[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-31":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-31","Annex A 8.31","Separation of development, test and production environments",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Development, testing and production environments should be separated and secured. The aim is to protect production systems and data from being compromised or disrupted by development and testing activity.\n\n**In practice.** Environments are logically or physically separated, with different accounts, credentials and network controls, and developers do not hold standing write access to production. Changes reach production through a controlled pipeline rather than manual copying. Production data is not used in test unless it is protected to the same level or masked. Evidence includes architecture diagrams, access lists for each environment, pipeline controls and the rules for using data outside production.\n\n**Common gaps.** Copies of real personal data in test systems are a very common finding and a GDPR concern. Shared credentials or tooling across environments and emergency access to production that becomes permanent also undermine separation.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"ai-coding-tools-create-security-validation-gap-in-development-lifecycle","AI coding tools create security validation gap in development lifecycle","2026-05-27T16:20:27.825+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",{"slug":28,"name":29,"problem":30,"stories":9},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":32,"name":33,"problem":34,"stories":9},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[36,41,46,51],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","16","Control 16","Application Software Security",{"family":42,"item":43,"code":44,"title":45,"together":9},"nist-sp","800-218","SP 800-218","SP 800-218: Secure Software Development Framework (SSDF) Version 1.1",{"family":47,"item":48,"code":49,"title":50,"together":9},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",{"family":52,"item":53,"code":54,"title":54,"together":9},"soc2","overview","SOC 2"]