# PLT-010: Offer required hosting regions


- Area: Platform, Privacy & Assurance

- Verification: Documentation
- OWASP adoption tier: Tier-independent
- Formerly: ARC-008
- URL: /r/PLT-010

**Acceptance criteria:** Document processing and storage locations, regional failover, subprocessor boundaries and tenant residency enforcement.

**Why it matters:** Where data is processed and stored is often a contractual and legal requirement.

**How to verify:** The vendor documents processing and storage locations, failover and subprocessor boundaries.

**OWASP adoption context:** Hosting and subprocessor-location choices are cross-tier deployment concerns; adoption tier does not create a universal residency obligation.

**Mappings:**
- NIST CSF 2.0: GV.SC-07; NIST AI RMF: MAP 4.1; SOC 2: CC9.2 — Documented processing locations, regional failover and subprocessor boundaries supply evidence for assessing third-party dependencies and associated supplier and legal risks. Location records do not verify residency enforcement or resolve those risks; US/EU hosting is not a universal requirement.
- ISO 42001: A.4.5, A.10.3 — Hosting, failover and subprocessor details inform computing-resource documentation and supplier responsibilities. Region availability alone does not establish suitable supplier terms or operating residency controls.
- ISO 27001: A.5.23, A.5.31, A.5.34 — Documented locations and residency-enforcement arrangements support the buyer’s cloud-use governance and applicable data-location/privacy obligations. Documentation alone does not demonstrate residency enforcement. US/EU hosting is not universally required by ISO and does not prove lawful transfer, suitable subprocessor agreements or failover arrangements.