I came across a rather disturbing bit of information the other day: many financial services organizations use real data in the development and testing of applications. At least that\u2019s the findings of a study commissioned by Compuware Corp. and conducted by the Ponemon Institute, an independent research firm focused on information and privacy management practices. To be more exact, the study found that 83% of financial service companies use real data in the development and testing of applications.Perhaps these companies overlook that obvious security flaw because they figure application development and testing is typically done in the back room, off the main network, in a non-production environment. Or perhaps, from what I\u2019ve read, developers often prefer to use the real McCoy when developing and testing apps to ensure they are ready for prime time when the time comes. Or perhaps there\u2019s some other reason.Regardless, it\u2019s not the best practice. And you\u2019d think financial services organizations wouldn\u2019t be doing such a thing. After all, financial companies these days are bound by so many data privacy regulations, such as the Sarbanes-Oxley Act (SOX) of 2002 or the data breach notification laws now in effect in a majority of states. And these regulations do not differentiate between product and testing environments; data is data is data, and if it\u2019s supposed to be safe and protected, well then\u2026So this (to me, anyway) surprising statistic got me wondering what the developers many companies have contracted to build and test applications are doing. It\u2019s a critical question I think should be added to a security checklist that needs to be picked through during the deal-making and then deal-signing phases of any outsourcing contract.When you ask whether your outsourcer is ISO 27001- or ISO 27002-certified (two standards that define and specify information management systems for examining risks, threats, and vulnerabilities and implementing controls and management processes), and and exactly who will be touching the code that\u2019s being developed and tested, and whether they\u2019ve had extensive background checks; and when you provide the outsourcer with explicit directions regarding who, and with whom, your code will be shared; you should probably bring up the data point.Forrester Research suggests four steps that companies should follow regarding data and application development and testing: 1) take inventory of test data requirements by defining the regulations and practices you need to comply with; 2) assess your risks by categorizing the sensitivity of production data and determining what data, if any, can be used; 3) create a strategy for replacing production data by masking or depersonalizing data when necessary; and 4) determine who will enforce the practices.What about you, wise readers? Do the findings from the Compuware\/Ponemon study surprise you? And more importantly, do you have any advice or wisdom when it comes to ensuring outsourcers hired to develop and test applications are safeguarding data?