# Ownership And Controls Mapping

Named ownership, segregation of duties, and the controls that make a critical job auditable.

- A business-critical automation needs a named owner, documented trigger/inputs/outputs, data classification, and support posture.
- Segregation of duties requires distinct principals for request/approve/execute on sensitive actions (NIST SP 800-53 AC-5).
- Reconciliation, idempotency, rollback, and evidence retention are the controls that make a critical job auditable and recoverable.

## Sources

- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- https://csrc.nist.gov/glossary/term/separation_of_duty