Glossary

Segregation of duties

Also called: SoD

A control preventing one person from accumulating incompatible permissions, such as requesting and approving.

A control preventing one person from accumulating incompatible permissions, such as requesting and approving. It is implemented through role-differentiated profiles and permissions, and protects governance by avoiding all-powerful users.

Implementing it in the process rather than in a written procedure is what makes it real. A control that depends on nobody granting themselves an incompatible permission is not a control but an expectation of conduct.

Related terms

Audit

The ability to demonstrate who did what, when, from where and on which object. It rests on per-instance trails recording action, date, time, user and device, for both active and closed instances.

Compliance by design

An approach in which compliance is built into the system design rather than verified afterwards through audit.

Deny by default

An authorization posture where nothing is permitted unless explicitly granted — what is not conceded is neither shown nor executed.

Role governance

The assignment of permissions and accountabilities by institutional function rather than by individual, so the solution does not depend on specific people.