AC-05: Separation of Duties

[kniz-raft]

AC:

• Control implementation statement has been reviewed by Raft for technical accuracy
• Control implementation statement has passed QASP review

DoD:

• Control implementation statement has been documented in GitHub

Control Description:
The organization:
a. Separates [at a minimum, data creation and control, software development and maintenance, and security functions];
b. Documents separation of duties of individuals; and
c. Defines information system access authorizations to support separation of duties.

[rnafarrete]

• Updated AC-05 with feedback from the team
• will need to create a separate branch before creating the pull request.

[rnafarrete]

Updated based on comments/feedback from team.