A.8.31 Separation of development, test and production environments
Separate and secure development, test and production environments.
16
artefacts
2
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Firewall rule set defining environment zones · Cloud console / configuration management
- Production deployment logs with timestamps · SIEM / log platform
periodic reviewEvidence produced at each review
- User access review records per environment · Identity provider / directory
- Change request records for moving code from dev to test · SIEM / log platform
governing documentDocuments that govern the control
- Development environment policy document · Policy repository / GRC workspace
- Test environment policy document · Policy repository / GRC workspace
- Production environment policy document · Policy repository / GRC workspace
- Environment segregation procedures manual · Policy repository / GRC workspace
- Logical network diagram showing separate VLANs for dev, test, and prod · Policy repository / GRC workspace
- Network segmentation implementation checklist · Policy repository / GRC workspace
- Segmented subnet allocation table · Policy repository / GRC workspace
- Role‑based access control matrix for dev, test, and prod systems · Policy repository / GRC workspace
- Privileged account list for each environment · Policy repository / GRC workspace
- Access request and approval forms · Policy repository / GRC workspace
- Rollback procedure documentation · Policy repository / GRC workspace
- Approval signatures for production releases · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Policies exist but are not enforced
- Shared credentials across environments
- Insufficient network isolation between zones
- Missing audit trails for environment changes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet