CISA Access Controls: Least Privilege and Separation of Duties

What does least privilege control?

Least privilege limits access to what a user or process needs for its assigned tasks; separation of duties divides incompatible capabilities so one person cannot complete a harmful sequence alone. NIST defines these as separate principles, and ISACA includes identity and access management in CISA Domain 5, Protection of Information Assets.

The official outline, checked November 3, 2026, assigns Domain 5 a 26% weight. That is the weight of the whole domain, not an access-control question count. The CISA exam domains guide places this topic alongside the other content you need to study.

For least privilege, ask: What does this person or process need to do, and what access exceeds that need? The baseline is the assigned function. An impressive job title or a manager's approval does not, by itself, explain why every permission is necessary.

In an original hypothetical example, a payroll reviewer needs to read a payroll report. The account can also change employee bank details. If changing those details is outside the reviewer's assigned tasks, that permission is the excess to investigate. Removing it addresses the mismatch between the task and the account's capabilities.

Least privilege does not mean nobody can hold powerful permissions. It means the necessary scope must be justified by the work. When studying a scenario, write down the required action before judging the access.

For broader topic practice, full ISACA CISA prep planned for launch covers the five exam domains.

What does separation of duties control?

Separation of duties addresses the combination of incompatible capabilities. NIST's definition focuses on preventing a user from having enough privileges to misuse a system alone. The study question is therefore: Can one person carry out the entire harmful sequence without another person's participation?

Consider a fictional purchasing process in which an employee creates an invoice and a different employee must authorize its payment. The organization's intended control divides those actions. If the same person can create and release the payment, the independent step is missing, even if each permission has been assigned deliberately.

Compare the questions directly:

Two account names are not enough to establish two independent people. In the example, giving one employee both a preparer account and a releaser account leaves the same person able to complete the sequence. Trace the capabilities to the people who can use them.

This example illustrates a control objective, not a universal rule that every organization must use these job titles. Identify the incompatible actions in the stated process before selecting a remedy.

Can a system satisfy one principle and fail the other?

Yes. The scope of each person's permissions and the division of incompatible actions are separate questions. These fictional configurations show why both need attention:

The final row is a description of the intended arrangement. It is not proof that the arrangement operates correctly or that every other access path has been considered.

An original role matrix makes that arrangement easier to inspect:

In this example, the roles belong to different employees. Read down each column to examine permission scope. Read across the payment process to examine the division of actions. If a scenario gives you only role names, you still need the underlying permissions and workflow to evaluate it.

For recall practice alongside cases, full ISACA CISA prep planned for launch includes 500 flashcards.

How do static and dynamic separation differ?

Static separation constrains conflicting role assignments. Dynamic separation enforces the restriction when actions are performed. NIST's separation-of-duty terminology supports this distinction; the illustrations here are editorial study examples.

Under a static arrangement, the fictional organization prevents one person from holding both the invoice-preparer and payment-releaser roles. The conflict is addressed when roles are assigned.

Under a dynamic arrangement, someone might perform either activity, but the workflow requires different people for the incompatible actions on a particular invoice. In this example, a person who prepared an invoice cannot release that invoice. The control checks the action and its context.

Neither label alone proves that the control works. For a static example, investigate whether conflicting assignments actually exist. For a dynamic example, investigate whether the workflow actually enforces the stated restriction. Do not infer one arrangement from the other: a list of roles cannot establish how a transaction-level restriction behaved.

What evidence should an auditor inspect?

Start with the weakness you are evaluating. The following suggestions are editorial ways to investigate the two principles, not a mandatory audit program prescribed by NIST or ISACA.

• For least privilege: compare assigned responsibilities with actual permissions. A role description explains intended work; the permissions show what the account can do. Investigate access that has no demonstrated connection to that work.
• For static separation: examine the defined role conflicts and the people assigned to those roles. Include the question of whether one person controls multiple relevant accounts.
• For dynamic separation: inspect the workflow restriction and records identifying who performed each incompatible action. A record showing an approval is incomplete for this purpose if it does not establish the required independence.
• For enforcement: consider an authorized test with defined expected behavior. In the fictional dynamic case, an attempted release by the invoice's preparer should be blocked under the stated rule.

Keep conclusions within the evidence. A role matrix describes permissions, while transaction records address activity. A successful test under specified conditions does not establish that all earlier transactions followed the rule. Independent participation also does not establish that participants could never collude.

The CISA audit evidence guide explains how to match examination, interviews, and testing to a control objective. Use it when your next question is how to investigate the suspected weakness.

How can you recognize the failed principle in a scenario?

Use this short editorial exercise before looking at the answer options:

1. Name the assigned task. What work is the person or process supposed to perform?
2. List the available actions. Which permissions are needed, and which appear unrelated?
3. Trace the incompatible sequence. Can one person complete it, including through multiple accounts or roles?
4. Match the response to the weakness. Removing unrelated permissions addresses excess access. Dividing incompatible actions addresses the missing independent step. Some cases need both.

Avoid choosing a control merely because its name sounds stronger. In the payroll example, adding another approver would leave an unrelated permission in place. In the invoice example, removing unrelated administration would still leave one employee able to prepare and release a payment.

Start with the 20 free CISA practice questions and use the free CISA study plan to reserve a review session. For each relevant scenario, explain the failed principle, the proposed correction, and the evidence you would want before accepting the correction as effective.

For additional question practice, full ISACA CISA prep planned for launch includes 1,350 questions. Keep exam preparation separate from credential eligibility; the CISA requirements and cost guide explains the certification steps.

<!-- Writer self-check: PLAN metadata and intent preserved; this entry has no assigned yearFocus. Official claims checked against RESEARCH.md O1/O4, L1, and S1; product claims checked against the separate product facts and CONTEXT.md. Fictional matrices, examples, evidence suggestions, and study method are labeled editorial. No universal job-title rule, small-organization exemption, mandatory NIST adoption, or collusion guarantee. Three spaced commercial links, both free tools, and both existing guides included. Independent review remains required. -->