APP-010 Environment Separation
Description
Development, test and production environments are separated logically or physically, with distinct access controls, distinct credentials and distinct deployment rights in each. Promotion of a change between environments follows a defined approval path and each promotion is recorded. Any production data present in a development or test environment is covered by a documented approval and a de-identification record.
Rationale
Shared environments create the three failures that show up in every post-incident review: production data reachable from a developer laptop, untested code reaching customers and a developer holding production write access by inheritance. Separation has to be structural, meaning separate accounts, networks or namespaces rather than a naming convention. DAT-016 owns the de-identification standard itself and the test-data lifecycle; this control requires the approval and the record to exist for the environment in question.
Applicability (9 profiles)
Framework Mappings (11)
| AIS-06 | Secure Application Deployment | partial |
| CCC-06 | Change Management Baseline | informative |
| AIS-06 | Secure Application Deployment | partial |
| CCC-06 | Change Management Baseline | informative |
| HIPAA-164.310.a.2.iii | Access Control and Validation Procedures | informative |
| 8.31 | Separation of development, test and production environments | full |
| 8.33 | Test information | informative |
| NIS2-CIR-6.8 | Network Segmentation | informative |
| CM-5 | Access Restrictions for Change | partial |
| CM-5(5) | Access Restrictions for Change | Privilege Limitation for Production and Operation | partial |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | informative |
Evidence (2)
Infrastructure or network configuration showing that production, staging, and development environments are deployed in logically or physically separate accounts, VPCs, or namespaces with distinct access controls.
Example: AWS account structure or GCP project listing showing separate accounts/projects for prod, staging, and dev; or Kubernetes namespace configuration with RBAC policies showing distinct permission sets per environment. Include IAM role assignments showing developers do not have write access to production.
Test: Review the cloud infrastructure account/project structure and IAM policies. Verify: (1) production runs in a dedicated account, project, or equivalent isolation boundary separate from development and test, (2) developer IAM roles with write access to dev/test do not have equivalent write access to production resources, (3) network policies or security groups prevent dev/test resources from initiating connections to production systems.
Policy or procedure defining environment separation requirements, including prohibition on use of production data in lower environments without documented de-identification.
Example: Environment Management Policy or Data Handling Procedure document containing explicit clauses prohibiting production data in dev/test without de-identification approval, and defining the approval process and de-identification method required.
Test: Request the environment management or data handling policy. Verify: (1) the document explicitly prohibits production data in dev/test environments, (2) an exception/approval process is defined for cases where production-like data is required, (3) any approved exceptions have a corresponding de-identification record and approval ticket, (4) policy was reviewed within the last 12 months.
Questions (3)
Are development, test and production environments separated logically or physically?
Separation must be structural (e.g. separate cloud accounts, VPCs, Kubernetes namespaces), not solely procedural. Developers with write access to dev/test must not hold equivalent production write access.
Is production data permitted in development or test environments?
Use of production data in non-production environments without de-identification is a data protection risk and a finding in most audit frameworks. Any approved exceptions must have a de-identification record.
Which of the following apply to the separation between your development, test and production environments?
Options run from the most commonly in place to the least. Separation enforced only by naming convention is not separation. The test is whether an account that can deploy to test can also deploy to production.