ASD ISM 1273 Segregate environments for database servers
What it says
Database servers for development, testing, staging and production environments are segregated.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep development and production database servers separate to ensure secure operations.
This control is about making sure that the database servers used for development, testing, staging, and actual operational purposes are kept separate. It matters because mixing them up can lead to mistakes or data breaches, which can disrupt business operations or expose sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If dev/test/stage and production databases aren't segregated, test activity can expose or alter production data, causing outages and data breaches.
How to implement
IT team should create separate environments: Set up different database servers for development, testing, staging, and production environments.
Ensure each is isolated by configuring networks and using separate physical or virtual servers.
System administrators should manage access: Assign specific permissions so only developers can access the development server, while only operational staff can access the production server.
Use strong passwords and change them regularly to maintain security.
Managers should document server purposes: Clearly list the purpose and users of each server environment.
Make this document available to all relevant staff to avoid confusion about which server should be used for what.
IT support should monitor database environments: Regularly check server usage and performance.
Use basic monitoring tools to identify any deviations or unauthorised access attempts and address any issues promptly.
IT team should update security protocols: Conduct regular reviews of security measures on each server environment to ensure they comply with the latest security guidelines.
Refer to resources from the Australian Cyber Security Centre for up-to-date advice.
Keep it running
Audit access and network rules to ensure dev/test/stage DBs cannot reach production, and enforce separate accounts, credentials and backups per environment.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network diagram: Request a diagram showing the separation of different environments.
Look at
How each server is represented and check for clear boundaries between development, testing, staging, and production.
Good evidence
Shows distinct separations with firewall details and access points.
- Check 2 of 5What an auditor asks for
Ask for
Access logs: Request logs of recent access attempts to each server environment.
Look at
Separate access patterns for each environment based on roles.
Good evidence
Contains minimal cross-access between environments and logs of attempts blocked by permissions.
- Check 3 of 5What an auditor asks for
Ask for
Server documentation: Request a document detailing each server's purpose and user lists.
Look at
A detailed description of which staff members can access which environment.
Good evidence
Shows clearly defined roles and responsibilities associated with each server.
- Check 4 of 5What an auditor asks for
Ask for
A monitoring report: Request a report on recent monitoring activities for each environment.
Look at
How issues were identified and resolved.
Good evidence
Includes records of regular checks and actions taken to address any anomalies.
- Check 5 of 5What an auditor asks for
Ask for
Security review records: Request documentation of the last security audit or review.
Look at
Records of checks against current guidelines, like those from the Australian Cyber Security Centre.
Good evidence
Details review outcomes, changes implemented, and future review dates.
Mappings
Closest match in ISO/IEC 27001: A.8.31, Separation of development, test, and production environments, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.31.
Annex A 8.31 requires development, testing and production environments to be separated and secured. ISM-1273 overlaps by mandating segregation specifically for database servers across development, testing, staging and production environments. ISM-1273 is narrower in system scope (databases) but slightly broader in lifecycle coverage (explicitly includes staging) compared with Annex A 8.31.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.