<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-residency-compliance
description: >-
  Assess and enforce data residency requirements to ensure personal and regulated
  data is stored and processed within jurisdictionally mandated geographic
  boundaries, supporting GDPR cross-border transfer rules and sovereignty mandates.
domain: cybersecurity
subdomain: data-security
tags:
  - data-residency
  - data-sovereignty
  - gdpr-transfers
  - data-localization
  - cross-border
  - schrems-ii
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Data Residency Compliance

## Overview

Assess and enforce data residency requirements to ensure personal and regulated
data is stored and processed within jurisdictionally mandated geographic
boundaries, supporting GDPR cross-border transfer rules and sovereignty mandates.

Mode: `[MODE: PRIVACY]` — Performing Data Residency Compliance.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action audit --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action transfers --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action report --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action audit --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
