Test information

The data and other materials used for testing should be carefully selected and protected.

Production information that contains personal or other confidential information should not be used for testing purposes.

The use of production data for testing purposes should be avoided. If confidential information is used in testing, the following security measures should be used:

• all sensitive details should be either deleted or made secure (e.g. anonymisation of personal data)
• testing environments are subject to the same strict access control as production
• copying production data to the test environment is done only with a separate authorization
• production data is removed from the test environment immediately upon completion of testing