Separation of Duties
Also: Segregation of duties
PCIComplianceHubLast updated
Dividing the steps of a function among more than one person so that no individual can carry the whole thing through alone. It is the organisational form of the same idea that dual control applies to cryptographic keys.
Applies to. Every entity, in the shape PCI DSS requires it: development separated from production, and the person performing an activity separated from the person assessing it.
Example. The developer who writes a change to the payment application cannot deploy it to production; a release engineer does. That is 6.5.3 (separate environments) and 6.5.4 (roles and functions separated between production and pre-production) at work. The engineer who runs the firewalls does not sign off the segmentation test.
Limits. PCI DSS does not require separation everywhere, and a small entity cannot manage it everywhere. It requires it where it names it: between development and production environments and the people who work in them (6.5.3, 6.5.4), in the organisational independence of scanners and testers (11.3.1, 11.4.x), and, for cleartext key components, as split knowledge and dual control (3.7.6). Where headcount makes it impossible, compensating controls are the documented alternative, not silence.