What is Separation of development, test and production?
In short
Organizations keep separate environments for developing, testing and running (production) systems, so changes are tested before they affect live data and developers can't change production directly.
Key takeaways
- Moving changes into production should be done by someone other than the developer, after approval.
- Test data should not include unmasked sensitive production data.
- Emergency changes still need to be reviewed after the fact.
Where it's tested
ISC: Information Technology General Controls (ITGCs) — study notes, a five-minute revision sheet and practice questions.
Practise: 3 questions
Question 1 of 3 · 0 answered
A developer at a company has standing write access to the production database. Which ITGC category does this deficiency primarily relate to, and why does it matter?