A regulated dataset must remain within approved locations, including backup copies. The architect needs a defensible deployment decision. Which approach best fits?

1. Map data-residency requirements to service locations, replication, backups, and processing behavior.
2. Document risk ownership, compensating controls, approval, and an expiry date.
3. Assess customer controls and obligations against the applicable requirements.
4. Retain approval records and appropriately protected audit evidence.