NIST SP 800-210 General Access Control Guidance for Cloud Systems 5.1: Preserve the data owner's control over application data held by the SaaS provider

What does 5.1 require?

For application data owned by consumer organisations and stored in the provider's database, the questions of where data is kept, its retention period, and whether the provider may decide access rights to it are answered; where the provider can set access rights, an up-to-date access control policy from the data owner is always enforced. A mutually agreed security class agreement can define each data provider's security class so that replicas carry the same class and only qualified hosts serve requests.