Where the data physically sits

Where does the file actually live

Every organisation can answer this for the obvious systems and almost none can answer it completely. The complete answer includes places data goes that nobody chose deliberately.

Cloud services handling covered information

Where a cloud service processes or stores covered defence information, the defence clause requires the provider to meet a specified security baseline or its equivalent, and imposes obligations on you about incident reporting and access.

Which means the choice of service is a compliance decision rather than an IT one, and a service that is excellent and does not meet the baseline is not available to you for that data.

Six places data goes that nobody mapped

Backups. Frequently in a different region from the system they protect.

Disaster recovery sites. Same question.

Support tooling. Screen sharing, remote assistance and diagnostic uploads all move data, sometimes abroad.

Logging and monitoring platforms. Which by design receive a copy of a great deal.

Email and collaboration. Where the covered file was attached once and remains.

Vendors' own support staff. Who may be anywhere and who may be able to see what they are supporting.

Where are your support people

Not where the data centre is: where the humans with administrative access sit, and what nationality arrangements apply to them. Reputable vendors answer this readily because they are asked it constantly by this sector.

It matters for the security requirement and, as the entry on export control notes, potentially for a different regime entirely.

What they are and what they are not

Several providers operate environments intended for this sector, with personnel and location constraints that ordinary commercial environments do not carry.

They cost more, they lag on features, and they answer questions the commercial equivalent cannot. Whether you need one depends on what you put in it, which returns to the boundary decision that governs everything else.

A diagram with arrows leaving the page

Draw where covered information is created, where it is stored, and every place a copy goes. Include the six above. The arrows that leave your organisation are the list of relationships that need examining.

Most suppliers doing this for the first time find at least one they had forgotten, and it is usually a support tool.

Providers move things

A service that processed your data in one region may not next year, and the change arrives as a release note. Where a contract term requires notice of such changes, it is worth having; where it does not, the review has to catch it.

Add it to the annual supplier review from the entry on your own suppliers.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.