Which of the following is a recommended separation of duties control in information systems?

• A. Programmers should have unsupervised access to production programs
• B. IT personnel should have unlimited access to production data
• C. Developers should not have access to production data
• D. End users should have unrestricted access to production data

Answer: (C)

Separation of duties and least privilege are the ideas behind controlling access to production systems. The goal is to ensure that no single person has both the ability to modify software and access live data, which helps prevent fraud, mistakes, and data breaches.

The recommended approach is that developers should not have access to production data. They work in separate environments for development and testing, while production access is restricted to authorized personnel who handle operations and change management, with proper approvals, monitoring, and audit trails. This creates checks and oversight in how code is deployed and how data is used.

Options that give programmers unsupervised access to production, grant unlimited production data access to IT staff, or give end users unrestricted data access all break the principle of least privilege and undermine safeguards against misuse and exposure.