A provider has compliance attestations, but a customer application uses broad permissions and unapproved data retention. Is the application automatically compliant?

1. Document risk ownership, compensating controls, approval, and an expiry date.
2. Assess customer controls and obligations against the applicable requirements.
3. Map data-residency requirements to service locations, replication, backups, and processing behavior.
4. Retain approval records and appropriately protected audit evidence.