While non-production test environments such as staging environments are essential to building high-quality software products and applications free of bugs or errors, the use of real data and lack of security measures in these environments expose information assets to heightened risks.
For example, developers may use easy-to-remember credentials(e.g “admin” for both username and password) for testing environments in which sensitive data assets are stored.
This may be exploited by cyber attackers to gain easy access to test environments and steal sensitive information assets.
Therefore, organisations should put in place appropriate controls and procedures to protect real-world data used for testing.
Control 8.33 enables organisations to achieve two purposes:
Control 8.33 is a preventive type of control that requires organisations to select and protect the most appropriate information for the testing stage so as to maintain the confidentiality and integrity of information.
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventive | #Confidentiality #Integrity | #Protect | #Information Protection | #Protection |
Considering that Control 8.33 entails the selection, protection, and management of the most appropriate test information to be used for testing, information security officers, in cooperation with the development team, should be ultimately responsible for establishing appropriate controls and procedures.
Organisations should not use sensitive information, including personal data, in the development and testing environments.
To protect the test information against loss of confidentiality and integrity, organisations should comply with the following:
Furthermore, organisations should apply appropriate measures to ensure the secure storage of information assets.
It is noted that system and acceptance testing may require an enormous amount of test information, equivalent to operational information.
27002:2022/8.33 replace 27002:2013/(14.3.1)
Although the 2022 version is similar to the 2013 version to great extent, the 2022 Version introduces the following requirement:
The 27002:2013 version, in contrast, did not include this requirement.
ISMS.online is a cloud-based solution that helps companies show compliance with ISO 27002. The ISMS.online solution can be used to manage the requirements of ISO 27002 and ensure that your organisation remains compliant with the new standard.
The ISO 27002 standard has been updated to reflect the growing cyber threats we face as a society. The current standard was first published in 2005 and revised in 2013 to reflect changes in technology, regulations and industry standards. The new version of ISO 27002 incorporates these updates into one document, as well as adding new requirements for organisations to help them better protect their data assets from cyber attacks.
The ISMS.online solution helps organisations implement ISO 27002: 2022 by providing an easy-to-use framework for documenting information security policies and procedures. It also provides a centralised location where you can store all your compliance documentation so it can be easily accessed by different stakeholders in the company (e.g. HR, IT).
Our platform is user-friendly and straightforward. It is not only for highly technical individuals; it is for everyone in your company.
Get in touch today to book a demo.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | New | Threat intelligence |
| 5.23 | New | Information security for use of cloud services |
| 5.30 | New | ICT readiness for business continuity |
| 7.4 | New | Physical security monitoring |
| 8.9 | New | Configuration management |
| 8.10 | New | Information deletion |
| 8.11 | New | Data masking |
| 8.12 | New | Data leakage prevention |
| 8.16 | New | Monitoring activities |
| 8.23 | New | Web filtering |
| 8.28 | New | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | New | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
