Control A.8.31Separation of development, test and production environments
Development, testing and production environments must be separated and secured.
Separation protects production from the instability of development and protects development from holding production’s data. Both directions matter, and the second is the one that leaks.
“Separated” means more than differently named: distinct credentials and access rights, distinct infrastructure or genuine isolation, and controlled promotion between them. Shared administrative accounts across environments dissolve the separation while leaving its appearance intact.
The tooling that spans environments — pipelines, deployment agents, monitoring, service accounts — is where separation usually breaks, because it needs access to all of them by design and is rarely treated as the privileged path it is.
The related discipline is A.8.33: separation is what makes it possible to keep production data out of test, and copying production data into a test environment defeats the control however well the environments are otherwise isolated.
How to put this in place
Mixing development, test and production lets mistakes and unfinished code reach live data. Your ISMS needs separated environments, so experiments cannot harm production and developers do not have standing access to it.
- Decide the environments you need and how they are separated, for example by account or subscription.
- Use separate credentials for each.
- Restrict production access and grant it only when needed.
- Move changes to production only through the release process.
- Check after each release that nobody keeps standing production access they no longer need.
Evidence an auditor usually looks for: environment design, access lists showing the separation, and release records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.