AC.L2-3.1.4
Separation of Duties
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AC.L2-3.1.4 in the reference catalog with its NIST cross-references
Official requirement
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
Assessment objectives
a. the duties of individuals requiring separation are defined;
b. responsibilities for duties that require separation are assigned to separate individuals; and
c. access privileges that enable individuals to exercise the duties that require separation are granted to separate individuals.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Split sensitive duties so one person does not hold incompatible responsibilities.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for the management of several key systems within your organization including some that process CUI . You assign the task of reviewing the system logs to two different people. This way, no one person is solely responsible for the execution of this critical security function [c]. Example 2 Y ou are a system administrator. Human Resources notifies you of a new hire, and you create an account with general privileges, but you are not allowed to grant access to systems that contain CUI [a,b]. The program manager contacts the team in your organization that has system administration authority over the CUI systems and informs them which CUI the new hire will need to access. Subsequently, a second system administrator grants access privileges to the new hire [c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Access control policy; procedures addressing divisions of responsibility and separation of duties; system security plan; system configuration settings and associated documentation; list of divisions of responsibility and separation of duties; system access authorizations; system audit logs and records; other relevant documents or records
Common mistakes
Assigning nominally separate roles to the same person without addressing the conflict.