Key takeaways
- Choose, protect and manage test data appropriately.
- Test data can leak sensitive information if not handled carefully.
- Start here: prefer synthetic or masked data for testing.
Purpose
Choose, protect and manage test data appropriately.
Requirement
Requirement summaryTest information shall be appropriately selected, protected and managed.
Why it matters
Test data can leak sensitive information if not handled carefully.
How to implement
- Prefer synthetic or masked data for testing.
- Approve and protect any production data used.
- Delete test data after use.
- Record use of real data.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.33. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for choosing and protecting test data.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.33 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Approvals for any use of real data in testing.
- Records showing test data was removed when no longer needed.
- Settings restricting access to test data.
Things you should be able to show or explain
- Be able to explain where test data comes from.
How much to show: Your current test data sources.
Common mistakes
- Real personal data copied into testing without approval.
- Test data never cleaned up.
- Copying full production databases to test.
- Test data never deleted.
- Tip: Prefer synthetic data over real customer data.
Policies & documents to have
- Data Management Policy
- Secure Development Policy
FAQ
Is A.8.33 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.33?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for choosing and protecting test data…