Which statement reflects proper separation of duties for handling production data?

Which statement reflects proper separation of duties for handling production data?

• A. Development staff should have access to production data
• B. End users should have access to production data only within their normal duties
• C. Programmers should be server administrators
• D. IT and business departments should be completely separated

Answer: (B)

Separation of duties in handling production data means no single person should control both the data and the processes that affect it. Access must align with a person’s role and need-to-know, so only those who truly need production data as part of their normal duties can interact with it. This minimizes risks of exposure, errors, or misuse and supports accountability through traceable actions. The option that aligns with this principle says end users should have access to production data only within their normal duties—that is, access is granted strictly as part of their job responsibilities. This implements the least-privilege approach and keeps production data protected from roles that don’t need it. Why other ideas fall short: giving development staff access to production data breaks the separation between development and operations and heightens the risk of improper changes or data exposure. Making programmers server administrators blends development with administrative control, increasing potential for unintended or unauthorized actions. The notion of IT and business being completely separated is impractical for daily operations and doesn’t specify how data access is limited to those who truly need it in their roles.

Separation of duties in handling production data means no single person should control both the data and the processes that affect it. Access must align with a person’s role and need-to-know, so only those who truly need production data as part of their normal duties can interact with it. This minimizes risks of exposure, errors, or misuse and supports accountability through traceable actions.

The option that aligns with this principle says end users should have access to production data only within their normal duties—that is, access is granted strictly as part of their job responsibilities. This implements the least-privilege approach and keeps production data protected from roles that don’t need it.

Why other ideas fall short: giving development staff access to production data breaks the separation between development and operations and heightens the risk of improper changes or data exposure. Making programmers server administrators blends development with administrative control, increasing potential for unintended or unauthorized actions. The notion of IT and business being completely separated is impractical for daily operations and doesn’t specify how data access is limited to those who truly need it in their roles.