All 93 controls · Technological controls
Control 8.33
Test information
What ISO/IEC 27002:2022 control 8.33 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Information used for testing is to be chosen, protected and managed appropriately. Purpose: keep testing meaningful while protecting the operational information used in it. Guidance: choose test information that makes results reliable while keeping the related operational information confidential, and do not copy sensitive information, including PII, into development and test environments (8.31). When copies of operational information are used for testing, whether in-house or in a cloud service, control access to test environments exactly as for operational ones; require a separate authorization every time operational information is copied into a test environment; log the copying and use to create an audit trail; remove or mask sensitive information used in tests (8.11); and delete operational information from the test environment properly (8.10) as soon as testing ends so it cannot be misused. Store test information securely to prevent tampering that could invalidate results, and use it only for testing. Other information: system and acceptance testing may need large volumes of test data that resemble operational data as closely as possible.
Purpose in the standard’s terms, in our words: Ensures testing is relevant and operational information used for testing is protected.
Attribute values in one line: Preventive; Confidentiality, Integrity; Protect; Information protection; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrity |
| Cybersecurity concepts | Protect |
| Operational capabilities | Information protection |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- A test data procedure stating how test information is selected and prohibiting unprotected sensitive data in non-production
- Authorization records for each copy of operational information into a test environment
- Logs of copying and use of operational information in test environments
- Masking or anonymization configuration applied to test data sets
- Deletion records showing operational data removed from test environments after testing
- Access control configuration for test environments equivalent to production where operational data is present
Where audits commonly find gaps
- Full production databases are cloned into test environments routinely without approval
- Test environments hold personal data with far weaker access controls than production
- Copies of production data remain in test long after testing ends
- Masking is applied inconsistently, leaving identifiable fields
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (14.3.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.