How to Audit ISO 27001 Annex A 8.33

The ultimate audit guide to ISO 27001 Annex A 8.33 Test Information

1. Establish a Formal Test Data Management Policy

Identify whether the organisation has documented and approved a policy specifically for the management of test information. This ensures that developers and testers have a clear framework for handling sensitive data subsets.

• Verify that the policy defines the requirements for data masking and anonymisation.
• Confirm that senior management has signed off on the selection criteria for test information.
• Check that the policy is reviewed annually to reflect changes in technical testing capabilities.

2. Audit the Use of Operational Production Data

Examine the processes for copying production data into test environments. The use of real production data for testing should be a last resort and requires stringent justifications and technical safeguards.

• Inspect authorization records for every instance where production data was utilised for testing.
• Verify that a Data Protection Impact Assessment (DPIA) was conducted prior to using PII in a test environment.
• Check for a documented “exception list” for tests that cannot be performed with synthetic data.

3. Verify Technical Anonymisation and Masking Techniques

Audit the technical tools used to sanitise test information. Effective anonymisation ensures that even if a test environment is compromised, the data remains useless to an attacker.

• Inspect the scripts or software used for pseudonymisation and data masking.
• Confirm that sensitive fields, such as names, addresses, and credit card numbers, are obscured.
• Validate that the anonymisation process is irreversible to prevent re-identification of individuals.

4. Provision Restricted IAM Roles for Test Environments

Evaluate the Identity and Access Management (IAM) controls applied to testing platforms. Access to test information must be granted on a least-privilege basis, ensuring only authorised personnel can view the data.

• Review the list of users with access to test databases and verify their business need.
• Confirm that Multi-Factor Authentication (MFA) is enforced for all developer and tester accounts.
• Check for segregation of duties between those who manage production data and those who perform tests.

5. Validate Logical and Physical Environment Separation

Confirm that test, development, and production environments are strictly separated. This prevents the accidental deployment of test code into production and the leakage of production data into less secure test tiers.

• Inspect network diagrams to verify VLAN isolation or separate cloud VPCs.
• Review firewall rules to ensure there is no direct connectivity between test and production databases.
• Verify that distinct sets of credentials are used for each environment.

6. Revoke and Securely Delete Test Information

Audit the disposal process for test data once a project or testing phase is complete. Retaining test information indefinitely increases the organisation’s risk surface and storage costs.

• Inspect evidence of secure deletion or decommissioning of test datasets.
• Verify that backup tapes or cloud snapshots of test environments are also purged.
• Check the “Test Data Register” for dates of intended disposal.

Annex A 8.33 Audit Steps and Evidence Requirements

Audit Step	How to Audit It	Common Examples of Evidence
1. Policy Review	Examine the Information Security Policy suite for a Test Data section.	Signed Test Data Management Policy.
2. Production Data Audit	Sample recent test projects to see if production data was requested.	Approved Change Requests, DPIA for test data.
3. Masking Verification	Ask a developer to show the database view of a test user profile.	Screenshots of obscured PII, Anonymisation scripts.
4. IAM Review	Check user permissions in the Test/UAT environment console.	IAM Role definitions, MFA enrollment logs.
5. Environment Check	Review network diagrams and perform a ping test between tiers.	VLAN configurations, Cloud Security Group rules.
6. Secure Disposal	Review the ticket history for completed projects to find data deletion tasks.	Secure wipe certificates, Jira task completion logs.
7. External ROE	Check the contract for a recent penetration test for data handling clauses.	Signed Rules of Engagement (ROE) documents.
8. Log Monitoring	Inspect the SIEM or database logs for the test environment.	Audit trail of user access to test databases.
9. Asset Inventory	Search the Asset Register for entries categorised as “Test Information”.	Asset Register export showing test data ownership.
10. Competence Audit	Review the annual training log for developer security modules.	Training certificates, attendance logs for secure coding workshops.

About the author