---
title: "Are development, testing, and production conducted in separate environments?"
url: https://insuranceposture.com/questions/network-and-logging/development-testing-production-conducted-separate-environments
category: "Network, logging and monitoring"
canonical_key: q_net_004
evidence_state: partial
updated: 2026-08-24
---

# Are development, testing, and production conducted in separate environments?

URL: https://insuranceposture.com/questions/network-and-logging/development-testing-production-conducted-separate-environments
Section: Network, logging and monitoring
Evidence state: Partly verifiable from your tenant

The real question underneath is whether production data has been copied into environments with weaker controls.

## What the carrier is actually asking

The carrier is asking whether development, test, and production run in separate environments with separate access. It is asking about isolation and, implicitly, about whether real data is used outside production.

## Why it is underwritten

Non-production environments routinely have weaker access control, no monitoring, and broader developer access, and they routinely contain a copy of production data. That combination has produced a long list of breaches where the compromised system was a test environment nobody was watching.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

In the cloud, separation is measurable through subscription and identity boundaries.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Azure | Separate subscriptions or management groups per environment | Environments in distinct scopes with distinct role assignments |
| Azure | Role assignments per environment | Production access is a separate grant, so development access does not confer it |
| Azure | Network connectivity between environments | No routed path from development into production data services |
| Data handling | Whether production data is copied into lower environments | Masking or synthetic data, since the alternative extends the regulated footprint. Attested |
| Azure | Public exposure of non-production resources | Test systems are frequently the ones left publicly reachable, so check them specifically |

**Test data is production data**

If a copy of the customer database sits in a test environment, that environment is inside the scope of every breach and every privacy obligation, with none of the controls. Masking is the fix, and it is deferred more often than any other data control.

## What a defensible yes requires

- Environments are separate at the subscription or account level with distinct access.
- Production access is granted separately and held by fewer people.
- Non-production data is masked or synthetic.
- No network path connects development directly to production data.
- Non-production resources are checked for public exposure, since they are the most likely to have it.

## How this answer goes wrong

Environments are separated by naming convention inside one subscription, with one role assignment covering all of them. Or they are properly separated and the test environment holds a full copy of production data with developer-wide access.

## If this answer turns out to be wrong

Remote access exposure and log retention are what a forensic report describes first, which makes them the answers most often revisited after a loss. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Is separation by resource group enough?

It is weaker than subscription separation because inherited permissions cross it easily. It can work with careful role design, and subscription separation is the cleaner boundary.

### Can we use production data in testing?

Only masked or with the same controls as production. Most organisations underestimate how much regulated data sits in their test environments.

### What about developer access to production?

It should be exceptional, time-bound, and logged. Standing developer access to production is a common finding and a real exposure.

### Does this apply to software-as-a-service?

Yes, where sandbox instances hold real data. The same principle applies to platforms you do not host.

## Related questions

- [Has the Applicant applied network segmentation within its environment?](https://insuranceposture.com/questions/network-and-logging/applicant-applied-network-segmentation-within-environment)
- [Is access restricted on a least-privilege basis to network, Personal Information, and Critical Information?](https://insuranceposture.com/questions/access-control/access-restricted-least-privilege-basis-network-personal-information-critical)
- [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci)
- [Does the use and distribution of administrator and privileged access require senior management approval?](https://insuranceposture.com/questions/access-control/distribution-administrator-privileged-access-require-senior-management-approval)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.