CISA · Question #604
Which of the following is the BEST compensating control against separation of duties conflicts in new code development?
The correct answer is A. Post-implementation change review. When developers have conflicting access in the code development process (e.g., they can both write and deploy code), a post-implementation change review by an independent party is the best compensating control. It provides detective oversight after the fact, ensuring that all…
Question
Which of the following is the BEST compensating control against separation of duties conflicts in new code development?
Options
- APost-implementation change review
- BAdding the developers to the change approval board
- CCreation of staging environments
- DA small number of people have access to deploy code
How the community answered
(28 responses)- A79% (22)
- B11% (3)
- C7% (2)
- D4% (1)
Explanation
When developers have conflicting access in the code development process (e.g., they can both write and deploy code), a post-implementation change review by an independent party is the best compensating control. It provides detective oversight after the fact, ensuring that all deployed changes were authorized and did not introduce unauthorized modifications. Adding developers to the change approval board (B) worsens the SoD conflict rather than compensating for it. Staging environments (C) support testing quality, not SoD. Having a small number of people deploy code (D) concentrates privilege but does not resolve the SoD conflict - it may even make it worse.
Topics
Community Discussion
No community discussion yet for this question.