PSS-12 Locations of Data Processing and Storage
Let the cloud customer choose, from the options available under its contract, the location or country in which its data is processed, stored and backed up, and ensure the cloud architecture itself enforces that choice.
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Backup / DR tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration evidence that backup copies remain within the chosen region · Backup / DR tooling
periodic reviewEvidence produced at each review
- Record confirming a tenant's actual data placement matches its selection · Document repository
governing documentDocuments that govern the control
- Contract or ordering options listing the selectable processing and storage regions · Vendor register / contract repository
- Architecture documentation showing regional placement is technically enforced · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Backup / DR tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Primary storage pinned regionally while backups or replicas leave the region
- Placement honoured by process alone with nothing preventing a cross region deployment
- Support tooling and telemetry data processed outside the selected location
- Customers given a choice with no means of verifying where data actually resides
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPSS-11 Images for Virtual Machines and Containers · SIM-01 Policy for security incident management