CMMC Practice Requirement:

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

CMMC Requirement Explanation:

Without the separation of duties security controls can easily be bypassed. By separating duties between individuals you can reduce the risk of malevolent activity.

Example CMMC Implementation:

Do not allow one person to be in charge of an entire critical task. Assign parts of the critical task to different persons.


- Scenario 1:

Alice handles the creation of user accounts and the assignment of account privileges. Your company periodically audits user accounts and their privileges. Instead of letting Alice do this you separate duties by assigning the auditing task to another employee.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance