Segregation of duties (SoD)
Rights that may not go together, no longer do
Whoever creates invoices does not approve them too. You record once which access may not go together, and Joinly holds a new conflict until someone chooses. Existing access stays in place, and every choice is in the audit log.
No credit card, nothing to install. Talk to an IAM specialist
- ISO 27001-certified
- Certified by AFAS
- Data in Amsterdam
Two separate tasks, together an open door
One person can create invoices and approve them as well. Or someone places orders and confirms receipt of them. On paper these are separate tasks; together, nobody is left to be the second pair of eyes.
Such combinations build up: a role change here, an import there. Usually segregation of duties lives in a spreadsheet nobody maintains, and a check afterwards finds the conflict weeks later. For the auditor it is a finding every time.
How it works
From rule to evidence, without work grinding to a halt
Step 1
Record what may not go together
You choose two access items that may not go together, for example entering payments and approving payments. Once, and the rule works both ways.
It is almost always about money, data or administration.
Step 2
A new conflict waits for a choice
If someone gets the second half, through a role, a request or an import, Joinly prepares that access without releasing it. Whatever is allowed simply goes ahead.
Step 3
Choose who keeps what
You choose which right stays, with a reason. If someone changes jobs and the conflict disappears, the access sorts itself out. A conflict can also start a workflow that alerts the manager or asks for approval.
Step 4
Show what was decided
Every choice and every change is in the audit log: who, what, when and why. That way you answer the auditor's question with evidence that is already there.
What it delivers
For finance and control
A payment takes two people again
Whoever enters something does not approve it themselves. The combination no longer arises, not even after a change of job or an import.
For IT
Work does not stop
Existing access stays in place and only a new conflict waits for a choice. Nobody loses access they need.
For the auditor
Segregation of duties you can demonstrate
For each conflict it is on record who chose and why. That is what ISO 27001, NEN 7510 and the accountant ask for.
Ask away
Frequently asked questions about segregation of duties
What does SoD mean?
Segregation of duties: tasks that together make misuse or mistakes possible are held by different people.
Does anyone lose access they need?
No. What is allowed goes ahead. Only a new conflicting request waits for a choice.
Which combinations are usually recorded?
Creating a supplier and approving the payment to it, entering payroll changes and authorising them, approving your own access request, and holding admin rights on the logging you check yourself.
Which standards ask for segregation of duties?
Among others ISO 27001, NEN 7510, the BIO and NIS2, and the accountant during the annual audit.
And if a combination is needed after all?
In a small department that can happen. Then you deliberately choose that someone keeps both, with a reason. That choice is in the audit log, and you put a check against it, such as a review afterwards.
Can I show how a conflict was resolved?
Yes. You can always show who made which choice and why.
More of the product
- Lifecycle managementJoiners, movers and leavers from HR
- WorkflowsThe right steps for every change
- Roles and RBACAccess that follows the job
- Role miningRoles from the access that is there
- Authorisation matrixAlways current, exportable
- Logging and auditingWho, what, when and why
- Application integrationsAccounts in every application
- SCIM gatewayOne standard for provisioning
- Active DirectoryOn-premises and hybrid
Try segregation of duties yourself
In your free trial environment you see with demo data what happens when someone gets rights that may not go together.
No credit card, nothing to install.
Rather talk to someone first? Talk to an IAM specialist