Segregation of duties means that incompatible tasks do not lie with the same person, for example granting permissions and giving approvals (ISO/IEC 27001, Annex A 5.3). The access review confirms once a year that all people only have the permissions they need (Annex A 5.18). This article is aimed at ISMS managers and Tenant Admins.

Before you start

  • The page can be opened by people who may assign or edit functional roles; by default, the ISMS managers. Whoever may edit functional roles may complete the access review and set rules and the approver.
  • Varmo calculates conflicts from the current functional roles and the tasks in workflows, for example as reviewer role for risks or as approver. Tenant Admins count with their administration permissions plus their functional roles.
  • The feature is included in all plans.

Resolving or justifying conflicts

  1. Open ISMS settings › Organisation & roles › Segregation of duties & access review.
  2. Under Conflicts, you see for each person which rule they breach and which permissions or tasks are on each side.
  3. If possible, distribute the tasks across several people: Adjust functional roles takes you to the members. The conflict disappears as soon as the permissions are separated.
  4. If separation is not possible, for example because your organisation is too small, click Justify. Describe why separation is not possible and how the risk is mitigated, for example through a regular check by management. Save with Record exception.

With Withdraw, you withdraw a justification; the conflict is then open again.

Setting the approver

Justified exceptions are approved by a functional role, the Exception approver, usually top management. In the section of the same name, choose the functional role and click Save.

  • An exception applies immediately, but is marked “Approval pending” until it is approved.
  • Nobody approves their own exception (four-eyes principle). If the approver consists only of the person concerned, whoever assigns functional roles receives the task to add another person.

Completing the access review

  1. Check for each person whether their functional roles still match their tasks, and remove people who have left, see Inviting members and managing access.
  2. Under Access review, click Complete access review. The button is only active once all conflicts have been resolved or justified and all exceptions approved.
  3. Confirm with the tick box that each person only has the permissions they need, people who have left have been removed and the exceptions are still justified. Optionally, add a remark and click Complete.

Varmo records the date, person, number of reviewed members and justified exceptions as evidence.

What happens next

  • Open conflicts appear as the team task Segregation of duties: justify or resolve conflict for the people who assign functional roles.
  • The members of the approver receive the task Approve segregation of duties exception. They approve or reject with a justification under ISMS settings › Organisation & roles › Exceptions. A rejected exception reopens the conflict.
  • The access review is due annually. 30 days beforehand, the people who edit functional roles receive the task Review access rights.
  • Justified exceptions appear in the management review; top management consciously accepts them.

Frequently asked questions

There are only two of us. Is that a problem?

No. In small organisations, conflicts are normal. Justify them with your actual compensating measures, for example a check by a third party. An auditor will ask about exactly that. See also Regulating approvals with the four-eyes principle.

When is the first access review due?

Twelve months after your organisation started in Varmo, then twelve months after the last completed review.

Can I delete a fixed rule?

No, the predefined rules are fixed. You can delete custom rules.