What evidence do auditors commonly ask for on A.3.31 Test information?

Test data policy prohibiting PII in testing and providing synthetic or false data; Where PII is used in testing, evidence of production-equivalent measures or a risk assessment and the controls selected; Records of test environment data provisioning.

What is the most common gap auditors find on A.3.31?

Production copies used for testing with weaker access control

ISO/IEC 27701:2025 · Annex A Table A.3 information security controls with PII-specific guidance

`A.3.31` Test information

Real PII shall not serve as test data; the organization shall use invented or synthetic personal data in its place. If testing with genuine PII is unavoidable, the test environment shall carry technical and organizational safeguards matching those of production so the risk is reduced, and where matching safeguards cannot be achieved, the organization shall carry out a risk assessment and choose suitable mitigating controls from its results.

Source: ISO/IEC 27701:2025, A.3.31. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.

artefacts

held by a system

at each review

moderate

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Records of test environment data provisioning · Identity provider / directory

periodic reviewEvidence produced at each review

Where PII is used in testing, evidence of production-equivalent measures or a risk assessment and the controls selected · Policy repository / GRC workspace

governing documentDocuments that govern the control

Test data policy prohibiting PII in testing and providing synthetic or false data · Policy repository / GRC workspace

First move

Start with the 1 of 3 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Production copies used for testing with weaker access control
Exception granted once and never re-assessed

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

A.3.30 Outsourced development