Incident response

DRHCSEC09: Have your incident responders been trained on your data residency policies?

Incident responders should be aware of your data residency policies, and they should check for data that is located in unapproved locations.

DRHCSEC10: Have your threat models been updated to cover data in unauthorized locations?

While threat models typically focus on exfiltration of data, they should be updated to include scenarios where data gets stored in locations that aren't compliant with data residency regulations and control objectives.

Best practices

• DRHCSEC09-BP01 Train and test incident responders on policies specific to data residency

• DRHCSEC10-BP01 Update your threat models to cover the accidental or malicious storage of data in unauthorized locations