Where sensitive data resides, and how it moves across borders, is recorded, open to audit and controlled under defined policy; owners understand the jurisdictional effect of cross-border movement and region-specific storage and usage rules, and policy-specified controls apply when cross-border sharing agreements are set up. Automation opportunities: record, and make visible, where the infrastructure that stores, uses and processes a cataloged data set is physically located; trigger cross-border sharing agreement workflows for international transfers and requests; apply regional limits on storage, processing and usage, escalating to the owner; audit and trigger workflow when sensitive data is accessed from a location without a sharing agreement. Certification test steps: entries with and without region-specific rules; recurring scanning; a report of current storage location and the movement audit trail; sensitive assets with no storage location sent to remediation; moving an asset to a new location, or consuming it from a new jurisdiction, triggers the sharing agreement workflow and is recorded in the audit trail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.