Address cloud-resident data and hosted storage scope per NIST SP 800-88 Rev 1 considerations (acknowledged in Section 3.6) + cloud-era guidance from NIST CSF 2.0 + NIST SP 800-145 + provider-specific documentation. Cloud-resident data sanitization considerations: (a) sanitization of cloud data primarily relies on provider cryptographic erase + multi-tenant isolation + provider sanitization procedures for decommissioned drives + with consumer key control for BYOK scenarios providing the strongest consumer-side guarantee, (b) ephemeral and copy-on-write storage creates undetected copies that may persist beyond consumer-initiated deletion (snapshots + backups + replication targets + cross-region copies) so consumer must enumerate all storage targets at decommissioning, (c) provider Service Level Agreements must specify sanitization commitments + retention windows + verification mechanisms + provider Certificate of Sanitization equivalent, (d) hosted storage with managed service providers requires contractual chain-of-custody and verification analogous to ITAD vendor management. Scope boundaries between Consumer-controlled sanitization + Provider-controlled sanitization must be documented per cloud service. Multi-tenant residual data risk should be assessed and accepted explicitly. Where consumer regulation demands stronger guarantees than provider standard offers (HIPAA + IRS Pub 1075 + classified data) consider dedicated hardware tenancy + BYOK with consumer key destruction + provider attestation + or on-premise alternative.
This control maps to 37 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 37 it maps to, and the evidence behind each claim, over MCP and REST.