ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Cross-border privacy requirements focus on where personal data may be stored or processed once it leaves the country or legal jurisdiction in which it was collected. The most appropriate requirement therefore restricts storage or processing to the originating region unless a lawful transfer mechanism-such as an adequacy decision, standard contractual clauses, or user consent-has been documented. Encrypting data, setting retention limits, or enforcing multi-factor authentication are valuable security and privacy controls, but none of them specifically mitigate jurisdictional or residency risks that arise when data crosses borders. Only the option limiting data movement and mandating a legal basis directly addresses the stated concern.