Skip to main content
All measures

Measure · ISO 27001 and other standards

Agree safe technical system testing

Plan audit or security testing of operational systems with testers, appropriate management and operations. Limit access and interventions, and record actual completion in the existing test assignment.

Accountable: Appropriate management with testers and responsible IT operationsReviewed

Reuse existing records

Use the existing audit or test assignment. It can hold the objective, scope, decision, safeguards and results together. An additional audit-security policy or new form is not required. If the technical test is part of an internal audit, link the existing audit record.

What to do

  1. 1

    Agree the scope and operational boundaries

    Record the objective, affected systems and data, permitted tests and access in the existing assignment. Agree the scope with testers, appropriate management, operations and affected users. Clarify timing, expected load, possible disruption, additional tools and necessary safeguards. Name reachable contacts, monitoring and a clear stopping procedure. Record the decision before access begins.

  2. 2

    Set up limited access and test under control

    Prefer read-only access, limited to the agreed scope. Where that is insufficient, an experienced authorised administrator can carry out the explicitly agreed check on behalf of the testers. Check that necessary devices and tools are appropriately protected. Use suitable isolated copies for more extensive work where the test objective permits. Monitor actual impacts and log test access in the target systems. Stop at agreed limits and resolve deviations with operations.

  3. 3

    Close access, copies and results

    Record the version actually tested, relevant impacts and results in the existing assignment, and report them to appropriate management. Remove temporary access, delete unneeded copies and protect required retention under the existing information protection rules. Connect identified deviations with owned follow-up work and check orderly operation after testing. If a test is stopped, its actual progress remains traceable.

Worked example

Example: A scanner will test an operational application

A team plans technical security testing of an operational application. It uses its existing test assignment.

Preparation
DecisionOperations and testers agree target systems, timing, a limited test account, permitted checks and a load limit. A named person can stop the run.
EvidenceThe assignment holds approved boundaries, contacts and the decision. The limit is a specific operational decision, not an ISO value.
Execution and closure
DecisionOperations monitors impacts during the run. The team records results and deviations, removes temporary access and unnecessary copies, and checks operation.
EvidenceTest access, actual scope, results, closure and necessary follow-up work remain linked to the assignment.

Record the result

  • The existing assignment connects the objective, systems, data, permitted access, timing, safeguards, authorised decision and stopping procedure.
  • Actual execution, test access and relevant impacts are traceable. Temporary access, copies and results are closed in a controlled, protected way.

Common implementation mistakes

Starting a test without agreement

Security testing can disrupt operation too. Agree scope, load, timing and stopping conditions before access begins.

Providing permanent full privileges

Limit rights and duration. Use read-only access or an explicitly agreed controlled testing route, then remove temporary access.

Keeping copies and results without protection

Delete unneeded information. Necessary retention still needs appropriate access and protection under your authoritative rules.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.8.34 · Schutz von Informationssystemen während der AuditprüfungGerman guide

    The workflow connects agreed planning, limited access, operational and information safeguards, controlled testing and closure. Actual configuration, execution and evidence remain necessary.

  • TISAX · 5.2.6

    VDA ISA 6.0.3 · Partial overlap

    The specific test assignment supports timely scope definition, coordination with operations and users, risk-aware execution, reported results and follow-up work. Regular testing, appropriate competence, methods and applicable additional requirements must still be implemented separately.

    Reference

Templates for your implementation

Related resources

Sources and further reading