Split conflicting tasks across different people so no single individual can both perform and conceal a harmful action. Where headcount makes this hard, add compensating checks like monitoring or approvals.
What an auditor, or Sekit's evidence engine, asks for.
Security roles and responsibilities
The document or chart showing who owns each aspect of security in the company (e.g. a security org chart or a RACI matrix).
From the Sekit evidence catalog
In practice
In a small company, the same person often requests, approves and executes a change, which is exactly what this control tries to prevent. The realistic fix is not always hiring more staff; it is compensating controls, such as a second reviewer on financial system changes or a monthly access review that would catch someone approving their own request. Auditors ask for the access matrix showing who can do what, and then test it: can the database administrator also approve their own production changes? If yes, either the roles need separating or a documented compensating control needs to exist and run.
Common gaps
One administrator holds both the ability to create user accounts and to approve access requests, with no compensating review to catch conflicts.
The access matrix documents segregation on paper, but the underlying system permissions were never configured to match it.
Compensating controls for small-team conflicts, such as monthly reviews of high-risk actions, are mentioned in policy but never performed.
Questions your auditor will ask
Can any single person both perform and approve the same sensitive action?
The access matrix shows conflicting permissions are split across roles, and system configuration enforces that split rather than relying on process alone.
How are conflicts of interest handled when the team is too small to separate every duty?
Documented compensating controls, such as a second reviewer or a recurring access review, cover roles that cannot be fully segregated.
Who reviews whether segregation of duties is still working as the team grows?
The person accountable for security policy, typically the security lead or CTO in a small firm, reviews and re-signs the roles and responsibilities document on a set cycle and after any headcount change.
Where regulation demands it
NIS2 11.2 requires managing access rights so that permissions match assigned responsibilities, which is what segregation of duties enforces at the account level.
ENS org.1 requires a written security policy, the natural place to define segregation-of-duties rules and the compensating controls that cover roles too small to fully separate.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.