03.01.04 Separation of Duties

This policy outlines the requirements for implementing separation of duties within the organization to mitigate the risk of fraud, errors, and unauthorized access to Controlled Unclassified Information (CUI). Separation of duties aims to prevent any single individual from having the necessary authority and access to independently perform all critical functions within a specific process or system.

• A.03.01.04.a: duties of individuals requiring separation are identified.
• A.03.01.04.b: system access authorizations to support separation of duties are defined.