SFS 4 / SF 7

Back to SFS 4

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are organization-owned data assets stored only in locations compliant with their security classification requirements throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented data residency policies aligned with classification levels and technical validation of storage locations

Assessment criterion and evidence

Actor: organization. Scope: all storage systems (local, network-attached, cloud) containing organization-owned data assets. Evidence period: entire review period. Required evidence: Documented data classification policy specifying location requirements; Technical evidence mapping data assets to storage locations with classification labels. Negative criterion: Data assets stored in non-compliant locations violating classification-based residency rules. Missing evidence: Pending assessment when storage location mappings or classification records are unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.