ISO 27001 A.8.33: test data, explained for startups

A.8.33 Test information

Test environments never hold real customer data. What proves it: test environments use generated or masked data, never raw production data.

A certification auditor samples test data approach. A file that usually does the job: your test data seeding script or masking job, and the rule in the secure development policy.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.8.33 walks you through it in this order.

1. Use generated test data, or a masking step that strips personal details.
2. Block copies of production data into test.
3. Check test databases for real data.

The free ISO 27001 readiness assessment asks one question that evidences it:

• What data do your test environments use?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Secure Development and Change Management Policy covers A.8.33. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC8.1, change management.

Technological controls

A.8.33 is one of the 34 technological controls in Annex A. The controls built into your systems: access, devices, malware, vulnerabilities, backups, logging, networks, encryption and secure development. Exports and settings screenshots prove most of them.

Nearby controls in the same theme:

• A.8.30, outsourced development
• A.8.31, separate environments
• A.8.32, change management
• A.8.34, audits on live systems

Before it: A.8.32, change management. After it: A.8.34, audits on live systems. Every control, by theme, is on the Annex A controls page.