ISO 27001 A.8.31: Separation of development, test and production environments

Create clear separation between development, testing, staging, and production. Each environment should have its own infrastructure (separate servers, VMs, or cloud accounts), network segments, databases, access controls, and CI/CD pipeline stages with promotion gates. Set up access controls per environment. Production access goes to operations personnel and on-call developers only. Development access is limited to active team members. Staging mirrors production restrictions. Test environments can be broader but still controlled. Keep production data out of non-production environments. Do not copy production data directly to dev or test. Use data masking (see A.8.11) to generate realistic but anonymised test data. If production data is absolutely needed for testing, apply strict controls: temporary access, audit logging, and prompt deletion when finished. Build promotion controls between environments. Changes flow from development through testing, staging, and into production via a defined process. Use CI/CD pipelines with automated testing at each stage. Require approvals for production deployments. Block any path for direct modifications to production from development tools. Apply security controls proportionate to each environment. Production gets the highest security. Staging should mirror production security closely. Test environments need reasonable controls, especially if any sensitive data is involved. Development can be more permissive but still needs baseline security. Use infrastructure as code and containerisation to keep environments consistent while maintaining separation. Define configurations in code for repeatable deployments. Use container orchestration for isolated environments. In cloud setups, leverage account-level or namespace-level separation.