Deployed their own change: what the rows show and the clause behind it
The person who wrote the change is the person who put it into production. Segregation of duties asks that the path to production does not rest with the author alone.
Is a developer allowed to deploy their own change to production, and which clause covers segregation of duties?
ISO/IEC 27001 5.3 asks that conflicting duties are split so no single person runs a sensitive process end to end, and 8.31 separates development from production. NIST SP 800-53 AC-5 and CM-5 restrict who may make changes, COBIT DSS06.03 allocates sensitive activities so duties are segregated, and PCI DSS 6.5.4 separates roles between production and pre-production. The checker lists every row where the author and the deployer are the same person, from the change export or the deployment log.
The question the auditor is likely to ask
walkthrough packHow is a developer prevented from promoting their own change to production, and what compensates where they can?
The clause behind it
9 clauses in 6 frameworks| Framework | The clause behind it |
|---|---|
| SOX 404 / ICFR | SOX 404 ITGC IT General Controls (ITGC) - Access, Change, Operations |
| COBIT 2019 | COBIT DSS06.03 Manage roles, responsibilities, access privileges and levels of authority · COBIT BAI07.06 Promote to production and manage releases |
| SOC 2 (Trust Services Criteria) | SOC 2 CC5.1 COSO principle 10: Selects and develops control activities to mitigate risks |
| ISO/IEC 27001:2022 | ISO 27001 5.3 Segregation of duties · ISO 27001 8.31 Separation of development, test and production environments |
| PCI DSS v4.0 | PCI DSS 6.5.4 Roles separated between production and pre-production |
| NIST SP 800-53 Rev 5 | SP 800-53 CM-5 Access restrictions for change · SP 800-53 AC-5 Separation of duties |
A result shows the frameworks you tick; SOX 404 brings COBIT and AS 2201 with it. PCI DSS clauses show on the cardholder systems only.
SOX 404 ITGC IT General Controls (ITGC) - Access, Change, OperationsThe clause text
ITGC including access management, change management, computer operations, program development, backup, recovery.
Source: SOX 404 / ICFR
COBIT DSS06.03 Manage roles, responsibilities, access privileges and levels of authorityThe clause text
Business roles, responsibilities, levels of authority and segregation of duties supporting the process objectives are managed, and access to all information assets related to business processes is authorised: roles and responsibilities follow approved job descriptions and process activities; levels of authority for approving transactions, transaction limits and other decisions follow approved job roles; sensitive activities are allocated so that duties are clearly segregated; access rights and privileges are the minimum needed for predefined job roles, removed or revised immediately on role change or termination; regular awareness and training cover roles, responsibilities, the importance of controls and the security, integrity, confidentiality and privacy of information; administrative privileges are secured, tracked and controlled to prevent misuse; and access control definitions, logs and exception reports are periodically reviewed so that privileges remain valid and aligned with current staff and roles.
Where it usually falls short: Transaction limits not enforced in the system; Access accumulated across role changes
Source: COBIT 2019
COBIT BAI07.06 Promote to production and manage releasesThe clause text
The accepted solution is promoted to the business and operations, run as a pilot or in parallel with the old solution for a defined period where appropriate, and where distribution is electronic or physical it is controlled so that it reaches authorised locations intact: transfer of procedures and supporting services, applications and infrastructure from testing to production follows organisational change management and release management standards; the extent of pilot or parallel processing is determined per the implementation plan; process and system documentation, configuration information and contingency plans are updated promptly; media libraries are updated promptly with the transferred version and the existing version and supporting configuration archived; electronic distribution is controlled so that users are notified and distribution occurs only to authorised and correctly identified destinations with completion confirmed; and physical distribution is logged with what was distributed, to whom, where implemented and when updated.
Where it usually falls short: Production updated from a developer's workstation rather than the controlled library
Source: COBIT 2019
SOC 2 CC5.1 COSO principle 10: Selects and develops control activities to mitigate risksNamed, not quoted: the criteria text is not held in full here.
Where it usually falls short: Controls listed with no traceability to any risk, so the entity cannot show they mitigate anything identified; Detective controls absent, leaving no means to identify failure of the preventive ones
Source: SOC 2 (Trust Services Criteria)
ISO 27001 5.3 Segregation of dutiesThe clause text
Split conflicting duties so no single person can run a sensitive process end to end unchecked.
Where it usually falls short: Combining conflicting roles in small teams; Lack of documented exceptions
Source: ISO/IEC 27001:2022
ISO 27001 8.31 Separation of development, test and production environmentsThe clause text
Separate and secure development, test and production environments.
Where it usually falls short: Policies exist but are not enforced; Shared credentials across environments
Source: ISO/IEC 27001:2022
PCI DSS 6.5.4 Roles separated between production and pre-productionRoles and functions are separated between production and pre-production so that only reviewed and approved changes are deployed.
A one-line statement; the standard's own text is not quoted here.
Source: PCI DSS v4.0
SP 800-53 CM-5 Access restrictions for changeThe clause text
Requires physical and logical access restrictions on who may make changes to the system to be defined, documented, approved and actually enforced, so that only authorized personnel can alter the system.
Where it usually falls short: Developers hold standing write access to production alongside the pipeline; Restrictions documented but not enforced, so the pipeline can be bypassed manually
Source: NIST SP 800-53 Rev 5
SP 800-53 AC-5 Separation of dutiesThe clause text
Requires the organization to identify and document the individual duties that must be kept apart to limit malevolent activity without collusion, and to define system access authorizations so that those duties cannot be exercised by one person.
Where it usually falls short: Conflicting duties named for finance processes only and never for system administration; Small teams create unavoidable conflicts that are tolerated rather than documented and compensated
Source: NIST SP 800-53 Rev 5