FFIEC IT Examination Handbook DAM-VII.B.2(a): VII.B.2(a) Data Controls in the Testing Environment (Development, Acquisition, and Maintenance)

Production data used in a test environment is protected as it would be in production, or synthetic data is generated instead, the test environment is made similar or identical to production including configurations and data sets so that testing finds flaws, and the environment is isolated and protected so it cannot become an exploit vector.