Control environment

The buyer’s own set of security, residency and process requirements that a vendor must operate inside — where delivery may happen, what data may leave, who may access what. It changes staffing and cost, which is why it belongs in the first conversation rather than the contract redlines.