Control A.8.33Test information
Test information must be appropriately selected, protected and managed.
The control that addresses one of the most widespread practices in software delivery: copying production data into non-production environments because it is realistic and convenient.
The problem is that the copy carries the sensitivity and rarely the protection. Test environments have broader access, weaker monitoring, and more people in them — often including suppliers under A.8.30.
Selected is the first verb for a reason: the question is what test information is actually needed. Synthetic data, subsets, or data masked under A.8.11 usually meet the need, and where a genuine production copy is unavoidable it has to carry production’s controls, with authorisation, a record, and deletion under A.8.10 when the work is done.
For personal data, the constraint is not only this control. Using production personal data for testing engages purpose limitation under data protection law, which A.5.34 brings into scope.
How to put this in place
Test environments tend to have weaker protection than production, so real data copied there is at risk. Your ISMS needs test data that is synthetic or masked by default, with tight rules for any exception.
- Decide that synthetic or masked data is the default for testing.
- Provide a way to generate or mask data that teams can use easily.
- Require approval for any use of live data, with a named owner.
- Protect that test environment to the same level as production.
- Delete the data after use and record it.
Evidence an auditor usually looks for: test data rules, approvals for any use of live data, and deletion records.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.