CMMC 1.0 Practice AC.3.017 Requirement:
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
CMMC 1.0 AC.3.017 Requirement Explanation:
Without the separation of duties security controls can easily be bypassed. By separating duties between individuals you can reduce the risk of malevolent activity.
Example CMMC 1.0 AC.3.017 Implementation:
Do not allow one person to be in charge of an entire critical task. Assign parts of the critical task to different persons.
CMMC 1.0 AC.3.017 Scenario(s):
- Scenario 1:
Alice handles the creation of user accounts and the assignment of account privileges. Your company periodically audits user accounts and their privileges. Instead of letting Alice do this you separate duties by assigning the auditing task to another employee.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.