To prove development, test and production are separate under ISO 27001 control 8.31, show distinct environments, distinct access, and a controlled path for moving code between them. Keep an environment diagram, access lists per environment, and a sample deployment record. Auditors check that the separation is effective.
What the control protects
Control 8.31 keeps production safe from intentional or unintentional changes, and from flaws that can exist in development and test systems. A half finished feature on a developer laptop should never be able to touch live data.
A policy or procedure is recommended, not mandatory. Smaller and mid sized companies can use the secure development policy. Larger ones write a dedicated procedure.
What to separate
The guidance mentions separate routers, firewalls and servers for each environment, and notes most companies can do this with tools they already have. In a cloud setup the same idea means separate accounts or projects, networks and credentials.
| Layer | Separation to show |
|---|---|
| Network | Rules that stop test systems reaching production |
| Accounts | Different credentials per environment |
| Data | Production data not copied into test without protection |
| People | Production access limited to named roles |
| Release path | Code moves by pipeline, not by hand |
Proof to keep
- A simple diagram of the three environments
- Access lists per environment, dated
- Criteria for segregation written in the policy
- A recent deployment record showing the promotion path
- A note on how test data is handled
Auditors typically check whether the environments are effectively separated, so a sample of access and one live walkthrough beat a long document.
Common gaps
- Shared admin credentials across environments
- A test database restored from production with no masking
- Developers deploying straight to production from a laptop
- Staging that can call production services
How to run the walkthrough
Auditors often ask to see this live. Prepare by listing, for each environment, where it runs, who can log in and how code reaches it. Be ready to show a deployment that went from test to production and the approval attached to it. If your team has a quick fix path that skips the pipeline, say so and show how it is controlled. Honesty about the exception, with a record, reads far better than a surprise discovered later.
Quick check
Do small companies need physically separate servers?
No. The control is about effective separation. Separate cloud accounts, networks and credentials can meet it.
Is a staging environment mandatory?
The control names development, test and production. How you name and build the middle environment is up to you, as long as it is separated.
Where tooling helps
Safeguard offers asset discovery, which helps you see what runs where, and compliance and evidence automation for keeping records. Network design remains your infrastructure team's job. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
