Why it matters
Real customer data used carelessly in test environments is a common, avoidable exposure.
How a self-led small team implements it
A stated rule against using real production data in test environments, backed by masking (A.8.11) where needed.
What auditors expect to see
Test data policy.
Track A.8.33 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS