id: "SA-09(08)" title: "Processing and Storage Location — U.S. Jurisdiction" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-09.08" priority: "P1" implementation_level: "organization" parent: "SA-09" enhancement: True
Statement
Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of the United States.
Guidance
The geographic location of information processing and data storage can have a direct impact on the ability of organizations to successfully execute their mission and business functions. A compromise or breach of high impact information and systems can have severe or catastrophic adverse impacts on organizational assets and operations, individuals, other organizations, and the Nation. Restricting the processing and storage of high-impact information to facilities within the legal jurisdictional boundary of the United States provides greater control over such processing and storage.
Assessment Objective
the geographic location of information processing and data storage is restricted to facilities located within the legal jurisdictional boundary of the United States.
System and services acquisition policy
system and services acquisition procedures
procedures addressing external system services
acquisition contracts for the system, system component, or system service
solicitation documentation
acquisition documentation
service level agreements
procedures addressing determining jurisdiction restrictions for processing and storage location
information/data and/or system services
organizational security requirements or conditions for external providers
system security plan
supply chain risk management plan
other relevant documents or records
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
organization personnel with supply chain risk management responsibilities
external providers of system services
Organizational processes restricting external system service providers to process and store information within the legal jurisdictional boundary of the United States