한국어
2.8.2

Test Data Security

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 3Cases 4

Certification criterion

To prevent leakage of operational data during the system testing process, procedures for the generation, use and management, disposal, and technical protection measures of test data shall be established and implemented.

Key checkpoints

  1. Is the use of actual operational data restricted during the development and testing process of the information system?
  2. When operational data is unavoidably used in the test environment, are control procedures such as approval by the responsible person, monitoring of access and leakage, and deletion of data after testing established and implemented?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.8.4 Test Data Security], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The use of actual operational data shall be restricted during the development and testing process of the information system.

  • To prevent personal information and important information from being leaked during the system testing process, test data is used by generating arbitrary data or by processing/transforming operational data before use
  • Establish and implement standards/procedures for the transformation and use of test data

When operational data is unavoidably used in the test environment, control procedures such as approval by the responsible person, monitoring of access and leakage, and deletion of data after testing shall be established and implemented.

  • Prepare an approval procedure for the use of operational data : define reporting and approval systems according to data importance, etc.
  • Prepare and implement a data disposal procedure after the test deadline expires
  • Apply access control measures in the test environment for the use of operational data
  • Perform monitoring and periodic review of the replication/use of operational data, etc.

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

  • Status of test data
  • Test data generation rules
  • When operational data is used in the test environment, the related approval history

Nonconformity examples

  • When specific standards and procedures for generating test data to be used on the development server have not been established
  • When actual operational data is used as test data without processing, and without a valid reason or approval by the responsible person
  • When, having obtained prior approval to use actual operational data for testing purposes for an unavoidable reason, the same level of access control as the operational database is not applied to the test database
  • When actual operational data used for testing purposes is not deleted from the test database even after the test has been completed

Source

Source: The certification criterion is based on [Annex 7-3] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2024.7.24); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2024.7.24); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7-3
Applies toISMS / ISMS-P
Key checkpoints2
Evidence3
Cases4
Related laws-
Annex 7 / 2.8.2Annex 7