Cloud security

ISMAP Never Says "Keep the Data in Japan": I Searched All 45 Pages of the Control Standard

The service passed Japanese government procurement, so the data must be in Japan. Read the actual program documents and that inference falls apart. Across all 45 pages of the ISMAP control standard, the words for "Japan", "outside the country" and "cross-border" never appear once, and the clauses that touch location go no further than notifying customers which countries may hold their data and assessing the risk of foreign law reaching it. Here are the clause numbers.