Your company's chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company's global expansion…

Setting the constraint at the Organization level would apply the restriction across all projects and folders, which conflicts with the need for granular control and folders potentially containing multiple data residency locations.

Resource is too granular and not a direct level for setting organization policies; organization policies are applied at Organization, Folder, or Project levels.

Setting the Resource Location Restriction organization policy constraint at the Project level provides the most granular control, aligning with the requirement that "projects are aligned to specific locations." This allows for different location restrictions to be applied to different projects, even if they reside within the same folder, which can contain multiple data residency locations. This level of control ensures that data for each project stays within its designated geographical boundary as per regulatory requirements.

Setting the constraint at the Folder level would apply the restriction to all projects within that folder, which might not be granular enough if projects within the same folder have different location requirements.