ISO 27002 Control 8.33: Key Security Considerations for Test Data

While non-production test environments such as staging environments are essential to building high-quality software products and applications free of bugs or errors, the use of real data and lack of security measures in these environments expose information assets to heightened risks.

For example, developers may use easy-to-remember credentials(e.g “admin” for both username and password) for testing environments in which sensitive data assets are stored.

This may be exploited by cyber attackers to gain easy access to test environments and steal sensitive information assets.

Therefore, organisations should put in place appropriate controls and procedures to protect real-world data used for testing.

Purpose of Control 8.33

Control 8.33 enables organisations to achieve two purposes:

  • To protect and maintain the confidentiality of information used in the testing environment.
  • Selection and use of test information that will yield reliable results.

Attributes Table of Control 8.33

Control 8.33 is a preventive type of control that requires organisations to select and protect the most appropriate information for the testing stage so as to maintain the confidentiality and integrity of information.

Control Type Information Security Properties Cybersecurity Concepts Operational Capabilities Security Domains
#Preventive #Confidentiality #Protect #Information Protection #Protection
#Integrity



Get an 81% headstart

We've done the hard work for you, giving you an 81% Headstart from the moment you log on.
All you have to do is fill in the blanks.

Book a demo



Ownership of Control 8.33

Considering that Control 8.33 entails the selection, protection, and management of the most appropriate test information to be used for testing, information security officers, in cooperation with the development team, should be ultimately responsible for establishing appropriate controls and procedures.

General Guidance on Compliance

Organisations should not use sensitive information, including personal data, in the development and testing environments.

To protect the test information against loss of confidentiality and integrity, organisations should comply with the following:

  • Access controls applied in real-world environments should also be implemented in test environments.
  • Establishing and implementing a separate authorisation procedure for the copying of real information into test environments.
  • To keep an audit trail, all activities related to copying and use of sensitive information in test environments should be recorded.
  • If sensitive information will be used in the test environment, it should be protected with appropriate controls such as data masking or data removal.
  • Once the testing is completed, information used in the test environment should be safely and permanently removed to eliminate the risk of unauthorised access.

Furthermore, organisations should apply appropriate measures to ensure the secure storage of information assets.

Supplementary Guidance on Control 8.33

It is noted that system and acceptance testing may require an enormous amount of test information, equivalent to operational information.




Manage all your compliance in one place

ISMS.online supports over 100 standards
and regulations, giving you a single
platform for all your compliance needs.

Book a demo



Changes and Differences from ISO 27002:2013

27002:2022/8.33 replaces 27002:2013/(14.3.1)

Although the 2022 version is similar to the 2013 version to great extent, the 2022 Version introduces the following requirement:

  • If sensitive information will be used in the test environment, it should be protected with appropriate controls such as data masking or data removal.

The 27002:2013 version, in contrast, did not include this requirement.

New ISO 27002 Controls

New Controls


Organisational Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
5.105.1.1, 05.1.2Policies for information security
5.206.1.1Information security roles and responsibilities
5.306.1.2Segregation of duties
5.407.2.1Management responsibilities
5.506.1.3Contact with authorities
5.606.1.4Contact with special interest groups
5.7NewThreat intelligence
5.806.1.5, 14.1.1Information security in project management
5.908.1.1, 08.1.2Inventory of information and other associated assets
5.1008.1.3, 08.2.3Acceptable use of information and other associated assets
5.1108.1.4Return of assets
5.12 08.2.1Classification of information
5.1308.2.2Labelling of information
5.1413.2.1, 13.2.2, 13.2.3Information transfer
5.1509.1.1, 09.1.2Access control
5.1609.2.1Identity management
5.17 09.2.4, 09.3.1, 09.4.3Authentication information
5.1809.2.2, 09.2.5, 09.2.6Access rights
5.1915.1.1Information security in supplier relationships
5.2015.1.2Addressing information security within supplier agreements
5.2115.1.3Managing information security in the ICT supply chain
5.2215.2.1, 15.2.2Monitoring, review and change management of supplier services
5.23NewInformation security for use of cloud services
5.2416.1.1Information security incident management planning and preparation
5.2516.1.4Assessment and decision on information security events
5.2616.1.5Response to information security incidents
5.2716.1.6Learning from information security incidents
5.2816.1.7Collection of evidence
5.2917.1.1, 17.1.2, 17.1.3Information security during disruption
5.30NewICT readiness for business continuity
5.3118.1.1, 18.1.5Legal, statutory, regulatory and contractual requirements
5.3218.1.2Intellectual property rights
5.3318.1.3Protection of records
5.3418.1.4Privacy and protection of PII
5.3518.2.1Independent review of information security
5.3618.2.2, 18.2.3Compliance with policies, rules and standards for information security
5.3712.1.1Documented operating procedures


People Controls


Physical Controls


How ISMS.online Helps

ISMS.online is a cloud-based solution that helps companies show compliance with ISO 27002. The ISMS.online solution can be used to manage the requirements of ISO 27002 and ensure that your organisation remains compliant with the new standard.

The ISO 27002 standard has been updated to reflect the growing cyber threats we face as a society. The current standard was first published in 2005 and revised in 2013 to reflect changes in technology, regulations and industry standards. The new version of ISO 27002 incorporates these updates into one document, as well as adding new requirements for organisations to help them better protect their data assets from cyber attacks.

The ISMS.online solution helps organisations implement ISO 27002: 2022 by providing an easy-to-use framework for documenting information security policies and procedures. It also provides a centralised location where you can store all your compliance documentation so it can be easily accessed by different stakeholders in the company (e.g. HR, IT).

Our platform is user-friendly and straightforward. It is not only for highly technical individuals; it is for everyone in your company.

Get in touch today to book a demo.


Jump to topic

Max Edwards

Max works as part of the ISMS.online marketing team and ensures that our website is updated with useful content and information about all things ISO 27001, 27002 and compliance.

ISMS Platform Tour

Interested in an ISMS.online platform tour?

Start your free 2-minute interactive demo now and experience the magic of ISMS.online in action!

Try it for free

We’re a Leader in our Field

Users Love Us
Leader Winter 2025
Leader Winter 2025 United Kingdom
Best ROI Winter 2025
Fastest Implementation Winter 2025
Most Implementable Winter 2025

"ISMS.Online, Outstanding tool for Regulatory Compliance"

-Jim M.

"Makes external audits a breeze and links all aspects of your ISMS together seamlessly"

-Karen C.

"Innovative solution to managing ISO and other accreditations"

-Ben H.

DORA is here! Supercharge your digital resilience today with our powerful new solution!