DevOps NYC — multi-cloud

Data residency

No general federal data-residency requirement for commercial data. Residency and personnel constraints arise contractually in government and regulated work: FedRAMP authorization for federal agency systems, DoD Impact Level 4/5 and US-persons handling for Controlled Unclassified Information under CMMC (48 CFR final rule effective 10 November 2025; phased rollout originally scheduled through Phase 4 beginning November 2028, but DoD paused the Phase 2 transition on 13 July 2026 pending a program review, so the forward schedule is currently unsettled), ITAR-controlled technical data, and CJIS for criminal-justice data. Some states impose sector-specific storage rules.

What shapes cloud procurement here

There is no VAT — consumption tax is state and local sales/use tax, and taxability of SaaS and cloud services genuinely varies by state, so contracts are usually quoted excluding tax with a nexus determination handled separately. Compliance conversations are driven by attestations rather than a single statute: SOC 2 Type II is the de facto commercial entry ticket, ISO 27001 is common for buyers with international footprints, HIPAA Business Associate Agreements gate healthcare work, and FedRAMP or DoD Impact Level authorization gates federal work, with CMMC entering defense supply-chain contracts from November 2025, though the DoD paused the Phase 2 transition in July 2026 pending a program review, so only self-assessment levels are currently being designated in new solicitations. Privacy diligence is fragmented across roughly twenty state regimes plus sectoral federal law, so vendors face state-specific data processing addenda rather than one national standard. Capacity is abundant and latency is rarely the constraint; the practical pressures are procurement cycles running through legal and security review, aggressive salary competition for platform and SRE talent, and buyer sensitivity to egress costs and multi-cloud lock-in.

Sector regulators