What is the term for dividing steps in a function among different individuals to prevent subversion?

• A. Dual Control
• B. Separation of Duties
• C. Job Segregation
• D. Access Review

Answer: (B)

Separation of duties is the practice of dividing responsibilities so that no single person completes a process from start to finish. By distributing steps among different individuals, it creates checks and balances that deter subversion and reduce the risk of fraud. In PCI DSS and security in general, this means separating tasks like initiating, approving, implementing, and reconciling changes or transactions across distinct roles. This way, potential fraud or errors require collusion to go undetected. Dual control is related, as it often enforces SoD for especially sensitive actions by requiring two people, but the broader concept described here is separation of duties. The other terms describe related but distinct controls—access reviews focus on evaluating who has access, and the terminology isn’t the standard way to name this overarching practice.