# Data Residency Requirements Assessment: Score Your Export Control and CUI Data Controls > Source: https://netray.co/tools/data-residency-requirements-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 8 questions on ITAR and CUI data location, US-persons-only cloud enforcement, and sub-tier verification to score your data residency compliance posture. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### Do you know which of your systems store or process ITAR-controlled technical data or Controlled Unclassified Information (CUI)? **Options:** ##### No inventory exists **Score:** 0 ##### Partial inventory covering some systems **Score:** 4 ##### Documented inventory for major systems **Score:** 7 ##### Complete, actively maintained inventory across all systems **Score:** 10 #### Are cloud workloads handling export-controlled data restricted to US-persons-only environments where required? **Options:** ##### Not restricted at all **Score:** 0 ##### Some workloads run in commercial cloud, with awareness of the gap **Score:** 3 ##### Most workloads restricted, with a few legacy exceptions remaining **Score:** 7 ##### Fully restricted and verified environments for all in-scope data **Score:** 10 #### Can you verify, contractually and technically, where your cloud provider physically stores and processes your regulated data? **Options:** ##### No verification exists **Score:** 0 ##### Contractual language only, no technical verification **Score:** 4 ##### Verified for primary systems only **Score:** 7 ##### Verified and continuously monitored across all in-scope systems **Score:** 10 #### How do you control foreign national or offshore personnel access to export-controlled data and systems? **Options:** ##### No controls exist **Score:** 0 ##### Policy exists but is not technically enforced **Score:** 4 ##### Technically enforced for most systems **Score:** 7 ##### Technically enforced and audited across all in-scope systems **Score:** 10 #### Do your suppliers and subcontractors meet the same data residency and access control requirements you flow down to them? **Options:** ##### Not verified at all **Score:** 0 ##### Contractually required, but never verified **Score:** 4 ##### Verified for tier-1 suppliers **Score:** 7 ##### Verified across tier-1 suppliers and monitored for known sub-tier suppliers **Score:** 10 #### How mature is your CMMC Level 2 or equivalent data handling and access control implementation for CUI? **Options:** ##### Not started **Score:** 0 ##### Gap assessment complete, remediation in progress **Score:** 5 ##### Implemented and self-assessed **Score:** 7 ##### Implemented and independently assessed or certified **Score:** 10 #### If you also handle EU personal data alongside export-controlled data, how do you separate GDPR residency obligations from export control requirements? **Options:** ##### Not separated, a single policy governs both **Score:** 0 ##### Some awareness, informal separation only **Score:** 4 ##### Documented separation of controls between the two regimes **Score:** 7 ##### Fully documented, technically enforced separation with distinct data zones **Score:** 10 #### How quickly could you produce a data residency and access audit trail if a prime contractor or DCMA auditor requested one? **Options:** ##### Unsure, would likely take months **Score:** 0 ##### Possible within weeks with significant manual effort **Score:** 4 ##### Possible within days with moderate manual effort **Score:** 7 ##### Possible same day through automated reporting **Score:** 10 **Bands:** #### Non-Compliant Exposure: Data Residency Controls Are Not in Place **Min:** 0 **Max:** 40 **Verdict:** Your organization lacks basic visibility into where export-controlled data lives and how access is restricted, which represents significant exposure under ITAR, CMMC, and related defense supply chain requirements. This level of gap should be treated as an urgent priority given the contractual and legal risk involved. **Recommendations:** - Build a complete data inventory identifying every system that stores or processes ITAR data or CUI - Restrict all export-controlled workloads to verified US-persons-only environments immediately - Implement technical access controls to prevent foreign national access to in-scope systems - Begin a CMMC Level 2 gap assessment if you have not already started one - Engage export control counsel to assess exposure from current practices #### Partial Controls: Primary Systems Covered, Sub-Tier and Offshore Access Gaps Remain **Min:** 41 **Max:** 65 **Verdict:** You have identified and restricted your primary systems handling export-controlled data, but verification of cloud provider data location, sub-tier supplier compliance, and CMMC implementation likely have meaningful gaps that a DCMA or prime contractor audit would surface. **Recommendations:** - Extend technical verification of data location to all systems, not just primary ones - Verify, rather than just contractually require, sub-tier supplier data residency compliance - Complete CMMC Level 2 remediation and move toward formal assessment - Document a clear separation between GDPR and export control data handling if both apply #### Substantially Compliant: Formalize Verification and Monitoring **Min:** 66 **Max:** 85 **Verdict:** Your core data residency controls, including US-persons-only cloud restriction and access enforcement, are largely in place. The remaining gap is typically continuous verification and monitoring rather than any fundamental architectural weakness. **Recommendations:** - Move from periodic verification to continuous monitoring of cloud data location - Extend sub-tier supplier verification beyond your most critical suppliers - Pursue independent CMMC assessment or certification if not already completed - Run a mock audit response exercise to validate your same-day evidence production capability #### Audit-Ready: Maintain Technical Enforcement and Extend to Supply Base **Min:** 86 **Max:** 100 **Verdict:** Your data residency program meets or exceeds typical expectations for ITAR, CUI, and CMMC compliance, with strong technical enforcement, verified sub-tier compliance, and fast audit response capability. The priority now is maintaining this posture and