← SA-3
SA-3(2) SA · System and Services Acquisition

Use of Live or Operational Data

LOW MODERATE HIGH
1 Overlay 2 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Live data is also referred to as operational data. The use of live or operational data in preproduction (i.e., development, test, and integration) environments can result in significant risks to organizations. In addition, the use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Therefore, it is important for the organization to manage any additional risks that may result from the use of live or operational data. Organizations can minimize such risks by using test or dummy data during the design, development, and testing of systems, system components, and system services. Risk assessment techniques may be used to determine if the risk of using live or operational data is acceptable.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for SA-3(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. the use of live data in pre-production environments is approved for the system, system component, or system service;
  2. the use of live data in pre-production environments is documented for the system, system component, or system service;
  3. the use of live data in pre-production environments is controlled for the system, system component, or system service;
  4. pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.

Examine

[SELECT FROM: System and services acquisition policy; system and services acquisition procedures; procedures addressing the integration of security and privacy into the system development life cycle process; system development life cycle documentation; security risk assessment documentation; privacy impact assessment; privacy risk assessment documentation; system security plan; privacy plan; data mapping documentation; personally identifiable information processing policy; procedures addressing the authority to test with personally identifiable information; procedures addressing the minimization of personally identifiable information used in testing, training, and research; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security and privacy responsibility; organizational personnel with system life cycle development responsibilities].

Test

[SELECT FROM: Organizational processes the use of live data in pre-production environments; mechanisms for protecting live data in pre-production environments].

Overlays

Showing the OT/ICS overlay for the parent control SA-3 — see the SA-3(2) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

  • Base control: Included (matches standard baseline)

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for SA-3(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • System and services acquisition policy
  • system security plan
  • privacy plan
  • personally identifiable information processing policy

Testing

  • Organizational processes the use of live data in pre-production environments
  • mechanisms for protecting live data in pre-production environments

Other Records

  • system and services acquisition procedures
  • procedures addressing the integration of security and privacy into the system development life cycle process
  • system development life cycle documentation
  • security risk assessment documentation
  • privacy impact assessment
  • privacy risk assessment documentation
  • data mapping documentation
  • procedures addressing the authority to test with personally identifiable information
  • procedures addressing the minimization of personally identifiable information used in testing, training, and research
  • other relevant documents or records