Least Privilege and Separation of Duties

ISC2 Certified in Cybersecurity CC

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Official 2026 CC Exam Facts and Timeline CAT Format and Beginner Security Judgment Domain Map and Time Allocation 30, 60, and 90 Day Study Plan with Readiness Thresholds

2 Domain 1: Security Principles (24%)

CIA Triad as a Practical Decision Tool Authentication, Authorization, Accounting, and Non-Repudiation Privacy in the CC Outline Beginner Security Decision Scenarios AI Security in Security Principles

3 Domain 1: Risk Management and Security Controls

Risk Identification in Business Context Risk Management Processes Risk Treatment Decisions Security Controls: Technical, Administrative, and Physical

4 Domain 1: Governance, Ethics, Policy, and Privacy

Governance and the ISC2 Code of Ethics Policies, Procedures, Standards, Laws, and Regulations Privacy and AI Governance Due Care, Due Diligence, and Governance Decisions

5 Domain 1: Physical Security Controls

Physical Controls and Their Monitoring Tailgating and Physical Penetration Testing

6 Domain 2: Security Governance - Business Continuity

Business Continuity (BC)

7 Domain 2: Security Governance - Disaster Recovery

Disaster Recovery (DR) Redundancy in Business Continuity and Disaster Recovery

8 Domain 2: GRC Planning

GRC Planning: Purpose, Importance, and Tools

9 Domain 2: Measuring Cybersecurity Effectiveness

Security Metrics, KRIs, and Dashboards AI Security in Governance, Awareness, and Continuity

10 Domain 2 and Domain 5: Security Awareness and Triage

Security Awareness and Organizational Culture Phishing and Password Protection Security Event Triage and Human Review

11 Domain 3: Identity Lifecycle Management

Identification, Authentication, Authorization, and Accountability Multi-Factor Authentication and Password Protection Provisioning, Deprovisioning, and Access Reviews Service Accounts and AI Bots in Identity Management AI Bots and Service Accounts in Identity Management

12 Domain 3: Logical Access Controls

Least Privilege and Separation of Duties DAC, MAC, RBAC, and ABAC

13 Domain 4: Networking Fundamentals

Network Models and IP Addressing Firewalls: Ports and Applications Virtual Private Networks (VPN) Wireless Networks and Embedded Systems

14 Domain 4: Network Security Architecture and Cloud Security

Network Segmentation Defense in Depth and Zero Trust Cloud Characteristics and Shared Security Model Cloud Service Models, Deployment Models, and Shared Security AI in Network Security and Cloud Hosting

15 Domain 5: Incident Response

Incident Response (IR) and the Incident Response Plan Preparing the Incident Response Plan Incident Response Exercises and Tabletops AI in Security Operations and Incident Response

16 Domain 5: Security Monitoring

Logging and Monitoring Security Events

17 Domain 5: Threat Actors and Threat Intelligence

Threat Actors, Threat Intelligence, and Frameworks

18 Domain 5: Data Security

Encryption and Hashing for Data Security Data Handling: Classification, Labeling, Masking, and Sanitization Security of the AI Workspace

19 Domain 5: Asset Protection

Configuration and Change Management Change Management and Asset Protection Asset Lifecycle and End-of-Life Management

20 Domain 5: Data Handling Policy

Data Handling Policy and Classification

21 Domain 5: Security Testing

Security Readiness, Application, and Physical Testing

22 Integrated CC Scenario Labs

Risk and Control Selection Drill Continuity, Recovery, and Response Drill Access Control Design Drill Segmentation and Triage Drill

23 Final 14-Day Review and Exam Readiness

CAT Pacing and 100-125 Item Strategy Missed-Question Notebook and Domain Repair Exam Day Logistics and Rescheduling After Passing: AMF and CPE

Least Privilege and Separation of Duties

Key Takeaways Explain This Topic AI

Least privilege grants only the access needed for an assigned task, and only for as long as it is needed.

Need-to-know restricts access to specific information; least privilege is broader, covering system actions like restart, deploy, approve, and create-user.

Separation of duties (SoD) splits a high-risk process so no single person can both commit and conceal fraud or error.

Dual control requires two people to act together; split knowledge means no single person holds the entire secret (e.g., a divided recovery key).

Privilege creep accumulates through transfers and expired projects; periodic access reviews and time-bounding are the antidotes.

