+CM-04(01) [H] Separate Test Environments

CM-04(01) [H] Separate Test Environments

Control

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.

Discussion

A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.

Assessment Objective

  1. changes to the system are analyzed in a separate test environment before implementation in an operational environment;
  2. changes to the system are analyzed for security impacts due to flaws;
  3. changes to the system are analyzed for privacy impacts due to flaws;
  4. changes to the system are analyzed for security impacts due to weaknesses;
  5. changes to the system are analyzed for privacy impacts due to weaknesses;
  6. changes to the system are analyzed for security impacts due to incompatibility;
  7. changes to the system are analyzed for privacy impacts due to incompatibility;
  8. changes to the system are analyzed for security impacts due to intentional malice;
  9. changes to the system are analyzed for privacy impacts due to intentional malice.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation analysis tools and associated outputs system design documentation system architecture and configuration documentation change control records procedures addressing the authority to test with PII system audit records documentation of separate test and operational environments system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by CM-04(01) [H] Separate Test Environments – Assessment Procedure
is blocked by Separation of Development, Testing and Operational Environments
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.