Separation of Development, Test and Production Environments - ISO 27001 Annex A Control
ISO 27001 Annex A 8.31
Mixing environments mixes risks - keep them separate or accept the consequences.
ISO 27001 Annex A 8.31 - Separation of Development, Test and Production Environments
Mixing environments mixes risks. Development environments where engineers iterate need flexibility that would be unsafe in production. Test environments need realistic data and configurations but should not affect real customers. Production environments need stability and tight change control. The control asks for these to be separated and secured according to their distinct needs.
Practical separation typically involves separate infrastructure (different servers, networks, cloud accounts), separate access controls (different identity populations and permission levels), separate data (test data should not be production data unless masked), and separate change paths (production changes go through a controlled pipeline rather than ad-hoc deployment).
Modern development with infrastructure as code makes environment parity easier - the same definitions create development, test and production environments with controlled differences. Container and microservice architectures increase the number of environments managed but maintain the separation principle. The technical mechanisms have evolved; the underlying control remains the same.
Test environments containing real production data is the separation issue I see most often. The justification is realistic testing, the consequence is a test environment with production-level sensitivity but development-level access controls. The fix is masked or synthetic data under A.8.11, with real production data only where there is a specific, controlled exception.
Practical Compliance Guidance
Environment separation is described in the IMS1 manual at section 8.3 on IT equipment alongside the wider development arrangements. Infrastructure documentation and access records provide the operational evidence.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| PP-8-100 Information Security Policy Procedure | Contains the Information Security Policy including the separation requirements between development, test and production. Use as the source for the environment baseline. |
Note - all the above files can be downloaded with an alphaZ subscription.
