ISO 27001 Separation of Development, Test and Production Environments Explained – Annex A 8.31

ISO 27001 Annex A 8.31 is a documented process for isolating system environments. It separates development, testing, and production activities. This reduces risk of unauthorised access to live systems. Organisations manage these boundaries using tools like SharePoint. This approach ensures security stays part of daily technical work.

Key Takeaways

• Establish Environment Separation Standards: Document master policies in SharePoint defining strict isolation boundaries, access controls, and data segregation rules between development, testing, and production environments.
• Manage Environment Provisioning in Jira: Enforce formal change management and request workflows in Jira for environment creation, permission changes, and deployment promotions.
• Document Environment Architecture in Confluence: Maintain current network topology diagrams, access control lists, and isolation boundaries in Confluence for development and operations teams.
• Enforce Technical Isolation Controls: Implement strict network segmentation, separate cloud accounts/VPCs, and independent access controls to ensure non-production environments cannot access live production resources.
• Restrict Production Data in Non-Production: Prohibit live production data in development or test environments, enforcing automated data masking or synthetic dataset generation for testing.
• Assign Deployment Sign-Off Responsibilities: Require explicit managerial and technical sign-offs in Jira before promoting code or configurations across environment boundaries.
• Log Environment Exceptions & Waivers: Record and track any temporary cross-environment connectivity or emergency access exceptions in a centralized SharePoint register.

How to Implement ISO 27001 Annex A 8.31

• Draft Environment Isolation Policy in SharePoint: Publish a master policy in SharePoint defining strict segregation rules, role-based access limits, and data protection boundaries between development, test, and production environments.
• Document Environment Architecture in Confluence: Maintain up-to-date network topology diagrams, VPC configurations, and boundary control specifications in Confluence for engineering and operations teams.
• Configure Separate Cloud Accounts & Credentials: Establish dedicated cloud accounts, subnets, and access roles to ensure complete logical and technical isolation between development, testing, and production workloads.
• Manage Deployment Promotions via Jira Workflows: Implement trackable Jira change management workflows requiring formal technical lead approval before code or infrastructure moves between environments.
• Restrict Production Data Access: Enforce strict controls prohibiting the use of live production databases in non-production environments, using synthetic data or automated masking pipelines instead.
• Perform Quarterly Access Permission Reviews: Regularly review environment access lists and IAM roles, logging findings and remediation actions in dedicated SharePoint meeting minutes.
• Log Environment Exceptions & Waivers: Maintain a version-controlled SharePoint register to document, review, and approve any temporary cross-environment connectivity or emergency access requests.
• Enforce Automated CI/CD Environment Controls: Configure CI/CD pipelines with restricted deployment tokens, ensuring developers cannot manually push code directly to production outside of approved release channels.

How to Audit ISO 27001 Annex A 8.31

• Inspect Environment Segregation Policies: Review documented IT architecture policies in SharePoint to verify formal requirements exist for the strict separation of development, testing/staging, and live production environments.
• Verify Network & Cloud Infrastructure Isolation: Audit network topology diagrams, VPC configurations, and firewall rules recorded in Confluence to confirm development and test networks are logically or physically isolated from production networks.
• Audit Identity & Access Control Boundaries: Sample user access permissions across environments using Jira access logs to ensure developers do not have administrative or write access to live production systems, databases, or deployment tools.
• Verify Production Data Protections in Test: Inspect testing and staging databases to confirm live production data or unmasked Personally Identifiable Information (PII) is not copied or stored in non-production environments.
• Check CI/CD Deployment Pipeline Controls: Audit CI/CD service accounts and release gate tickets in Jira to ensure code cannot be promoted from testing to production without formal change approval and automated security checks.
• Verify Separate Credentials & Secret Storage: Check configuration files and key vaults across environments to ensure API keys, database credentials, and SSL certificates used in development/test differ strictly from production secrets.
• Audit Developer Workstation & Remote Access Limits: Inspect remote access policies and jump box controls in Confluence to confirm developers cannot bypass staging controls to execute unmonitored code directly in production.
• Review Environment Exception Logs: Sample logged exception tickets in SharePoint to confirm any temporary cross-environment access or troubleshooting activities had documented management authorization and immediate revocation.
• Verify Pre-Deployment Approval Sign-Offs: Audit change management tickets in Jira to confirm lead engineers and management have formally approved release promotions across environment boundaries.
• Audit Access Deprovisioning Records: Sample completed role change or offboarding tickets in Jira to confirm prompt revocation of production credentials and environment permissions.

Audit Evidence Checklist

• Environment Isolation Policy & Standards: Present the master Environment Separation Policy stored in SharePoint, showing formal version control history and leadership sign-off metadata.
• Architecture & Network Boundary Diagrams: Supply up-to-date network topology diagrams, cloud account structures, and VPC isolation specifications maintained in Confluence.
• Jira Deployment Approval Tickets: Provide Jira change management records showing mandatory technical and managerial sign-offs prior to promoting builds into production.
• SharePoint Access Review Logs: Share documented quarterly IAM access review records, user privilege verifications, and signed audit logs stored in SharePoint.
• Change Review Meeting Minutes: Produce formal meeting notes and change advisory board (CAB) review records in SharePoint detailing production release approvals and risk evaluations.
• Environment Exception & Waiver Register: Present centralized SharePoint registers showing management approval, duration tracking, and revocation evidence for temporary cross-environment access.
• Internal Isolation Audit Reports: Provide internal audit reports and verification assessments stored in SharePoint confirming ongoing logical and administrative environment separation.