using it as a qualification advantage. **Recommendations:** - Use your data residency maturity as a differentiator in prime contractor supplier qualification - Continue extending verification depth into your sub-tier supply chain - Reassess controls whenever new cloud services or AI tools are introduced into in-scope systems - Automate residency and access audit trail reporting to maintain same-day response capability ## Content **Intro:** Data residency failures rarely show up as a single dramatic breach, they show up as a finding during a DCMA audit or a prime contractor supplier review when nobody can definitively say where a piece of export-controlled data physically lives. This 8-question assessment scores your organization across data inventory, cloud location verification, access control enforcement, and sub-tier supplier compliance, then places you in one of four readiness bands. It is built for defense suppliers, medical device makers, and regulated manufacturers who must prove, not just assert, where their controlled data resides. **Sections:** #### You cannot control what you have not inventoried **Body:** The starting point for data residency compliance is a complete, current inventory of every system that stores or processes export-controlled technical data or Controlled Unclassified Information, and this inventory decays quickly as new SaaS tools, AI features, and integrations are added without a formal review. Organizations that skip this step consistently discover, usually during an audit, that a shadow IT tool or an unreviewed AI copilot has been processing regulated data outside approved boundaries. **Bullets:** - Shadow IT and unreviewed AI tools are a growing source of undocumented data residency risk - Inventory needs a recurring review trigger, not a one-time project - Every new system integration should be screened for CUI or ITAR data exposure before go-live #### Contractual assurance is not technical verification **Body:** Requiring a cloud provider or supplier to contractually attest to data residency compliance is a necessary first step, but it is not the same as technically verifying where data actually resides and who can access it. Prime contractor and DCMA audits increasingly ask for technical evidence, such as access logs and infrastructure configuration, not just signed attestations, and organizations relying solely on paper assurance are exposed when that evidence is requested. **Bullets:** - Technical verification means confirming actual infrastructure region and access logs, not just contract language - Cloud provider attestations should be validated periodically, not accepted once and forgotten - Access control enforcement needs to be technical, not policy-only, to withstand audit scrutiny #### Sub-tier verification is where most programs still fall short **Body:** Flowing down data residency and access control requirements to suppliers contractually is common, but verifying that sub-tier suppliers actually implement those controls is far less common, and it is exactly where prime contractor audits tend to probe deepest. Building even a lightweight verification process, such as periodic attestation review or spot technical checks for your most critical suppliers, closes a gap that most competitors have not addressed either. **Bullets:** - Sub-tier verification does not need to be exhaustive to be valuable, start with your highest-risk suppliers - Periodic attestation review is a practical middle ground between full audit and no verification - Gaps found here are common enough that closing them is a genuine competitive differentiator **Cta:** Netray designs on-prem and sovereign AI architectures for defense suppliers and regulated manufacturers, keeping export-controlled data and AI workloads inside verified, access-controlled boundaries by design. **Faq:** #### What is Controlled Unclassified Information (CUI) and why does data residency matter for it? **Answer:** CUI is government-created or government-owned information that requires safeguarding under federal law, regulation, or policy but is not classified. Data residency matters because CUI handling requirements, including CMMC controls, often specify where the data can be stored, processed, and who may access it based on citizenship and clearance status. #### What does US-persons-only mean for cloud environments handling export-controlled data? **Answer:** It means the cloud environment restricts both data location and personnel access to US citizens or lawful permanent residents, commonly implemented through government cloud regions such as GovCloud that are physically and administratively segregated from standard commercial cloud infrastructure. #### Can GDPR and ITAR data residency requirements conflict for a manufacturer operating in the EU? **Answer:** They can create complexity rather than a direct conflict, since GDPR governs personal data of EU residents while ITAR governs export-controlled technical data regardless of nationality. Organizations handling both typically need documented, technically enforced separation between the two data categories to satisfy each regime independently. #### How is CMMC different from a general data residency requirement? **Answer:** CMMC is a certification framework specifying required cybersecurity practices and maturity levels for handling CUI in defense contracts, of which data residency and access control are components, not the entirety. Data residency addresses where data lives, while CMMC addresses the full set of controls protecting it wherever it resides. #### How quickly should an organization be able to produce a data residency audit trail? **Answer:** Mature programs can produce a complete audit trail showing data location, access logs, and compliance evidence within the same day through automated reporting tools. Organizations relying on manual processes commonly need days to weeks, which itself can become a negative signal during a prime contractor or DCMA review. ## Search terms data residency assessment, ITAR data residency, CUI data handling, CMMC data residency, GovCloud compliance, export control data storage, data sovereignty assessment, DFARS 7012 compliance --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json