ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2)
- Plataforma
- Google Workspace
- Categoría
- Admin & User Management
- Severidad
- Low
- Pilar de Zero Trust
- Data (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Rutas de veredicto declaradas, cada una probada con un fixture
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.COMMONCONTROLS.15.2 requires that data be processed in the same region selected for data at rest, so processing does not move covered data outside the chosen jurisdiction. This check reads the data_regions.data_processing_region Cloud Identity policy and flags any organizational unit where processing is not limited to the storage region.
Valor recomendado
Data processing limited to the storage region (limitToStorageRegion = true) in all organizational units.
Remediación
In the Google Admin console, under Account > Data regions, enable 'Process data only in the selected region' so processing stays within the region chosen for data at rest.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.COMMONCONTROLS.15.2v1
- NIST SP 800-53
- SA-9, AC-4