A company’s legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?

A geolocation policy is the most effective way to restrict access to the SaaS application based on the user's geographical location. This policy allows the company to define specific countries or regions from which access is permitted or denied, directly addressing the requirement to prevent access from high-risk countries. Data masking obscures sensitive data but doesn't prevent access to the document itself or restrict access based on location. Encryption protects data confidentiality but still allows authorized users, regardless of their location, to decrypt and view the documents if they have the keys. Data sovereignty regulation is a legal concept concerning data storage and processing within a country's borders, not a technical control to limit access based on user location.