AC.2.004 — Separate Duties to Reduce Risk

What AC.2.004 means in plain English

Don't let one person have complete control over something important from start to finish. For example, the same person who approves purchase orders shouldn't also be the one who processes payments. Or the person who manages IT accounts shouldn't be the only one who reviews those accounts. Splitting up critical tasks means one bad actor alone can't cause a major problem.

The assessment question

“Are critical functions — such as approving financial transactions, creating user accounts, and reviewing system logs — divided between two or more people so no single individual has end-to-end control without oversight?”

How to implement AC.2.004

1. Make a short list of your most sensitive functions: who approves contract-related purchases, who manages IT admin accounts, who reviews audit logs. Ensure at least two people are involved in each critical process.
2. In Microsoft 365, ensure the Global Admin role is held by at least two people (owner and backup) and that the IT manager's account activities are reviewable by the business owner.
3. Set up a simple two-person rule for financial approvals: the person who requests payment is different from the person who approves it — document this in your purchasing procedure.
4. Use Microsoft 365 Privileged Identity Management (PIM) if available to require approval before elevated admin roles are activated.
5. Document your separation-of-duties assignments in a simple one-page matrix: task, primary responsible person, secondary reviewer/approver.

Evidence your assessor will ask for

• Separation of duties matrix listing critical functions and assigned personnel
• Screenshot of Microsoft 365 admin roles showing multiple admins with limited roles
• Written purchasing or financial approval procedure showing two-person requirement
• Interview notes or attestation from owner confirming SOD is practiced

More Access Control controls