What is the purpose of Segregation of Duties (SoD) between development/test and production environments?

What is the purpose of Segregation of Duties (SoD) between development/test and production environments?

• A. SoD ensures different personnel manage development/test and production, reducing risk.
• B. SoD requires the same person to manage both.
• C. SoD is unrelated to environments.
• D. SoD requires using production data for testing.

Answer: (A)

Segregation of Duties between development/test and production focuses on preventing changes from being moved into live systems without proper checks. By having different people manage the development/testing environments and the production environment, there are built-in checks and balances that reduce the risk of errors, fraud, or unauthorized modifications making it into production. In practice, development and testing work is kept separate from production, and any code or configuration changes that are to go live must pass through a formal change-management process with appropriate reviews, testing, and approvals before deployment. This separation creates accountability and traceability for every change, since different roles oversee creation, testing, and deployment. The other options contradict this protective model or address separate concerns (such as using production data for testing), which do not fulfill the purpose of SoD.

Segregation of Duties between development/test and production focuses on preventing changes from being moved into live systems without proper checks. By having different people manage the development/testing environments and the production environment, there are built-in checks and balances that reduce the risk of errors, fraud, or unauthorized modifications making it into production. In practice, development and testing work is kept separate from production, and any code or configuration changes that are to go live must pass through a formal change-management process with appropriate reviews, testing, and approvals before deployment. This separation creates accountability and traceability for every change, since different roles oversee creation, testing, and deployment. The other options contradict this protective model or address separate concerns (such as using production data for testing), which do not fulfill the purpose of SoD.