Are your development and testing environments physically and logically separated from your production environment?

Separation of environments is a critical security control that prevents development activities from impacting production systems and reduces the risk of unauthorized access to production data. Without proper separation, testing changes could accidentally affect live systems, developers might have unnecessary access to sensitive production data, and security vulnerabilities in development tools could expose production environments. Evidence of fulfillment could include network diagrams showing segregation between environments, access control matrices demonstrating different permission sets for each environment, documentation of environment provisioning processes, or screenshots of infrastructure management tools showing the distinct environments with their configurations.