OIS · Organisation of Information Security
OIS-04 Segregation of Duties
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Extended area to be covered by the risk assessment by the cloud service provider's risk management.
Added aspects on which the role, rights and authorities concept (previously: rights profiles, approval and assignment of access and access authorisations) are to be based.
Further qualified the compensating controls to be operated in case a segregation of duties cannot be implemented.
Added requirement to maintain an inventory of conflicting tasks and responsibilities.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
Conflicting tasks and responsibilities are separated based on an OIS-06 risk assessment to reduce the risk of unauthorised or unintended changes or misuse of cloud customer data processed, stored or transmitted in the cloud service.
The risk assessment covers the following areas, insofar as these are applicable to the provision of the Cloud Service and are in the area of responsibility of the Cloud Service Provider:
- Administration of rights profiles, approval and assignment of access and access authorisations (cf. IDM-01);
- Development, testing and release of changes (cf. DEV-01); and
- Operation of the system components.
If separation cannot be established for organisational or technical reasons, measures are in place to monitor the activities in order to detect unauthorised or unintended changes as well as misuse and to take appropriate actions.
Basic criterion
Conflicting tasks and responsibilities are segregated based on a risk assessment in accordance with OIS-07 to reduce the risk of unauthorised or unintended changes or misuse of cloud service customer data, cloud service derived data and cloud service provider data. The risk assessment covers the following areas, insofar as these are applicable to the provision of the cloud service and are in the area of responsibility of the cloud service provider:
- Administration of a role, rights and authorisation framework based on role-based access control and the business and security requirements of the cloud service provider (cf. IAM-01);
- Development, testing and release of changes (cf. DEV-01);
- Risk management (cf. OIS-07); and
- Operation of the system components.
Supplementary information
Identified events that may constitute unauthorised or unintentional changes to or misuse of cloud service customer data, cloud service derived data and cloud service provider data may, for example, be treated as a security incident, cf. SIM-01.
The area of risk management in the context of segregation of duties refers to the so-called different lines of defense, i.e. roles that review risks (2nd line of defense) are different from roles that own risks (1st line of defense).
Mitigating measures are outlined in the risk treatment plan (cf. OIS-09) and implemented by the cloud service provider in a way that prioritises the segregation of duties.
If segregation of duties cannot be implemented due to organisational or technical constraints, the cloud service provider establishes and operates compensating controls to monitor relevant activities. These controls are designed to detect unauthorised or unintended changes, misuse of data, or violations of operational policies, and enable timely and appropriate response actions.
An inventory consisting of conflicting tasks, responsibilities and resolving measures is established and maintained by the cloud service provider. For the assignment, change or revocation of roles, rights and authorities, the cloud service provider enforces the segregation of duties.
Additional criterion
OIS-04.01AC
Additional, complementingTo resolve conflicting roles, measures associated with the segregation of duties are monitored and enforced by the cloud service provider.
OIS-04.02AC
Additional, complementingTimely and appropriate remediation measures address any deviations identified during monitoring.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources