Test information

Plain-language summary

Choosing, protecting and managing the data used for testing — preferably synthetic or masked, with live copies only under approval, protection and prompt deletion — so test environments do not become an unprotected copy of your live personal and confidential information.

What the clause is really asking

Test environments are usually less protected than production, with more people, including consultants, given access. When live data is copied in for realism, sensitive information ends up there. This control asks you to select test information appropriately and protect it. The preferred route is test data that is synthetic or masked so it no longer identifies anyone. Where production data must be used, the control expects the same access controls as production, a recorded authorisation for each copy, logging of the copy, and deletion as soon as testing ends. In South Africa this is a POPIA question first: copying customers' or employees' personal information into a test system is further processing that must be compatible with the original purpose (section 15), should use no more than is needed (section 10), and still needs section 19 safeguards. The common misunderstanding is that a test system is internal and therefore safe; consultants and test accounts with weak passwords say otherwise. In practice this bites at ERP upgrades and payroll system changes, when the whole live company is copied to test.

What auditors look for

Auditors ask how test data is obtained for your key systems, and then look in a test environment — the ERP test company, the staging website, the payroll test instance — for live personal information. If they find it, they ask who approved the copy, who has access, whether access controls match production and when it will be deleted. They ask whether masking or synthetic data was considered. They check consultants' access to the test system. The hard question: how many copies of your customer or employee data exist outside production right now, and who can see them?

Typical evidence

Test data procedure or rules; approval records for copying production data to test; masking or anonymisation method and records; access lists for test environments; logs of production data copies; deletion records after testing; POPIA assessment of using personal information in testing; register of test environments holding live data.

How to comply — recommendations

Write a half-page rule: testing uses synthetic or masked data by default; copying live personal or confidential information into a test environment needs written approval from the information owner, must be masked where the test allows, gets the same access controls as production, and is deleted on a set date. Find out which of your systems can mask data on copy — many ERP and payroll products can, and test data generators cover the rest. Keep a register of production copies with approver, purpose and deletion date. Check the test environments quarterly against the register and remove stale copies.

Common nonconformities

Full copies of live personal information in test environments without approval; test environments with weaker access controls than production; consultants with access to live data in test; masking or anonymisation never considered; production copies never deleted after testing; no record of copies made; POPIA implications of test use not assessed.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.