## 8.33 Test information

| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
| ------------ | ------------------------------- | ---------------------- | ------------------------ | ---------------- |
| #Preventive  | #Confidentiality #Integrity     | #Protect               | #Information_protection  | #Protection      |

**Control**
Test information should be appropriately selected, protected and managed.

**Purpose**
To ensure relevance of testing and protection of operational information used for testing.

**Guidance**
Test information should be selected to ensure the reliability of tests results and the confidentiality of the relevant operational information. Sensitive information (including personally identifiable information) should not be copied into the development and testing environments (see [8.31](a-8.31-Separation-of-development-test-and-production-environments.md)).

The following guidelines should be applied to protect the copies of operational information, when used for testing purposes, whether the test environment is built in-house or on a cloud service:

a\) applying the same access control procedures to test environments as those applied to operational environments;

b\) having a separate authorization each time operational information is copied to a test environment;

c\) logging the copying and use of operational information to provide an audit trail;

d\) protecting sensitive information by removal or masking (see [8.11](a-8.11-Data-masking.md)) if used for testing;

e\) properly deleting (see [8.10](a-8.10-Information-deletion.md)) operational information from a test environment immediately after the testing is complete to prevent unauthorized use of test information.

Test information should be securely stored (to prevent tampering, which can otherwise lead to invalid results) and only used for testing purposes.

**Other information**
System and acceptance testing can require substantial volumes of test information that are as close as possible to operational information.