ISO 27001 A.8.33: Test information

Write a test data management policy that defines how test information is selected, created, protected, and managed. The default should be synthetic or anonymised data, with production data only as a documented exception.

Generate synthetic test data wherever you can. Use test data generation tools to create realistic but fictitious datasets. Make sure your synthetic data covers edge cases and boundary conditions, not just the happy path. Build reusable datasets that work across multiple test cycles.

When you need production-like characteristics, apply data masking or anonymisation (see A.8.11). Use consistent masking rules to maintain referential integrity across tables. Verify that masked data cannot be re-identified through cross-referencing. Confirm that the masked data still works for your test scenarios.

If actual production data must be used (this should be exceptional and justified): get formal authorisation from the data owner, apply proper access controls to the test environment, log and monitor all access to the test data, limit the volume to the minimum needed, set a hard deadline for secure deletion, and confirm compliance with data protection regulations.

Protect test data throughout its lifecycle. Restrict access based on need. Do not leave test data sitting on developer workstations. Securely delete it when testing is complete. Be especially careful with sensitive data in automated testing pipelines.

Keep records of test data usage. Document what data is used, where it came from, who has access, and when it will be deleted. For personal data under GDPR, record test data usage in your processing activities register.