The basics
ISO 27001 control A.8.31 Separation of development, test and production environments requires companies to keep these environments apart. This is important in order to protect production environments from intentional or unintentional modification or from software design flaws, that might be present in development and testing environments.
Documentation
ISO 27001 control A.8.31 Separation of development, test and production environments can be documented:
- for smaller and mid-sized companies by writing a Secure Development Policy
- for larger companies by writing a Procedure for Separation of Development, Test and Production Environments
These documents are not mandatory, but are recommended.
Implementation
In order to comply with control A.8.31 Separation of development, test and production environments you might implement the following:
- Technology — the technology to enable the separation of environments in most cases will be already available in the company. Companies of all sizes will probably be able to use multiple routers, firewalls, and servers to separate their development, test, and production environments.
- Organization/processes — you should set up a process for defining criteria for the environment segregation, and manage access to and between the environments. You can document those processes through a Secure Development Policy or a Procedure for Separation of Development, Test and Production Environments.
- People — make employees aware of why segregating environments is needed, train IT staff on how to segregate them, and train the developers on how to properly use and move systems under development or maintenance between them.
Audit evidence
During the certification audit, the auditor might look for the following evidence regarding control A.8.31 Separation of development, test and production environments: if development, test, and production environments are effectively separated.
