Understanding Compliance Between Commercial, Government and DoD Offerings - February 2021 Update

This was a helpful blog.  But, I have a question/challenge:

"It does not guarantee fulfillment of US Persons nor US Citizenship requirements, nor does it confer data residency in the Continental United States (CONUS)."

I am not aware of an ITAR requirement now for data sovereignty.  22 CFR §120.54 says it is not an export of ITAR technical data if it is encrypted end to end between US Persons and/or stored using FIPS 140-2 approved cloud storage. 

I understand that you have focused the GCC High offerings to meet DFARS 7012 and ITAR requirements but there are many small companies that make this a difficult hurdle for them to overcome.