NIST SP 800-88 8: Cloud-Resident Data, Hosted Storage, and Scope Boundaries

Address cloud-resident data and hosted storage scope per NIST SP 800-88 Rev 1 considerations (acknowledged in Section 3.6) + cloud-era guidance from NIST CSF 2.0 + NIST SP 800-145 + provider-specific documentation. Cloud-resident data sanitization considerations: (a) sanitization of cloud data primarily relies on provider cryptographic erase + multi-tenant isolation + provider sanitization procedures for decommissioned drives + with consumer key control for BYOK scenarios providing the strongest consumer-side guarantee, (b) ephemeral and copy-on-write storage creates undetected copies that may persist beyond consumer-initiated deletion (snapshots + backups + replication targets + cross-region copies) so consumer must enumerate all storage targets at decommissioning, (c) provider Service Level Agreements must specify sanitization commitments + retention windows + verification mechanisms + provider Certificate of Sanitization equivalent, (d) hosted storage with managed service providers requires contractual chain-of-custody and verification analogous to ITAD vendor management. Scope boundaries between Consumer-controlled sanitization + Provider-controlled sanitization must be documented per cloud service. Multi-tenant residual data risk should be assessed and accepted explicitly. Where consumer regulation demands stronger guarantees than provider standard offers (HIPAA + IRS Pub 1075 + classified data) consider dedicated hardware tenancy + BYOK with consumer key destruction + provider attestation + or on-premise alternative.