Explains segregation of duties
The person who approves or checks is not the one who performs or authored the work (ISO/IEC 27002:2022, 5.3).
Can AI do this?
AI does this well Most of the tested AI models master this. 3 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 100% | Mastered |
| gemini-3.5-flash-lite | Low cost | 99% | Not shown |
| gpt-6-luna | Low cost | 100% | Mastered |
| claude-haiku-5-5 | Low cost | 100% | Mastered |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: The person who approves or checks is not the one who performs or authored the work (ISO/IEC 27002:2022, 5.3).
How it is assessed: Answers a written question on the segregation of duties correctly
Related knobits
Needed for
- G-214 Recognises approval and implementation in one person
- G-411 Recognises a control in self-review
- S-302 Recognises a toxic combination in one role
- S-303 Recognises a toxic combination across a job's roles
- S-331 Splits a toxic combination into separate roles
- S-502 Recognises an access recertification by the holder
All 26 knobits of Design the governance operating model and stewardship.
Source: Practice the stage 2 reference and review checklist rest on