A security engineer is attempting to convey the importance of including job rotation in a company's standard security policies. Which of the following would be the BEST justification?

Question

Options

• AMaking employees rotate through jobs ensures succession plans can be implemented and
• BForcing different people to perform the same job minimizes the amount of time malicious actions
• CAdministrators and engineers who perform multiple job functions throughout the day benefit from
• DIt eliminates the need to share administrative account passwords because employees gain

• A
  3% (1)
• B
  89% (32)
• C
  6% (2)
• D
  3% (1)

Explanation

Job rotation is a preventive and detective security control primarily aimed at reducing insider threat risk. When a different employee periodically takes over a role, any fraudulent or malicious activity - such as falsifying records, embezzlement, or unauthorized access - is more likely to be discovered by the incoming person. This limits the window of time during which a bad actor can operate undetected before a handover exposes the irregularity. This is the foundational security rationale for job rotation and is widely cited in frameworks like NIST and ISO 27001. Option A (succession planning) is an HR/business continuity benefit, not a security justification. Option C (administrator benefit) is a productivity argument, not a security one. Option D (eliminating password sharing) is not directly related to job rotation - that concern is better addressed by individual account provisioning.

No community discussion yet for this question.