+SA-09(08) Processing and Storage Location — U.S. Jurisdiction
|
SA-09(08) Processing and Storage Location — U.S. Jurisdiction
Control
Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
Discussion
The geographic location of information processing and data storage can have a direct impact on the ability of organizations to successfully execute their mission and business functions. A compromise or breach of high impact information and systems can have severe or catastrophic adverse impacts on organizational assets and operations, individuals, other organizations, and the Nation. Restricting the processing and storage of high-impact information to facilities within the legal jurisdictional boundary of the United States provides greater control over such processing and storage.
Assessment Objective
the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.
Assessment Method
Examine
System and services acquisition policy
system and services acquisition procedures
procedures addressing external system services
acquisition contracts for the system, system component, or system service
solicitation documentation
acquisition documentation
service level agreements
procedures addressing determining jurisdiction restrictions for processing and storage location
information/data and/or system services
organizational security requirements or conditions for external providers
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organization personnel with supply chain risk management responsibilities
external providers of system services
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|