Skip to main content
Ian Job

ISO/IEC 27001:2022 · Technological control

ISO 27001 Annex A 8.33: Test information

Quick answer

ISO 27001 Annex A 8.33 (Test information) is a technological control. Select, protect and manage information used for testing.

What auditors look for

Auditors check that 8.33 is either justified as not applicable in your Statement of Applicability or implemented and working. Typical evidence includes:

  • Test data rules
  • Masked or synthetic test datasets
  • Approval for any use of live data

How to implement 8.33 in practice

  1. Prefer synthetic data
  2. Mask any production data used
  3. Delete test copies after use
  4. Name an owner for 8.33, decide how often it runs and file evidence each time, so the control is audit-ready all year.

How 8.33 supports GDPR

This control helps demonstrate GDPR Art. 25, 32. Map it once in your control matrix so the same evidence supports both ISO 27001 and GDPR accountability. See the GDPR compliance checklist.

Recording 8.33 in the Statement of Applicability

List 8.33 with whether it applies, the reason (usually the risks it treats or a legal or contractual requirement), its implementation status and where the evidence lives. If you exclude it, explain why none of your risks or obligations require it.

Free resources

More technological controls