Last updated: October 2026

Key Concepts

Least privilege is among the most testable CC principles: a subject receives only the permissions required to perform assigned work, no broader and no longer than necessary. It is easy to state and hard to operate because access accumulates . People change teams, projects close, contractors extend, emergency access is granted, and "temporary" exceptions become permanent unless someone deliberately revokes them. The drift this creates is called privilege creep , and the standard countermeasures are periodic access reviews (recertification) and time-bounding grants with expiration dates.

Apply least privilege with four questions: What task must the subject perform? What object does that task require? What exact action on that object is needed? How long is the access needed? A marketing intern who builds campaign reports may need read access to selected analytics dashboards for the summer. The intern does not need platform administrator rights, export rights for all customer records, or any access after the internship ends.

Need-to-know is related but narrower: it asks whether a subject needs specific information to do the job. A nurse needs a patient's medication list to treat them; a billing clerk needs insurance and invoice fields but not full clinical notes. Least privilege includes need-to-know but also governs system actions like restart, approve, delete, configure, deploy, or create users. They are often contrasted: information access leans on need-to-know, action/system access leans on least privilege.

Separation of duties (SoD) , also called segregation of duties, divides sensitive tasks across multiple people or roles so no one person can both perform and hide an error or fraud. In finance, one person creates a vendor, a second approves it, and a third releases payment. In software delivery, a developer writes code, a separate reviewer approves the change, and an automated pipeline deploys it. In identity administration, a manager requests access, an application owner approves, and an identity team provisions.

SoD only works when the steps are meaningful and independent . A weak control demands two approvals but both come from the same person using two accounts. A strong control separates request, approval, implementation, and review, and logs each step so the organization can prove who did what.

Exam Application

Dual control and split knowledge are the heavier-duty cousins of SoD. Dual control requires two authorized people to act together on one sensitive operation (opening a vault, releasing a large wire). Split knowledge means no single person holds the complete secret, such as dividing a cryptographic recovery key into two halves held by different custodians. Reach for these when the risk is high enough that ordinary role separation is insufficient.

The table below shows how the same principle is named differently depending on what is split:

• Control What it requires Typical use
• Least privilege Only the minimum permissions for a task All accounts and roles
• Need-to-know Access only to required information Classified or sensitive data
• Separation of duties Different people for different process steps Vendor setup, payments, code deploy
• Dual control Two people act together on one action Vault, large wire transfer
• Split knowledge No one person holds the whole secret Key recovery, master credentials

Work a fraud scenario. In a small company the office manager can create vendors, change bank-account details, approve invoices, and issue payments. That is efficient but is a textbook SoD failure: one person can invent a fake vendor and pay it. A better design lets the office manager enter invoices, requires a department manager to approve the purchase, and requires finance to approve before payment, with system-enforced amount limits and logged approvals.

Scenario clues. When a scenario says a user has more access than the task needs , the answer is usually least privilege . When one person controls an entire high-risk process , the answer is usually separation of duties .

The enduring challenge is balance. Too little access slows work and breeds risky workarounds (shadow IT, password sharing); too much access widens the blast radius of any compromise or mistake. Good access design is specific, reviewed on a schedule, time-bounded when appropriate, and tied to real job duties rather than convenience or title.

Where These Controls Fail in Practice

Scenarios often describe a broken control and ask what went wrong. Recognizing the failure modes is as valuable as defining the principle:

Privilege accumulation through transfers. An employee moves from finance to marketing but keeps the old finance permissions. Each move adds rights, none removes them, until the account can touch far more than the current job requires. The fix is review at the moment of transfer, not only at annual recertification.

Emergency access that never expires. "Break-glass" accounts granted during an outage are powerful by design. If they are not revoked and logged afterward, they become standing backdoors. The control is time-bounding plus mandatory post-use review.

Cosmetic separation of duties. A process demands two approvals, but one person controls both approving accounts, or the same manager requests and approves. The steps look separate yet collapse into one actor. Genuine SoD requires different people and independent logging.

Service accounts with human-grade rights. Automation accounts often accumulate broad permissions "to be safe." They rarely rotate credentials and are seldom reviewed, making them high-value targets. Least privilege applies to non-human subjects just as strictly as to people.

A final point: least privilege and separation of duties reinforce each other. Least privilege shrinks what any one account can do; separation of duties ensures that even a maximally privileged single account cannot complete a sensitive process alone. Defense in depth means layering both rather than relying on either by itself, because a determined insider or a fully compromised credential can defeat any one control acting in isolation.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 3.2 (Principle of Least Privilege; Separation of Duties), checked 2026-10-22.