How to Audit ISO 27001 Annex A 8.31: Separation of Development, Test, and Production Environments

In this ultimate how to audit guide to ISO 27001 Annex A 8.31 Separation of Development, Test, and Production Environments, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 8.31 Separation of Development, Test, and Production Environments Audit Checklist

Auditing ISO 27001 Annex A 8.31 Separation of Development, Test, and Production Environments is the technical verification of logical and physical isolation between lifecycle stages. The Primary Implementation Requirement is strict network segregation and IAM role exclusivity, providing the Business Benefit of protecting production integrity and preventing unauthorised data exposure.

This technical verification tool is designed for lead auditors to establish the logical and physical isolation of critical environments. Use this checklist to validate compliance with ISO 27001 Annex A 8.31.

1. Environment Segregation Policy Formalisation Verified

Verification Criteria: A documented policy exists defining the mandatory separation between development, testing, and production environments, including specific trust boundaries.

Required Evidence: Approved “Access Control Policy” or “Secure Development Policy” citing environment isolation requirements.

Pass/Fail Test: If the organisation cannot produce a formalised standard defining the separation of these environments, mark as Non-Compliant.

2. Logical Network Isolation Confirmed

Verification Criteria: Technical network controls (e.g., VLANs, Subnets, or VPCs) are active to prevent unauthorised traffic flow between development and production zones.

Required Evidence: Firewall rule base exports or Cloud Network Security Group (NSG) logs showing restricted ingress/egress between environments.

Pass/Fail Test: If a developer machine in the ‘Dev’ subnet can ping or access the ‘Production’ database directly via the internal network, mark as Non-Compliant.

3. Administrative Account Segregation Validated

Verification Criteria: Identity and Access Management (IAM) configurations ensure that administrative accounts for development environments have no permissions in production.

Required Evidence: IAM role reports or Active Directory group memberships showing distinct, non-overlapping accounts for ‘Dev’ and ‘Prod’ admins.

Pass/Fail Test: If a single administrative credential grants ‘Write’ or ‘Owner’ access to both development and production clusters, mark as Non-Compliant.