ISO 27001:2022 Annex A Control 8.31

General Guidance on ISO 27001:2022 Annex A 8.31 Compliance

Organisations should consider the production issues that should be avoided when deciding on the necessary degree of separation between the three environments.

Annex A 8.31 suggests organisations bear in mind seven criteria:

1. Segregation of development and production systems to a satisfactory level is recommended. For instance, utilising distinct virtual and physical environments for production could be a viable solution.
2. Rules and authorisation procedures must be drafted, documented and implemented regarding the use of software in the production environment after it has passed through the development environment.
3. Organisations should evaluate and trial alterations to applications and production systems in an isolated test setting, excluded from the production environment, prior to implementing them in the production environment.
4. No testing in production environments should occur unless it has been precisely defined and authorised beforehand.
5. Development resources, such as compilers and editors, should not be available in production environments unless it is absolutely essential.
6. To reduce mistakes, correct environment labels should be prominently featured in menus.
7. No sensitive information assets should be transferred into any dev or testing systems unless equivalent security measures are in place.

Guidance on Protection of Development and Testing Environments

Organisations should safeguard development and testing environments from potential security hazards, considering the following:

• Ensure all development, integration and testing tools, e.g. builders, integrators and libraries, are regularly patched and kept up to date.
• Ensure all systems and software are securely set up.
• Appropriate controls must be in place for access to environments.
• Changes to environments and their codes should be monitored and reviewed.
• Secure monitoring and review of environments should be undertaken.
• Environments should be safeguarded with backups.

No individual should be granted the prerogative to make changes to both development and production environments without obtaining approval beforehand. To avoid this, organisations can separate access rights or put in place and execute access controls.

Organisations can contemplate further technical controls, such as logging all access activities and monitoring access to these environments in real-time.

Supplementary Guidance on Annex A 8.31

If organisations do not take the necessary steps, their information systems can be exposed to substantial security hazards.

Developers and testers with access to the production environment may make unintended alterations to files or system settings, run unauthorised code, or inadvertently reveal sensitive data.

Organisations require a steady setting to perform thorough testing on their code, barring developers from accessing production environments that store and process sensitive real-world data.

Organisations should assign specific roles and enforce separation of duties.

The development and testing teams can risk compromising the confidential production data if using the same computing devices. Inadvertent changes to sensitive information or software programs may be made.

Organisations are urged to set up aiding processes to use production data in testing and development systems in agreement with ISO 27001:2022 Annex A 8.33.

Organisations should consider the measures discussed in this Annex A Control when carrying out end-user training in training settings.

Lastly, organisations can obscure the boundaries between development, testing and production settings. For instance, testing may be conducted in a development environment, or staff may test the product by actually using it.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.31 replaces ISO 27001:2013 Annex A 12.1.4 and ISO 27001:2013 Annex A 14.2.6. This revision makes the necessary adjustments to bring the standard in line with the most current practices.

The two versions share a great deal in common, but two differences are noteworthy.

ISO 27001:2013 Annex A 14.2.6 Provided More Detailed Guidance on Secure Development Environments

ISO 27001:2013 Annex A 14.2.6 deals with secure development environments and outlines 10 recommendations for organisations to consider when constructing a development environment.

In comparison, ISO 27001:2022 Annex A 8.33 does not include certain proposals, like having a back-up at a distant location and limitations on data transfer.

ISO 27001:2022 Annex A 8.31 Addresses Product Testing and the Use of Production Data

In comparison to ISO 27001:2013, ISO 27001:2022 Annex A 8.31 offers guidance on product testing and utilisation of production data in line with ISO 27001:2022 Annex A 8.33.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.Online provides support for the entirety of ISO 27001 implementation, from risk assessment to the creation of policies, procedures, and guidelines to adhere to the standard.

ISMS.Online offers a convenient approach for recording discoveries and sharing them with colleagues online. It further enables you to craft and store checklists for each ISO 27001 task, enabling you to monitor your organisation’s security program effortlessly.

We also provide organisations with an automated tool-set which facilitates compliance with the ISO 27001 standard. Its user-friendly design makes it simple to prove conformance.

Get in touch with us now to arrange a demonstration.