ISO/IEC 27002:2022 control 8.31 applies, with telecommunications guidance: data in development and test environments should be good enough to exercise the system and the service as they would behave in a genuine telecommunications setting. Developers should hold operational passwords or other authentication tokens only when controls grant that access temporarily for the purpose of supporting live systems, and those controls should see to it that, once the task is done, the access is withdrawn or the tokens are changed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.