A DSP with a compelling reason to store data outside Australia consults the ATO first and demonstrates it has considered jurisdictional constraints; the ATO prefers redundancy locations to mirror the primary environment and will consider offshore redundancy where strong encryption and alignment to APRA CPG 235 (Managing Data Risk) and SPG 231 (Outsourcing) are shown. Consistent with CPG 235 the ATO expects enterprise frameworks (security, project management, system development, outsourcing and risk management), a detailed risk assessment, an understanding of the business processes and data sensitivity affected, and a business case for the added risk; consistent with SPG 231, a risk assessment with mitigations covering country, compliance (legal), contractual, access (including the ATO's information gathering powers) and counterparty risk; and an offshoring agreement with security and confidentiality provisions. A DSP storing data offshore tells customers their data is in a foreign jurisdiction, applies the Australian Privacy Principles and gives customers guidance on where and how their data is managed.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.