DEV-10 Separation of environments
Keep production environments physically or logically apart from development and test environments to prevent unauthorised access to customer data, malware spread and unintended component changes, and do not use productio
4
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Scan or review results showing non-production stores hold no live customer content · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Environment inventory marking the boundary between production and non-production · Policy repository / GRC workspace
- Access and network controls stopping non-production systems from reaching production · Policy repository / GRC workspace
- Method for producing test data by anonymisation or synthesis · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Production copies loaded into test systems to reproduce a defect and then left in place
- Accounts and credentials that span both production and development estates
- Separation claimed logically while both estates share one platform with no enforcing control
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDEV-09 Approvals for provision in the production environment · HR-01 Verification of qualification and trustworthiness