(ISC)2 Certified in Cybersecurity Practice Exam

Which is a primary objective of implementing segregation of duties within an organization?

1. Enhancing User Experience

2. Minimizing Insider Threats

3. Improving System Performance

4. Reducing Operational Costs

The correct answer is: Minimizing Insider Threats

The primary objective of implementing segregation of duties is to minimize insider threats. This principle involves dividing responsibilities among different individuals to decrease the risk of fraud and errors. By ensuring that no single individual has control over all aspects of any critical transaction or process, an organization can create checks and balances. For instance, separating the duties of individuals who handle approval, processing, and auditing tasks means that collusion or abuse of power is less likely to occur, thereby protecting sensitive data and resources. Segregation of duties is a fundamental concept in risk management and internal controls, as it significantly limits the opportunities for individuals to conduct unauthorized actions without detection. This practice also enhances auditability and accountability, contributing to a more secure environment. In contrast, enhancing user experience, improving system performance, and reducing operational costs, while essential organizational goals, are not the primary purpose of segregation of duties. Rather these objectives may improve as a secondary effect of a more secure and controlled operational environment.