Navigate

SA-15 (9)

SA-15 (9): Use Of Live Data

The organization approves, documents, and controls the use of live data in development and test environments for the information system, system component, or information system service.

Supplemental

The use of live data in preproduction environments can result in significant risk to organizations. Organizations can minimize such risk by using test or dummy data during the development and testing of information systems, information system components, and information system services.

CIA Levels
Confidentiality	low
Integrity	unknown
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Mod)

Related Controls

The controls below (if any) were marked by NIST as being related to SA-15 (9).

Control	Description
No controls

Enhancements

The controls below (if any) add on to the requirements of SA-15 (9).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SA-15 (9).

CCI	Definition
CCI-003283	The organization approves the use of live data in development environments for the information system, system component, or information system service.
CCI-003284	The organization approves the use of live data in test environments for the information system, system component, or information system service.
CCI-003285	The organization documents the use of live data in development environments for the information system, system component, or information system service.
CCI-003286	The organization documents the use of live data in test environments for the information system, system component, or information system service.
CCI-003287	The organization controls the use of live data in development environments for the information system, system component, or information system service.
CCI-003288	The organization controls the use of live data in test environments for the information system, system component, or information system service.