DRHCSEC01-BP01 Update your control objectives to address your data residency compliance requirements

Control objectives should be updated to clearly indicate where data is expected to be located due to data residency requirements.

Desired outcome: Control objectives identify the locations and conditions where specific data is required to be stored.

Benefits of establishing this best practice: Clarifies requirements which facilitates implementation of those requirements as well as control automation and audit.

Level of risk exposed if this best practice is not established: High

Implementation guidance

Update documentation of data residency requirements and control objectives with specific details on which data elements are subject to allowed or disallowed storage and transmission locations. For more detail, see SEC01-BP03 Identify and validate control objectives.