ISO/IEC 27001:2022 Annex A · Control 8.31

Separation of Development, Test and Production Environments: A Practical Implementation Guide

Separate environments to reduce unauthorized change, data exposure and accidental impact on production.

This control concerns separating development, testing and production environments and controlling movement between them.

Practical interpretation: Separation includes identities, networks, data, credentials, pipelines, administration and change paths—not only different server names.

What should the control achieve?

Environment boundaries and purposes are defined.
Production access and data are restricted.
Changes move through controlled pipelines.
Non-production compromise cannot easily reach production.

Step-by-step implementation

Define environment model

Document development, test, staging, production and management boundaries.

Separate access and credentials

Use distinct identities, secrets and authorization levels.

Segment networks and accounts

Separate cloud accounts, subscriptions or zones according to risk.

Control promotion

Move signed artifacts through pipelines rather than rebuilding manually.

Protect production data

Use synthetic or masked test information and approve exceptions.

Monitor boundary violations

Detect direct changes, shared secrets and unauthorized connectivity.

What this could look like in practice

Development and production use separate cloud accounts and credentials. The pipeline promotes the same tested artifact to production after approval. Developers have no standing production access, and test databases contain masked data.

Activity	Practical implementation	Evidence
Code promotion	Pipeline moves immutable artifact through stages.	Deployment log
Access	Production privilege is separate and time-limited.	PAM record
Test data	Masked subset supports realistic testing.	Masking record
Boundary check	Monitoring finds shared secrets or open routes.	Finding

Implementation evidence

Environment-separation standard
Architecture diagrams
Access matrices
Network controls
Pipeline configuration
Artifact records
Test-data controls
Boundary tests

Useful metrics

Direct production changes
Shared credentials across environments
Production data in non-production
Boundary findings

Common mistakes

Using separate names in one unrestricted account.
Rebuilding different artifacts per environment.
Copying production databases unmasked.
Giving developers permanent production access.
Sharing signing keys or secrets.

Questions an auditor may ask

How are environments separated?
How do changes reach production?
How is test data sourced?
Show a boundary violation check.

Implementation test: Attempt cross-environment access and direct production change, then verify enforcement, logging and approved promotion path.

Continue through Annex A

Explore the growing library of practical guides for all 93 Annex A controls.

Open the ISO 27001 Annex A Control Library

This independent educational guide paraphrases the practical intent of the control and does not replace the official ISO standards, professional advice or an organization-specific risk assessment. It is not affiliated with or endorsed by ISO.

ISO 27001 Annex A 8.31: Separation of Development, Test and Production Environments – Practical Implementation Guide