ISO 27001 A.8.31 - Separation of Development Test and Production Environments

Requirement

“Development, testing and production environments shall be separated and secured.”

Plain-language meaning

Developers need places to build and test. Production needs stability, integrity, and controlled access. These environments should not be casually mixed.

The organization should prevent test code, development tools, experimental configuration, or weak test controls from affecting live services. If production data is used outside production, the test environment must protect it properly.

Why this matters

Development and test environments often have weaker controls, more debugging access, incomplete monitoring, unstable code, and experimental settings. If they are connected too loosely to production, they can become a route into live systems or leak sensitive data.

The risk increases when production data is copied into test, when administrators share back-end services across environments, or when developers can deploy directly to production.

Implementation guidance

1. Define environment classes

Document development, test, staging, pre-production, production, support, and sandbox environments. Define the purpose, owner, data classification, access model, connectivity, logging, and change route for each.

2. Separate access and identities

Use separate access controls, roles, accounts, credentials, and approval routes where risk justifies it. Production access should be more restrictive than development or test access.

3. Control connectivity

Restrict network paths, shared services, management networks, CI/CD pipelines, administrative back ends, and database links between environments. Shared identity or admin platforms should be risk-assessed.

4. Protect production data

Avoid using sensitive production data in test. Where it is necessary and justified, apply masking, pseudonymisation, access restrictions, logging, and controls at least equivalent to the sensitivity of the data.

5. Use change control for promotion

Tested and verified solutions should move into production through controlled change and release processes. Developers should not bypass change control by manually modifying production.

6. Secure each environment

Development and test systems still need security baselines, access review, patching, logging, malware protection, configuration control, and vulnerability management appropriate to their risk.

Audit guidance

Auditors should verify:

• development, test, and production environments are documented;
• separation is implemented through access, network, infrastructure, and process controls;
• untested software cannot be used in production without authorization;
• promotion into production follows change control;
• shared administration or identity services are risk-assessed;
• test environments with sensitive data have controls appropriate to that data;
• users of the environments understand expected behavior;
• background checks or special controls are considered for staff with access to secure development environments where risk justifies it.

Evidence examples

Strong evidence

• Separate access roles exist for dev, test, and production.
• Production deployment requires approval and release controls.
• Test data is masked or formally approved with compensating controls.
• Environment connectivity is documented and technically restricted.
• Shared admin back ends are reviewed as part of the risk assessment.
• Developers and testers understand environment rules.

Weak evidence

• Environment names exist but access is shared.
• Developers have standing production admin access.
• Production data is copied into test without masking or approval.
• No evidence of deployment approval exists.
• Test systems are unmanaged because “they are not production.”
• Shared admin networks or identity services are ignored.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.9 Configuration Management
• A.8.15 Logging
• A.8.19 Installation of Software on Operational Systems
• A.8.25 Secure Development Life Cycle
• A.8.28 Secure Coding
• A.8.29 Security Testing in Development and Acceptance
• A.8.30 Outsourced Development
• A.8.11 Data Masking
• A.5.37 Documented Operating Procedures
• Risk Assessment
• Statement of Applicability
• Development Test Production Separation Checklist
• Test Data Security Approval Record
• A.8.31 Audit Evidence Pack
• A.8.31 Audit Checklist

KB-ready summary

• Document each environment and its purpose.
• Separate access, roles, credentials, and network paths.
• Restrict production deployments through change control.
• Avoid production data in test unless justified and protected.
• Secure development and test systems according to risk.
• Review shared administration and CI/CD paths.

Templates and checklists

• Development Environment Separation Standard
• Development Test Production Separation Checklist
• Test Data Security Approval Record
• A.8.31 Audit Checklist