Key takeaways
- Keep development, test and production environments apart and secured.
- Mixing development and production risks accidental changes and data exposure.
- Start here: separate development, test and production environments.
Purpose
Keep development, test and production environments apart and secured.
Requirement
Requirement summaryDevelopment, testing and production environments shall be separated and secured.
Why it matters
Mixing development and production risks accidental changes and data exposure.
How to implement
- Separate development, test and production environments.
- Restrict who can access production.
- Avoid using live data in lower environments.
- Control promotion between environments.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.31. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for keeping development, test and live (production) systems separate.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.31 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Access lists showing who can reach the live environment.
- A diagram or description showing separate environments.
- Approvals for any developer access to live systems.
Things you should be able to show or explain
- Be able to show the separation in practice.
How much to show: Access to live systems.
Common mistakes
- Developers have everyday access to live systems.
- Test data mixed into live systems.
- Developers testing directly in production.
- Production credentials used in test.
- Tip: Different credentials per environment.
Policies & documents to have
- Operations Security Policy
- Secure Development Policy
FAQ
Is A.8.31 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.31?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for keeping development, test and live (production) systems separate…