helps you reduce your attack surface — and stay compliant.

---