New Zealand Information Security Manual (NZISM) 23.4.11.C.02: Data location risks in public cloud risk assessments

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Chapter 23: Public Cloud Security – New Zealand Information Security Manual (NZISM)

• 23.1.54.C.01 23.1.54.C.01 Identify classification, domain and trust zone boundaries for public cloud
• 23.1.54.C.02 23.1.54.C.02 Separate domain when multiple identity systems control access
• 23.1.55.C.01 23.1.55.C.01 Understand shared security responsibilities per cloud service
• 23.1.55.C.02 23.1.55.C.02 Document agency and provider security responsibilities
• 23.1.55.C.03 23.1.55.C.03 Align security processes with provider responsibilities
• 23.1.56.C.01 23.1.56.C.01 Infrastructure as code for cloud management
• 23.2.16.C.01 23.2.16.C.01 Update risk assessment process for public cloud risks
• 23.2.16.C.02 23.2.16.C.02 Per-service cloud risk assessment following GCDO process