Compliance belongs at the app layer, not the network layer, as
@RebeccaRettig1 explains here.
“You can put the compliance where your apps are, which is, PS, where you have almost all your compliance today.”
“This is like, can I use the open internet or do I have to use a closed version of the internet? ... You are putting your compliance tools around your products.”
“If you’re not doing it in a knowing, repeated, intentional way, then you can create systems where your products are on these networks, just like they’re on the open internet, where bad guys may be running around too, possibly.”