8.33 Test information
Information used for testing is to be chosen, protected and managed appropriately. Purpose: keep testing meaningful while protecting the operational information used in it. Guidance: choose test information that makes results reliable while keeping the related operational information confidential, and do not copy sensitive information, including PII, into development and test environments (8.31). When copies of operational information are used for testing, whether in-house or in a cloud service, control access to test environments exactly as for operational ones; require a separate authorization every time operational information is copied into a test environment; log the copying and use to create an audit trail; remove or mask sensitive information used in tests (8.11); and delete operational information from the test environment properly (8.10) as soon as testing ends so it cannot be misused. Store test information securely to prevent tampering that could invalidate results, and use it only for testing. Other information: system and acceptance testing may need large volumes of test data that resemble operational data as closely as possible.
Source: ISO/IEC 27002:2022, 8.33. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Logs of copying and use of operational information in test environments · SIEM / log platform
- Masking or anonymization configuration applied to test data sets · Cloud console / configuration management
- Access control configuration for test environments equivalent to production where operational data is present · Identity provider / directory
periodic reviewEvidence produced at each review
- Authorization records for each copy of operational information into a test environment · Cloud console / configuration management
- Deletion records showing operational data removed from test environments after testing · Cloud console / configuration management
governing documentDocuments that govern the control
- A test data procedure stating how test information is selected and prohibiting unprotected sensitive data in non-production · Policy repository / GRC workspace
First move
Common gaps auditors find
- Full production databases are cloned into test environments routinely without approval
- Test environments hold personal data with far weaker access controls than production
- Copies of production data remain in test long after testing ends
- Masking is applied inconsistently, leaving identifiable fields
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.32 Change management · 8.34 Protection of information systems during audit testing