id: "SA-03(02)" title: "Use of Live or Operational Data" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-03.02" priority: "P1" implementation_level: "organization" parent: "SA-03" enhancement: True
Approve, document, and control the use of live data in preproduction environments for the system, system component, or system service; and
Protect preproduction environments for the system, system component, or system service at the same impact or classification level as any live data in use within the preproduction environments.
Guidance
Live data is also referred to as operational data. The use of live or operational data in preproduction (i.e., development, test, and integration) environments can result in significant risks to organizations. In addition, the use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Therefore, it is important for the organization to manage any additional risks that may result from the use of live or operational data. Organizations can minimize such risks by using test or dummy data during the design, development, and testing of systems, system components, and system services. Risk assessment techniques may be used to determine if the risk of using live or operational data is acceptable.
Assessment Objective: the use of live data in pre-production environments is approved for the system, system component, or system service;
Assessment Objective: the use of live data in pre-production environments is documented for the system, system component, or system service;
Assessment Objective: the use of live data in pre-production environments is controlled for the system, system component, or system service;
Assessment Objective: pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.
System and services acquisition policy
system and services acquisition procedures
procedures addressing the integration of security and privacy into the system development life cycle process
system development life cycle documentation
security risk assessment documentation
privacy impact assessment
privacy risk assessment documentation
system security plan
privacy plan
data mapping documentation
personally identifiable information processing policy
procedures addressing the authority to test with personally identifiable information
procedures addressing the minimization of personally identifiable information used in testing, training, and research
other relevant documents or records
Organizational personnel with information security and privacy responsibility
organizational personnel with system life cycle development responsibilities
Organizational processes the use of live data in pre-production environments
mechanisms for protecting live data in pre-production environments