Limitation of Production Data Use

[Applicable to all service providers]
1. Establish a policy to specify procedures for secure handling, sanitization, anonymization, and compliance with regulations when using or replicating production data.

2. Conduct risk assessments to identify risks associated with data use.

3. Define and enforce physical and logical boundaries to keep production data secure.

4. Establish and implement policies and procedures for secure development and managing changes.

5. Implement segregation of duties and enforce least privilege access to production environments only after authorization from data owner. 

6. Implement principle of least privilege and authorized access to datasets, models, and other sensitive information.

7. Implement security measures to secure datacenters.

8. Provide regular training on security, privacy, and secure coding practices.

9. Implement timely termination and management of employee access.

10. Monitor assets, enforce secure configurations, and manage vulnerabilities on infrastructure and applications processing and storing production data.

11. Enable logs and continuously monitor system access for anomalies.

12. Replicate only the necessary data to minimize potential risks.

13. Anonymize or pseudonymize data to protect privacy and reduce the risk of exposing sensitive information.

14. Implement security measures such as encryption, and secure data transfer protocols.

15. Ensure data replication complies with relevant data protection laws and regulations, such as GDPR.

16. Maintain detailed records of the data replication process and perform periodic audits to ensure compliance.

17. Establish process to inform relevant stakeholders about the data replication process, including its purpose and scope.

18. Detect and remove or remediate sensitive or poisoned data before using it for training.

19. Implement mechanisms to ensure the integrity of data, models, and code used in AI development and deployment.

20. Implement the process of obtaining authorization from data owner before using the data for non-production purposes.

1. Verify that infrastructure-level policies and technical safeguards are in place to control the use of production tenant data in test, dev, or benchmarking environments.

2. Verify if infrastructure users (e.g., internal teams or client teams) obtain approval before replicating production workloads or datasets in non-production environments.

3. Verify if mechanisms (e.g., data masking, encryption) are in place to anonymize and secure data during infrastructure provisioning or testing.

4. Verify if any deviations from the infrastructure provider’s standard for handling production data are documented and approved.

5. Verify if infrastructure governance procedures are periodically updated to reflect regulatory, contractual, or service-level agreement changes.

6. Verify if internal teams are trained on policies and practices for securing client or production data when testing or provisioning infrastructure services.