Section 9. Segregation Of Security Duties

Segregation of duties is required to reduce the risk of accidental or deliberate damage to the state or agency IT system through misuse by a person or persons. In small agencies in which separation of duties is difficult to achieve, with the approval of DoIT, the agency shall implement 1.12.20 NMAC 3 compensatory controls including, but not limited to, actively monitoring its IT operations, audit trails, and by regularly documented management supervision.