{"id":"PLT-010","section":"Platform, Privacy & Assurance","requirement":"Offer required hosting regions","acceptance":"Document processing and storage locations, regional failover, subprocessor boundaries and tenant residency enforcement.","tier":"Tier-independent","whyItMatters":"Where data is processed and stored is often a contractual and legal requirement.","verificationMethod":"D","verificationTest":"The vendor documents processing and storage locations, failover and subprocessor boundaries.","formerly":"ARC-008","alsoIn":[],"sort":64,"adoptionContext":"Hosting and subprocessor-location choices are cross-tier deployment concerns; adoption tier does not create a universal residency obligation.","mappings":[{"frameworks":["csf","rmf","soc2"],"explanation":"Documented processing locations, regional failover and subprocessor boundaries supply evidence for assessing third-party dependencies and associated supplier and legal risks. Location records do not verify residency enforcement or resolve those risks; US/EU hosting is not a universal requirement.","kind":"framework","references":{"csf":["GV.SC-07"],"rmf":["MAP 4.1"],"soc2":["CC9.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Hosting, failover and subprocessor details inform computing-resource documentation and supplier responsibilities. Region availability alone does not establish suitable supplier terms or operating residency controls.","kind":"framework","references":{"iso":["A.4.5","A.10.3"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Documented locations and residency-enforcement arrangements support the buyer’s cloud-use governance and applicable data-location/privacy obligations. Documentation alone does not demonstrate residency enforcement. US/EU hosting is not universally required by ISO and does not prove lawful transfer, suitable subprocessor agreements or failover arrangements.","kind":"framework","references":{"iso27001":["A.5.23","A.5.31","A.5.34"]},"relation":null,"conditions":[]}],"area":"Platform, Privacy & Assurance","areaSlug":"PLT","url":"/r/PLT-010","frameworkRefs":{"ISO27001":["A.5.23","A.5.31","A.5.34"],"ISO42001":["A.4.5","A.10.3"],"NIST-CSF":["GV.SC-07"],"NIST-AI-RMF":["MAP 4.1"],"SOC2":["CC9.2"]}}