Study. uk . com
  1. Home
  2. All questions
  3. Question 360

CISSP study material · question 360 of 500

A manager argues that separation of duties makes fraud impossible. What does SP 800-53 actually claim for the control?

  1. It reduces the risk of malicious activity without collusion, leaving conspiracy between two people unaddressed.
  2. It reduces error rather than malice, and has no effect on deliberate abuse.
  3. It eliminates fraud entirely where duties are divided among three or more people.
  4. It applies to system support functions only, not to business processes.
Show the answer

Answer: A. It reduces the risk of malicious activity without collusion, leaving conspiracy between two people unaddressed.

AC-5's discussion says separation of duties addresses the potential for abuse of authorised privilege and helps reduce the risk of malevolent activity without collusion.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53 Rev. 5 > AC-5 Separation of Duties

Challenge yourself on this topic → Study as cards