Just a bit of color to other replies here. Financial industries of course have audits and those audits require controls to be written. Controls can have human /

Just a bit of color to other replies here. Financial industries of course have audits and those audits require controls to be written. Controls can have human / organizational solutions as well as technical solutions and they'll ask for proof that these controls are followed. Figure out how to write a control and prove it to the auditors that it's followed and adheres to both of these, then I guess you're golden. Probably easier said than done. FFIEC audit handbook excerpts for "Segregation of Duties" [1] and "Principle of least privilege" [2] [1] https://ithandbook.ffiec.gov/it-booklets/information-security/ii-information-security-program-management/iic-risk-mitigation/iic7-user-security-controls/iic7(c)-segregation-of-duties.aspx https://ithandbook.ffiec.gov/it-booklets/information-securit... [2] https://ithandbook.ffiec.gov/it-booklets/information-security/ii-information-security-program-management/iic-risk-mitigation/iic7-user-security-controls/iic7(b)-user-access-program.aspx https://ithandbook.ffiec.gov/it-booklets/information-securit...