IAM users should not hold both service account admin and service account user roles

SOC 2

• CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity's objectives

PCI DSS v4.0

• 7.2.1: Access to system components and data is appropriately defined and assigned.
• 7.2.2: Access to system components and data is appropriately defined and assigned.
• 7.2.5: Access to system components and data is appropriately defined and assigned.
• 7.3.1: Access to system components and data is managed via an access control system(s).
• 7.3.3: Access to system components and data is managed via an access control system(s).

ISO/IEC 27001:2022

• A.5.3 Segregation of duties
• A.5.15 Access control
• A.5.18 Access rights
• A.8.2 Privileged access rights

NIS2 Directive (EU 2022/2555)

• 1 Policy on the security of network and information systems
• 3 Incident handling
• 6 Security in network and information systems acquisition, development and maintenance
• 11 Access control

NIST SP 800-53 Rev 5

• AC-5 Separation Of Duties
• AC-6: Least Privilege
• Access Enforcement (AC-3)
• Media Access (MP-2)

NIST Cybersecurity Framework v2.0

• GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
• GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
• PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization.
• PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions.
• PR.AA-05

CIS GCP Benchmark v3.0.0

• 1.8 Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users

CIS GCP Benchmark v4.0.0

• 1.8 Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users

BSI C5:2025

• HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
• IAM-01.01B The cloud service provider documents, communicates and makes available according to SP-01: - A role, rights and authorities concept based on role-based access control and the business and security requirements of the cloud service provider; and- A policy for managing user accounts and...
• IAM-06.01B Privileged access rights for internal and external employees as well as technical users of the cloud service provider are assigned and changed in accordance with the policy for managing user accounts and access rights (cf. IAM-01) or a separate specific policy.
• IAM-06.02B Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ('need-to-know principle').
• IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.

CIS GCP Benchmark v1.2.0

• 1.8 Ensure that Separation of duties is enforced while assigning service account related roles to users

CIS GCP Benchmark v1.3.0

• 1.8 Ensure that Separation of duties is enforced while assigning service account related roles to users

CIS GCP Benchmark v2.0.0

• 1.8 Ensure that Separation of duties is enforced while assigning service account related roles to users

HIPAA Security Rule 2003

• 164.308(a)(3)(i) Workforce security

NIST Cybersecurity Framework v1.0

• PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.