The business wants to move customer records to a cloud provider region located outside the home country to reduce costs. What should the security manager do FIRST?

Moving personal data across borders can trigger legal restrictions on where data may be stored and the conditions under which it may be transferred, and customer contracts may add their own residency commitments. Whether the move is permissible at all, and under what conditions, determines every later decision, so the security manager's first step is to confirm, with legal and compliance, the residency and transfer requirements that apply to these records. Reviewing the provider's certifications and test reports is part of third-party due diligence and is important, but it addresses the provider's control environment, not whether the organization may place the data there. Requiring on-premises key management may be a sensible control, and it might even become a condition of a lawful transfer, but specifying the control before knowing the requirement is solution-first thinking. Negotiating availability and support terms is a commercial step that belongs after the decision to proceed has been validated. Exam caveat: encryption can reduce risk but does not automatically satisfy legal residency requirements; the legal position must be established first. Operational check: obtain a documented legal assessment of the transfer, the identified residency constraints and any required safeguards before signing the cloud contract.