ISO 27001 Annex A 8.31 Separation of development, test, and production environments
What it says
Development, testing and production environments shall be separated and secured.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure development, testing, and production systems are separate to avoid disrupting live services.
Imagine having your rehearsal for a play mixed up with the actual performance on stage! Keeping development, testing, and the real software you use separate is just like that. It ensures that your everyday work isn't disrupted by unpredictable changes or errors, which helps keep things running smoothly and securely.
Free. Save your status, tasks and notes.
Why it matters
Mixing development and production increases the risk of downtime and data breaches when untested changes affect live services.
How to implement
The IT manager should ensure that development, testing, and production systems are kept in separate environments.
This can be done by using different servers or virtual spaces for each, ensuring no overlap. According to ISO 27002:2022, this separation protects your live systems from being affected by new developments or tests.
The security officer must verify that there are strict access controls in place between these environments.
This involves setting up permissions so only authorised personnel can access these systems, aligned with Australian standards such as CPS 234. This helps prevent unauthorised changes or data breaches.
The software development team should implement a change management process to track and authorise changes from development to production.
This involves documenting all changes and getting approval before pushing them live, as suggested by ISO 27002:2022 guidance.
The IT security team should regularly patch and update all tools in the development and testing environments.
Following the Australian Cyber Security Centre's guidelines ensures these systems are not vulnerable to security threats.
The operations manager should conduct regular reviews and training to make sure the environment is accurately labelled.
This involves clearly marking which environment is which, to avoid human error as outlined in ISO 27002:2022.
Keep it running
Regularly confirm dev/test accounts, tools, and pipelines cannot access or run in production, and review environment boundaries.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request to see the environment separation policy.
Look at
Check that the policy clearly states the separation requirements and procedures for development, testing, and production systems.
Good evidence
The policy is comprehensive, with clear guidelines that align with the ISO 27001 requirements.
- Check 2 of 5What an auditor asks for
Ask for
Obtain access logs for the development and production environments.
Look at
Ensure the logs show that only authorised personnel have accessed these environments.
Good evidence
Access is consistently restricted based on roles, and logs are regularly reviewed.
- Check 3 of 5What an auditor asks for
Ask for
Request the change management records for recent deployments.
Look at
Check for documented approvals and test results before changes were moved to production.
Good evidence
Each change is well-documented, authorised, and includes testing evidence.
- Check 4 of 5What an auditor asks for
Ask for
Review the system update and patch management schedules for development tools.
Look at
Ensure schedules are up-to-date and reflect timely patches following ISO and Australian guidelines.
Good evidence
Patch management is actively maintained and demonstrates consistent updating.
- Check 5 of 5What an auditor asks for
Ask for
Request a demonstration of environment identification practices.
Look at
Verify that the labelling in the computer interfaces distinguishes clearly between different environments.
Good evidence
Environments are clearly labelled, reducing the risk of confusion and errors.
Mappings
Closest match in ASD Information Security Manual: ISM-0400, Segregation of environments in software development, which asks for the same thing.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-0400.
Annex A 8.31 requires development, testing and production environments to be separated and secured. ISM-0400 states the same core requirement by mandating segregation of development, testing, staging and production environments. ISM-0400 is essentially the ISM expression of the same control intent, with minor scope expansion via explicit inclusion of staging.
This control is equivalent to ISM-1419.
ISM-1419 requires development and modification of software to occur only in development environments, to protect production integrity. Annex A 8.31 requires separation and securing of development, test and production environments, which directly enforces that changes are created in dev/test and promoted into production rather than performed in production. Annex A 8.31 is slightly broader by explicitly covering test environments and environmental security, but the core requirement aligns closely with ISM-1419.
This control is broader than ISM-1274.
Annex A 8.31 requires separation and security controls between development, test and production environments to prevent compromise or disruption of production services. ISM-1274 supports this by controlling the use of production database contents in non-production and requiring non-production to be secured to at least production level if production data is used. While Annex A 8.31 is about environment separation overall, ISM-1274 focuses on a specific risk (production data leakage) that can undermine the security of separated environments.
This control partially overlaps ISM-0385.
ISM-0385 requires servers to maintain effective functional separation from other servers so they can operate independently. Annex A 8.31 requires separation and security of development, test and production environments, which is a common way organisations implement functional separation to prevent cross-environment interference. The ISO control is specifically about environment lifecycle separation, while ISM-0385 is broader about server-to-server independence regardless of lifecycle stage.
This control partially overlaps ISM-1273.
Annex A 8.31 requires development, testing and production environments to be separated and secured. ISM-1273 overlaps by mandating segregation specifically for database servers across development, testing, staging and production environments. ISM-1273 is narrower in system scope (databases) but slightly broader in lifecycle coverage (explicitly includes staging) compared with Annex A 8.31.
This control partially overlaps ISM-1420.
ISM-1420 requires that production data is only used in non-production environments when those environments are secured to at least the same level as production. Annex A 8.31 requires development, test, and production environments to be separated and secured, which supports reducing the risk of production data exposure when used outside production. The overlap is that both drive stronger security boundaries and protections around non-production use-cases, but ISM-1420 is specifically about the condition for using production data, while Annex A 8.31 is about environment separation and general securing rather than equivalence of security levels for data reuse.
This control partially overlaps ISM-2143.
ISM-2143 requires credentials to be unique per application/workload and not shared across development, testing, staging and production. ISO/IEC 27001:2022 Annex A 8.31 requires separation and securing of development, test and production environments, which directly supports preventing credential reuse and cross-environment access paths. ISM-2143 is specifically about credential segregation, while Annex A 8.31 is broader environment segregation (networks, systems, access controls) and does not explicitly mandate unique per-application credentials.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.