AC-5 asks you to identify and document the duties of people that must be separated, and then define system access so the separation holds.
800-53 binds federal systems and, by contract, some suppliers. For everyone else it is a reference, and one auditors apply readily to engineering teams.
What it means in practice
The point, per the guidance, is to reduce the chance of abuse without collusion. That means dividing business and support functions among different individuals or roles, running system support with different people, and making sure people who administer access control do not also administer audit.
The guidance says enforcement runs through AC-2 account management, AC-3 access enforcement, and identity controls IA-2, IA-4 and IA-12.
Everyday examples: the person who writes a change does not approve it, and the person who grants admin rights cannot edit the logs of those grants.
Evidence to collect
- A documented list of conflicting duty pairs.
- The role design that keeps them apart.
- Branch protection or approval settings that block self approval.
- A review showing no one holds conflicting roles.
Common gaps
- One admin who holds every role in a small team.
- Self approved production changes.
- No compensating control when separation is impossible.
How to implement it
List the pairs that matter most: request and approve, deploy and approve, administer and audit. Enforce them in tooling. For tiny teams, add a compensating review by a second person or an outside party.
Quick check
Should access control admins also administer audit?
No. The guidance says security personnel who administer access control should not also administer audit functions.
Sources
- NIST SP 800-53 Rev 5, AC-5: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AC-5
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
