ASD ISM 1274 Ensure non-production databases match production security
What it says
Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishProduction data can only be used in non-production areas if they are secured equally as well.
When using copies of your main, everyday database for testing or development, those copies need to be protected just as well as the original. If not, sensitive information could be leaked, leading to privacy breaches or other security issues.
Free. Save your status, tasks and notes.
Why it matters
Using production data in a less-secure non-production environment can expose sensitive records, causing breaches, loss of trust and compliance penalties.
How to implement
System owners should collaborate with IT teams to classify the sensitivity of data in the production database.
This involves identifying what data is considered sensitive and needs protection, such as personal information or financial data.
IT teams should replicate security settings from production to non-production databases.
This means using the same access controls and monitoring tools to prevent unauthorised access.
Managers should ensure staff handling non-production databases are trained in data privacy and security policies.
This training should include understanding what data should remain confidential and why safeguarding it is critical.
Security officers should perform regular checks to verify that non-production databases are as secure as production databases.
They can do this by reviewing access logs and implementing security updates simultaneously on all environments.
Procurement teams should ensure any third-party tools or services used with non-production databases conform to the same security standards as those used with production databases.
They should validate this during the vendor selection process by asking for security certifications.
Keep it running
Do not copy production data into dev/test unless the environment meets production-equivalent controls (access, logging, encryption). Otherwise use masked/synthetic data.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The non-production database security policy: Request documentation that describes security measures applied to non-production databases.
Look at
Matching security settings to the production environment.
Good evidence
Would be a document that lists identical security protocols across environments.
- Check 2 of 5What an auditor asks for
Ask for
To see access logs for non-production databases: Request access records to check who has accessed these databases.
Look at
Restricted and audited access similar to production environments.
Good evidence
Shows logs that align access controls with production databases.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Request records showing which staff have been trained in handling non-production data securely.
Look at
Training completion dates and topics covered.
Good evidence
Includes recent training on data security relevant to their role.
- Check 4 of 5What an auditor asks for
Ask for
Regular security review reports: Request documentation from security officers on their database checks.
Look at
Documented evidence of reviews and any actions taken.
Good evidence
Shows regular audits with issues identified and resolved.
- Check 5 of 5What an auditor asks for
Ask for
Vendor compliance certificates: Request documentation from procurement about third-party vendor compliance.
Look at
Certifications or assessments that match those required for production data protection.
Good evidence
Includes up-to-date certificates from trusted cyber security standards.
Mappings
Closest match in ISO/IEC 27001: A.8.31, Separation of development, test, and production environments, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.31.
ISM-1274 requires that production database contents are not used in non-production unless the non-production environment is secured to at least the same level as production. This relates directly to Annex A 8.31, which requires separation and securing of development, test and production environments as a general control objective. ISM-1274 is a specific data-handling and environment-security condition (focused on production data replication/use), whereas Annex A 8.31 is broader and applies to environment separation and security more generally, even where no production data is used.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.