Requirement 6.5.6: Test data and test accounts are removed from system components

Defined Approach Requirements

6.5.6 Test data and test accounts are removed from system components before the system goes into production.

Customized Approach Objective

Test data and test accounts cannot exist in production environments.

Defined Approach Testing Procedures

6.5.6.a Examine policies and procedures to verify that processes are defined for removal of test data and test accounts from system components before the system goes into production.

6.5.6.b Observe testing processes for both off-the-shelf software and in-house applications, and interview personnel to verify test data and test accounts are removed before a system goes into production.

6.5.6.c Examine data and accounts for recently installed or updated off-the-shelf software and in-house applications to verify there is no test data or test accounts on systems in production.

Purpose

This data may give away information about the functioning of an application or system and is an easy target for unauthorized individuals to exploit to gain access to systems. Possession of such information could facilitate compromise of the system and related account data.