In a system handling sensitive personal data, suppose a class of trial accounts was deliberately excluded from pre-production access-control testing because those accounts were not intended to access production. After launch, it was discovered that hundreds of those trial accounts were technically capable of accessing all live reporting records.

From a security assurance / C&A / IAM perspective:

1. Would excluding those accounts from effective-access testing normally be considered an assurance scope gap?
2. Is “these accounts were not intended to access production” normally enough reason not to test whether they actually could?
3. Would you expect negative authorisation testing to verify that non-production/trial account types cannot reach production data?
4. Would this normally be characterised as a testing failure, configuration failure, assurance failure, or some combination?
5. What records would you expect to exist afterwards to establish where the control failed?

Looking for some input from people who work in software security, IAM/RBAC, or government IT assurance. I’m not particularly technical, so I’m trying to get my head around what would normally be expected here.

Say you’ve got a system holding sensitive personal information. It has a live production environment, a training environment, and role-based access controls. Before launch it goes through a formal Certification & Accreditation process and gets an Authority to Operate.

Later on, some legitimate accounts that had previously been used for trial or familiarisation purposes are found to be able to access live production reports they weren’t meant to see.

The organisation has since said that:

• nothing about those accounts changed on the day the reports became available;
• the pre-launch C&A had no remediation finding around trial-account segregation, RBAC, report permissions, environment separation or production access; and
• the Authority to Operate had no related condition or residual risk.

What I’m trying to understand is: would a normal C&A/security assessment be expected to test the actual permissions of different account types, including whether trial/training/familiarisation accounts can reach production data? Or is that the sort of thing that could reasonably sit outside the scope of C&A?

Also, what would people who work in this area actually call that kind of testing? Access-control testing? Authorisation testing? RBAC validation? Environment segregation testing?

I’m more interested in what normal assurance practice would look like.