Test information

What the requirement asks

Information used for testing is to be chosen, protected and managed appropriately. Purpose: keep testing meaningful while protecting the operational information used in it. Guidance: choose test information that makes results reliable while keeping the related operational information confidential, and do not copy sensitive information, including PII, into development and test environments (8.31). When copies of operational information are used for testing, whether in-house or in a cloud service, control access to test environments exactly as for operational ones; require a separate authorization every time operational information is copied into a test environment; log the copying and use to create an audit trail; remove or mask sensitive information used in tests (8.11); and delete operational information from the test environment properly (8.10) as soon as testing ends so it cannot be misused. Store test information securely to prevent tampering that could invalidate results, and use it only for testing. Other information: system and acceptance testing may need large volumes of test data that resemble operational data as closely as possible. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Test information must be safe to use. The guidance asks for the source, the masking, the access and the disposal.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A test data procedure stating how test information is selected and prohibiting unprotected sensitive data in non-production and one live sample together.

Evidence an assessor asks for

• Test data managementA test data procedure stating how test information is selected and prohibiting unprotected sensitive data in non-production
• Test data managementAuthorization records for each copy of operational information into a test environment
• Test data managementLogs of copying and use of operational information in test environments
• Test data managementMasking or anonymization configuration applied to test data sets
• Test data managementDeletion records showing operational data removed from test environments after testing
• Test data managementAccess control configuration for test environments equivalent to production where operational data is present

The question an assessor will ask

An assessor will ask for A test data procedure stating how test information is selected and prohibiting unprotected sensitive data in non-production, then trace it to the system it protects. For A.8.33 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Full production databases are cloned into test environments routinely without approval
• Test environments hold personal data with far weaker access controls than production
• Copies of production data remain in test long after testing ends
• Masking is applied inconsistently, leaving identifiable fields

Before the next audit

Before the next audit, check one live sample for this gap: full production databases are cloned into test environments routinely without approval.