A.8.31 Audit Checklist

When to use this

Use this checklist when auditing separation of development, test, staging, and production environments.

Related controls

• A.8.31 Separation of Development Test and Production Environments
• A.8.31 Audit Evidence Pack

Audit checklist

• Environment inventory is documented.
• Access rights differ by environment.
• Production access is restricted and approved.
• Network and administrative paths are controlled.
• Shared identity/admin back ends are risk-assessed.
• CI/CD and release routes enforce change control.
• Production data in test is avoided or formally controlled.
• Non-production environments are secured according to risk.
• Users understand expected environment behavior.
• Evidence proves separation in configuration, not only diagrams.

Sampling record