What to Teach Employees

• Understand the Purpose of Environment Boundaries: Teach engineers and developers why development, testing, and production environments are strictly segregated to prevent unvetted code or unauthorized changes from impacting live business operations.
• Never Use Real Production Data in Test Environments: Train development and QA teams to use synthetic, anonymized, or masked datasets for testing rather than copying live customer PII or sensitive production databases.
• Enforce Strict Segregation of Credentials: Show systems teams why development and staging environments must use separate passwords, API keys, and certificates that never overlap with live production secrets.
• Respect Segregation of Duties (SoD): Train developers to understand why they are restricted from having direct administrative access to live production systems or manual deployment permissions.
• Use Formal CI/CD Deployment Pipelines: Show technical staff how to deploy code changes exclusively through approved automated deployment pipelines linked to Jira release tickets rather than pushing hotfixes directly to production hosts.
• Identify and Report Cross-Environment Risks: Train engineers to spot and report misconfigurations, such as test systems communicating directly with production databases or shared cloud storage buckets.
• Adhere to Emergency Production Access Protocols: Train operational staff on the “break-glass” procedure for emergency production access, ensuring temporary rights are logged in Jira, monitored, and revoked immediately after use.
• Maintain Distinct Security Controls per Tier: Teach administrators why development environments, while isolated, still require baseline security controls so they cannot be leveraged as pivot points to attack the production network.
• Access Centralised Environment Policies: Instruct engineering and operations teams where to find master environment isolation policies, topology diagrams, and change management procedures in SharePoint and Confluence.

Common Implementation Challenges

• Developer Demand for Direct Production Access: Engineering teams pushing for direct SSH or administrative access to live production environments to debug complex incidents quickly, bypassing formal staging and approval controls.
• Inadvertent Use of Production Data in Testing: Developers and QA engineers copying unmasked production databases or customer PII into staging environments to reproduce edge-case bugs, creating severe data privacy vulnerabilities.
• Secret and API Key Leakage Across Tiers: Accidental reuse of production API keys, database credentials, or TLS certificates in development and test environments, exposing production assets if non-production tiers are compromised.
• Environment Drift Between Staging and Production: Discrepancies in software versions, operating system patches, or cloud network configurations between testing and production environments causing unexpected deployment failures.
• Cost Friction in Maintaining Mirror Environments: High infrastructure costs associated with maintaining fully isolated cloud VPCs or multi-tenant staging environments that match live production scale and performance.
• Over-Permissive Cross-Tier Network Rules: Firewalls or cloud security groups inadvertently allowing development or build servers to communicate directly with production databases or management subnets.
• Unmonitored Non-Production Attack Surfaces: Treating development and test networks as low-priority zones, resulting in missing patches, weak access controls, and unmonitored lateral movement routes into production.
• Abuse or Inadequate Logging of Emergency “Break-Glass” Access: Failure to strictly limit, monitor, and quickly revoke temporary administrator access granted to developers during production emergency outages.

How to Measure Effectiveness (KPIs)

• Unauthorized Direct Production Access Count: Tracks the number of detected instances where non-operational staff (e.g., developers, QA engineers) accessed live production environments outside approved emergency “break-glass” procedures logged in Jira.
• Production Data Isolation Breach Rate: Measures the number of policy violations where unmasked production data or live customer PII was identified within development, testing, or staging environments.
• Cross-Environment Secret Reuse Rate: Tracks the percentage of credentials, API keys, or certificates detected as identical across development/test and production key vaults or configuration files.
• Emergency Access (“Break-Glass”) Revocation Time: Measures the average time taken to audit, close, and revoke temporary developer administrator access granted in Jira during live production incident interventions.
• Bypassed CI/CD Pipeline Deployment Count: Tracks the number of manual code changes or direct hotfixes deployed to production systems outside of automated, approved Jira release pipelines.
• Environment Configuration Parity Index: Measures the percentage alignment between staging and production infrastructure settings documented in Confluence to ensure tests accurately reflect operational performance and security controls.
• Quarterly Environment Access Audit Completion Rate: Tracks the percentage of scheduled user privilege reviews for development, test, and production environments completed on time and recorded in SharePoint.
• Environment Exception Review Rate: Measures the total number of active, documented cross-environment connectivity waivers and temporary bypasses reviewed quarterly in SharePoint registers.

Related ISO 27001 Controls

ISO 27001 Annex A 8.31 connects to several core ISO 27001 requirements:

• ISO 27001 Clause 8.1: Operational planning and control.
• ISO 27001 Annex A 8.32: Change management.
• ISO 27001 Annex A 8.3: Information access restriction.