An organization's IT department wants to complete a proof of concept (POC) for a security tool. The project lead has asked for approval to use the production data for testing purposes as it will…

Accepting the risk without a formal assessment is irresponsible, as it bypasses the core function of a risk practitioner to evaluate potential harms and ensure due care.

The risk practitioner's best recommendation is to assess the specific risks (e.g., data breach, corruption, compliance violations) associated with using production data for testing, weighing them against the potential benefits of accurate results, and considering available mitigations and the organization's risk appetite, before making an informed decision.

While benchmarking against peer organizations can provide context, it does not replace a tailored risk assessment specific to the organization's unique data, environment, and compliance obligations.

Denying the request outright without a full risk assessment might prevent the organization from achieving valuable insights if the risks are manageable through controls like data anonymization or strict access.