Information used for testing is to be chosen, protected and managed appropriately. Purpose: keep testing meaningful while protecting the operational information used in it. Guidance: choose test information that makes results reliable while keeping the related operational information confidential, and do not copy sensitive information, including PII, into development and test environments (8.31). When copies of operational information are used for testing, whether in-house or in a cloud service, control access to test environments exactly as for operational ones; require a separate authorization every time operational information is copied into a test environment; log the copying and use to create an audit trail; remove or mask sensitive information used in tests (8.11); and delete operational information from the test environment properly (8.10) as soon as testing ends so it cannot be misused. Store test information securely to prevent tampering that could invalidate results, and use it only for testing. Other information: system and acceptance testing may need large volumes of test data that resemble operational data as closely as possible.
This control maps to 32 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
ISO 27002:2022 8.33 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.
The graph holds this control, the 32 it maps to, and the evidence behind each claim, over MCP and REST.