Dual Control
What is Dual Control?
A security procedure requiring two authorized individuals to perform a critical action simultaneously, preventing any single person from acting alone.
Frameworks that govern dual control
What the standards actually require on dual control
Requirements naming dual control across 6 standards, quoted from the control text.
At the ACS and DS, physical access to HSMs is limited to authorised personnel and handled under dual control. The assessor examines the procedures and observes the access controls.
pci-3ds-core-security-standard::P2-6.3.2 · P2-6.3.2 Physical HSM access restricted and under dual control →Where staff perform manual key-management operations involving cleartext keys, key-management policies and procedures must be in place under which those operations are run with dual control and split knowledge.
3.7.6 · 3.7.6 Split knowledge and dual control for manual key operations →Decommissioning an HSM's critical processes, such as invoking the system menu, requires dual control.
pci-pin-security::31-1.1 · PCI PIN 31-1.1 →Keys loaded from individual components or shares are loaded under dual control and split knowledge, whether the media are paper, smart cards or other tokens.
pci-p2pe::12-1 · PCI P2PE 12-1 →Development personnel design, build and maintain solutions to business problems, with roles separated in larger entities and overlapping in smaller ones only where mitigating controls exist, segregation of development and implementation duties so developers ca...
ffiec-it-examination-handbook::DAM-II.B.3 · II.B.3 Development Roles (Development, Acquisition, and Maintenance) →The bank has an internal control framework, the responsibility of the board and senior management, that keeps an effectively controlled and tested operating environment for its risk profile with a forward-looking view (including climate-related and emerging ri...
basel-core-principles-for-effective-banking-supervision-2024::P26 · Principle 26: internal control and audit →Questions people ask about dual control
What is Dual Control?
Why is Dual Control important for compliance?
Which compliance frameworks address Dual Control?
Where can I learn more about Dual Control?
See how Dual Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.