Two members of the finance department have access to sensitive information. The company is concerned they may work together to steal information. Which of the following controls could be implemented…

Least privilege limits what an individual can access but does not detect or reveal collusion between two users who each legitimately hold their own access.

Separation of duties prevents a single person from completing a sensitive task alone, but if two colluding users each hold separate duties they can still cooperate to commit fraud.

Mandatory access control enforces access based on sensitivity labels, which restricts access but does not reveal or detect collusion between already-authorized users.

When employees are required to take vacations, a substitute must perform their duties, making it difficult to hide ongoing fraud or collusion because the cover-up mechanisms are temporarily removed. This control is specifically designed to detect fraud between colluding parties who depend on continuous presence to conceal activity.