Separation of Duties (SoD) is a control that splits a sensitive process across two or more people so no single person can complete it alone. The employee who requests a payment does not approve it. The developer who writes code does not push it to production unreviewed. Breaking the steps apart removes the one spot where a lone insider could act unchecked.
The payoff is fraud prevention and error catching, since a second set of hands has to sign off before anything becomes final. The tradeoff is friction and headcount, so most teams reserve strict SoD for genuinely high-risk workflows like financial approvals, privileged account changes, and production deployments. A common mistake is writing SoD into policy while quietly granting one administrator every role in practice, which collapses the control without anyone noticing.
How is separation of duties tested on the CISSP?
Expect scenario questions in Domain 1: Security and Risk Management, where SoD lives inside governance and preventive administrative controls. Know how it differs from dual control, in which two people must act together at the same moment, and be ready to spot which duties should never rest with a single role.