ASD ISM 1420 Ensure non-production security matches production
What it says
Data from production environments is not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishData from live systems can't be used in test setups unless test setups are just as secure.
This control ensures that if you want to use real data from your live systems for testing purposes, your test environment must be just as secure as your live environment. If the test setup isn't up to par, sensitive information could be exposed, leading to privacy breaches or data loss.
Free. Save your status, tasks and notes.
Why it matters
If non-production isn't secured like production, using production data in test/dev can expose sensitive information and cause a breach.
How to implement
The IT team should review the security settings of the non-production environment.
They need to do a thorough comparison between the test environment's and the production environment's security configurations to make sure they are on the same level.
Managers should ensure that staff are aware of the policy of not using live data in test environments without proper security.
This can be done through regular training sessions and updates to internal policy documents.
System administrators should put in place configurable alerts to detect any data transfers from production to non-production environments that happen outside of approved processes.
They can use simple software tools that track data flows and alert on anomalies.
The legal team should draft agreements or internal policies clearly outlining the restrictions and conditions for using production data in non-production contexts.
These documents should be easily accessible to all staff members.
System auditors should conduct regular checks to confirm that test environments are updated to the same security standard as production.
They can follow a checklist that compares the applied security patches and permissions settings between environments.
Keep it running
Only use production data in non-production when controls match production; verify via audits and apply equivalent access, logging and patching.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The security configuration documentation for both production and non-production environments.
Look at
The listed security measures and compare them.
Good evidence
Setup shows encryption and access controls that match in both environments.
- Check 2 of 5What an auditor asks for
Look at
Anomalies or unapproved transfers in those logs.
Good evidence
Shows a log with only authorised and documented transfers.
- Check 3 of 5What an auditor asks for
Ask for
Recent security update records applied to both environments.
Look at
Whether all updates applied to production are also applied to non-production.
Good evidence
Result is a matching list of updates showing no lag between environments.
- Check 4 of 5What an auditor asks for
Look at
Training attendance records and materials shared.
Good evidence
Shows regular sessions with updated materials covering the control.
- Check 5 of 5What an auditor asks for
Ask for
Documentation of the oversight mechanisms in place to ensure compliance with this control.
Look at
The regularity and thoroughness of oversight reports.
Good evidence
Includes detailed reports showing ongoing compliance and any issues being addressed.
Mappings
Closest match in ISO/IEC 27001: A.8.31, Separation of development, test, and production environments, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.31.
ISM-1420 requires that production data is only used in non-production environments when those environments are secured to at least the same level as production. Annex A 8.31 requires development, test, and production environments to be separated and secured, which supports reducing the risk of production data exposure when used outside production. The overlap is that both drive stronger security boundaries and protections around non-production use-cases, but ISM-1420 is specifically about the condition for using production data, while Annex A 8.31 is about environment separation and general securing rather than equivalence of security levels for data reuse.
This control depends on A.5.15.
ISM-1420 requires organisations to ensure non-production environments meet production-equivalent security before using production data in them. Annex A 5.15 establishes the access control policies and procedures that define and enforce who can access systems and data across environments. ISM-1420 typically depends on these policies to define what 'same level as production' means and to implement the necessary logical access restrictions in non-production.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.