A healthcare company plans to store regulated patient records in a provider's object storage service that disperses fragments of each object across facilities in several countries. Legal counsel raises a concern before approval. Which issue should the cloud security professional address first?
Select an answer to reveal the explanation.
Short Explanation
Spreading data across the globe is great for resilience, but the law cares where every piece lands. You've got to pin those fragments to approved regions, because a regulator won't accept 'it's only a fragment' as an excuse. Don't get distracted by deletion or integrity myths here.
Full Explanation
Dispersion improves durability, but it can scatter fragments of regulated data across facilities in multiple countries. Privacy and health regulations, contractual commitments and data residency policies frequently restrict where personal or health data may be stored and processed, and a fragment of a record is still part of that record for legal purposes. The first issue is therefore data location: the customer must know where fragments reside and constrain storage to permitted jurisdictions, through region selection, provider commitments in the contract and verification. The remanence concern is overstated; dispersed data can be deleted and, more reliably, rendered unreadable by crypto-shredding, so dispersion does not make deletion impossible. Erasure coding preserves the original data exactly on reconstruction, so integrity checks against source hashes still match. Regulations of this kind generally do not impose cross-border reassembly time limits, and latency is a performance matter rather than the legal concern counsel raised. Exam caveat: accountability for compliance stays with the data controller even when the provider chooses physical placement. Operational check: obtain documented region guarantees and confirm configuration restricts storage and replication to approved jurisdictions.