[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-33":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-33","Annex A 8.33","Test information",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Select, protect and manage test information appropriately.\n\n**In practice.** Test data is chosen to suit the test while minimising sensitivity, using synthetic data or masked and anonymised copies wherever possible. Where production data must be used, it is authorised in advance, protected with the same controls as production, logged when copied and deleted once testing finishes. Access to test environments is controlled, and test data is kept separate from production systems. Evidence includes the test data policy, approvals for use of production data, masking procedures and deletion records.\n\n**Common gaps.** Full production copies, including personal data, are routinely loaded into development and test environments with weaker access controls. Copies are rarely tracked or deleted, so sensitive data accumulates in places nobody monitors.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]