Separate Production and Non>Production Systems
Description
Maintain separate environments for production and non-production systems.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Test Data Leak from Development Database in Production Network
ConfidentialityAn attacker compromises a development database containing a copy of production customer data because development and production systems share the same network segment and security controls.
Unstable Development Code Crashes Production System
AvailabilityA developer accidentally deploys experimental code to a production server because development and production environments are not separated, causing a production outage.
Attacker Pivots from Development to Production Environment
ConfidentialityAn attacker compromises a weakly secured development server and uses it as a pivot point to access production systems because both environments share infrastructure and credentials.
Vulnerabilities (When Safeguard Absent)
No Separation Between Production and Non-Production Environments
Without environment separation, development, staging, and production systems share networks, credentials, or infrastructure, allowing issues or compromises in non-production to directly impact production.
Shared Credentials and Access Between Environments
Co-mingled environments often share database credentials, API keys, and service accounts, meaning a compromise of the less-secured development environment exposes production secrets.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |