+SA-09(05) Processing, Storage, and Service Location
|
SA-09(05) Processing, Storage, and Service Location
Control
Restrict the location of [Selection(one-or-more): information processing; information or data; system services] to [Assignement: locations] based on [Assignement: requirements].
Discussion
The location of information processing, information and data storage, or system services can have a direct impact on the ability of organizations to successfully execute their mission and business functions. The impact occurs when external providers control the location of processing, storage, or services. The criteria that external providers use for the selection of processing, storage, or service locations may be different from the criteria that organizations use. For example, organizations may desire that data or information storage locations be restricted to certain locations to help facilitate incident response activities in case of information security incidents or breaches. Incident response activities, including forensic analyses and after-the-fact investigations, may be adversely affected by the governing laws, policies, or protocols in the locations where processing and storage occur and/or the locations from which system services emanate.
Assessment Objective
based on [Assignement: requirements], [Selection(one-or-more): information processing; information or data; system services] is/are restricted to [Assignement: locations].
Assessment Method
Examine
System and services acquisition policy
procedures addressing external system services
acquisition contracts for the system, system component, or system service
solicitation documentation
acquisition documentation
service level agreements
restricted locations for information processing
information/data and/or system services
information processing, information/data, and/or system services to be maintained in restricted locations
organizational security requirements or conditions for external providers
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
external providers of system services
organizational personnel with supply chain risk management responsibilities
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|