A company is considering using a public cloud environment for a new HR application. However,
they are concerned about the regulatory requirements for their employee data. Several of the
countries in which the company operates require that personal information not flow across country
borders.
What should the company do when it investigates cloud providers?

A.
Evaluate the cloud provider’s architecture to ensure that it meets regulatory requirements for
storing, backing up, replicating, and moving data

B.
Accept the cloud provider’s service-level agreement for specific protections regarding employee
data

C.
Review the cloud provider’s audit results to verify that it has never moved data across country
borders

D.
Create a one-off contract with the cloud provider to specify that the data will never be moved
across country borders