Contents
What is the purpose of the requirement separation of duties within PCI DSS?
The Separation of Duties Principle (SoD) is the division of the duties of approval, implementation, recording, and control of activities and financial decisions and transactions to reduce the risks of error, deficiency, inaccuracy, irregularity, and corruption among personnel.
What is the principle of separation of duty?
Definition(s): refers to the principle that no user should be given enough privileges to misuse the system on their own. For example, the person authorizing a paycheck should not also be the one who can prepare them.
What is one of the major reasons why the separation of duties should be practiced?
It serves three primary purposes:
- Reduce the risk of conflict of interest or the appearance of conflict of interest.
- Reduce the risk of errors, fraud, abuse, theft, or other wrongful actions.
- Comply with regulatory mandates (e.g., SOX, HIPAA, PCI DSS, GDPR) and industry-specific regulations (e.g., ISO 17799)
What are the requirements for PCI DSS 6.4?
PCI DSS requirement 6.4.2 separation of duties between development/test environments
Do you need a QSA for PCI DSS?
PCI-DSS is an exceptionally broad (and interpretative) set of rules – so this answer is probably best answered by a QSA (for anything other than opinion/heresy). However, our interpretation is such that the environments have to be separate, but not necessarily on physically separate hardware.
Why is an ASV scan required for PCI DSS?
For this reason, the organization must have a method for continuously assessing and assigning risk rankings to vulnerabilities. However, this method cannot be achieved with an ASV scan or internal network vulnerability scan. Instead, it is necessary to monitor industry resources for vulnerability information actively.
When do you need a separation of duties?
In environments where one individual performs multiple roles (for example application development and implementing updates to production systems), duties should be assigned such that no one individual has end-to-end control of a process without an independent checkpoint.